@adonis-agora/authkit-server 1.0.0-rc.4 → 1.0.0-rc.6

package/build/src/doctor/doctor_input.d.ts

@@ -0,0 +1,27 @@
+import type { ApplicationService } from '@adonisjs/core/types';
+import { type DoctorInput, type Finding } from './checks.js';
+/** Logger mínimo para reportar peers instalados-mas-quebrados. */
+export interface CanImportLogger {
+    warning(msg: string): void;
+}
+/**
+ * Tenta importar um peer; `true` se importável.
+ *
+ * Distingue "não instalado" de "instalado mas quebrado": só um erro de
+ * módulo-não-encontrado (`ERR_MODULE_NOT_FOUND`/`MODULE_NOT_FOUND`) é tratado como
+ * peer ausente (silencioso — é o caso esperado). Qualquer outro erro significa que
+ * o peer ESTÁ presente mas falhou ao carregar (import circular, erro de sintaxe,
+ * config inválida) — isso o doctor precisa gritar, senão um peer quebrado aparece
+ * como "ausente" e o diagnóstico mente.
+ */
+export declare function canImport(specifier: string, logger?: CanImportLogger): Promise<boolean>;
+/**
+ * Monta o `DoctorInput` a partir do app (config `authkit` resolvida, `session`, peers). Usado por
+ * `authkit:doctor` e pelos checks do `agora:doctor`. Lança se `config/authkit.ts` não resolver.
+ */
+export declare function buildDoctorInput(app: ApplicationService, logger?: CanImportLogger): Promise<DoctorInput>;
+/**
+ * O finding de idade da chave de assinatura managed (best-effort): `null` quando o jwks não é
+ * `managed` com store, ou quando o keystore não pôde ser lido.
+ */
+export declare function managedSigningKeyAgeFinding(app: ApplicationService, authkitConfig: Record<string, any> | null): Promise<Finding | null>;

package/build/src/doctor/doctor_input.js

@@ -0,0 +1,86 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { DatabaseAdapter } from '../adapters/database_adapter.js';
+import { resolveAuthkitConfig } from '../commands/resolve_config.js';
+import { defaultEncryptForStore } from '../define_config.js';
+import { signingKeyAgeDays } from '../keys/keystore.js';
+import { KeystoreCodec } from '../keys/keystore_codec.js';
+import { loadEncryptionService } from '../keys/keystore_crypto.js';
+import { KeystoreManager, resolveKeystoreVault } from '../keys/keystore_manager.js';
+import { signingKeyAgeFinding } from './checks.js';
+/**
+ * Tenta importar um peer; `true` se importável.
+ *
+ * Distingue "não instalado" de "instalado mas quebrado": só um erro de
+ * módulo-não-encontrado (`ERR_MODULE_NOT_FOUND`/`MODULE_NOT_FOUND`) é tratado como
+ * peer ausente (silencioso — é o caso esperado). Qualquer outro erro significa que
+ * o peer ESTÁ presente mas falhou ao carregar (import circular, erro de sintaxe,
+ * config inválida) — isso o doctor precisa gritar, senão um peer quebrado aparece
+ * como "ausente" e o diagnóstico mente.
+ */
+export async function canImport(specifier, logger) {
+    try {
+        await import(__rewriteRelativeImportExtension(specifier));
+        return true;
+    }
+    catch (err) {
+        const code = err?.code;
+        if (code !== 'ERR_MODULE_NOT_FOUND' && code !== 'MODULE_NOT_FOUND') {
+            logger?.warning(`⚠️  ${specifier} está instalado mas falhou ao carregar: ${err.message}`);
+        }
+        return false;
+    }
+}
+/**
+ * Monta o `DoctorInput` a partir do app (config `authkit` resolvida, `session`, peers). Usado por
+ * `authkit:doctor` e pelos checks do `agora:doctor`. Lança se `config/authkit.ts` não resolver.
+ */
+export async function buildDoctorInput(app, logger) {
+    const config = await app.container.make('config');
+    // `defineConfig` exporta um config provider — resolve antes de inspecionar,
+    // senão todo campo aparece como "ausente" (provider cru não tem issuer etc.).
+    const authkitConfig = await resolveAuthkitConfig(app, config.get('authkit', null));
+    const sessionConfig = config.get('session', null) ?? null;
+    return {
+        authkitConfig,
+        sessionConfig,
+        peers: {
+            session: await canImport('@adonisjs/session', logger),
+            shield: await canImport('@adonisjs/shield', logger),
+            ally: await canImport('@adonisjs/ally', logger),
+            limiter: await canImport('@adonisjs/limiter', logger),
+        },
+        __adapterClasses: { DatabaseAdapter },
+    };
+}
+/**
+ * O finding de idade da chave de assinatura managed (best-effort): `null` quando o jwks não é
+ * `managed` com store, ou quando o keystore não pôde ser lido.
+ */
+export async function managedSigningKeyAgeFinding(app, authkitConfig) {
+    const jwksInput = (authkitConfig?.jwksConfig ?? authkitConfig?.jwks);
+    if (jwksInput?.source !== 'managed' || !jwksInput?.store)
+        return null;
+    try {
+        const vault = resolveKeystoreVault(jwksInput.store, {
+            makePath: (p) => app.makePath(p),
+            container: app.container,
+        });
+        const encrypt = jwksInput.encrypt ?? defaultEncryptForStore(jwksInput.store);
+        const enc = encrypt ? await loadEncryptionService().catch(() => undefined) : undefined;
+        const mgr = new KeystoreManager(vault, new KeystoreCodec({ encrypt, enc }), jwksInput.algorithm ?? 'RS256');
+        const store = await mgr.read().catch(() => null);
+        const maxAge = jwksInput.rotationDays ?? 90;
+        return signingKeyAgeFinding(signingKeyAgeDays(store), maxAge);
+    }
+    catch {
+        /* idade é best-effort no doctor */
+        return null;
+    }
+}

package/build/src/doctor/index.d.ts

@@ -0,0 +1,5 @@
+import type { AgoraDoctorCheck } from './agora_doctor.js';
+export type { AgoraDoctorCheck, AgoraDoctorRegistry, AgoraDoctorReport, AgoraDoctorResult, AgoraDoctorStatus, } from './agora_doctor.js';
+export { AGORA_DOCTOR_BINDING, registerDoctorChecks } from './agora_doctor.js';
+/** authkit's checks, for `node ace agora:doctor --no-boot` (which imports this entry instead of booting). */
+export declare const agoraDoctorChecks: AgoraDoctorCheck[];

package/build/src/doctor/index.js

@@ -0,0 +1,4 @@
+import { authkitDoctorChecks } from './agora_checks.js';
+export { AGORA_DOCTOR_BINDING, registerDoctorChecks } from './agora_doctor.js';
+/** authkit's checks, for `node ace agora:doctor --no-boot` (which imports this entry instead of booting). */
+export const agoraDoctorChecks = authkitDoctorChecks();

package/build/src/host/admin_api/admin_users_service.d.ts

@@ -8,8 +8,11 @@ import type { SettingsCapability } from '../runtime_settings.js';
 export interface AdminActor {
     actorId: string | null;
     ip: string | null;
-    /** Marca metadata da auditoria — 'admin-api' nas escritas via REST, 'admin' no console HTML. */
-    source?: 'admin-api' | 'admin';
+    /**
+     * Marca metadata da auditoria — 'admin-api' nas escritas via REST, 'admin' no console HTML,
+     * 'mcp' nas ações dos dev tools (endpoint MCP do Agora).
+     */
+    source?: 'admin-api' | 'admin' | 'mcp';
 }
 /** Resultado da deleção via admin: false quando o store não suporta hard delete. */
 export type DeleteUserResult = {

package/build/src/host/admin_authorize.d.ts

@@ -0,0 +1,8 @@
+import { type ConsoleAuthorize, type ConsoleAuthorizeDecision } from '../console_authorize.js';
+/**
+ * Whether the app runs in production. Unknown (the provider did not register the
+ * app) counts as production, so an omitted `admin.authorize` fails closed.
+ */
+export declare function appInProduction(): boolean;
+/** The resolved `admin.authorize` checker (memoized per configured value). Never throws. */
+export declare function adminAuthorizeChecker(authorize: ConsoleAuthorize): (ctx: any) => Promise<ConsoleAuthorizeDecision>;

package/build/src/host/admin_authorize.js

@@ -0,0 +1,25 @@
+import { getBootedApp } from '../../services/booted_app.js';
+import { resolveConsoleAuthorize, } from '../console_authorize.js';
+/**
+ * Whether the app runs in production. Unknown (the provider did not register the
+ * app) counts as production, so an omitted `admin.authorize` fails closed.
+ */
+export function appInProduction() {
+    try {
+        return getBootedApp().inProduction !== false;
+    }
+    catch {
+        return true;
+    }
+}
+/** One checker per configured `admin.authorize`, so a lazy import runs once. */
+const adminAuthorizeCheckers = new WeakMap();
+/** The resolved `admin.authorize` checker (memoized per configured value). Never throws. */
+export function adminAuthorizeChecker(authorize) {
+    let checker = adminAuthorizeCheckers.get(authorize);
+    if (!checker) {
+        checker = resolveConsoleAuthorize(authorize);
+        adminAuthorizeCheckers.set(authorize, checker);
+    }
+    return checker;
+}

package/build/src/host/i18n.d.ts

@@ -191,6 +191,7 @@ export declare const DEFAULT_MESSAGES: {
     'agents.consent.body': string;
     'agents.consent.signed_in_as': string;
     'agents.consent.scopes_label': string;
+    'agents.consent.opt_in_hint': string;
     'agents.consent.code': string;
     'agents.consent.allow': string;
     'agents.consent.deny': string;
@@ -944,6 +945,7 @@ export declare const PT_BR_MESSAGES: {
     'agents.consent.body': string;
     'agents.consent.signed_in_as': string;
     'agents.consent.scopes_label': string;
+    'agents.consent.opt_in_hint': string;
     'agents.consent.code': string;
     'agents.consent.allow': string;
     'agents.consent.deny': string;

package/build/src/host/i18n.js

@@ -200,6 +200,7 @@ export const DEFAULT_MESSAGES = {
     'agents.consent.body': 'The request came from {origin}. Choose what it can do — you can revoke access at any time.',
     'agents.consent.signed_in_as': 'Signed in as {email}',
     'agents.consent.scopes_label': 'Allow it to:',
+    'agents.consent.opt_in_hint': 'Not selected for you: tick it only if you want to allow it.',
     'agents.consent.code': 'Request code: {code}. Make sure it matches the code your assistant shows.',
     'agents.consent.allow': 'Allow',
     'agents.consent.deny': 'Deny',
@@ -1040,6 +1041,7 @@ export const PT_BR_MESSAGES = {
     'agents.consent.body': 'O pedido veio de {origin}. Escolha o que ele pode fazer — você pode revogar o acesso quando quiser.',
     'agents.consent.signed_in_as': 'Conectado como {email}',
     'agents.consent.scopes_label': 'Permitir que ele:',
+    'agents.consent.opt_in_hint': 'Não vem marcado: marque só se quiser permitir.',
     'agents.consent.code': 'Código do pedido: {code}. Confira se é o mesmo que o seu assistente mostra.',
     'agents.consent.allow': 'Permitir',
     'agents.consent.deny': 'Negar',

package/build/src/host/register_auth_host.js

@@ -1,5 +1,3 @@
-import { getBootedApp } from '../../services/booted_app.js';
-import { resolveConsoleAuthorize, } from '../console_authorize.js';
 import { resolveRateLimit } from '../define_config.js';
 import { accountHome } from './account_home.js';
 import { getAccountLoginUrl, setAccountLoginUrl } from './account_login_url.js';
@@ -7,6 +5,7 @@ import { accountPath, accountPathsMap, accountPrefix, joinAccountPath, setAccoun
 import { resolveAccountRoles } from './account_roles.js';
 import { ACCOUNT_SESSION_KEY } from './account_session_key.js';
 import { adminApiGuard } from './admin_api/admin_api_guard.js';
+import { adminAuthorizeChecker, appInProduction } from './admin_authorize.js';
 import { normalizeAdminApiPrefix, normalizeAdminPrefix, setAdminApiPrefix, setAdminPrefix, } from './admin_prefix.js';
 import { getAuthHostConfig, markAuthHostAutoMounted, wasAuthHostAutoMounted, } from './auth_host_config.js';
 import { consoleDeniedPage } from './console_denied_page.js';
@@ -238,18 +237,6 @@ export const adminGuard = async (ctx, next) => {
         return consoleDenied(ctx, decision);
     return next();
 };
-/**
- * Whether the app runs in production. Unknown (the provider did not register the
- * app) counts as production, so an omitted `admin.authorize` fails closed.
- */
-function appInProduction() {
-    try {
-        return getBootedApp().inProduction !== false;
-    }
-    catch {
-        return true;
-    }
-}
 /** The response for an `admin.authorize` denial: same rules in every `@adonis-agora` console. */
 function consoleDenied(ctx, decision) {
     const json = wantsJson(ctx);
@@ -272,16 +259,6 @@ function consoleDenied(ctx, decision) {
     ctx.response.header('Content-Type', 'text/html; charset=utf-8');
     return ctx.response.status(403).send(consoleDeniedPage(403));
 }
-/** One checker per configured `admin.authorize`, so a lazy import runs once. */
-const adminAuthorizeCheckers = new WeakMap();
-function adminAuthorizeChecker(authorize) {
-    let checker = adminAuthorizeCheckers.get(authorize);
-    if (!checker) {
-        checker = resolveConsoleAuthorize(authorize);
-        adminAuthorizeCheckers.set(authorize, checker);
-    }
-    return checker;
-}
 const C = {
     oidc: () => import('../controllers/oidc_callback_controller.js'),
     authorizationServerMetadata: () => import('../controllers/authorization_server_metadata_controller.js'),

package/build/src/host/screen_props.d.ts

@@ -183,16 +183,22 @@ export interface ThrottledProps extends WithMessages {
     retryUrl: string;
 }
 /** The agent asking for access, on `agents/consent`. */
+/** One scope on the personal-agent consent screen. */
+export interface AgentConsentScope {
+    id: string;
+    description: string;
+    /** i18n key shown instead of `description` (an extension's message). */
+    descriptionKey?: string;
+    /** Not ticked for the person: granted only if they tick it themselves. */
+    optIn?: boolean;
+}
 export interface AgentConsentRequest {
     /** Device-flow user code, when the agent uses it. */
     userCode?: string;
     agentName: string | null;
     agentOrigin: string | null;
     logoUri?: string | null;
-    scopes: Array<{
-        id: string;
-        description: string;
-    }>;
+    scopes: Array<AgentConsentScope>;
     /** Extra hidden form fields to send back. */
     hidden?: Array<{
         name: string;
@@ -216,10 +222,7 @@ export interface AgentsConsentProps extends WithMessages {
 export interface AgentsDoneProps extends WithMessages {
     status: 'approved' | 'denied' | 'expired' | 'invalid';
     agentName: string | null;
-    scopes: Array<{
-        id: string;
-        description: string;
-    }>;
+    scopes: Array<AgentConsentScope>;
 }
 /** `account/apps` — apps and personal agents with access to the account. */
 export interface AccountAppsProps extends WithMessages {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adonis-agora/authkit-server",
-  "version": "1.0.0-rc.4",
+  "version": "1.0.0-rc.6",
   "description": "AdonisJS OIDC/OAuth2 provider (Identity Provider) toolkit: ejectable auth server with sessions, rate-limiting, MFA/TOTP, audit log, federated logout and OpenTelemetry metrics.",
   "license": "MIT",
   "author": "dudousxd",
@@ -46,7 +46,8 @@
     "./telescope": "./build/src/observability/telescope/index.js",
     "./authkit_server_provider": "./build/providers/authkit_server_provider.js",
     "./commands": "./build/commands/main.js",
-    "./commands/configure": "./build/commands/configure.js"
+    "./commands/configure": "./build/commands/configure.js",
+    "./doctor": "./build/src/doctor/index.js"
   },
   "adonisjs": {
     "types": "@adonis-agora/authkit-server",
@@ -118,7 +119,7 @@
   },
   "devDependencies": {
     "@adonis-agora/authkit-react": "1.0.0-rc.2",
-    "@adonis-agora/durable": "0.59.0",
+    "@adonis-agora/durable": "0.60.0",
     "@adonis-agora/telescope": "0.27.1",
     "@adonisjs/ally": "6.3.2",
     "@adonisjs/auth": "10.1.0",
@@ -169,6 +170,7 @@
     "build": "node scripts/build_host_css.mjs && node scripts/build_webauthn.mjs && node scripts/build_ui.mjs && node -e \"const fs=require('node:fs');for(const d of ['build/stubs','build/host/views'])fs.rmSync(d,{recursive:true,force:true})\" && tsc && node -e \"require('node:fs').cpSync('src/host/assets','build/src/host/assets',{recursive:true})\" && node -e \"require('node:fs').cpSync('stubs','build/stubs',{recursive:true,filter:(s)=>!s.endsWith('.ts')})\" && node -e \"const fs=require('node:fs');if(fs.existsSync('assets'))fs.cpSync('assets','build/assets',{recursive:true})\" && node -e \"require('node:fs').cpSync('src/host/views','build/host/views',{recursive:true})\" && node -e \"const fs=require('node:fs');fs.mkdirSync('build/host/ui',{recursive:true});fs.readdirSync('src/host/ui').filter(f=>f.endsWith('.html')).forEach(f=>fs.copyFileSync('src/host/ui/'+f,'build/host/ui/'+f))\" && node -e \"require('node:fs').copyFileSync('commands/commands.json','build/commands/commands.json')\" && node -e \"const fs=require('node:fs');fs.mkdirSync('build/src/password',{recursive:true});fs.copyFileSync('src/password/common_passwords.txt','build/src/password/common_passwords.txt')\"",
     "build:ui": "node scripts/build_ui.mjs",
     "build:webauthn": "node scripts/build_webauthn.mjs",
+    "check:agora-doctor": "node ../../scripts/check-agora-doctor.mjs .",
     "check:host-css": "node scripts/check_host_css.mjs",
     "check:webauthn-bundle": "node scripts/check_webauthn_bundle.mjs",
     "typecheck": "tsc --noEmit && node scripts/typecheck_ui.mjs && node scripts/typecheck_tests.mjs",