@adonis-agora/authkit-server 1.0.0-rc.7 → 1.0.0-rc.9

package/build/src/host/i18n.js

@@ -182,6 +182,25 @@ export const DEFAULT_MESSAGES = {
     'account.delete.deleted': 'Your account has been permanently deleted.',
     'account.delete.invalid_confirmation': 'Confirmation failed. Your account was not deleted.',
     'account.delete.not_supported': 'Account deletion is not available in this installation.',
+    // Console de conta — páginas de extensions (account/extension).
+    'account.extension.logout': 'Log out',
+    'account.extension.nav_label': 'Account',
+    'account.extension.unknown_block': 'This section cannot be shown here.',
+    'account.extension.unsafe_link': 'This link was hidden because its address is not allowed.',
+    'account.extension.unsafe_script': 'This section was hidden because it loads a script from an address that is not allowed.',
+    'account.extension.load_failed': 'This page could not be loaded right now. Try again in a moment.',
+    'account.extension.next_page': 'Next page',
+    'account.extension.confirm_title': 'Confirm',
+    'account.extension.confirm_submit': 'Continue',
+    'account.extension.cancel': 'Cancel',
+    'account.extension.action_failed': 'That did not work. Try again in a moment.',
+    'account.extension.action_not_found': 'This action is not available.',
+    'account.extension.impersonation_refused': 'This action is not available while acting as another user.',
+    'account.extension.field_required': '{field} is required.',
+    'account.extension.field_too_long': '{field} is too long.',
+    'account.extension.field_invalid': '{field} has an invalid value.',
+    'account.extension.done': 'Done.',
+    'account.extension.provider_loading': 'Loading…',
     // Console de conta — apps com acesso (account/apps).
     'account.apps.page_title': 'Apps with access',
     'account.apps.title': 'Apps with access',
@@ -1023,6 +1042,25 @@ export const PT_BR_MESSAGES = {
     'account.delete.deleted': 'Sua conta foi deletada permanentemente.',
     'account.delete.invalid_confirmation': 'Confirmação falhou. Sua conta NÃO foi deletada.',
     'account.delete.not_supported': 'A deleção de conta não está disponível nesta instalação.',
+    // Console de conta — páginas de extensions (account/extension).
+    'account.extension.logout': 'Sair',
+    'account.extension.nav_label': 'Conta',
+    'account.extension.unknown_block': 'Esta seção não pode ser exibida aqui.',
+    'account.extension.unsafe_link': 'Este link foi ocultado porque o endereço não é permitido.',
+    'account.extension.unsafe_script': 'Esta seção foi ocultada porque carrega um script de um endereço não permitido.',
+    'account.extension.load_failed': 'Não foi possível carregar esta página agora. Tente de novo em instantes.',
+    'account.extension.next_page': 'Próxima página',
+    'account.extension.confirm_title': 'Confirmar',
+    'account.extension.confirm_submit': 'Continuar',
+    'account.extension.cancel': 'Cancelar',
+    'account.extension.action_failed': 'Não deu certo. Tente de novo em instantes.',
+    'account.extension.action_not_found': 'Esta ação não está disponível.',
+    'account.extension.impersonation_refused': 'Esta ação não está disponível enquanto você age como outro usuário.',
+    'account.extension.field_required': '{field} é obrigatório.',
+    'account.extension.field_too_long': '{field} é longo demais.',
+    'account.extension.field_invalid': '{field} tem um valor inválido.',
+    'account.extension.done': 'Feito.',
+    'account.extension.provider_loading': 'Carregando…',
     // Console de conta — apps com acesso (account/apps).
     'account.apps.page_title': 'Apps com acesso',
     'account.apps.title': 'Apps com acesso',

package/build/src/host/rate_limit.d.ts

@@ -36,6 +36,14 @@ export interface AuthThrottles {
      * anti-brute-force do código adivinhável, ANTES do lockout por interaction.
      */
     otpLogin: ThrottleMiddleware;
+    /**
+     * Actions das páginas de extension do console de conta, keyed pela CONTA da sessão
+     * (bucket `authkit_account_actions`). `accountActions` responde 429 com a tela
+     * `throttled` (formulários); `accountActionsJson` responde o 429 cru (JSON API) —
+     * mesmo bucket, mesma contagem.
+     */
+    accountActions: ThrottleMiddleware;
+    accountActionsJson: ThrottleMiddleware;
 }
 /**
  * Service do `@adonisjs/limiter` resolvido de forma preguiçosa. Tipado como `any`

package/build/src/host/rate_limit.js

@@ -6,6 +6,7 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     }
     return path;
 };
+import { ACCOUNT_SESSION_KEY } from './account_session_key.js';
 import { brandFor } from './branding.js';
 let limiterServicePromise;
 /**
@@ -73,6 +74,12 @@ function buildThrottle(name, bucket, store, keyOf) {
 export function createAuthThrottles(config) {
     if (!config.enabled)
         return undefined;
+    const accountActions = buildThrottle('authkit_account_actions', config.accountActions ?? { points: 30, duration: '1 min' }, config.store, (ctx) => {
+        const accountId = ctx.session?.get?.(ACCOUNT_SESSION_KEY);
+        return typeof accountId === 'string' && accountId !== ''
+            ? `account:${accountId}`
+            : `account-ip:${ctx.request.ip?.() ?? 'unknown'}`;
+    });
     return {
         // Login/signup/forgot/reset: keyed por IP (default do HttpLimiter).
         // `friendly`: rota de BROWSER — 429 vira a tela themeável `throttled`
@@ -102,6 +109,8 @@ export function createAuthThrottles(config) {
         // Verificação de código OTP: keyed por IP (default), bucket próprio e mais
         // apertado que o login. O namespace do nome mantém a contagem separada.
         otpLogin: withFriendly429(buildThrottle('authkit_otp_login', config.otpLogin, config.store)),
+        accountActions: withFriendly429(accountActions),
+        accountActionsJson: accountActions,
     };
 }
 /**

package/build/src/host/register_auth_host.d.ts

@@ -1,4 +1,5 @@
 import type { Router } from '@adonisjs/core/http';
+import { type AccountExtensionRouteEntry } from '../account/mount.js';
 import type { AuthSocialConfig, RateLimitConfigInput } from '../define_config.js';
 import { type AccountPathKey, type AccountPathsOptions } from './account_paths.js';
 import type { PolicyRouteOption } from './config_locks.js';
@@ -25,6 +26,14 @@ export declare function wantsJson(ctx: any): boolean;
  * As roles permitidas são resolvidas em runtime do `authkit.server` (config lazy).
  */
 export declare const adminGuard: (ctx: any, next: () => Promise<void>) => Promise<any>;
+/**
+ * The admin console gate as the console switcher reads it: `{ allowed }`, never a response, never a
+ * throw. Used as the `authorize` of the admin console's `'agora.consoles'` entry.
+ */
+export declare function adminConsoleDecision(ctx: any): Promise<{
+    allowed: boolean;
+    reason?: 'unauthenticated' | 'forbidden';
+}>;
 /**
  * Opções de montagem das rotas do host-kit.
  *
@@ -304,6 +313,11 @@ export interface AuthHostRouteMap {
         loginUrl: string;
         /** Quais telas foram efetivamente montadas. */
         screens: Record<keyof AccountScreensOptions, boolean>;
+        /**
+         * Account console extension pages (filled once every provider booted): id, path, label (a
+         * literal, or the message key) and order. `useAccountExtensions()` gives the localized nav.
+         */
+        extensions: AccountExtensionRouteEntry[];
     };
     /** Console admin: prefixo resolvido, ou `null` quando não foi montado. */
     admin: {

package/build/src/host/register_auth_host.js

@@ -1,3 +1,6 @@
+import { getBootedApp } from '../../services/booted_app.js';
+import { mountAccountExtensions } from '../account/mount.js';
+import { registerAgoraConsole } from '../console_switcher.js';
 import { resolveRateLimit } from '../define_config.js';
 import { accountHome } from './account_home.js';
 import { getAccountLoginUrl, setAccountLoginUrl } from './account_login_url.js';
@@ -6,6 +9,7 @@ import { resolveAccountRoles } from './account_roles.js';
 import { ACCOUNT_SESSION_KEY } from './account_session_key.js';
 import { adminApiGuard } from './admin_api/admin_api_guard.js';
 import { adminAuthorizeChecker, appInProduction } from './admin_authorize.js';
+import { adminConsoleEntry } from './admin_console/admin_console_entry.js';
 import { normalizeAdminApiPrefix, normalizeAdminPrefix, setAdminApiPrefix, setAdminPrefix, } from './admin_prefix.js';
 import { getAuthHostConfig, markAuthHostAutoMounted, wasAuthHostAutoMounted, } from './auth_host_config.js';
 import { consoleDeniedPage } from './console_denied_page.js';
@@ -86,6 +90,23 @@ async function checkAndRefreshIdle(ctx) {
         return false;
     }
 }
+/** Read-only twin of {@link checkAndRefreshIdle}: whether the idle timeout passed. Never writes. */
+async function isIdleExpired(ctx) {
+    try {
+        const runtimeSettings = await resolveRuntimeSettings(ctx);
+        if (!runtimeSettings)
+            return false;
+        const policy = await resolveEffectiveSessionPolicy(runtimeSettings);
+        const idleMs = policy.idleTimeoutMinutes * 60 * 1000;
+        if (idleMs <= 0)
+            return false;
+        const lastSeen = ctx.session?.get(ACCOUNT_LAST_SEEN_KEY);
+        return lastSeen !== undefined && Date.now() - lastSeen > idleMs;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Constrói a URL de redirect para o login da conta, preservando o destino
  * original como `return_to` (URL-encoded). A URL de destino é o path + query
@@ -187,45 +208,65 @@ const accountGuard = async (ctx, next) => {
  * As roles permitidas são resolvidas em runtime do `authkit.server` (config lazy).
  */
 export const adminGuard = async (ctx, next) => {
+    const access = await evaluateAdminAccess(ctx);
+    switch (access.kind) {
+        case 'allowed':
+            return next();
+        case 'disabled':
+            // Defesa contra flag-drift: as rotas são montadas com `admin: true` em tempo de
+            // registro, ANTES de o config resolver. Se o config tiver `admin.enabled: false`,
+            // as rotas existem mas o console deve estar desligado — 404 (não vaza a existência).
+            return ctx.response.notFound();
+        case 'agent':
+            return ctx.response.status(403).send('');
+        case 'signed-out':
+            // `/account/login` é sempre o login da conta — NÃO muda com o prefixo admin.
+            return unauthenticated(ctx, buildLoginRedirect(ctx));
+        case 'idle':
+            return unauthenticated(ctx, buildLoginRedirect(ctx, 'reason=idle'));
+        case 'not-admin':
+            // Evita vazar a existência do console admin: redireciona para o accountHome
+            // (sem mostrar a URL do admin).
+            if (wantsJson(ctx)) {
+                return ctx.response
+                    .status(403)
+                    .send({ error: { code: 'forbidden', message: 'Admin role required.' } });
+            }
+            return redirectExact(ctx.response, accountHome(access.cfg));
+        case 'denied':
+            return consoleDenied(ctx, access.decision);
+    }
+};
+/**
+ * The admin console gate: the session, then `admin.roles`, then `admin.authorize`.
+ *
+ * `probe: true` is the console switcher asking from another console: it reads the idle timeout
+ * without refreshing or ending the session.
+ */
+async function evaluateAdminAccess(ctx, options = {}) {
     const service = await ctx.containerResolver.make('authkit.server');
     const cfg = service.config;
-    // Defesa contra flag-drift: as rotas são montadas com `admin: true` em tempo de
-    // registro, ANTES de o config resolver. Se o config tiver `admin.enabled: false`,
-    // as rotas existem mas o console deve estar desligado — 404 (não vaza a existência).
-    if (!cfg.admin.enabled) {
-        return ctx.response.notFound();
-    }
+    if (!cfg.admin.enabled)
+        return { kind: 'disabled' };
     if (isAgentBrowser(ctx))
-        return ctx.response.status(403).send('');
+        return { kind: 'agent' };
     // Com `accountSession.acceptIdpSession`, a sessão do IdP também abre o console.
     await ensureConsoleSession(ctx);
     const accountId = ctx.session?.get(ACCOUNT_SESSION_KEY);
-    if (!accountId) {
-        // `/account/login` é sempre o login da conta — NÃO muda com o prefixo admin.
-        return unauthenticated(ctx, buildLoginRedirect(ctx));
-    }
+    if (!accountId)
+        return { kind: 'signed-out' };
     // Idle timeout: também protege o console admin.
-    const idleExpired = await checkAndRefreshIdle(ctx);
-    if (idleExpired) {
-        return unauthenticated(ctx, buildLoginRedirect(ctx, 'reason=idle'));
-    }
+    const idleExpired = options.probe ? await isIdleExpired(ctx) : await checkAndRefreshIdle(ctx);
+    if (idleExpired)
+        return { kind: 'idle' };
     const allowed = cfg.admin.roles;
     const account = await cfg.accountStore.findById(accountId);
     // Resolve roles through the host's role authority (`resolveTokenRoles`) when set — the same source
     // the token claim is minted from — so an app-role admin reaches the console. Falls back to the
     // account's stored `globalRoles` when no hook is configured.
     const roles = account ? await resolveAccountRoles(cfg, account) : [];
-    const isAdmin = roles.some((r) => allowed.includes(r));
-    if (!isAdmin) {
-        // Evita vazar a existência do console admin: redireciona para o accountHome
-        // (sem mostrar a URL do admin).
-        if (wantsJson(ctx)) {
-            return ctx.response
-                .status(403)
-                .send({ error: { code: 'forbidden', message: 'Admin role required.' } });
-        }
-        return redirectExact(ctx.response, accountHome(cfg));
-    }
+    if (!roles.some((r) => allowed.includes(r)))
+        return { kind: 'not-admin', cfg };
     // `admin.authorize`, after the roles: both must pass. Omitted, the console is open
     // outside production and closed (403) in production.
     const decision = cfg.admin.authorize
@@ -234,9 +275,45 @@ export const adminGuard = async (ctx, next) => {
             ? { allowed: false, status: 403 }
             : { allowed: true };
     if (!decision.allowed)
-        return consoleDenied(ctx, decision);
-    return next();
-};
+        return { kind: 'denied', decision };
+    return { kind: 'allowed' };
+}
+/**
+ * The admin console gate as the console switcher reads it: `{ allowed }`, never a response, never a
+ * throw. Used as the `authorize` of the admin console's `'agora.consoles'` entry.
+ */
+export async function adminConsoleDecision(ctx) {
+    try {
+        const access = await evaluateAdminAccess(ctx, { probe: true });
+        if (access.kind === 'allowed')
+            return { allowed: true };
+        const unauthenticated = access.kind === 'signed-out' ||
+            access.kind === 'idle' ||
+            (access.kind === 'denied' && access.decision.status === 401);
+        return { allowed: false, reason: unauthenticated ? 'unauthenticated' : 'forbidden' };
+    }
+    catch {
+        return { allowed: false, reason: 'forbidden' };
+    }
+}
+/**
+ * Registers the admin console in the shared `'agora.consoles'` registry, so every other
+ * `@adonis-agora` console's switcher can link to it. A no-op when the provider did not register the
+ * app (tests that mount routes on a bare router).
+ */
+function announceAdminConsole(adminPrefix) {
+    let app;
+    try {
+        app = getBootedApp();
+    }
+    catch {
+        return;
+    }
+    void (async () => {
+        const logger = (await app.container.make('logger').catch(() => undefined));
+        await registerAgoraConsole(app, adminConsoleEntry(adminPrefix, adminConsoleDecision), logger);
+    })().catch(() => { });
+}
 /** The response for an `admin.authorize` denial: same rules in every `@adonis-agora` console. */
 function consoleDenied(ctx, decision) {
     const json = wantsJson(ctx);
@@ -286,6 +363,7 @@ const C = {
     // Console React JSON API (session-authed, under {prefix}/api/*).
     consoleShell: () => import('./admin_console/admin_shell_controller.js'),
     consoleOverview: () => import('./admin_console/console_overview_controller.js'),
+    consoleSwitcher: () => import('./admin_console/console_switcher_controller.js'),
     consoleUsers: () => import('./admin_console/console_users_controller.js'),
     consoleSessions: () => import('./admin_console/console_sessions_controller.js'),
     consoleClients: () => import('./admin_console/console_clients_controller.js'),
@@ -911,6 +989,32 @@ export function registerAuthHost(router, opts = {}) {
         router.post(`${apiBase}/mfa/passkeys/verify`, [C.accountMfaApi, 'passkeyRegisterVerify']);
     })
         .use([accountGuard]);
+    // Account console extensions (`@adonis-agora/authkit-server/account-extension`): pages other
+    // packages register from their provider's `boot()`. Same guard as the built-in screens; the
+    // page routes mount once every provider booted. `account: false` turns them off too.
+    const extensionEntries = [];
+    if (accountOpt !== false) {
+        const builtins = {};
+        if (mountSecurity)
+            builtins.security = securityPath;
+        if (mountMfa)
+            builtins.mfa = mfaPath;
+        if (mountTokens)
+            builtins.tokens = tokensPath;
+        if (mountApps)
+            builtins.apps = appsPath;
+        if (mountOrgs)
+            builtins.orgs = orgsPath;
+        mountAccountExtensions(router, {
+            guard: accountGuard,
+            ...(throttles
+                ? { throttle: { html: throttles.accountActions, json: throttles.accountActionsJson } }
+                : {}),
+            overrides: hostCfg?.accountConsole?.extensions,
+            builtins,
+            entries: extensionEntries,
+        });
+    }
     // API headless (Clerk-style) — montada fora do `accountGuard` (não depende da
     // sessão de CONTA), autenticada pelo resolver do host (`headless.resolveAccountId`).
     // `PUT` usa CSRF igual à API do console (middleware de shield do host).
@@ -936,6 +1040,8 @@ export function registerAuthHost(router, opts = {}) {
         resolvedAdminPrefix = ap;
         // Persiste no singleton de processo para que controllers e views usem o mesmo prefixo.
         setAdminPrefix(ap);
+        // Announce the console to the other `@adonis-agora` consoles (the switcher).
+        announceAdminConsole(ap);
         router
             .group(() => {
             // Console admin (SPA React self-contained): todas as rotas GET servem o
@@ -949,6 +1055,10 @@ export function registerAuthHost(router, opts = {}) {
             // ─── JSON API do console (session-authed via adminGuard upstream) ─────
             // GET {ap}/api/overview
             router.get(`${ap}/api/overview`, [C.consoleOverview, 'handle']);
+            // Console switcher: the other `@adonis-agora` consoles this viewer may open, and the
+            // global search across them (search BEFORE the list: fixed path first).
+            router.get(`${ap}/api/consoles/search`, [C.consoleSwitcher, 'search']);
+            router.get(`${ap}/api/consoles`, [C.consoleSwitcher, 'index']);
             // Usuários.
             router.get(`${ap}/api/users`, [C.consoleUsers, 'index']);
             router.get(`${ap}/api/users/:id`, [C.consoleUsers, 'show']);
@@ -1134,6 +1244,7 @@ export function registerAuthHost(router, opts = {}) {
                 mfa: mountMfa,
                 apps: mountApps,
             },
+            extensions: extensionEntries,
         },
         admin: resolvedAdminPrefix ? { prefix: resolvedAdminPrefix } : null,
         adminApi: resolvedAdminApiPrefix ? { prefix: resolvedAdminApiPrefix } : null,

package/build/src/host/renderers/edge_renderer.js

@@ -1,3 +1,4 @@
+import { accountNavFor } from '../../account/runtime.js';
 import { getAccountLoginUrl } from '../account_login_url.js';
 import { accountPathsMap } from '../account_paths.js';
 import { DEFAULT_MESSAGES, translate } from '../i18n.js';
@@ -40,9 +41,13 @@ export async function renderEdgeView(ctx, view, props) {
     // `accountRoutes` — sem cada view conhecer o prefixo. Os action-subpaths
     // fixos (`/password`, `/passkeys/verify`, ...) são concatenados na própria view.
     const accountPaths = accountPathsMap();
+    // `accountNav` como prop global das telas do console de conta: telas embutidas montadas e
+    // páginas de extension visíveis para a conta (partial `authkit::account/partials/nav`).
+    const accountNav = props.accountNav ?? (await accountNavFor(ctx, view, props));
     return ctx.view.render(`authkit::${view}`, {
         loginUrl,
         accountPaths,
+        accountNav,
         ...props,
         t,
         messages,

package/build/src/host/renderers/inertia_renderer.js

@@ -1,3 +1,4 @@
+import { accountNavFor } from '../../account/runtime.js';
 import { DEFAULT_MESSAGES } from '../i18n.js';
 import { renderEdgeView } from './edge_renderer.js';
 /**
@@ -68,6 +69,11 @@ export function inertiaRenderer(opts) {
         // Happy path: view vai ao Inertia.
         // `messages` vai como shared prop para as páginas React traduzirem.
         const messages = await resolveMessagesFromCtx(ctx);
-        return ctx.inertia.render(`${opts.prefix}/${view}`, { ...props, messages });
+        const accountNav = props.accountNav ?? (await accountNavFor(ctx, view, props));
+        return ctx.inertia.render(`${opts.prefix}/${view}`, {
+            ...(accountNav ? { accountNav } : {}),
+            ...props,
+            messages,
+        });
     };
 }

package/build/src/host/screen_props.d.ts

@@ -8,6 +8,8 @@
  * typed per view, so a controller that drifts from these types fails the
  * package's `tsc`.
  */
+import type { ResolvedActionStep } from '../account/http.js';
+import type { AccountNavEntry, ResolvedAccountPage } from '../account/runtime.js';
 import type { OrgInvitation, OrgMember, OrgSummary } from '../accounts/account_store.js';
 import type { PatRecord } from '../pat/pat_store.js';
 import type { AccountConfirmProps, AccountEmailConfirmedProps, AccountLoginProps, AccountMfaProps, AccountSecurityProps } from './account_screen_props.js';
@@ -279,6 +281,31 @@ export interface AccountOrgsProps extends WithMessages {
     invitation?: OrgInvitation | null;
     token?: string;
 }
+/**
+ * `account/extension` — a page an account console extension added. `page` is the resolved page
+ * (texts translated, values formatted); `step` is set on the confirmation step of an action.
+ * `accountNav` (the console navigation) is added by the renderer to every account screen.
+ */
+export interface AccountExtensionProps extends WithMessages {
+    csrfToken: string;
+    page: ResolvedAccountPage;
+    step: ResolvedActionStep | null;
+    flash: {
+        tone: 'success' | 'danger';
+        text: string;
+    } | null;
+    /** The response's CSP nonce, for the scripts of `component` blocks. */
+    cspNonce: string | null;
+    accountNav?: AccountNavEntry[] | null;
+    /** `<html lang>` of the console locale. */
+    htmlLang?: string;
+    /** Edge only: the `<script>` tag of a `component` block's script (nonce included). */
+    scriptTag?: (script: {
+        src: string;
+        integrity: string | null;
+        module: boolean;
+    }) => string;
+}
 /** Props of every screen, by view name. */
 export interface AuthkitScreenProps {
     login: LoginProps;
@@ -302,6 +329,7 @@ export interface AuthkitScreenProps {
     'account/orgs': AccountOrgsProps;
     'account/confirm': AccountConfirmProps;
     'account/email-confirmed': AccountEmailConfirmedProps;
+    'account/extension': AccountExtensionProps;
 }
 /** Every screen authkit-server renders. */
 export type AuthkitScreen = keyof AuthkitScreenProps;