@dudousxd/adonis-authkit-server 0.5.0 → 0.7.0

package/build/src/host/controllers/interaction_controller.js

@@ -3,7 +3,9 @@ import { brandFor, isFirstParty } from '../branding.js';
 import { translate } from '../i18n.js';
 import { attemptPasswordLogin } from '../login_attempt.js';
 import { notifyLoginSuccess } from '../login_notify.js';
-import { supportsPasskeys } from '../../accounts/account_store.js';
+import { supportsPasskeys, supportsMagicLink } from '../../accounts/account_store.js';
+import { sendMagicLinkEmail } from '../default_mailer.js';
+import { TRUSTED_DEVICE_COOKIE, buildTrustedDevicePayload, isTrustedDeviceValid, } from '../trusted_device.js';
 const SESSION_KEY = 'authkit_login_email';
 /** accountId aguardando o 2º fator depois da senha verificada. */
 const MFA_PENDING_KEY = 'authkit_mfa_pending';
@@ -45,6 +47,10 @@ export default class AuthInteractionController {
         // Step 2: password — look up user for personalisation (enumeration-safe: always show step 2)
         const acc = await cfg.accountStore.findByEmail(email);
         const account = acc ? { fullName: acc.name ?? null, globalRoles: acc.globalRoles ?? [] } : null;
+        // Passwordless: magic link disponível se ligado E o store suporta. Passkey-first
+        // disponível se ligado, o store suporta E a conta tem ao menos uma passkey.
+        const magicLinkAvailable = cfg.passwordless.magicLink && supportsMagicLink(cfg.accountStore);
+        const passkeyFirstAvailable = cfg.passwordless.passkeyFirst && !!acc && (await this.hasPasskeys(cfg, acc.id));
         return render(ctx, 'login', {
             uid: details.uid,
             csrfToken: ctx.request.csrfToken,
@@ -52,6 +58,8 @@ export default class AuthInteractionController {
             email,
             account,
             brand,
+            magicLinkAvailable,
+            passkeyFirstAvailable,
         });
     }
     /**
@@ -102,7 +110,9 @@ export default class AuthInteractionController {
                     ? translate(cfg.messages, 'errors.account_locked', {
                         seconds: result.retryAfterSec ?? 0,
                     })
-                    : translate(cfg.messages, 'errors.invalid_credentials'),
+                    : result.disabled
+                        ? translate(cfg.messages, 'errors.account_disabled')
+                        : translate(cfg.messages, 'errors.invalid_credentials'),
                 brand,
             });
         }
@@ -126,6 +136,18 @@ export default class AuthInteractionController {
                     noEnrollment: true,
                 });
             }
+            // Trusted device: se o mecanismo está ligado, a conta JÁ tem MFA enrolado e
+            // o request NÃO é um step-up (que sempre força o MFA), um cookie de confiança
+            // válido para ESTA conta pula o 2º fator. amr fica `['pwd']` (sem acr de MFA).
+            if (cfg.trustedDevices.enabled && mfa.enabled && !mfaRequired) {
+                const trusted = await this.checkTrustedDevice(ctx, acc.id, mfa.enabledAt ?? null);
+                if (trusted) {
+                    await service.interactions.completeLogin(ctx, acc.id, { amr: ['pwd'] });
+                    await notifyLoginSuccess(ctx, cfg, { accountId: acc.id, email, ip, clientId });
+                    ctx.session.forget(SESSION_KEY);
+                    return;
+                }
+            }
             ctx.session.put(MFA_PENDING_KEY, acc.id);
             // Passkey disponível como alternativa ao TOTP se o store suporta E a conta
             // tem ao menos uma credencial registrada.
@@ -135,6 +157,8 @@ export default class AuthInteractionController {
                 csrfToken: ctx.request.csrfToken,
                 brand,
                 passkeyAvailable,
+                trustedDevicesEnabled: cfg.trustedDevices.enabled,
+                trustedDeviceDays: cfg.trustedDevices.days,
             });
         }
         // Sem MFA: finaliza a interaction (escreve o 303 de volta para o client).
@@ -185,9 +209,13 @@ export default class AuthInteractionController {
                 error: translate(cfg.messages, 'errors.invalid_code'),
                 brand,
                 passkeyAvailable: await this.hasPasskeys(cfg, accountId),
+                trustedDevicesEnabled: cfg.trustedDevices.enabled,
+                trustedDeviceDays: cfg.trustedDevices.days,
             });
         }
-        // Sucesso no 2º fator: finaliza a interaction para o accountId pendente.
+        // Sucesso no 2º fator: opcionalmente confia neste dispositivo (checkbox).
+        await this.maybeTrustDevice(ctx, cfg, accountId);
+        // Finaliza a interaction para o accountId pendente.
         ctx.session.forget(MFA_PENDING_KEY);
         ctx.session.forget(SESSION_KEY);
         await notifyLoginSuccess(ctx, cfg, {
@@ -230,6 +258,135 @@ export default class AuthInteractionController {
         const list = await cfg.accountStore.listPasskeys(accountId);
         return Array.isArray(list) && list.length > 0;
     }
+    /**
+     * Lê o cookie de dispositivo confiável (encriptado, appKey-backed) e valida que
+     * pertence a `accountId`, não expirou e é posterior ao último (re)enrollment de
+     * MFA. Step-up NÃO chama isto (força sempre o MFA). Best-effort: qualquer erro de
+     * leitura → não confiável.
+     */
+    async checkTrustedDevice(ctx, accountId, mfaEnabledAt) {
+        try {
+            const payload = ctx.request.encryptedCookie(TRUSTED_DEVICE_COOKIE);
+            return isTrustedDeviceValid(payload, { accountId, mfaEnabledAt });
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Se o checkbox "confiar neste dispositivo" foi marcado E o mecanismo está ligado,
+     * grava o cookie encriptado de confiança para a conta (skip MFA por N dias).
+     */
+    async maybeTrustDevice(ctx, cfg, accountId) {
+        if (!cfg.trustedDevices.enabled)
+            return;
+        const checked = ctx.request.input('trustDevice');
+        // Checkbox HTML: presente ('on'/'true'/'1') = marcado.
+        const on = checked === 'on' || checked === 'true' || checked === '1' || checked === true;
+        if (!on)
+            return;
+        const payload = buildTrustedDevicePayload(accountId, cfg.trustedDevices);
+        ctx.response.encryptedCookie(TRUSTED_DEVICE_COOKIE, payload, {
+            httpOnly: true,
+            sameSite: 'lax',
+            maxAge: cfg.trustedDevices.days * 24 * 60 * 60,
+        });
+    }
+    /**
+     * accountId para uma cerimônia de passkey no login. Prioriza o accountId pendente
+     * do MFA (passkey como 2º fator). Quando ausente e o passkey-first está ligado,
+     * resolve a conta pelo e-mail guardado na sessão (passkey ANTES da senha) — só se
+     * a conta existe E tem ao menos uma passkey.
+     */
+    async resolvePasskeyAccountId(ctx, cfg) {
+        const pending = ctx.session.get(MFA_PENDING_KEY);
+        if (pending)
+            return pending;
+        if (!cfg.passwordless?.passkeyFirst)
+            return undefined;
+        const email = ctx.session.get(SESSION_KEY);
+        if (!email)
+            return undefined;
+        const acc = await cfg.accountStore.findByEmail(email);
+        if (!acc)
+            return undefined;
+        return (await this.hasPasskeys(cfg, acc.id)) ? acc.id : undefined;
+    }
+    /**
+     * POST /auth/interaction/:uid/magic
+     * Magic link: lê o e-mail da sessão (passwordless.magicLink ligado), emite um
+     * token de uso único e dispara o e-mail. SEMPRE renderiza "link enviado",
+     * independentemente de a conta existir (anti-enumeração). Throttled como o login.
+     */
+    async magicLinkRequest(ctx) {
+        const service = await ctx.containerResolver.make('authkit.server');
+        const cfg = service.config;
+        const render = cfg.render;
+        const details = await service.interactions.details(ctx);
+        const brand = brandFor(cfg.branding, details.params.client_id, details.params.audience);
+        const email = ctx.session.get(SESSION_KEY);
+        const uid = ctx.request.param('uid');
+        if (cfg.passwordless.magicLink && supportsMagicLink(cfg.accountStore) && email) {
+            const issued = await cfg.accountStore.issueMagicLinkToken(email);
+            if (issued) {
+                await cfg.audit?.record({
+                    type: 'login.magic_link_sent',
+                    accountId: issued.account.id,
+                    email,
+                    ip: ctx.request.ip?.() ?? null,
+                    clientId: details.params.client_id ?? null,
+                });
+                const origin = `${ctx.request.protocol()}://${ctx.request.host()}`;
+                const magicUrl = `${origin}/auth/interaction/${uid}/magic?token=${encodeURIComponent(issued.token)}`;
+                if (cfg.mail?.onMagicLink) {
+                    await cfg.mail.onMagicLink({ email, magicUrl, token: issued.token });
+                }
+                else {
+                    await sendMagicLinkEmail(ctx, { email, magicUrl });
+                }
+            }
+        }
+        // Resposta uniforme (não vaza existência de conta).
+        return render(ctx, 'login', {
+            uid,
+            csrfToken: ctx.request.csrfToken,
+            step: 'password',
+            email,
+            account: null,
+            brand,
+            magicLinkSent: true,
+        });
+    }
+    /**
+     * GET /auth/interaction/:uid/magic?token=...
+     * Consome o magic link. Em sucesso finaliza o login (amr `['email']`). Token
+     * inválido/expirado volta ao início do login.
+     */
+    async magicLinkConsume(ctx) {
+        const service = await ctx.containerResolver.make('authkit.server');
+        const cfg = service.config;
+        const uid = ctx.request.param('uid');
+        const ip = ctx.request.ip?.() ?? null;
+        const clientId = (await service.interactions.details(ctx)).params.client_id;
+        const token = ctx.request.qs().token ?? '';
+        if (!cfg.passwordless.magicLink || !supportsMagicLink(cfg.accountStore) || !token) {
+            return ctx.response.redirect(`/auth/interaction/${uid}`);
+        }
+        const acc = await cfg.accountStore.consumeMagicLinkToken(token);
+        if (!acc) {
+            await cfg.audit?.record({ type: 'login.failure', ip, clientId, metadata: { stage: 'magic_link' } });
+            return ctx.response.redirect(`/auth/interaction/${uid}`);
+        }
+        await notifyLoginSuccess(ctx, cfg, {
+            accountId: acc.id,
+            email: acc.email,
+            ip,
+            clientId: clientId ?? null,
+            metadata: { method: 'magic_link' },
+        });
+        ctx.session.forget(SESSION_KEY);
+        await service.interactions.completeLogin(ctx, acc.id, { amr: ['email'] });
+    }
     /**
      * POST /auth/interaction/:uid/passkey/options
      * Gera as opções de autenticação por passkey para o accountId pendente do MFA,
@@ -238,7 +395,7 @@ export default class AuthInteractionController {
     async passkeyOptions(ctx) {
         const service = await ctx.containerResolver.make('authkit.server');
         const cfg = service.config;
-        const accountId = ctx.session.get(MFA_PENDING_KEY);
+        const accountId = await this.resolvePasskeyAccountId(ctx, cfg);
         if (!accountId) {
             return ctx.response.badRequest({
                 message: translate(cfg.messages, 'errors.session_expired'),
@@ -266,7 +423,7 @@ export default class AuthInteractionController {
         const render = cfg.render;
         const details = await service.interactions.details(ctx);
         const brand = brandFor(cfg.branding, details.params.client_id, details.params.audience);
-        const accountId = ctx.session.get(MFA_PENDING_KEY);
+        const accountId = await this.resolvePasskeyAccountId(ctx, cfg);
         const challenge = ctx.session.get(PASSKEY_AUTH_CHALLENGE_KEY);
         const ip = ctx.request.ip?.() ?? null;
         const clientId = details.params.client_id ?? null;
@@ -301,8 +458,12 @@ export default class AuthInteractionController {
                 error: translate(cfg.messages, 'mfa_challenge.passkey_error'),
                 brand,
                 passkeyAvailable: await this.hasPasskeys(cfg, accountId),
+                trustedDevicesEnabled: cfg.trustedDevices.enabled,
+                trustedDeviceDays: cfg.trustedDevices.days,
             });
         }
+        // Passkey OK: opcionalmente confia neste dispositivo (checkbox no challenge).
+        await this.maybeTrustDevice(ctx, cfg, accountId);
         ctx.session.forget(MFA_PENDING_KEY);
         ctx.session.forget(SESSION_KEY);
         await notifyLoginSuccess(ctx, cfg, {
@@ -311,7 +472,9 @@ export default class AuthInteractionController {
             clientId,
             metadata: { mfa: 'webauthn' },
         });
-        await service.interactions.completeLogin(ctx, accountId, this.stepUpExtra(cfg, details, 'webauthn'));
+        // Step-up carimba acr/amr quando solicitado; senão a passkey conta como o fator
+        // forte do login (amr `['webauthn']`) — vale tanto p/ MFA quanto passkey-first.
+        await service.interactions.completeLogin(ctx, accountId, this.stepUpExtra(cfg, details, 'webauthn') ?? { amr: ['webauthn'] });
     }
     /**
      * GET /auth/interaction/:uid/switch

package/build/src/host/default_mailer.d.ts

@@ -45,6 +45,14 @@ export declare function sendNewLoginEmail(ctx: HttpContext, data: {
     ip: string;
     when: string;
 }): Promise<void>;
+/**
+ * Envia o e-mail de magic link (login passwordless) pelo mailer default do host.
+ * Best-effort: no fallback (sem mail) loga o link; nunca lança.
+ */
+export declare function sendMagicLinkEmail(ctx: HttpContext, data: {
+    email: string;
+    magicUrl: string;
+}): Promise<void>;
 /**
  * Envia o e-mail de verificação pelo mailer default do host.
  * Best-effort: no fallback (sem mail) loga o link; nunca lança.

package/build/src/host/default_mailer.js

@@ -197,6 +197,34 @@ export async function sendNewLoginEmail(ctx, data) {
         ctx.logger.error({ err: error, email: data.email }, 'authkit: falha ao enviar alerta de novo acesso');
     }
 }
+/**
+ * Envia o e-mail de magic link (login passwordless) pelo mailer default do host.
+ * Best-effort: no fallback (sem mail) loga o link; nunca lança.
+ */
+export async function sendMagicLinkEmail(ctx, data) {
+    try {
+        const brand = resolveBrand(ctx);
+        const { messages: t, locale } = resolveMailMessages(ctx);
+        const content = renderTransactionalEmail({
+            brand,
+            locale,
+            linkFallback: translate(t, 'mail.common.link_fallback'),
+            subject: translate(t, 'mail.magic_link.subject'),
+            heading: translate(t, 'mail.magic_link.heading'),
+            intro: translate(t, 'mail.magic_link.intro'),
+            ctaLabel: translate(t, 'mail.magic_link.cta'),
+            ctaUrl: data.magicUrl,
+            footnote: translate(t, 'mail.magic_link.fallback'),
+        });
+        const sent = await sendEmail(ctx, data.email, content);
+        if (!sent) {
+            ctx.logger.info({ magicUrl: data.magicUrl, email: data.email }, 'authkit: magic link de login (dev — @adonisjs/mail ausente)');
+        }
+    }
+    catch (error) {
+        ctx.logger.error({ err: error, email: data.email }, 'authkit: falha ao enviar magic link de login');
+    }
+}
 /**
  * Envia o e-mail de verificação pelo mailer default do host.
  * Best-effort: no fallback (sem mail) loga o link; nunca lança.

package/build/src/host/i18n.d.ts

@@ -44,6 +44,9 @@ export declare const DEFAULT_MESSAGES: {
     'login.switch_account': string;
     'login.password_label': string;
     'login.submit': string;
+    'login.magic_link_button': string;
+    'login.magic_link_sent': string;
+    'login.passkey_button': string;
     'signup.page_title': string;
     'signup.title': string;
     'signup.intro': string;
@@ -80,6 +83,7 @@ export declare const DEFAULT_MESSAGES: {
     'mfa_challenge.recovery_submit': string;
     'mfa_challenge.passkey_button': string;
     'mfa_challenge.passkey_error': string;
+    'mfa_challenge.trust_device': string;
     'consent.page_title': string;
     'consent.title': string;
     'consent.body': string;
@@ -121,6 +125,31 @@ export declare const DEFAULT_MESSAGES: {
     'account.security.change_email_submit': string;
     'account.security.email_change_requested': string;
     'account.security.email_changed': string;
+    'account.security.trusted_devices_section': string;
+    'account.security.trusted_devices_intro': string;
+    'account.security.trusted_devices_revoke': string;
+    'account.security.trusted_devices_revoked': string;
+    'account.profile.section': string;
+    'account.profile.intro': string;
+    'account.profile.name_label': string;
+    'account.profile.avatar_label': string;
+    'account.profile.avatar_upload_label': string;
+    'account.profile.avatar_upload_hint': string;
+    'account.profile.avatar_invalid_type': string;
+    'account.profile.avatar_too_large': string;
+    'account.profile.submit': string;
+    'account.profile.updated': string;
+    'account.profile.not_supported': string;
+    'account.apps.page_title': string;
+    'account.apps.title': string;
+    'account.apps.intro': string;
+    'account.apps.logout': string;
+    'account.apps.empty': string;
+    'account.apps.tokens': string;
+    'account.apps.revoke': string;
+    'account.apps.revoke_confirm': string;
+    'account.apps.revoked': string;
+    'account.apps.not_supported': string;
     'account.email_confirmed.page_title': string;
     'account.email_confirmed.ok_title': string;
     'account.email_confirmed.ok_body': string;
@@ -167,6 +196,20 @@ export declare const DEFAULT_MESSAGES: {
     'admin.users.roles_placeholder': string;
     'admin.users.save_roles': string;
     'admin.users.sessions': string;
+    'admin.users.create_section': string;
+    'admin.users.create_name_placeholder': string;
+    'admin.users.create_email_placeholder': string;
+    'admin.users.create_password_placeholder': string;
+    'admin.users.create_submit': string;
+    'admin.users.created': string;
+    'admin.users.reset_password': string;
+    'admin.users.reset_sent': string;
+    'admin.users.disable': string;
+    'admin.users.enable': string;
+    'admin.users.disabled': string;
+    'admin.users.enabled': string;
+    'admin.users.disabled_badge': string;
+    'admin.users.disable_confirm': string;
     'admin.sessions.page_title': string;
     'admin.sessions.title': string;
     'admin.sessions.account': string;
@@ -243,6 +286,7 @@ export declare const DEFAULT_MESSAGES: {
     'mfa_challenge.required_no_enrollment': string;
     'errors.invalid_credentials': string;
     'errors.invalid_code': string;
+    'errors.account_disabled': string;
     'errors.email_taken': string;
     'errors.signup_failed': string;
     'errors.invalid_or_expired_token': string;
@@ -264,6 +308,11 @@ export declare const DEFAULT_MESSAGES: {
     'mail.verify.cta': string;
     'mail.verify.fallback': string;
     'mail.verify.expires': string;
+    'mail.magic_link.subject': string;
+    'mail.magic_link.heading': string;
+    'mail.magic_link.intro': string;
+    'mail.magic_link.cta': string;
+    'mail.magic_link.fallback': string;
     'mail.new_login.subject': string;
     'mail.new_login.heading': string;
     'mail.new_login.intro': string;
@@ -298,6 +347,9 @@ export declare const PT_BR_MESSAGES: {
     'login.switch_account': string;
     'login.password_label': string;
     'login.submit': string;
+    'login.magic_link_button': string;
+    'login.magic_link_sent': string;
+    'login.passkey_button': string;
     'signup.page_title': string;
     'signup.title': string;
     'signup.intro': string;
@@ -334,6 +386,7 @@ export declare const PT_BR_MESSAGES: {
     'mfa_challenge.recovery_submit': string;
     'mfa_challenge.passkey_button': string;
     'mfa_challenge.passkey_error': string;
+    'mfa_challenge.trust_device': string;
     'consent.page_title': string;
     'consent.title': string;
     'consent.body': string;
@@ -375,6 +428,31 @@ export declare const PT_BR_MESSAGES: {
     'account.security.change_email_submit': string;
     'account.security.email_change_requested': string;
     'account.security.email_changed': string;
+    'account.security.trusted_devices_section': string;
+    'account.security.trusted_devices_intro': string;
+    'account.security.trusted_devices_revoke': string;
+    'account.security.trusted_devices_revoked': string;
+    'account.profile.section': string;
+    'account.profile.intro': string;
+    'account.profile.name_label': string;
+    'account.profile.avatar_label': string;
+    'account.profile.avatar_upload_label': string;
+    'account.profile.avatar_upload_hint': string;
+    'account.profile.avatar_invalid_type': string;
+    'account.profile.avatar_too_large': string;
+    'account.profile.submit': string;
+    'account.profile.updated': string;
+    'account.profile.not_supported': string;
+    'account.apps.page_title': string;
+    'account.apps.title': string;
+    'account.apps.intro': string;
+    'account.apps.logout': string;
+    'account.apps.empty': string;
+    'account.apps.tokens': string;
+    'account.apps.revoke': string;
+    'account.apps.revoke_confirm': string;
+    'account.apps.revoked': string;
+    'account.apps.not_supported': string;
     'account.email_confirmed.page_title': string;
     'account.email_confirmed.ok_title': string;
     'account.email_confirmed.ok_body': string;
@@ -421,6 +499,20 @@ export declare const PT_BR_MESSAGES: {
     'admin.users.roles_placeholder': string;
     'admin.users.save_roles': string;
     'admin.users.sessions': string;
+    'admin.users.create_section': string;
+    'admin.users.create_name_placeholder': string;
+    'admin.users.create_email_placeholder': string;
+    'admin.users.create_password_placeholder': string;
+    'admin.users.create_submit': string;
+    'admin.users.created': string;
+    'admin.users.reset_password': string;
+    'admin.users.reset_sent': string;
+    'admin.users.disable': string;
+    'admin.users.enable': string;
+    'admin.users.disabled': string;
+    'admin.users.enabled': string;
+    'admin.users.disabled_badge': string;
+    'admin.users.disable_confirm': string;
     'admin.sessions.page_title': string;
     'admin.sessions.title': string;
     'admin.sessions.account': string;
@@ -497,6 +589,7 @@ export declare const PT_BR_MESSAGES: {
     'mfa_challenge.required_no_enrollment': string;
     'errors.invalid_credentials': string;
     'errors.invalid_code': string;
+    'errors.account_disabled': string;
     'errors.email_taken': string;
     'errors.signup_failed': string;
     'errors.invalid_or_expired_token': string;
@@ -518,6 +611,11 @@ export declare const PT_BR_MESSAGES: {
     'mail.verify.cta': string;
     'mail.verify.fallback': string;
     'mail.verify.expires': string;
+    'mail.magic_link.subject': string;
+    'mail.magic_link.heading': string;
+    'mail.magic_link.intro': string;
+    'mail.magic_link.cta': string;
+    'mail.magic_link.fallback': string;
     'mail.new_login.subject': string;
     'mail.new_login.heading': string;
     'mail.new_login.intro': string;