alepha 0.14.2 → 0.14.3

package/src/api/parameters/schemas/activateConfigBodySchema.ts

@@ -0,0 +1,12 @@
+import { type Static, t } from "alepha";
+
+/**
+ * Activate config body schema.
+ */
+export const activateConfigBodySchema = t.object({
+  version: t.integer({ description: "Version number to activate" }),
+  creatorId: t.optional(t.uuid()),
+  creatorName: t.optional(t.text()),
+});
+
+export type ActivateConfigBody = Static<typeof activateConfigBodySchema>;

package/src/api/parameters/schemas/checkScheduledResponseSchema.ts

@@ -0,0 +1,8 @@
+import { t } from "alepha";
+
+/**
+ * Check scheduled response schema.
+ */
+export const checkScheduledResponseSchema = t.object({
+  message: t.text(),
+});

package/src/api/parameters/schemas/configCurrentResponseSchema.ts

@@ -0,0 +1,13 @@
+import { t } from "alepha";
+import { parameterResponseSchema } from "./parameterResponseSchema.ts";
+
+/**
+ * Current config response schema.
+ */
+export const configCurrentResponseSchema = t.object({
+  current: t.optional(parameterResponseSchema),
+  next: t.optional(parameterResponseSchema),
+  defaultValue: t.optional(t.json()),
+  currentValue: t.optional(t.json()),
+  schema: t.optional(t.json()),
+});

package/src/api/parameters/schemas/configHistoryResponseSchema.ts

@@ -0,0 +1,9 @@
+import { t } from "alepha";
+import { parameterResponseSchema } from "./parameterResponseSchema.ts";
+
+/**
+ * Config history response schema.
+ */
+export const configHistoryResponseSchema = t.object({
+  versions: t.array(parameterResponseSchema),
+});

package/src/api/parameters/schemas/configNameParamSchema.ts

@@ -0,0 +1,10 @@
+import { t } from "alepha";
+
+/**
+ * Config name param schema.
+ */
+export const configNameParamSchema = t.object({
+  name: t.text({
+    description: "Configuration name (e.g., app.features.flags)",
+  }),
+});

package/src/api/parameters/schemas/configNamesResponseSchema.ts

@@ -0,0 +1,8 @@
+import { t } from "alepha";
+
+/**
+ * Config names list response schema.
+ */
+export const configNamesResponseSchema = t.object({
+  names: t.array(t.text()),
+});

package/src/api/parameters/schemas/configTreeNodeSchema.ts

@@ -0,0 +1,13 @@
+import { type Static, t } from "alepha";
+
+/**
+ * Tree node schema for configuration tree navigation.
+ */
+export const configTreeNodeSchema = t.object({
+  name: t.text(),
+  path: t.text(),
+  isLeaf: t.boolean(),
+  children: t.array(t.any()),
+});
+
+export type ConfigTreeNode = Static<typeof configTreeNodeSchema>;

package/src/api/parameters/schemas/configVersionParamSchema.ts

@@ -0,0 +1,9 @@
+import { t } from "alepha";
+
+/**
+ * Config name and version param schema.
+ */
+export const configVersionParamSchema = t.object({
+  name: t.text(),
+  version: t.integer(),
+});

package/src/api/parameters/schemas/configVersionResponseSchema.ts

@@ -0,0 +1,9 @@
+import { t } from "alepha";
+import { parameterResponseSchema } from "./parameterResponseSchema.ts";
+
+/**
+ * Config version response schema.
+ */
+export const configVersionResponseSchema = t.object({
+  config: t.optional(parameterResponseSchema),
+});

package/src/api/parameters/schemas/configsByStatusResponseSchema.ts

@@ -0,0 +1,9 @@
+import { t } from "alepha";
+import { parameterResponseSchema } from "./parameterResponseSchema.ts";
+
+/**
+ * Configs by status response schema.
+ */
+export const configsByStatusResponseSchema = t.object({
+  configs: t.array(parameterResponseSchema),
+});

package/src/api/parameters/schemas/createConfigVersionBodySchema.ts

@@ -0,0 +1,24 @@
+import { type Static, t } from "alepha";
+
+/**
+ * Create config version body schema.
+ */
+export const createConfigVersionBodySchema = t.object({
+  content: t.json({ description: "New configuration content" }),
+  schemaHash: t.text({
+    description: "Hash of the schema for migration detection",
+  }),
+  activationDate: t.optional(
+    t.datetime({ description: "When to activate (default: now)" }),
+  ),
+  changeDescription: t.optional(
+    t.text({ description: "Description of changes" }),
+  ),
+  tags: t.optional(t.array(t.text())),
+  creatorId: t.optional(t.uuid()),
+  creatorName: t.optional(t.text()),
+});
+
+export type CreateConfigVersionBody = Static<
+  typeof createConfigVersionBodySchema
+>;

package/src/api/parameters/schemas/index.ts

@@ -0,0 +1,15 @@
+export * from "./activateConfigBodySchema.ts";
+export * from "./checkScheduledResponseSchema.ts";
+export * from "./configCurrentResponseSchema.ts";
+export * from "./configHistoryResponseSchema.ts";
+export * from "./configNameParamSchema.ts";
+export * from "./configNamesResponseSchema.ts";
+export * from "./configsByStatusResponseSchema.ts";
+export * from "./configTreeNodeSchema.ts";
+export * from "./configVersionParamSchema.ts";
+export * from "./configVersionResponseSchema.ts";
+export * from "./createConfigVersionBodySchema.ts";
+export * from "./parameterResponseSchema.ts";
+export * from "./parameterStatusSchema.ts";
+export * from "./rollbackConfigBodySchema.ts";
+export * from "./statusParamSchema.ts";

package/src/api/parameters/schemas/parameterResponseSchema.ts

@@ -0,0 +1,26 @@
+import { type Static, t } from "alepha";
+import { parameterStatusSchema } from "./parameterStatusSchema.ts";
+
+/**
+ * Parameter response schema for API responses.
+ */
+export const parameterResponseSchema = t.object({
+  id: t.uuid(),
+  createdAt: t.datetime(),
+  updatedAt: t.datetime(),
+  name: t.text(),
+  content: t.json(),
+  schemaHash: t.text(),
+  status: parameterStatusSchema,
+  activationDate: t.datetime(),
+  expiredAt: t.optional(t.datetime()),
+  version: t.integer(),
+  changeDescription: t.optional(t.text()),
+  tags: t.optional(t.array(t.text())),
+  creatorId: t.optional(t.uuid()),
+  creatorName: t.optional(t.text()),
+  previousContent: t.optional(t.json()),
+  migrationLog: t.optional(t.text()),
+});
+
+export type ParameterResponse = Static<typeof parameterResponseSchema>;

package/src/api/parameters/schemas/parameterStatusSchema.ts

@@ -0,0 +1,13 @@
+import { type Static, t } from "alepha";
+
+/**
+ * Parameter status enum schema.
+ */
+export const parameterStatusSchema = t.enum([
+  "expired",
+  "current",
+  "next",
+  "future",
+]);
+
+export type ParameterStatus = Static<typeof parameterStatusSchema>;

package/src/api/parameters/schemas/rollbackConfigBodySchema.ts

@@ -0,0 +1,15 @@
+import { type Static, t } from "alepha";
+
+/**
+ * Rollback config body schema.
+ */
+export const rollbackConfigBodySchema = t.object({
+  targetVersion: t.integer({
+    description: "Version number to rollback to",
+  }),
+  changeDescription: t.optional(t.text()),
+  creatorId: t.optional(t.uuid()),
+  creatorName: t.optional(t.text()),
+});
+
+export type RollbackConfigBody = Static<typeof rollbackConfigBodySchema>;

package/src/api/parameters/schemas/statusParamSchema.ts

@@ -0,0 +1,9 @@
+import { t } from "alepha";
+import { parameterStatusSchema } from "./parameterStatusSchema.ts";
+
+/**
+ * Status param schema.
+ */
+export const statusParamSchema = t.object({
+  status: parameterStatusSchema,
+});

package/src/api/users/__tests__/EmailVerification.spec.ts

@@ -0,0 +1,369 @@
+import { Alepha } from "alepha";
+import { AlephaApiVerification } from "alepha/api/verifications";
+import { DateTimeProvider } from "alepha/datetime";
+import { AlephaEmail, MemoryEmailProvider } from "alepha/email";
+import { AlephaSecurity } from "alepha/security";
+import { BadRequestError } from "alepha/server";
+import { describe, it } from "vitest";
+import { AlephaApiUsers, UserController, UserService } from "../index.ts";
+
+const setup = async () => {
+  const alepha = Alepha.create({
+    env: { LOG_LEVEL: "error" },
+  });
+
+  alepha.with(AlephaSecurity);
+  alepha.with(AlephaEmail);
+  alepha.with(AlephaApiVerification);
+  alepha.with(AlephaApiUsers);
+
+  await alepha.start();
+
+  const emailProvider = alepha.inject(MemoryEmailProvider);
+  emailProvider.records = [];
+
+  return {
+    alepha,
+    userService: alepha.inject(UserService),
+    dateTimeProvider: alepha.inject(DateTimeProvider),
+    emailProvider,
+    actions: alepha.inject(UserController),
+  };
+};
+
+// Helper to extract code from email
+const extractCode = (emailBody: string): string => {
+  // Code is displayed in the email body as a 6-digit number
+  const match = emailBody.match(/(\d{6})/);
+  if (!match) throw new Error("Code not found in email");
+  return match[1];
+};
+
+describe("alepha/api/users - Email Verification", () => {
+  it("should successfully request email verification and send email", async ({
+    expect,
+  }) => {
+    const { userService, emailProvider, actions } = await setup();
+
+    // Create a test user
+    const user = await userService.users().create({
+      username: "testuser",
+      email: "test@example.com",
+      roles: ["user"],
+      emailVerified: false,
+    });
+
+    // Request email verification
+    const result = await actions.requestEmailVerification({
+      body: {
+        email: "test@example.com",
+      },
+    });
+
+    expect(result.success).toBe(true);
+    expect(result.message).toContain("verification code has been sent");
+
+    // Verify email was sent via verification service
+    await expect.poll(() => emailProvider.records.length).toBe(1);
+    const email = emailProvider.records[0];
+    expect(email.to).toBe("test@example.com");
+    expect(email.subject).toBe("Verify your email address");
+    // Check for 6-digit code in email
+    expect(email.body).toMatch(/\d{6}/);
+    expect(email.body).toContain("5 minutes"); // Default code verification expiration
+  });
+
+  it("should not reveal if email does not exist", async ({ expect }) => {
+    const { emailProvider, actions } = await setup();
+
+    // Request email verification for non-existent email
+    const result = await actions.requestEmailVerification({
+      body: {
+        email: "nonexistent@example.com",
+      },
+    });
+
+    // Should return success to prevent email enumeration
+    expect(result.success).toBe(true);
+    expect(result.message).toContain("verification code has been sent");
+
+    // But no email should be sent
+    expect(emailProvider.records).toHaveLength(0);
+  });
+
+  it("should not send email if already verified", async ({ expect }) => {
+    const { userService, emailProvider, actions } = await setup();
+
+    // Create a user with already verified email
+    await userService.users().create({
+      username: "verifieduser",
+      email: "verified@example.com",
+      roles: ["user"],
+      emailVerified: true,
+    });
+
+    // Request email verification
+    const result = await actions.requestEmailVerification({
+      body: {
+        email: "verified@example.com",
+      },
+    });
+
+    // Should return success but not send email
+    expect(result.success).toBe(true);
+    expect(emailProvider.records).toHaveLength(0);
+  });
+
+  it("should successfully verify email with valid token", async ({
+    expect,
+  }) => {
+    const { userService, emailProvider, actions } = await setup();
+
+    // Create a test user
+    const user = await userService.users().create({
+      username: "testuser",
+      email: "test@example.com",
+      roles: ["user"],
+      emailVerified: false,
+    });
+
+    // Request email verification
+    await userService.requestEmailVerification("test@example.com");
+
+    // Extract code from email
+    await expect.poll(() => emailProvider.records.length).toBe(1);
+    const token = extractCode(emailProvider.records[0].body);
+
+    // Verify email
+    const result = await actions.verifyEmail({
+      body: {
+        email: "test@example.com",
+        token,
+      },
+    });
+
+    expect(result.success).toBe(true);
+    expect(result.message).toContain("Email has been verified successfully");
+
+    // Check that emailVerified is now true
+    const updatedUser = await userService.users().findOne({
+      where: { id: { eq: user.id } },
+    });
+    expect(updatedUser.emailVerified).toBe(true);
+  });
+
+  it("should reject invalid verification token", async ({ expect }) => {
+    const { userService, actions } = await setup();
+
+    // Create a test user
+    await userService.users().create({
+      username: "testuser",
+      email: "test@example.com",
+      roles: ["user"],
+      emailVerified: false,
+    });
+
+    // Attempt to verify with invalid token
+    await expect(
+      actions.verifyEmail({
+        body: {
+          email: "test@example.com",
+          token: "550e8400-e29b-41d4-a716-446655440000",
+        },
+      }),
+    ).rejects.toThrowError(BadRequestError);
+  });
+
+  it("should reject expired verification token", async ({ expect }) => {
+    const { userService, dateTimeProvider, emailProvider, actions } =
+      await setup();
+
+    // Create a test user
+    await userService.users().create({
+      username: "testuser",
+      email: "test@example.com",
+      roles: ["user"],
+      emailVerified: false,
+    });
+
+    // Request email verification
+    await userService.requestEmailVerification("test@example.com");
+
+    // Extract code
+    await expect.poll(() => emailProvider.records.length).toBe(1);
+    const token = extractCode(emailProvider.records[0].body);
+
+    // Travel forward in time to expire the token (default expiration is 5 minutes for code verification)
+    dateTimeProvider.travel(6, "minutes");
+
+    // Attempt to verify with expired token
+    await expect(
+      actions.verifyEmail({
+        body: {
+          email: "test@example.com",
+          token,
+        },
+      }),
+    ).rejects.toThrowError(BadRequestError);
+  });
+
+  it("should not allow token reuse after successful verification", async ({
+    expect,
+  }) => {
+    const { userService, emailProvider, actions } = await setup();
+
+    // Create a test user
+    await userService.users().create({
+      username: "testuser",
+      email: "test@example.com",
+      roles: ["user"],
+      emailVerified: false,
+    });
+
+    // Request email verification
+    await userService.requestEmailVerification("test@example.com");
+
+    // Extract code
+    await expect.poll(() => emailProvider.records.length).toBe(1);
+    const token = extractCode(emailProvider.records[0].body);
+
+    // Verify email
+    await actions.verifyEmail({
+      body: {
+        email: "test@example.com",
+        token,
+      },
+    });
+
+    // Attempt to use the same token again should fail
+    await expect(
+      actions.verifyEmail({
+        body: {
+          email: "test@example.com",
+          token,
+        },
+      }),
+    ).rejects.toThrowError(BadRequestError);
+  });
+
+  it("should check email verification status", async ({ expect }) => {
+    const { userService, actions } = await setup();
+
+    // Create a test user with unverified email
+    await userService.users().create({
+      username: "unverifieduser",
+      email: "unverified@example.com",
+      roles: ["user"],
+      emailVerified: false,
+    });
+
+    // Create a test user with verified email
+    await userService.users().create({
+      username: "verifieduser",
+      email: "verified@example.com",
+      roles: ["user"],
+      emailVerified: true,
+    });
+
+    // Check unverified email
+    const unverifiedResult = await actions.checkEmailVerification({
+      query: { email: "unverified@example.com" },
+    });
+    expect(unverifiedResult.verified).toBe(false);
+
+    // Check verified email
+    const verifiedResult = await actions.checkEmailVerification({
+      query: { email: "verified@example.com" },
+    });
+    expect(verifiedResult.verified).toBe(true);
+
+    // Check non-existent email
+    const nonExistentResult = await actions.checkEmailVerification({
+      query: { email: "nonexistent@example.com" },
+    });
+    expect(nonExistentResult.verified).toBe(false);
+  });
+
+  it("should respect rate limiting on verification requests", async ({
+    expect,
+  }) => {
+    const { userService, dateTimeProvider, emailProvider, actions } =
+      await setup();
+
+    // Create a test user
+    await userService.users().create({
+      username: "testuser",
+      email: "test@example.com",
+      roles: ["user"],
+      emailVerified: false,
+    });
+
+    // Request email verification multiple times within cooldown period
+    await actions.requestEmailVerification({
+      body: {
+        email: "test@example.com",
+      },
+    });
+
+    await expect.poll(() => emailProvider.records.length).toBe(1);
+
+    // Second request should be silently ignored (cooldown)
+    await actions.requestEmailVerification({
+      body: {
+        email: "test@example.com",
+      },
+    });
+
+    // Still only 1 email
+    expect(emailProvider.records.length).toBe(1);
+
+    // Wait for cooldown to pass (90 seconds default)
+    dateTimeProvider.travel(91, "seconds");
+
+    // Now should work
+    await actions.requestEmailVerification({
+      body: {
+        email: "test@example.com",
+      },
+    });
+
+    await expect.poll(() => emailProvider.records.length).toBe(2);
+  });
+
+  it("should correctly identify verified vs unverified users using isEmailVerified", async ({
+    expect,
+  }) => {
+    const { userService } = await setup();
+
+    // Create users with different verification statuses
+    await userService.users().create({
+      username: "unverifieduser",
+      email: "unverified@example.com",
+      roles: ["user"],
+      emailVerified: false,
+    });
+
+    await userService.users().create({
+      username: "verifieduser",
+      email: "verified@example.com",
+      roles: ["user"],
+      emailVerified: true,
+    });
+
+    // Check verification status
+    const unverifiedStatus = await userService.isEmailVerified(
+      "unverified@example.com",
+    );
+    expect(unverifiedStatus).toBe(false);
+
+    const verifiedStatus = await userService.isEmailVerified(
+      "verified@example.com",
+    );
+    expect(verifiedStatus).toBe(true);
+
+    const nonExistentStatus = await userService.isEmailVerified(
+      "nonexistent@example.com",
+    );
+    expect(nonExistentStatus).toBe(false);
+  });
+});