alepha 0.14.4 → 0.15.1

package/dist/api/users/index.js

@@ -10,11 +10,11 @@ import { AlephaApiAudits, AuditService } from "alepha/api/audits";
 import { $logger } from "alepha/logger";
 import { $bucket } from "alepha/bucket";
 import { $client } from "alepha/server/links";
+import { $authCredentials, $authGithub, $authGoogle, ServerAuthProvider, authenticationProviderSchema } from "alepha/server/auth";
 import { randomInt, randomUUID } from "node:crypto";
 import { $cache } from "alepha/cache";
 import { DateTimeProvider } from "alepha/datetime";
-import { $realm, CryptoProvider, InvalidCredentialsError, SecurityProvider } from "alepha/security";
-import { $authCredentials, $authGithub, $authGoogle, ServerAuthProvider, authenticationProviderSchema } from "alepha/server/auth";
+import { $issuer, CryptoProvider, InvalidCredentialsError, SecurityProvider } from "alepha/security";
 import { FileSystemProvider } from "alepha/file";
 import { AlephaApiFiles } from "alepha/api/files";
 
@@ -37,8 +37,7 @@ const users = $entity({
 		realm: db.default(t.text(), DEFAULT_USER_REALM_NAME),
 		username: t.optional(t.shortText({
 			minLength: 3,
-			maxLength: 50,
-			pattern: "^[a-zA-Z0-9._-]+$"
+			maxLength: 50
 		})),
 		email: t.optional(t.string({ format: "email" })),
 		phoneNumber: t.optional(t.e164()),
@@ -99,6 +98,7 @@ const realmAuthSettingsAtom = $atom({
 		emailRequired: t.boolean({ description: "Require email address for user accounts" }),
 		usernameEnabled: t.boolean({ description: "Enable username as a login/registration credential" }),
 		usernameRequired: t.boolean({ description: "Require username for user accounts" }),
+		usernameRegExp: t.string({ description: "Regular expression that usernames must match (if username is enabled)" }),
 		phoneEnabled: t.boolean({ description: "Enable phone number as a login/registration credential" }),
 		phoneRequired: t.boolean({ description: "Require phone number for user accounts" }),
 		verifyEmailRequired: t.boolean({ description: "Require email verification for user accounts" }),
@@ -124,6 +124,7 @@ const realmAuthSettingsAtom = $atom({
 		emailRequired: true,
 		usernameEnabled: false,
 		usernameRequired: false,
+		usernameRegExp: "^[a-zA-Z0-9_]{3,30}$",
 		phoneEnabled: false,
 		phoneRequired: false,
 		verifyEmailRequired: false,
@@ -167,8 +168,8 @@ const sessions = $entity({
 });
 
 //#endregion
-//#region ../../src/api/users/providers/UserRealmProvider.ts
-var UserRealmProvider = class {
+//#region ../../src/api/users/providers/RealmProvider.ts
+var RealmProvider = class {
 	alepha = $inject(Alepha);
 	defaultIdentities = $repository(identities);
 	defaultSessions = $repository(sessions);
@@ -193,46 +194,46 @@ var UserRealmProvider = class {
 			});
 		}
 	});
-	register(userRealmName, userRealmOptions = {}) {
-		this.realms.set(userRealmName, {
-			name: userRealmName,
+	register(realmName, realmOptions = {}) {
+		this.realms.set(realmName, {
+			name: realmName,
 			repositories: {
-				identities: userRealmOptions.entities?.identities ?? this.defaultIdentities,
-				sessions: userRealmOptions.entities?.sessions ?? this.defaultSessions,
-				users: userRealmOptions.entities?.users ?? this.defaultUsers
+				identities: realmOptions.entities?.identities ?? this.defaultIdentities,
+				sessions: realmOptions.entities?.sessions ?? this.defaultSessions,
+				users: realmOptions.entities?.users ?? this.defaultUsers
 			},
 			settings: {
 				...realmAuthSettingsAtom.options.default,
-				...userRealmOptions.settings,
+				...realmOptions.settings,
 				passwordPolicy: {
 					...realmAuthSettingsAtom.options.default.passwordPolicy,
-					...userRealmOptions.settings?.passwordPolicy
+					...realmOptions.settings?.passwordPolicy
 				}
 			}
 		});
-		return this.getRealm(userRealmName);
+		return this.getRealm(realmName);
 	}
 	/**
 	* Gets a registered realm by name, auto-creating default if needed.
 	*/
-	getRealm(userRealmName = DEFAULT_USER_REALM_NAME) {
-		let realm = this.realms.get(userRealmName);
+	getRealm(realmName = DEFAULT_USER_REALM_NAME) {
+		let realm = this.realms.get(realmName);
 		if (!realm) {
 			const firstRealm = Array.from(this.realms.values())[0];
-			if (userRealmName === DEFAULT_USER_REALM_NAME && firstRealm) realm = firstRealm;
-			else if (this.alepha.isTest()) realm = this.register(userRealmName);
-			else throw new AlephaError(`Missing user realm '${userRealmName}', please declare $userRealm in your application.`);
+			if (realmName === DEFAULT_USER_REALM_NAME && firstRealm) realm = firstRealm;
+			else if (this.alepha.isTest()) realm = this.register(realmName);
+			else throw new AlephaError(`Missing realm '${realmName}', please declare $realm in your application.`);
 		}
 		return realm;
 	}
-	identityRepository(userRealmName = DEFAULT_USER_REALM_NAME) {
-		return this.getRealm(userRealmName).repositories.identities;
+	identityRepository(realmName = DEFAULT_USER_REALM_NAME) {
+		return this.getRealm(realmName).repositories.identities;
 	}
-	sessionRepository(userRealmName = DEFAULT_USER_REALM_NAME) {
-		return this.getRealm(userRealmName).repositories.sessions;
+	sessionRepository(realmName = DEFAULT_USER_REALM_NAME) {
+		return this.getRealm(realmName).repositories.sessions;
 	}
-	userRepository(userRealmName = DEFAULT_USER_REALM_NAME) {
-		return this.getRealm(userRealmName).repositories.users;
+	userRepository(realmName = DEFAULT_USER_REALM_NAME) {
+		return this.getRealm(realmName).repositories.users;
 	}
 };
 
@@ -240,10 +241,10 @@ var UserRealmProvider = class {
 //#region ../../src/api/users/services/IdentityService.ts
 var IdentityService = class {
 	log = $logger();
-	userRealmProvider = $inject(UserRealmProvider);
+	realmProvider = $inject(RealmProvider);
 	auditService = $inject(AuditService);
 	identities(userRealmName) {
-		return this.userRealmProvider.identityRepository(userRealmName);
+		return this.realmProvider.identityRepository(userRealmName);
 	}
 	/**
 	* Find identities with pagination and filtering.
@@ -295,7 +296,7 @@ var IdentityService = class {
 			provider: identity.provider,
 			userId: identity.userId
 		});
-		const realm = this.userRealmProvider.getRealm(userRealmName);
+		const realm = this.realmProvider.getRealm(userRealmName);
 		await this.auditService.recordUser("update", {
 			userRealm: realm.name,
 			resourceId: identity.userId,
@@ -398,9 +399,9 @@ const sessionResourceSchema = t.object({
 //#region ../../src/api/users/services/SessionCrudService.ts
 var SessionCrudService = class {
 	log = $logger();
-	userRealmProvider = $inject(UserRealmProvider);
+	realmProvider = $inject(RealmProvider);
 	sessions(userRealmName) {
-		return this.userRealmProvider.sessionRepository(userRealmName);
+		return this.realmProvider.sessionRepository(userRealmName);
 	}
 	/**
 	* Find sessions with pagination and filtering.
@@ -672,10 +673,10 @@ var UserService = class {
 	log = $logger();
 	verificationController = $client();
 	userNotifications = $inject(UserNotifications);
-	userRealmProvider = $inject(UserRealmProvider);
+	realmProvider = $inject(RealmProvider);
 	auditService = $inject(AuditService);
 	users(userRealmName) {
-		return this.userRealmProvider.userRepository(userRealmName);
+		return this.realmProvider.userRepository(userRealmName);
 	}
 	/**
 	* Request email verification for a user.
@@ -779,7 +780,7 @@ var UserService = class {
 			userId: user.id,
 			type
 		});
-		const realm = this.userRealmProvider.getRealm(userRealmName);
+		const realm = this.realmProvider.getRealm(userRealmName);
 		await this.auditService.recordUser("update", {
 			userId: user.id,
 			userEmail: email,
@@ -843,7 +844,7 @@ var UserService = class {
 			email: data.email,
 			userRealmName
 		});
-		const realm = this.userRealmProvider.getRealm(userRealmName);
+		const realm = this.realmProvider.getRealm(userRealmName);
 		if (data.username) {
 			if (await this.users(userRealmName).findOne({ where: { username: { eq: data.username } } }).catch(() => void 0)) {
 				this.log.debug("Username already taken", { username: data.username });
@@ -895,7 +896,7 @@ var UserService = class {
 		const before = await this.getUserById(id, userRealmName);
 		const user = await this.users(userRealmName).updateById(id, data);
 		this.log.debug("User updated", { userId: id });
-		const realm = this.userRealmProvider.getRealm(userRealmName);
+		const realm = this.realmProvider.getRealm(userRealmName);
 		const changes = {};
 		for (const key of Object.keys(data)) if (data[key] !== void 0 && before[key] !== data[key]) changes[key] = {
 			from: before[key],
@@ -921,7 +922,7 @@ var UserService = class {
 		const user = await this.getUserById(id, userRealmName);
 		await this.users(userRealmName).deleteById(id);
 		this.log.info("User deleted", { userId: id });
-		const realm = this.userRealmProvider.getRealm(userRealmName);
+		const realm = this.realmProvider.getRealm(userRealmName);
 		await this.auditService.recordUser("delete", {
 			userRealm: realm.name,
 			resourceId: id,
@@ -1025,6 +1026,67 @@ var AdminUserController = class {
 	});
 };
 
+//#endregion
+//#region ../../src/api/users/schemas/realmConfigSchema.ts
+const realmConfigSchema = t.object({
+	settings: realmAuthSettingsAtom.schema,
+	realmName: t.string(),
+	authenticationMethods: t.array(authenticationProviderSchema)
+});
+
+//#endregion
+//#region ../../src/api/users/controllers/RealmController.ts
+/**
+* Controller for exposing realm configuration.
+* Uses $route instead of $action to keep endpoints hidden from API documentation.
+*/
+var RealmController = class {
+	url = "/realms";
+	group = "realms";
+	realmProvider = $inject(RealmProvider);
+	serverAuthProvider = $inject(ServerAuthProvider);
+	/**
+	* Get realm configuration settings.
+	* This endpoint is not exposed in the API documentation.
+	*/
+	getRealmConfig = $action({
+		group: this.group,
+		method: "GET",
+		path: `${this.url}/config`,
+		secure: false,
+		cache: {
+			etag: true,
+			control: { maxAge: [24, "hours"] }
+		},
+		schema: {
+			query: t.object({ realmName: t.optional(t.string()) }),
+			response: realmConfigSchema
+		},
+		handler: ({ query }) => {
+			const { name: realmName, settings } = this.realmProvider.getRealm(query.realmName);
+			return {
+				settings,
+				realmName,
+				authenticationMethods: this.serverAuthProvider.getAuthenticationProviders({ realmName })
+			};
+		}
+	});
+	checkUsernameAvailability = $action({
+		group: this.group,
+		path: `${this.url}/check-username`,
+		secure: false,
+		schema: {
+			query: t.object({ realmName: t.optional(t.text()) }),
+			body: t.object({ username: t.text() }),
+			response: t.object({ available: t.boolean() })
+		},
+		handler: async ({ query, body }) => {
+			const realmName = query.realmName;
+			return { available: !await this.realmProvider.userRepository(realmName).findOne({ where: { username: { eq: body.username } } }).catch(() => void 0) };
+		}
+	});
+};
+
 //#endregion
 //#region ../../src/api/users/schemas/completePasswordResetRequestSchema.ts
 /**
@@ -1116,20 +1178,20 @@ var CredentialService = class {
 	dateTimeProvider = $inject(DateTimeProvider);
 	verificationController = $client();
 	userNotifications = $inject(UserNotifications);
-	userRealmProvider = $inject(UserRealmProvider);
+	realmProvider = $inject(RealmProvider);
 	auditService = $inject(AuditService);
 	intentCache = $cache({
 		name: "password-reset-intents",
 		ttl: [INTENT_TTL_MINUTES$1, "minutes"]
 	});
 	users(userRealmName) {
-		return this.userRealmProvider.userRepository(userRealmName);
+		return this.realmProvider.userRepository(userRealmName);
 	}
 	sessions(userRealmName) {
-		return this.userRealmProvider.sessionRepository(userRealmName);
+		return this.realmProvider.sessionRepository(userRealmName);
 	}
 	identities(userRealmName) {
-		return this.userRealmProvider.identityRepository(userRealmName);
+		return this.realmProvider.identityRepository(userRealmName);
 	}
 	/**
 	* Phase 1: Create a password reset intent.
@@ -1246,7 +1308,7 @@ var CredentialService = class {
 			userId: intent.userId,
 			email: intent.email
 		});
-		const realm = this.userRealmProvider.getRealm(intent.realmName);
+		const realm = this.realmProvider.getRealm(intent.realmName);
 		await this.auditService.recordUser("update", {
 			userId: intent.userId,
 			userEmail: intent.email,
@@ -1305,7 +1367,7 @@ var CredentialService = class {
 		const hashedPassword = await this.cryptoProvider.hashPassword(newPassword);
 		await this.identities(userRealmName).updateById(identity.id, { password: hashedPassword });
 		await this.sessions(userRealmName).deleteMany({ userId: { eq: user.id } });
-		const realm = this.userRealmProvider.getRealm(userRealmName);
+		const realm = this.realmProvider.getRealm(userRealmName);
 		await this.auditService.recordUser("update", {
 			userId: user.id,
 			userEmail: email,
@@ -1334,7 +1396,7 @@ var RegistrationService = class {
 	cryptoProvider = $inject(CryptoProvider);
 	verificationController = $client();
 	userNotifications = $inject(UserNotifications);
-	userRealmProvider = $inject(UserRealmProvider);
+	realmProvider = $inject(RealmProvider);
 	auditService = $inject(AuditService);
 	intentCache = $cache({
 		name: "registration-intents",
@@ -1352,8 +1414,7 @@ var RegistrationService = class {
 			username: body.username,
 			userRealmName
 		});
-		const realmSettings = this.userRealmProvider.getRealm(userRealmName).settings;
-		this.userRealmProvider.userRepository(userRealmName);
+		const realmSettings = this.realmProvider.getRealm(userRealmName).settings;
 		if (realmSettings?.registrationAllowed === false) {
 			this.log.warn("Registration not allowed for realm", { userRealmName });
 			throw new BadRequestError("Registration is not allowed");
@@ -1362,6 +1423,18 @@ var RegistrationService = class {
 			this.log.debug("Registration rejected: username required", { userRealmName });
 			throw new BadRequestError("Username is required");
 		}
+		if (body.username) {
+			const usernameRegExp = realmSettings?.usernameRegExp;
+			if (usernameRegExp) {
+				if (!new RegExp(usernameRegExp).test(body.username)) {
+					this.log.debug("Registration rejected: username regex mismatch", {
+						userRealmName,
+						username: body.username
+					});
+					throw new BadRequestError("Username does not meet the required format");
+				}
+			}
+		}
 		if (realmSettings?.emailRequired !== false && !body.email) {
 			this.log.debug("Registration rejected: email required", { userRealmName });
 			throw new BadRequestError("Email is required");
@@ -1428,8 +1501,8 @@ var RegistrationService = class {
 			});
 		}
 		const userRealmName = intent.realmName;
-		const userRepository = this.userRealmProvider.userRepository(userRealmName);
-		const identityRepository = this.userRealmProvider.identityRepository(userRealmName);
+		const userRepository = this.realmProvider.userRepository(userRealmName);
+		const identityRepository = this.realmProvider.identityRepository(userRealmName);
 		if (intent.requirements.email) {
 			if (!body.emailCode) {
 				this.log.debug("Registration completion missing email code", { intentId: body.intentId });
@@ -1477,7 +1550,7 @@ var RegistrationService = class {
 			email: user.email,
 			username: user.username
 		});
-		const realm = this.userRealmProvider.getRealm(userRealmName);
+		const realm = this.realmProvider.getRealm(userRealmName);
 		await this.auditService.recordUser("create", {
 			userId: user.id,
 			userEmail: user.email ?? void 0,
@@ -1497,7 +1570,7 @@ var RegistrationService = class {
 	* Check if username, email, and phone are available.
 	*/
 	async checkUserAvailability(body, userRealmName) {
-		const userRepository = this.userRealmProvider.userRepository(userRealmName);
+		const userRepository = this.realmProvider.userRepository(userRealmName);
 		if (body.username) {
 			if (await userRepository.findOne({ where: { username: { eq: body.username } } }).catch(() => void 0)) {
 				this.log.debug("Username already taken", { username: body.username });
@@ -1522,23 +1595,19 @@ var RegistrationService = class {
 	*/
 	async sendEmailVerification(email) {
 		this.log.debug("Sending email verification code", { email });
-		try {
-			const verification = await this.verificationController.requestVerificationCode({
-				params: { type: "code" },
-				body: { target: email }
-			});
-			await this.userNotifications.emailVerification.push({
-				contact: email,
-				variables: {
-					email,
-					code: verification.token,
-					expiresInMinutes: Math.floor(verification.codeExpiration / 60)
-				}
-			});
-			this.log.debug("Email verification code sent", { email });
-		} catch (error) {
-			this.log.warn("Failed to send email verification code", error);
-		}
+		const verification = await this.verificationController.requestVerificationCode({
+			params: { type: "code" },
+			body: { target: email }
+		});
+		await this.userNotifications.emailVerification.push({
+			contact: email,
+			variables: {
+				email,
+				code: verification.token,
+				expiresInMinutes: Math.floor(verification.codeExpiration / 60)
+			}
+		});
+		this.log.debug("Email verification code sent", { email });
 	}
 	/**
 	* Send phone verification code.
@@ -1831,67 +1900,6 @@ var UserController = class {
 	});
 };
 
-//#endregion
-//#region ../../src/api/users/schemas/userRealmConfigSchema.ts
-const userRealmConfigSchema = t.object({
-	settings: realmAuthSettingsAtom.schema,
-	realmName: t.string(),
-	authenticationMethods: t.array(authenticationProviderSchema)
-});
-
-//#endregion
-//#region ../../src/api/users/controllers/UserRealmController.ts
-/**
-* Controller for exposing realm configuration.
-* Uses $route instead of $action to keep endpoints hidden from API documentation.
-*/
-var UserRealmController = class {
-	url = "/realms";
-	group = "realms";
-	userRealmProvider = $inject(UserRealmProvider);
-	serverAuthProvider = $inject(ServerAuthProvider);
-	/**
-	* Get realm configuration settings.
-	* This endpoint is not exposed in the API documentation.
-	*/
-	getRealmConfig = $action({
-		group: this.group,
-		method: "GET",
-		path: `${this.url}/config`,
-		secure: false,
-		cache: {
-			etag: true,
-			control: { maxAge: [24, "hours"] }
-		},
-		schema: {
-			query: t.object({ userRealmName: t.optional(t.string()) }),
-			response: userRealmConfigSchema
-		},
-		handler: ({ query }) => {
-			const { name: realmName, settings } = this.userRealmProvider.getRealm(query.userRealmName);
-			return {
-				settings,
-				realmName,
-				authenticationMethods: this.serverAuthProvider.getAuthenticationProviders({ realmName })
-			};
-		}
-	});
-	checkUsernameAvailability = $action({
-		group: this.group,
-		path: `${this.url}/check-username`,
-		secure: false,
-		schema: {
-			query: t.object({ userRealmName: t.optional(t.text()) }),
-			body: t.object({ username: t.text() }),
-			response: t.object({ available: t.boolean() })
-		},
-		handler: async ({ query, body }) => {
-			const realmName = query.userRealmName;
-			return { available: !await this.userRealmProvider.userRepository(realmName).findOne({ where: { username: { eq: body.username } } }).catch(() => void 0) };
-		}
-	});
-};
-
 //#endregion
 //#region ../../src/api/users/services/SessionService.ts
 var SessionService = class {
@@ -1900,17 +1908,17 @@ var SessionService = class {
 	dateTimeProvider = $inject(DateTimeProvider);
 	cryptoProvider = $inject(CryptoProvider);
 	log = $logger();
-	userRealmProvider = $inject(UserRealmProvider);
+	realmProvider = $inject(RealmProvider);
 	fileController = $client();
 	auditService = $inject(AuditService);
 	users(userRealmName) {
-		return this.userRealmProvider.userRepository(userRealmName);
+		return this.realmProvider.userRepository(userRealmName);
 	}
 	sessions(userRealmName) {
-		return this.userRealmProvider.sessionRepository(userRealmName);
+		return this.realmProvider.sessionRepository(userRealmName);
 	}
 	identities(userRealmName) {
-		return this.userRealmProvider.identityRepository(userRealmName);
+		return this.realmProvider.identityRepository(userRealmName);
 	}
 	/**
 	* Random delay to prevent timing attacks (50-200ms)
@@ -1923,18 +1931,37 @@ var SessionService = class {
 	* Validate user credentials and return the user if valid.
 	*/
 	async login(provider, username, password, userRealmName) {
-		const { settings, name } = this.userRealmProvider.getRealm(userRealmName);
+		const { settings, name } = this.realmProvider.getRealm(userRealmName);
 		const isEmail = username.includes("@");
 		const isPhone = /^[+\d][\d\s()-]+$/.test(username);
 		const isUsername = !isEmail && !isPhone;
-		const identities$1 = this.identities(userRealmName);
-		const users$1 = this.users(userRealmName);
+		const identities = this.identities(userRealmName);
+		const users = this.users(userRealmName);
 		await this.randomDelay();
 		try {
-			const where = users$1.createQueryWhere();
+			const where = users.createQueryWhere();
 			where.realm = name;
-			if (settings.usernameEnabled !== false && isUsername) where.username = username;
-			else if (settings.emailEnabled !== false && isEmail) where.email = username;
+			if (settings.usernameEnabled !== false && isUsername) {
+				if (settings.usernameRegExp) {
+					if (!new RegExp(settings.usernameRegExp).test(username)) {
+						this.log.warn("Username does not match required format", {
+							provider,
+							username,
+							realm: name
+						});
+						await this.auditService.recordAuth("login_failed", {
+							userRealm: name,
+							description: "Username does not match required format",
+							metadata: {
+								provider,
+								username
+							}
+						});
+						throw new InvalidCredentialsError();
+					}
+				}
+				where.username = username;
+			} else if (settings.emailEnabled !== false && isEmail) where.email = username;
 			else if (settings.phoneEnabled === true && isPhone) where.phoneNumber = username;
 			else {
 				this.log.warn("Invalid login identifier format", {
@@ -1952,7 +1979,7 @@ var SessionService = class {
 				});
 				throw new InvalidCredentialsError();
 			}
-			const user = await users$1.findOne({ where }).catch(() => void 0);
+			const user = await users.findOne({ where }).catch(() => void 0);
 			if (!user) {
 				this.log.warn("User not found during login attempt", {
 					provider,
@@ -1969,7 +1996,7 @@ var SessionService = class {
 				});
 				throw new InvalidCredentialsError();
 			}
-			const identity = await identities$1.findOne({ where: {
+			const identity = await identities.findOne({ where: {
 				provider: { eq: provider },
 				userId: { eq: user.id }
 			} });
@@ -2061,14 +2088,6 @@ var SessionService = class {
 			sessionId: session.id,
 			userId: session.userId
 		});
-		const { name } = this.userRealmProvider.getRealm(userRealmName);
-		await this.auditService.recordAuth("token_refresh", {
-			userId: user.id,
-			userEmail: user.email ?? void 0,
-			userRealm: name,
-			sessionId: session.id,
-			description: "Session token refreshed"
-		});
 		return {
 			user,
 			expiresIn: expiresAt.unix() - now.unix(),
@@ -2081,7 +2100,7 @@ var SessionService = class {
 		await this.sessions(userRealmName).deleteOne({ refreshToken });
 		this.log.debug("Session deleted");
 		if (session) {
-			const { name } = this.userRealmProvider.getRealm(userRealmName);
+			const { name } = this.realmProvider.getRealm(userRealmName);
 			await this.auditService.recordAuth("logout", {
 				userId: session.userId,
 				userRealm: name,
@@ -2096,10 +2115,10 @@ var SessionService = class {
 			profileSub: profile.sub,
 			email: profile.email
 		});
-		const realm = this.userRealmProvider.getRealm(userRealmName);
-		const identities$1 = this.identities(userRealmName);
-		const users$1 = this.users(userRealmName);
-		const identity = await identities$1.findOne({ where: {
+		const realm = this.realmProvider.getRealm(userRealmName);
+		const identities = this.identities(userRealmName);
+		const users = this.users(userRealmName);
+		const identity = await identities.findOne({ where: {
 			provider,
 			providerUserId: profile.sub
 		} }).catch(() => void 0);
@@ -2109,19 +2128,19 @@ var SessionService = class {
 				identityId: identity.id,
 				userId: identity.userId
 			});
-			const user$1 = await users$1.findById(identity.userId);
+			const user = await users.findById(identity.userId);
 			await this.auditService.recordAuth("login", {
-				userId: user$1.id,
-				userEmail: user$1.email ?? void 0,
+				userId: user.id,
+				userEmail: user.email ?? void 0,
 				userRealm: realm.name,
-				resourceId: user$1.id,
+				resourceId: user.id,
 				description: `User logged in via OAuth2 (${provider})`,
 				metadata: {
 					provider,
 					providerUserId: profile.sub
 				}
 			});
-			return user$1;
+			return user;
 		}
 		if (!profile.email) {
 			this.log.debug("OAuth2 profile has no email, returning profile as-is", {
@@ -2133,7 +2152,7 @@ var SessionService = class {
 				...profile
 			};
 		}
-		const existing = await users$1.findOne({ where: { email: profile.email } }).catch(() => void 0);
+		const existing = await users.findOne({ where: { email: profile.email } }).catch(() => void 0);
 		if (existing) {
 			this.log.debug("Linking OAuth2 profile to existing user by email", {
 				provider,
@@ -2141,7 +2160,7 @@ var SessionService = class {
 				userId: existing.id,
 				email: profile.email
 			});
-			await identities$1.create({
+			await identities.create({
 				provider,
 				providerUserId: profile.sub,
 				userId: existing.id
@@ -2160,7 +2179,7 @@ var SessionService = class {
 			});
 			return existing;
 		}
-		const user = await users$1.create({
+		const user = await users.create({
 			realm: realm.name,
 			username: profile.email.split("@")[0],
 			email: profile.email,
@@ -2177,7 +2196,7 @@ var SessionService = class {
 				const file = this.fsp.createFile({ response });
 				if (response.ok && response.body) {
 					const fileEntity = await this.fileController.uploadFile({ body: { file } }, { user });
-					await users$1.updateById(user.id, { picture: fileEntity.id });
+					await users.updateById(user.id, { picture: fileEntity.id });
 				}
 			} catch (error) {
 				this.log.warn("Failed to fetch user profile picture", error);
@@ -2224,7 +2243,7 @@ var SessionService = class {
 };
 
 //#endregion
-//#region ../../src/api/users/primitives/$userRealm.ts
+//#region ../../src/api/users/primitives/$realm.ts
 /**
 * Already configured realm for user management.
 *
@@ -2238,24 +2257,24 @@ var SessionService = class {
 * Environment Variables:
 * - `APP_SECRET`: Secret key for signing tokens (if not provided in options).
 */
-const $userRealm = (options = {}) => {
+const $realm = (options = {}) => {
 	const { alepha } = $context();
 	const sessionService = alepha.inject(SessionService);
 	const securityProvider = alepha.inject(SecurityProvider);
-	const userRealmProvider = alepha.inject(UserRealmProvider);
-	const name = options.realm?.name ?? DEFAULT_USER_REALM_NAME;
+	const realmProvider = alepha.inject(RealmProvider);
+	const name = options.issuer?.name ?? DEFAULT_USER_REALM_NAME;
 	options.settings ??= {};
 	if (options.settings.emailRequired) options.settings.emailEnabled = true;
 	if (options.settings.usernameRequired) options.settings.usernameEnabled = true;
 	if (options.settings.phoneRequired) options.settings.phoneEnabled = true;
-	const userRealm = userRealmProvider.register(name, options);
+	const realmRegistration = realmProvider.register(name, options);
 	alepha.with(AlephaApiFiles);
 	alepha.with(AlephaApiAudits);
-	const realm = $realm({
-		...options.realm,
+	const realm = $issuer({
+		...options.issuer,
 		name,
 		secret: options.secret ?? securityProvider.secretKey,
-		roles: options.realm?.roles ?? [{
+		roles: options.issuer?.roles ?? [{
 			name: "admin",
 			permissions: [{ name: "*" }]
 		}, {
@@ -2278,24 +2297,24 @@ const $userRealm = (options = {}) => {
 			onDeleteSession: async (refreshToken) => {
 				await sessionService.deleteSession(refreshToken);
 			},
-			...options.realm?.settings
+			...options.issuer?.settings
 		}
 	});
-	realm.link = (name$1) => {
-		return (ctx) => sessionService.link(name$1, ctx.user, realm.name);
+	realm.link = (name) => {
+		return (ctx) => sessionService.link(name, ctx.user, realm.name);
 	};
-	realm.login = (name$1) => {
+	realm.login = (name) => {
 		return (credentials) => {
-			return sessionService.login(name$1, credentials.username, credentials.password, realm.name);
+			return sessionService.login(name, credentials.username, credentials.password, realm.name);
 		};
 	};
-	const identities$1 = options.identities ?? { credentials: true };
-	if (identities$1) {
+	const identities = options.identities ?? { credentials: true };
+	if (identities) {
 		const auth = {};
-		if (identities$1.credentials) auth.credentials = $authCredentials(realm);
-		else userRealm.settings.registrationAllowed = false;
-		if (identities$1.google) auth.google = $authGoogle(realm);
-		if (identities$1.github) auth.github = $authGithub(realm);
+		if (identities.credentials) auth.credentials = $authCredentials(realm);
+		else realmRegistration.settings.registrationAllowed = false;
+		if (identities.google) auth.google = $authGoogle(realm);
+		if (identities.github) auth.github = $authGithub(realm);
 		alepha.with(() => auth);
 	}
 	return realm;
@@ -2376,7 +2395,7 @@ const AlephaApiUsers = $module({
 		AlephaServerHelmet,
 		AlephaServerCompress,
 		AlephaEmail,
-		UserRealmProvider,
+		RealmProvider,
 		SessionService,
 		SessionCrudService,
 		CredentialService,
@@ -2387,11 +2406,11 @@ const AlephaApiUsers = $module({
 		AdminUserController,
 		AdminSessionController,
 		AdminIdentityController,
-		UserRealmController,
+		RealmController,
 		UserNotifications
 	]
 });
 
 //#endregion
-export { $userRealm, AdminIdentityController, AdminSessionController, AdminUserController, AlephaApiUsers, CredentialService, DEFAULT_USER_REALM_NAME, IdentityService, RegistrationService, SessionCrudService, SessionService, UserController, UserRealmController, UserRealmProvider, UserService, completePasswordResetRequestSchema, completeRegistrationRequestSchema, createUserSchema, identities, identityQuerySchema, identityResourceSchema, loginSchema, passwordResetIntentResponseSchema, realmAuthSettingsAtom, registerSchema, registrationIntentResponseSchema, resetPasswordRequestSchema, resetPasswordSchema, sessionQuerySchema, sessionResourceSchema, sessions, updateUserSchema, userQuerySchema, userRealmConfigSchema, userResourceSchema, users };
+export { $realm, AdminIdentityController, AdminSessionController, AdminUserController, AlephaApiUsers, CredentialService, DEFAULT_USER_REALM_NAME, IdentityService, RealmController, RealmProvider, RegistrationService, SessionCrudService, SessionService, UserController, UserService, completePasswordResetRequestSchema, completeRegistrationRequestSchema, createUserSchema, identities, identityQuerySchema, identityResourceSchema, loginSchema, passwordResetIntentResponseSchema, realmAuthSettingsAtom, realmConfigSchema, registerSchema, registrationIntentResponseSchema, resetPasswordRequestSchema, resetPasswordSchema, sessionQuerySchema, sessionResourceSchema, sessions, updateUserSchema, userQuerySchema, userResourceSchema, users };
 //# sourceMappingURL=index.js.map