alepha 0.15.3 → 0.15.5

package/dist/api/users/index.js

@@ -1,15 +1,13 @@
 import { $atom, $context, $inject, $module, Alepha, AlephaError, Json, isFileLike, t } from "alepha";
-import { $notification, AlephaApiNotifications } from "alepha/api/notifications";
-import { AlephaApiVerification } from "alepha/api/verifications";
 import { AlephaEmail } from "alepha/email";
 import { AlephaServerCompress } from "alepha/server/compress";
 import { AlephaServerHelmet } from "alepha/server/helmet";
 import { $action, BadRequestError, ConflictError, ForbiddenError, HttpError, NotFoundError, UnauthorizedError, okSchema } from "alepha/server";
 import { $entity, $repository, db, pageQuerySchema, parseQueryString, sql } from "alepha/orm";
-import { AlephaApiAudits, AuditService } from "alepha/api/audits";
 import { $logger } from "alepha/logger";
-import { $bucket } from "alepha/bucket";
+import { AuditService } from "alepha/api/audits";
 import { $client } from "alepha/server/links";
+import { $notification } from "alepha/api/notifications";
 import { $authCredentials, $authGithub, $authGoogle, ServerAuthProvider, authenticationProviderSchema } from "alepha/server/auth";
 import { createHash, randomBytes, randomInt, randomUUID } from "node:crypto";
 import { $cache } from "alepha/cache";
@@ -21,8 +19,10 @@ import { access, copyFile, cp, mkdir, readFile, readdir, rename, rm, stat, write
 import { PassThrough, Readable } from "node:stream";
 import { fileURLToPath } from "node:url";
 import { exec, spawn } from "node:child_process";
-import { AlephaApiFiles } from "alepha/api/files";
-import { AlephaApiJobs } from "alepha/api/jobs";
+import { AlephaApiVerification } from "alepha/api/verifications";
+import { $bucket } from "alepha/bucket";
+import { $job } from "alepha/api/jobs";
+import { $config } from "alepha/api/parameters";
 
 //#region ../../src/api/users/schemas/identityQuerySchema.ts
 const identityQuerySchema = t.extend(pageQuerySchema, {
@@ -112,6 +112,8 @@ const realmAuthSettingsAtom = $atom({
 		firstNameLastNameEnabled: t.boolean({ description: "Enable first and last name for user accounts" }),
 		firstNameLastNameRequired: t.boolean({ description: "Require first and last name for user accounts" }),
 		resetPasswordAllowed: t.boolean({ description: "Enable forgot password functionality" }),
+		adminEmails: t.array(t.email(), { description: "List of email addresses that are automatically promoted to admin role on login" }),
+		adminUsernames: t.array(t.text(), { description: "List of usernames that are automatically promoted to admin role on login" }),
 		passwordPolicy: t.object({
 			minLength: t.integer({
 				description: "Minimum password length",
@@ -138,6 +140,8 @@ const realmAuthSettingsAtom = $atom({
 		resetPasswordAllowed: false,
 		firstNameLastNameEnabled: false,
 		firstNameLastNameRequired: false,
+		adminEmails: [],
+		adminUsernames: [],
 		passwordPolicy: {
 			minLength: 8,
 			requireUppercase: true,
@@ -181,16 +185,17 @@ var RealmProvider = class {
 	defaultSessions = $repository(sessions);
 	defaultUsers = $repository(users);
 	realms = /* @__PURE__ */ new Map();
-	avatars = $bucket({
-		maxSize: 5 * 1024 * 1024,
-		mimeTypes: [
-			"image/jpeg",
-			"image/png",
-			"image/gif",
-			"image/webp"
-		]
-	});
 	register(realmName, realmOptions = {}) {
+		const features = {
+			jobs: false,
+			notifications: false,
+			apiKeys: false,
+			parameters: false,
+			files: false,
+			audits: false,
+			organizations: false,
+			...realmOptions.features
+		};
 		this.realms.set(realmName, {
 			name: realmName,
 			repositories: {
@@ -205,7 +210,8 @@ var RealmProvider = class {
 					...realmAuthSettingsAtom.options.default.passwordPolicy,
 					...realmOptions.settings?.passwordPolicy
 				}
-			}
+			},
+			features
 		});
 		return this.getRealm(realmName);
 	}
@@ -233,12 +239,45 @@ var RealmProvider = class {
 	}
 };
 
+//#endregion
+//#region ../../src/api/users/services/UserAudits.ts
+/**
+* User-specific audit wrapper service.
+*
+* This service wraps the core AuditService to provide user-related audit logging.
+* It is lazy-loaded when the `audits` feature is enabled in the realm.
+*/
+var UserAudits = class {
+	auditService = $inject(AuditService);
+	/**
+	* Record a user-related audit event.
+	*/
+	recordUser(action, context) {
+		return this.auditService.recordUser(action, context);
+	}
+	/**
+	* Record an authentication-related audit event.
+	*/
+	recordAuth(action, context) {
+		return this.auditService.recordAuth(action, context);
+	}
+	/**
+	* Record a generic audit event.
+	*/
+	record(category, action, context) {
+		return this.auditService.record(category, action, context);
+	}
+};
+
 //#endregion
 //#region ../../src/api/users/services/IdentityService.ts
 var IdentityService = class {
+	alepha = $inject(Alepha);
 	log = $logger();
 	realmProvider = $inject(RealmProvider);
-	auditService = $inject(AuditService);
+	userAudits(realmName) {
+		if (this.realmProvider.getRealm(realmName).features.audits) return this.alepha.inject(UserAudits);
+	}
 	identities(userRealmName) {
 		return this.realmProvider.identityRepository(userRealmName);
 	}
@@ -293,7 +332,7 @@ var IdentityService = class {
 			userId: identity.userId
 		});
 		const realm = this.realmProvider.getRealm(userRealmName);
-		await this.auditService.recordUser("update", {
+		await this.userAudits(userRealmName)?.recordUser("update", {
 			userRealm: realm.name,
 			resourceId: identity.userId,
 			description: `Identity provider disconnected: ${identity.provider}`,
@@ -318,6 +357,7 @@ var AdminIdentityController = class {
 	findIdentities = $action({
 		path: this.url,
 		group: this.group,
+		secure: true,
 		description: "Find identities with pagination and filtering",
 		schema: {
 			query: t.extend(identityQuerySchema, { userRealmName: t.optional(t.string()) }),
@@ -334,6 +374,7 @@ var AdminIdentityController = class {
 	getIdentity = $action({
 		path: `${this.url}/:id`,
 		group: this.group,
+		secure: true,
 		description: "Get an identity by ID",
 		schema: {
 			params: t.object({ id: t.uuid() }),
@@ -349,6 +390,7 @@ var AdminIdentityController = class {
 		method: "DELETE",
 		path: `${this.url}/:id`,
 		group: this.group,
+		secure: true,
 		description: "Delete an identity",
 		schema: {
 			params: t.object({ id: t.uuid() }),
@@ -458,6 +500,7 @@ var AdminSessionController = class {
 	findSessions = $action({
 		path: this.url,
 		group: this.group,
+		secure: true,
 		description: "Find sessions with pagination and filtering",
 		schema: {
 			query: t.extend(sessionQuerySchema, { userRealmName: t.optional(t.string()) }),
@@ -474,6 +517,7 @@ var AdminSessionController = class {
 	getSession = $action({
 		path: `${this.url}/:id`,
 		group: this.group,
+		secure: true,
 		description: "Get a session by ID",
 		schema: {
 			params: t.object({ id: t.uuid() }),
@@ -489,6 +533,7 @@ var AdminSessionController = class {
 		method: "DELETE",
 		path: `${this.url}/:id`,
 		group: this.group,
+		secure: true,
 		description: "Delete a session",
 		schema: {
 			params: t.object({ id: t.uuid() }),
@@ -535,7 +580,7 @@ const userQuerySchema = t.extend(pageQuerySchema, {
 const userResourceSchema = users.schema;
 
 //#endregion
-//#region ../../src/api/users/notifications/UserNotifications.ts
+//#region ../../src/api/users/services/UserNotifications.ts
 var UserNotifications = class {
 	passwordReset = $notification({
 		category: "security",
@@ -666,11 +711,16 @@ var UserNotifications = class {
 //#endregion
 //#region ../../src/api/users/services/UserService.ts
 var UserService = class {
+	alepha = $inject(Alepha);
 	log = $logger();
 	verificationController = $client();
-	userNotifications = $inject(UserNotifications);
 	realmProvider = $inject(RealmProvider);
-	auditService = $inject(AuditService);
+	userAudits(realmName) {
+		if (this.realmProvider.getRealm(realmName).features.audits) return this.alepha.inject(UserAudits);
+	}
+	userNotifications(realmName) {
+		if (this.realmProvider.getRealm(realmName).features.notifications) return this.alepha.inject(UserNotifications);
+	}
 	users(userRealmName) {
 		return this.realmProvider.userRepository(userRealmName);
 	}
@@ -709,7 +759,7 @@ var UserService = class {
 				url.searchParams.set("email", email);
 				url.searchParams.set("token", verification.token);
 				const fullVerifyUrl = verifyUrl ? `${verifyUrl}${url.search}` : url.pathname + url.search;
-				await this.userNotifications.emailVerificationLink.push({
+				await this.userNotifications(userRealmName)?.emailVerificationLink.push({
 					contact: email,
 					variables: {
 						email,
@@ -722,7 +772,7 @@ var UserService = class {
 					userId: user.id
 				});
 			} else {
-				await this.userNotifications.emailVerification.push({
+				await this.userNotifications(userRealmName)?.emailVerification.push({
 					contact: email,
 					variables: {
 						email,
@@ -777,7 +827,7 @@ var UserService = class {
 			type
 		});
 		const realm = this.realmProvider.getRealm(userRealmName);
-		await this.auditService.recordUser("update", {
+		await this.userAudits(userRealmName)?.recordUser("update", {
 			userId: user.id,
 			userEmail: email,
 			userRealm: realm.name,
@@ -869,7 +919,7 @@ var UserService = class {
 			username: user.username,
 			email: user.email
 		});
-		await this.auditService.recordUser("create", {
+		await this.userAudits(userRealmName)?.recordUser("create", {
 			userRealm: realm.name,
 			resourceId: user.id,
 			description: "User created",
@@ -899,7 +949,7 @@ var UserService = class {
 			to: data[key]
 		};
 		const isRoleChange = data.roles !== void 0 && JSON.stringify(before.roles) !== JSON.stringify(data.roles);
-		await this.auditService.recordUser(isRoleChange ? "role_change" : "update", {
+		await this.userAudits(userRealmName)?.recordUser(isRoleChange ? "role_change" : "update", {
 			userRealm: realm.name,
 			resourceId: user.id,
 			description: isRoleChange ? "User roles changed" : `User updated: ${Object.keys(changes).join(", ")}`,
@@ -919,7 +969,7 @@ var UserService = class {
 		await this.users(userRealmName).deleteById(id);
 		this.log.info("User deleted", { userId: id });
 		const realm = this.realmProvider.getRealm(userRealmName);
-		await this.auditService.recordUser("delete", {
+		await this.userAudits(userRealmName)?.recordUser("delete", {
 			userRealm: realm.name,
 			resourceId: id,
 			severity: "warning",
@@ -944,6 +994,7 @@ var AdminUserController = class {
 	findUsers = $action({
 		path: this.url,
 		group: this.group,
+		secure: true,
 		description: "Find users with pagination and filtering",
 		schema: {
 			query: t.extend(userQuerySchema, { userRealmName: t.optional(t.string()) }),
@@ -960,6 +1011,7 @@ var AdminUserController = class {
 	getUser = $action({
 		path: `${this.url}/:id`,
 		group: this.group,
+		secure: true,
 		description: "Get a user by ID",
 		schema: {
 			params: t.object({ id: t.uuid() }),
@@ -975,6 +1027,7 @@ var AdminUserController = class {
 		method: "POST",
 		path: this.url,
 		group: this.group,
+		secure: true,
 		description: "Create a new user",
 		schema: {
 			query: t.object({ userRealmName: t.optional(t.string()) }),
@@ -990,6 +1043,7 @@ var AdminUserController = class {
 		method: "PATCH",
 		path: `${this.url}/:id`,
 		group: this.group,
+		secure: true,
 		description: "Update a user",
 		schema: {
 			params: t.object({ id: t.uuid() }),
@@ -1006,6 +1060,7 @@ var AdminUserController = class {
 		method: "DELETE",
 		path: `${this.url}/:id`,
 		group: this.group,
+		secure: true,
 		description: "Delete a user",
 		schema: {
 			params: t.object({ id: t.uuid() }),
@@ -1169,13 +1224,18 @@ const registrationIntentResponseSchema = t.object({
 //#region ../../src/api/users/services/CredentialService.ts
 const INTENT_TTL_MINUTES$1 = 10;
 var CredentialService = class {
+	alepha = $inject(Alepha);
 	log = $logger();
 	cryptoProvider = $inject(CryptoProvider);
 	dateTimeProvider = $inject(DateTimeProvider);
 	verificationController = $client();
-	userNotifications = $inject(UserNotifications);
 	realmProvider = $inject(RealmProvider);
-	auditService = $inject(AuditService);
+	userAudits(realmName) {
+		if (this.realmProvider.getRealm(realmName).features.audits) return this.alepha.inject(UserAudits);
+	}
+	userNotifications(realmName) {
+		if (this.realmProvider.getRealm(realmName).features.notifications) return this.alepha.inject(UserNotifications);
+	}
 	intentCache = $cache({
 		name: "password-reset-intents",
 		ttl: [INTENT_TTL_MINUTES$1, "minutes"]
@@ -1230,7 +1290,7 @@ var CredentialService = class {
 				params: { type: "code" },
 				body: { target: email }
 			});
-			await this.userNotifications.passwordReset.push({
+			await this.userNotifications(userRealmName)?.passwordReset.push({
 				contact: email,
 				variables: {
 					email,
@@ -1305,7 +1365,7 @@ var CredentialService = class {
 			email: intent.email
 		});
 		const realm = this.realmProvider.getRealm(intent.realmName);
-		await this.auditService.recordUser("update", {
+		await this.userAudits(intent.realmName)?.recordUser("update", {
 			userId: intent.userId,
 			userEmail: intent.email,
 			userRealm: realm.name,
@@ -1313,7 +1373,7 @@ var CredentialService = class {
 			description: "Password reset completed",
 			metadata: { email: intent.email }
 		});
-		await this.auditService.record("security", "sessions_invalidated", {
+		await this.userAudits(intent.realmName)?.record("security", "sessions_invalidated", {
 			userId: intent.userId,
 			userEmail: intent.email,
 			userRealm: realm.name,
@@ -1364,7 +1424,7 @@ var CredentialService = class {
 		await this.identities(userRealmName).updateById(identity.id, { password: hashedPassword });
 		await this.sessions(userRealmName).deleteMany({ userId: { eq: user.id } });
 		const realm = this.realmProvider.getRealm(userRealmName);
-		await this.auditService.recordUser("update", {
+		await this.userAudits(userRealmName)?.recordUser("update", {
 			userId: user.id,
 			userEmail: email,
 			userRealm: realm.name,
@@ -1372,7 +1432,7 @@ var CredentialService = class {
 			description: "Password reset completed (legacy)",
 			metadata: { email }
 		});
-		await this.auditService.record("security", "sessions_invalidated", {
+		await this.userAudits(userRealmName)?.record("security", "sessions_invalidated", {
 			userId: user.id,
 			userEmail: email,
 			userRealm: realm.name,
@@ -1387,17 +1447,22 @@ var CredentialService = class {
 //#region ../../src/api/users/services/RegistrationService.ts
 const INTENT_TTL_MINUTES = 10;
 var RegistrationService = class {
+	alepha = $inject(Alepha);
 	log = $logger();
 	dateTimeProvider = $inject(DateTimeProvider);
 	cryptoProvider = $inject(CryptoProvider);
 	verificationController = $client();
-	userNotifications = $inject(UserNotifications);
 	realmProvider = $inject(RealmProvider);
-	auditService = $inject(AuditService);
 	intentCache = $cache({
 		name: "registration-intents",
 		ttl: [INTENT_TTL_MINUTES, "minutes"]
 	});
+	userAudits(realmName) {
+		if (this.realmProvider.getRealm(realmName).features.audits) return this.alepha.inject(UserAudits);
+	}
+	userNotifications(realmName) {
+		if (this.realmProvider.getRealm(realmName).features.notifications) return this.alepha.inject(UserNotifications);
+	}
 	/**
 	* Phase 1: Create a registration intent.
 	*
@@ -1446,8 +1511,8 @@ var RegistrationService = class {
 			phone: realmSettings?.verifyPhoneRequired === true && !!body.phoneNumber,
 			captcha: false
 		};
-		if (requirements.email && body.email) await this.sendEmailVerification(body.email);
-		if (requirements.phone && body.phoneNumber) await this.sendPhoneVerification(body.phoneNumber);
+		if (requirements.email && body.email) await this.sendEmailVerification(body.email, userRealmName);
+		if (requirements.phone && body.phoneNumber) await this.sendPhoneVerification(body.phoneNumber, userRealmName);
 		const intentId = randomUUID();
 		const expiresAt = this.dateTimeProvider.now().add(INTENT_TTL_MINUTES, "minutes").toISOString();
 		const intent = {
@@ -1547,7 +1612,7 @@ var RegistrationService = class {
 			username: user.username
 		});
 		const realm = this.realmProvider.getRealm(userRealmName);
-		await this.auditService.recordUser("create", {
+		await this.userAudits(userRealmName)?.recordUser("create", {
 			userId: user.id,
 			userEmail: user.email ?? void 0,
 			userRealm: realm.name,
@@ -1589,13 +1654,13 @@ var RegistrationService = class {
 	/**
 	* Send email verification code.
 	*/
-	async sendEmailVerification(email) {
+	async sendEmailVerification(email, realmName) {
 		this.log.debug("Sending email verification code", { email });
 		const verification = await this.verificationController.requestVerificationCode({
 			params: { type: "code" },
 			body: { target: email }
 		});
-		await this.userNotifications.emailVerification.push({
+		await this.userNotifications(realmName)?.emailVerification.push({
 			contact: email,
 			variables: {
 				email,
@@ -1608,14 +1673,14 @@ var RegistrationService = class {
 	/**
 	* Send phone verification code.
 	*/
-	async sendPhoneVerification(phoneNumber) {
+	async sendPhoneVerification(phoneNumber, realmName) {
 		this.log.debug("Sending phone verification code", { phoneNumber });
 		try {
 			const verification = await this.verificationController.requestVerificationCode({
 				params: { type: "code" },
 				body: { target: phoneNumber }
 			});
-			await this.userNotifications.phoneVerification.push({
+			await this.userNotifications(realmName)?.phoneVerification.push({
 				contact: phoneNumber,
 				variables: {
 					phoneNumber,
@@ -3699,9 +3764,9 @@ var ShellProvider = class {};
 //#endregion
 //#region ../../src/system/index.ts
 /**
-* | type | quality | stability |
-* |------|---------|-----------|
-* | tooling | standard | stable |
+* | Stability | Since | Runtime |
+* |-----------|-------|---------|
+* | 3 - stable | 0.14.0 | node, bun, browser|
 *
 * System-level abstractions for portable code across runtimes.
 *
@@ -3746,7 +3811,9 @@ var SessionService = class {
 	log = $logger();
 	realmProvider = $inject(RealmProvider);
 	fileController = $client();
-	auditService = $inject(AuditService);
+	userAudits(realmName) {
+		if (this.realmProvider.getRealm(realmName).features.audits) return this.alepha.inject(UserAudits);
+	}
 	users(userRealmName) {
 		return this.realmProvider.userRepository(userRealmName);
 	}
@@ -3757,6 +3824,40 @@ var SessionService = class {
 		return this.realmProvider.identityRepository(userRealmName);
 	}
 	/**
+	* Check if user should be auto-promoted to admin based on adminEmails/adminUsernames settings.
+	* If user matches and doesn't have admin role, promote them.
+	*/
+	async ensureAdminRole(user, userRealmName) {
+		if (user.roles.includes("admin")) return false;
+		const { settings, name } = this.realmProvider.getRealm(userRealmName);
+		const adminEmails = settings.adminEmails ?? [];
+		const adminUsernames = settings.adminUsernames ?? [];
+		const isAdminByEmail = user.email && adminEmails.includes(user.email);
+		const isAdminByUsername = user.username && adminUsernames.includes(user.username);
+		if (!isAdminByEmail && !isAdminByUsername) return false;
+		user.roles = [...user.roles.filter((r) => r !== "admin"), "admin"];
+		await this.users(userRealmName).updateById(user.id, { roles: user.roles });
+		const reason = isAdminByEmail ? "adminEmails" : "adminUsernames";
+		this.log.info(`User auto-promoted to admin via ${reason} setting`, {
+			userId: user.id,
+			email: user.email,
+			username: user.username,
+			realm: name
+		});
+		await this.userAudits(userRealmName)?.recordUser("role_change", {
+			userId: user.id,
+			userEmail: user.email ?? void 0,
+			userRealm: name,
+			resourceId: user.id,
+			description: `User auto-promoted to admin via ${reason} setting`,
+			metadata: {
+				addedRole: "admin",
+				reason
+			}
+		});
+		return true;
+	}
+	/**
 	* Random delay to prevent timing attacks (50-200ms)
 	* Uses cryptographically secure random number generation
 	*/
@@ -3785,7 +3886,7 @@ var SessionService = class {
 							username,
 							realm: name
 						});
-						await this.auditService.recordAuth("login_failed", {
+						await this.userAudits(userRealmName)?.recordAuth("login_failed", {
 							userRealm: name,
 							description: "Username does not match required format",
 							metadata: {
@@ -3805,7 +3906,7 @@ var SessionService = class {
 					username,
 					realm: name
 				});
-				await this.auditService.recordAuth("login_failed", {
+				await this.userAudits(userRealmName)?.recordAuth("login_failed", {
 					userRealm: name,
 					description: "Invalid login identifier format",
 					metadata: {
@@ -3822,7 +3923,7 @@ var SessionService = class {
 					username,
 					realm: name
 				});
-				await this.auditService.recordAuth("login_failed", {
+				await this.userAudits(userRealmName)?.recordAuth("login_failed", {
 					userRealm: name,
 					description: "User not found",
 					metadata: {
@@ -3852,7 +3953,7 @@ var SessionService = class {
 					username,
 					realm: name
 				});
-				await this.auditService.recordAuth("login_failed", {
+				await this.userAudits(userRealmName)?.recordAuth("login_failed", {
 					userRealm: name,
 					resourceId: user.id,
 					description: "Invalid password",
@@ -3863,7 +3964,7 @@ var SessionService = class {
 				});
 				throw new InvalidCredentialsError();
 			}
-			await this.auditService.recordAuth("login", {
+			await this.userAudits(userRealmName)?.recordAuth("login", {
 				userId: user.id,
 				userEmail: user.email ?? void 0,
 				userRealm: name,
@@ -3874,6 +3975,7 @@ var SessionService = class {
 					username
 				}
 			});
+			await this.ensureAdminRole(user, userRealmName);
 			return user;
 		} catch (error) {
 			if (error instanceof InvalidCredentialsError) throw error;
@@ -3920,6 +4022,7 @@ var SessionService = class {
 			throw new UnauthorizedError("Session expired");
 		}
 		const user = await this.users(userRealmName).findOne({ where: { id: { eq: session.userId } } });
+		await this.ensureAdminRole(user, userRealmName);
 		this.log.debug("Session refreshed", {
 			sessionId: session.id,
 			userId: session.userId
@@ -3937,7 +4040,7 @@ var SessionService = class {
 		this.log.debug("Session deleted");
 		if (session) {
 			const { name } = this.realmProvider.getRealm(userRealmName);
-			await this.auditService.recordAuth("logout", {
+			await this.userAudits(userRealmName)?.recordAuth("logout", {
 				userId: session.userId,
 				userRealm: name,
 				sessionId: session.id,
@@ -3965,7 +4068,7 @@ var SessionService = class {
 				userId: identity.userId
 			});
 			const user = await users.findById(identity.userId);
-			await this.auditService.recordAuth("login", {
+			await this.userAudits(userRealmName)?.recordAuth("login", {
 				userId: user.id,
 				userEmail: user.email ?? void 0,
 				userRealm: realm.name,
@@ -3976,6 +4079,7 @@ var SessionService = class {
 					providerUserId: profile.sub
 				}
 			});
+			await this.ensureAdminRole(user, userRealmName);
 			return user;
 		}
 		if (!profile.email) {
@@ -4001,7 +4105,7 @@ var SessionService = class {
 				providerUserId: profile.sub,
 				userId: existing.id
 			});
-			await this.auditService.recordAuth("login", {
+			await this.userAudits(userRealmName)?.recordAuth("login", {
 				userId: existing.id,
 				userEmail: existing.email ?? void 0,
 				userRealm: realm.name,
@@ -4013,6 +4117,7 @@ var SessionService = class {
 					linked: true
 				}
 			});
+			await this.ensureAdminRole(existing, userRealmName);
 			return existing;
 		}
 		const user = await users.create({
@@ -4049,7 +4154,7 @@ var SessionService = class {
 			email: user.email,
 			username: user.username
 		});
-		await this.auditService.recordUser("create", {
+		await this.userAudits(userRealmName)?.recordUser("create", {
 			userId: user.id,
 			userEmail: user.email ?? void 0,
 			userRealm: realm.name,
@@ -4062,7 +4167,7 @@ var SessionService = class {
 				email: user.email
 			}
 		});
-		await this.auditService.recordAuth("login", {
+		await this.userAudits(userRealmName)?.recordAuth("login", {
 			userId: user.id,
 			userEmail: user.email ?? void 0,
 			userRealm: realm.name,
@@ -4074,6 +4179,7 @@ var SessionService = class {
 				firstLogin: true
 			}
 		});
+		await this.ensureAdminRole(user, userRealmName);
 		return user;
 	}
 };
@@ -4508,9 +4614,9 @@ var ApiKeyController = class {
 //#endregion
 //#region ../../src/api/keys/index.ts
 /**
-* | type | quality | stability |
-* |------|---------|--------------|
-* | backend | good | experimental |
+* | Stability | Since | Runtime |
+* |-----------|-------|---------|
+* | 3 - stable | 0.11.0 | node, bun, workerd|
 *
 * API key management module for programmatic access.
 *
@@ -4544,6 +4650,95 @@ const AlephaApiKeys = $module({
 	]
 });
 
+//#endregion
+//#region ../../src/api/users/services/UserFiles.ts
+/**
+* User-specific file storage wrapper service.
+*
+* This service provides file storage for user-related files such as:
+* - User avatars/profile pictures
+*
+* It is lazy-loaded when the `files` feature is enabled in the realm.
+*/
+var UserFiles = class {
+	/**
+	* Bucket for user avatar storage.
+	*/
+	avatars = $bucket({
+		maxSize: 5 * 1024 * 1024,
+		mimeTypes: [
+			"image/jpeg",
+			"image/png",
+			"image/gif",
+			"image/webp"
+		]
+	});
+};
+
+//#endregion
+//#region ../../src/api/users/services/UserJobs.ts
+/**
+* User-specific jobs wrapper service.
+*
+* This service handles user-related scheduled jobs such as:
+* - Session purge (cleaning up expired sessions)
+* - Verification code cleanup
+* - Inactive user notifications
+*
+* It is lazy-loaded when the `jobs` feature is enabled in the realm.
+*/
+var UserJobs = class {
+	log = $logger();
+	dateTimeProvider = $inject(DateTimeProvider);
+	sessionRepository = $repository(sessions);
+	/**
+	* Purge expired sessions from the database.
+	*
+	* This job runs daily at 3:00 AM and removes all sessions
+	* where the `expiresAt` timestamp has passed.
+	*/
+	purgeExpiredSessions = $job({
+		name: "users.purgeExpiredSessions",
+		description: "Remove expired user sessions from the database",
+		cron: "0 3 * * *",
+		handler: async () => {
+			const now = this.dateTimeProvider.nowISOString();
+			this.log.info("Starting expired sessions purge", { cutoffTime: now });
+			const expiredSessions = await this.sessionRepository.findMany({ where: { expiresAt: { lt: now } } });
+			if (expiredSessions.length === 0) {
+				this.log.info("No expired sessions found");
+				return;
+			}
+			this.log.info("Found expired sessions", { count: expiredSessions.length });
+			const deletedIds = await this.sessionRepository.deleteMany({ expiresAt: { lt: now } });
+			this.log.info("Expired sessions purged successfully", { deletedCount: deletedIds.length });
+		}
+	});
+};
+
+//#endregion
+//#region ../../src/api/users/services/UserParameters.ts
+/**
+* User-specific configuration service.
+*
+* This service wraps the core ConfigStore to provide realm settings management.
+* It is lazy-loaded when the `parameters` feature is enabled in the realm.
+*/
+var UserParameters = class {
+	/**
+	* Realm authentication settings configuration.
+	*
+	* Controls user registration, login methods, verification requirements,
+	* and password policies for the realm.
+	*/
+	realmSettings = $config({
+		name: "alepha.api.users.realmSettings",
+		description: "Realm authentication and registration settings",
+		schema: realmAuthSettingsAtom.schema,
+		default: realmAuthSettingsAtom.options.default
+	});
+};
+
 //#endregion
 //#region ../../src/api/users/primitives/$realm.ts
 /**
@@ -4569,12 +4764,32 @@ const $realm = (options = {}) => {
 	if (options.settings.emailRequired) options.settings.emailEnabled = true;
 	if (options.settings.usernameRequired) options.settings.usernameEnabled = true;
 	if (options.settings.phoneRequired) options.settings.phoneEnabled = true;
+	const features = {
+		jobs: false,
+		notifications: false,
+		apiKeys: false,
+		parameters: false,
+		files: false,
+		audits: false,
+		organizations: false,
+		...options.features
+	};
+	if (!features.notifications) {
+		options.settings.verifyEmailRequired = false;
+		options.settings.verifyPhoneRequired = false;
+		options.settings.resetPasswordAllowed = false;
+	}
 	const realmRegistration = realmProvider.register(name, options);
-	alepha.with(AlephaApiFiles);
-	alepha.with(AlephaApiAudits);
-	alepha.with(AlephaApiJobs);
+	if (features.files) alepha.with(UserFiles);
+	if (features.audits) alepha.with(UserAudits);
+	if (features.jobs) alepha.with(UserJobs);
+	if (features.notifications) {
+		alepha.with(AlephaApiVerification);
+		alepha.with(UserNotifications);
+	}
+	if (features.parameters) alepha.with(UserParameters);
 	const customResolvers = [...options.issuer?.resolvers ?? []];
-	if (options.apiKeys) {
+	if (features.apiKeys) {
 		alepha.with(AlephaApiKeys);
 		const apiKeyService = alepha.inject(ApiKeyService);
 		customResolvers.push(apiKeyService.createResolver());
@@ -4690,9 +4905,9 @@ const resetPasswordSchema = t.object({
 //#endregion
 //#region ../../src/api/users/index.ts
 /**
-* | type | quality | stability |
-* |------|---------|-----------|
-* | backend | epic | stable |
+* | Stability | Since | Runtime |
+* |-----------|-------|---------|
+* | 3 - stable | 0.5.0 | node, bun, workerd|
 *
 * Complete user management with multi-realm support for multi-tenant applications.
 *
@@ -4711,8 +4926,6 @@ const resetPasswordSchema = t.object({
 const AlephaApiUsers = $module({
 	name: "alepha.api.users",
 	services: [
-		AlephaApiVerification,
-		AlephaApiNotifications,
 		AlephaServerHelmet,
 		AlephaServerCompress,
 		AlephaEmail,
@@ -4727,11 +4940,10 @@ const AlephaApiUsers = $module({
 		AdminUserController,
 		AdminSessionController,
 		AdminIdentityController,
-		RealmController,
-		UserNotifications
+		RealmController
 	]
 });
 
 //#endregion
-export { $realm, AdminIdentityController, AdminSessionController, AdminUserController, AlephaApiUsers, CredentialService, DEFAULT_USER_REALM_NAME, IdentityService, RealmController, RealmProvider, RegistrationService, SessionCrudService, SessionService, UserController, UserService, completePasswordResetRequestSchema, completeRegistrationRequestSchema, createUserSchema, identities, identityQuerySchema, identityResourceSchema, loginSchema, passwordResetIntentResponseSchema, realmAuthSettingsAtom, realmConfigSchema, registerSchema, registrationIntentResponseSchema, resetPasswordRequestSchema, resetPasswordSchema, sessionQuerySchema, sessionResourceSchema, sessions, updateUserSchema, userQuerySchema, userResourceSchema, users };
+export { $realm, AdminIdentityController, AdminSessionController, AdminUserController, AlephaApiUsers, CredentialService, DEFAULT_USER_REALM_NAME, IdentityService, RealmController, RealmProvider, RegistrationService, SessionCrudService, SessionService, UserAudits, UserController, UserFiles, UserJobs, UserNotifications, UserParameters, UserService, completePasswordResetRequestSchema, completeRegistrationRequestSchema, createUserSchema, identities, identityQuerySchema, identityResourceSchema, loginSchema, passwordResetIntentResponseSchema, realmAuthSettingsAtom, realmConfigSchema, registerSchema, registrationIntentResponseSchema, resetPasswordRequestSchema, resetPasswordSchema, sessionQuerySchema, sessionResourceSchema, sessions, updateUserSchema, userQuerySchema, userResourceSchema, users };
 //# sourceMappingURL=index.js.map