alepha 0.19.0 → 0.19.2

package/dist/api/users/index.js

@@ -1,23 +1,75 @@
 import { $atom, $context, $inject, $module, Alepha, AlephaError, t } from "alepha";
-import { AlephaEmail } from "alepha/email";
+import { AuditService } from "alepha/api/audits";
+import { $bucket } from "alepha/bucket";
 import { $issuer, $permission, $secure, CryptoProvider, InvalidCredentialsError, SecurityProvider } from "alepha/security";
 import { $action, BadRequestError, ConflictError, HttpError, UnauthorizedError, okSchema } from "alepha/server";
-import { $entity, $repository, db, pageQuerySchema, parseQueryString } from "alepha/orm";
+import { $entity, $repository, db, pageQuerySchema, parseQueryString, sql } from "alepha/orm";
 import { $logger } from "alepha/logger";
-import { AuditService } from "alepha/api/audits";
 import { $client } from "alepha/server/links";
 import { $notification } from "alepha/api/notifications";
 import { $authCredentials, $authGithub, $authGoogle, ServerAuthProvider, authenticationProviderSchema } from "alepha/server/auth";
 import { $etag } from "alepha/server/etag";
 import { randomInt, randomUUID } from "node:crypto";
-import { $cache } from "alepha/cache";
+import { $cache, CacheProvider } from "alepha/cache";
 import { DateTimeProvider } from "alepha/datetime";
-import { FileSystemProvider } from "alepha/system";
-import { $bucket } from "alepha/bucket";
 import { $job } from "alepha/api/jobs";
-import { $parameter, AlephaApiParameters } from "alepha/api/parameters";
+import { FileSystemProvider } from "alepha/system";
 import { AlephaApiKeys, ApiKeyService } from "alepha/api/keys";
+import { $parameter, AlephaApiParameters } from "alepha/api/parameters";
 import { AlephaApiVerification } from "alepha/api/verifications";
+//#region ../../src/api/users/audits/UserAudits.ts
+/**
+* User-specific audit wrapper service.
+*
+* This service wraps the core AuditService to provide user-related audit logging.
+* It is lazy-loaded when the `audits` feature is enabled in the realm.
+*/
+var UserAudits = class {
+	auditService = $inject(AuditService);
+	/**
+	* Record a user-related audit event.
+	*/
+	recordUser(action, context) {
+		return this.auditService.recordUser(action, context);
+	}
+	/**
+	* Record an authentication-related audit event.
+	*/
+	recordAuth(action, context) {
+		return this.auditService.recordAuth(action, context);
+	}
+	/**
+	* Record a generic audit event.
+	*/
+	record(category, action, context) {
+		return this.auditService.record(category, action, context);
+	}
+};
+//#endregion
+//#region ../../src/api/users/buckets/UserBuckets.ts
+/**
+* User-specific file storage wrapper service.
+*
+* This service provides file storage for user-related files such as:
+* - User avatars/profile pictures
+*
+* It is lazy-loaded when the `avatars` feature is enabled in the realm.
+*/
+var UserBuckets = class {
+	/**
+	* Bucket for user avatar storage.
+	*/
+	avatars = $bucket({
+		maxSize: 5 * 1024 * 1024,
+		mimeTypes: [
+			"image/jpeg",
+			"image/png",
+			"image/gif",
+			"image/webp"
+		]
+	});
+};
+//#endregion
 //#region ../../src/api/users/schemas/identityQuerySchema.ts
 const identityQuerySchema = t.extend(pageQuerySchema, {
 	userId: t.optional(t.uuid()),
@@ -36,7 +88,7 @@ const users = $entity({
 		realm: db.default(t.text(), DEFAULT_USER_REALM_NAME),
 		username: t.optional(t.shortText({
 			minLength: 3,
-			maxLength: 50
+			maxLength: 30
 		})),
 		email: t.optional(t.string({ format: "email" })),
 		phoneNumber: t.optional(t.e164()),
@@ -45,12 +97,14 @@ const users = $entity({
 		lastName: t.optional(t.string()),
 		picture: t.optional(t.string()),
 		enabled: db.default(t.boolean(), true),
-		emailVerified: db.default(t.boolean(), false)
+		emailVerified: db.default(t.boolean(), false),
+		organizationId: db.organization()
 	}),
 	indexes: [
 		{
-			columns: ["realm", "username"],
-			unique: true
+			expressions: (self) => [self.realm, sql`LOWER(${self.username})`],
+			unique: true,
+			name: "users_realm_username_lower_idx"
 		},
 		{
 			columns: ["realm", "email"],
@@ -91,35 +145,6 @@ const identities = $entity({
 //#region ../../src/api/users/schemas/identityResourceSchema.ts
 const identityResourceSchema = t.omit(identities.schema, ["password"]);
 //#endregion
-//#region ../../src/api/users/audits/UserAudits.ts
-/**
-* User-specific audit wrapper service.
-*
-* This service wraps the core AuditService to provide user-related audit logging.
-* It is lazy-loaded when the `audits` feature is enabled in the realm.
-*/
-var UserAudits = class {
-	auditService = $inject(AuditService);
-	/**
-	* Record a user-related audit event.
-	*/
-	recordUser(action, context) {
-		return this.auditService.recordUser(action, context);
-	}
-	/**
-	* Record an authentication-related audit event.
-	*/
-	recordAuth(action, context) {
-		return this.auditService.recordAuth(action, context);
-	}
-	/**
-	* Record a generic audit event.
-	*/
-	record(category, action, context) {
-		return this.auditService.record(category, action, context);
-	}
-};
-//#endregion
 //#region ../../src/api/users/atoms/realmAuthSettingsAtom.ts
 const fieldRequirement = (description) => t.union([
 	t.const("none"),
@@ -153,6 +178,23 @@ const realmAuthSettingsAtom = $atom({
 			requireLowercase: t.boolean({ description: "Require at least one lowercase letter" }),
 			requireNumbers: t.boolean({ description: "Require at least one number" }),
 			requireSpecialCharacters: t.boolean({ description: "Require at least one special character" })
+		}),
+		loginRateLimit: t.object({
+			ipMaxAttempts: t.integer({
+				description: "Max failed login attempts per IP before temporary lockout",
+				default: 15,
+				minimum: 1
+			}),
+			accountMaxAttempts: t.integer({
+				description: "Max failed login attempts per account before temporary lockout",
+				default: 5,
+				minimum: 1
+			}),
+			windowMs: t.integer({
+				description: "Rate limit window duration in milliseconds",
+				default: 900 * 1e3,
+				minimum: 1e3
+			})
 		})
 	}),
 	default: {
@@ -173,6 +215,11 @@ const realmAuthSettingsAtom = $atom({
 			requireLowercase: true,
 			requireNumbers: true,
 			requireSpecialCharacters: false
+		},
+		loginRateLimit: {
+			ipMaxAttempts: 15,
+			accountMaxAttempts: 5,
+			windowMs: 900 * 1e3
 		}
 	}
 });
@@ -217,8 +264,9 @@ var RealmProvider = class {
 	defaultUsers = $repository(users);
 	realms = /* @__PURE__ */ new Map();
 	register(realmName, realmOptions = {}) {
+		if (realmName.includes(".")) throw new AlephaError(`Realm name "${realmName}" must not contain dots — dots are reserved for parameter tree paths`);
 		const features = {
-			sessionPurge: false,
+			jobs: false,
 			notifications: false,
 			apiKeys: false,
 			parameters: false,
@@ -226,7 +274,7 @@ var RealmProvider = class {
 			audits: false,
 			...realmOptions.features
 		};
-		this.realms.set(realmName, {
+		const realm = {
 			name: realmName,
 			repositories: {
 				identities: realmOptions.entities?.identities ?? this.defaultIdentities,
@@ -239,10 +287,19 @@ var RealmProvider = class {
 				passwordPolicy: {
 					...realmAuthSettingsAtom.options.default.passwordPolicy,
 					...realmOptions.settings?.passwordPolicy
+				},
+				loginRateLimit: {
+					...realmAuthSettingsAtom.options.default.loginRateLimit,
+					...realmOptions.settings?.loginRateLimit
 				}
 			},
-			features
-		});
+			features,
+			getSettings: async function() {
+				if (this.settingsParameter) return await this.settingsParameter.get();
+				return this.settings;
+			}
+		};
+		this.realms.set(realmName, realm);
 		return this.getRealm(realmName);
 	}
 	/**
@@ -880,7 +937,7 @@ var UserService = class {
 		});
 		const realm = this.realmProvider.getRealm(userRealmName);
 		if (data.username) {
-			if (await this.users(userRealmName).findOne({ where: { username: { eq: data.username } } })) {
+			if (await this.users(userRealmName).findOne({ where: { username: { ilike: data.username } } })) {
 				this.log.debug("Username already taken", { username: data.username });
 				throw new BadRequestError("User with this username already exists");
 			}
@@ -1089,13 +1146,15 @@ var RealmController = class {
 		group: this.group,
 		method: "GET",
 		path: `${this.url}/config`,
-		use: [$etag({ control: { maxAge: [24, "hours"] } })],
+		use: [$etag()],
 		schema: {
 			query: t.object({ realmName: t.optional(t.string()) }),
 			response: realmConfigSchema
 		},
-		handler: ({ query }) => {
-			const { name: realmName, settings } = this.realmProvider.getRealm(query.realmName);
+		handler: async ({ query }) => {
+			const realm = this.realmProvider.getRealm(query.realmName);
+			const settings = await realm.getSettings();
+			const realmName = realm.name;
 			return {
 				settings,
 				realmName,
@@ -1448,7 +1507,7 @@ var RegistrationService = class {
 			username: body.username,
 			userRealmName
 		});
-		const realmSettings = this.realmProvider.getRealm(userRealmName).settings;
+		const realmSettings = await this.realmProvider.getRealm(userRealmName).getSettings();
 		if (realmSettings?.registrationAllowed === false) {
 			this.log.warn("Registration not allowed for realm", { userRealmName });
 			throw new BadRequestError("Registration is not allowed");
@@ -1606,7 +1665,7 @@ var RegistrationService = class {
 	async checkUserAvailability(body, userRealmName) {
 		const userRepository = this.realmProvider.userRepository(userRealmName);
 		if (body.username) {
-			if (await userRepository.findOne({ where: { username: { eq: body.username } } })) {
+			if (await userRepository.findOne({ where: { username: { ilike: body.username } } })) {
 				this.log.debug("Username already taken", { username: body.username });
 				throw new ConflictError("User with this username already exists");
 			}
@@ -1929,8 +1988,46 @@ var UserController = class {
 	});
 };
 //#endregion
+//#region ../../src/api/users/jobs/UserJobs.ts
+/**
+* User-specific jobs wrapper service.
+*
+* This service handles user-related scheduled jobs such as:
+* - Session purge (cleaning up expired sessions)
+* - Verification code cleanup
+* - Inactive user notifications
+*
+* It is lazy-loaded when the `sessionPurge` feature is enabled in the realm.
+*/
+var UserJobs = class {
+	log = $logger();
+	dateTimeProvider = $inject(DateTimeProvider);
+	sessionRepository = $repository(sessions);
+	/**
+	* Purge expired sessions from the database.
+	*
+	* This job runs daily at 3:00 AM and removes all sessions
+	* where the `expiresAt` timestamp has passed.
+	*/
+	purgeExpiredSessions = $job({
+		cron: "0 0 * * *",
+		handler: async () => {
+			const now = this.dateTimeProvider.nowISOString();
+			this.log.info("Starting expired sessions purge", { cutoffTime: now });
+			const expiredSessions = await this.sessionRepository.findMany({ where: { expiresAt: { lt: now } } });
+			if (expiredSessions.length === 0) {
+				this.log.info("No expired sessions found");
+				return;
+			}
+			this.log.info("Found expired sessions", { count: expiredSessions.length });
+			const deletedIds = await this.sessionRepository.deleteMany({ expiresAt: { lt: now } });
+			this.log.info("Expired sessions purged successfully", { deletedCount: deletedIds.length });
+		}
+	});
+};
+//#endregion
 //#region ../../src/api/users/services/SessionService.ts
-var SessionService = class {
+var SessionService = class SessionService {
 	alepha = $inject(Alepha);
 	fsp = $inject(FileSystemProvider);
 	dateTimeProvider = $inject(DateTimeProvider);
@@ -1938,6 +2035,7 @@ var SessionService = class {
 	log = $logger();
 	realmProvider = $inject(RealmProvider);
 	fileController = $client();
+	cacheProvider = $inject(CacheProvider);
 	userAudits(realmName) {
 		if (this.realmProvider.getRealm(realmName).features.audits) return this.alepha.inject(UserAudits);
 	}
@@ -1956,7 +2054,9 @@ var SessionService = class {
 	*/
 	async ensureAdminRole(user, userRealmName) {
 		if (user.roles.includes("admin")) return false;
-		const { settings, name } = this.realmProvider.getRealm(userRealmName);
+		const realm = this.realmProvider.getRealm(userRealmName);
+		const settings = await realm.getSettings();
+		const { name } = realm;
 		const adminEmails = settings.adminEmails ?? [];
 		const adminUsernames = settings.adminUsernames ?? [];
 		const isAdminByEmail = user.email && adminEmails.includes(user.email);
@@ -1985,22 +2085,94 @@ var SessionService = class {
 		return true;
 	}
 	/**
+	* Generate a unique username from an OAuth profile.
+	*
+	* 1. Extract candidate from email prefix
+	* 2. Sanitize against realm's usernameRegExp (strip invalid chars, truncate)
+	* 3. Check case-insensitive uniqueness, append suffix (2, 3, ...) if taken
+	* 4. Fall back to "user" + random 6-char alphanumeric if all else fails
+	*/
+	async generateUniqueUsername(profile, realmSettings, users) {
+		const maxLength = 30;
+		const maxSuffixAttempts = 10;
+		let candidate = profile.email?.split("@")[0] ?? profile.name ?? "";
+		candidate = candidate.replace(/[^a-zA-Z0-9_.-]/g, "");
+		if (realmSettings?.usernameRegExp) try {
+			if (!new RegExp(realmSettings.usernameRegExp).test(candidate)) candidate = candidate.replace(/[^a-zA-Z0-9_]/g, "");
+		} catch {}
+		if (candidate.length < 3) candidate = `user${candidate}`;
+		candidate = candidate.slice(0, maxLength - 2);
+		const isAvailable = async (name) => {
+			return !(await users.findMany({
+				where: { username: { contains: name } },
+				limit: 1
+			})).some((u) => u.username?.toLowerCase() === name.toLowerCase());
+		};
+		if (await isAvailable(candidate)) return candidate;
+		for (let i = 2; i <= maxSuffixAttempts + 1; i++) {
+			const withSuffix = `${candidate}${i}`;
+			if (withSuffix.length <= maxLength && await isAvailable(withSuffix)) return withSuffix;
+		}
+		return `user${Math.random().toString(36).slice(2, 8)}`;
+	}
+	/**
 	* Random delay to prevent timing attacks (50-200ms)
 	* Uses cryptographically secure random number generation
 	*/
 	randomDelay() {
 		return new Promise((resolve) => setTimeout(resolve, randomInt(50, 201)));
 	}
+	static LOGIN_CACHE_NAME = "login-rate-limit";
+	/**
+	* Check if a login key is currently locked out.
+	* Read-only — does not increment the counter.
+	*/
+	async isLoginLocked(key, max) {
+		try {
+			const count = await this.cacheProvider.getTyped(SessionService.LOGIN_CACHE_NAME, key);
+			return count != null && count >= max;
+		} catch (error) {
+			this.log.warn("Failed to check login rate limit, allowing attempt", error);
+			return false;
+		}
+	}
+	/**
+	* Record a failed login attempt. Uses getTyped + setTyped (not incr) so that
+	* each write refreshes the TTL — implementing sliding-window behavior.
+	*
+	* Returns `true` if this failure just crossed the lockout threshold.
+	*/
+	async recordFailedLogin(key, max, windowMs) {
+		try {
+			const newCount = (await this.cacheProvider.getTyped(SessionService.LOGIN_CACHE_NAME, key) ?? 0) + 1;
+			await this.cacheProvider.setTyped(SessionService.LOGIN_CACHE_NAME, key, newCount, { ttl: windowMs });
+			return newCount === max;
+		} catch (error) {
+			this.log.warn("Failed to record failed login attempt", error);
+			return false;
+		}
+	}
 	/**
 	* Validate user credentials and return the user if valid.
 	*/
 	async login(provider, username, password, userRealmName) {
-		const { settings, name } = this.realmProvider.getRealm(userRealmName);
+		const realm = this.realmProvider.getRealm(userRealmName);
+		const settings = await realm.getSettings();
+		const { name } = realm;
+		const { loginRateLimit } = settings;
 		const isEmail = username.includes("@");
 		const isPhone = /^[+\d][\d\s()-]+$/.test(username);
 		const isUsername = !isEmail && !isPhone;
 		const identities = this.identities(userRealmName);
 		const users = this.users(userRealmName);
+		const request = this.alepha.store.get("alepha.http.request");
+		const ipKey = request?.ip ? `login:ip:${request.ip}` : void 0;
+		if (ipKey) {
+			if (await this.isLoginLocked(ipKey, loginRateLimit.ipMaxAttempts)) {
+				this.log.warn("Login blocked — IP rate limit exceeded", { ip: request?.ip });
+				throw new InvalidCredentialsError();
+			}
+		}
 		await this.randomDelay();
 		try {
 			const where = users.createQueryWhere();
@@ -2024,7 +2196,7 @@ var SessionService = class {
 						throw new InvalidCredentialsError();
 					}
 				}
-				where.username = username;
+				where.username = { ilike: username };
 			} else if (settings.email !== "none" && isEmail) where.email = username;
 			else if (settings.phoneNumber !== "none" && isPhone) where.phoneNumber = username;
 			else {
@@ -2058,6 +2230,22 @@ var SessionService = class {
 						username
 					}
 				});
+				if (ipKey) {
+					if (await this.recordFailedLogin(ipKey, loginRateLimit.ipMaxAttempts, loginRateLimit.windowMs)) await this.userAudits(userRealmName)?.record("security", "rate_limited", {
+						userRealm: name,
+						success: false,
+						description: "IP temporarily locked due to too many failed login attempts",
+						metadata: { ip: request?.ip }
+					});
+				}
+				throw new InvalidCredentialsError();
+			}
+			const accountKey = `login:account:${name}:${user.id}`;
+			if (await this.isLoginLocked(accountKey, loginRateLimit.accountMaxAttempts)) {
+				this.log.warn("Login blocked — account rate limit exceeded", {
+					userId: user.id,
+					realm: name
+				});
 				throw new InvalidCredentialsError();
 			}
 			const identity = await identities.getOne({ where: {
@@ -2089,6 +2277,21 @@ var SessionService = class {
 						username
 					}
 				});
+				if (ipKey) {
+					if (await this.recordFailedLogin(ipKey, loginRateLimit.ipMaxAttempts, loginRateLimit.windowMs)) await this.userAudits(userRealmName)?.record("security", "rate_limited", {
+						userRealm: name,
+						success: false,
+						description: "IP temporarily locked due to too many failed login attempts",
+						metadata: { ip: request?.ip }
+					});
+				}
+				if (await this.recordFailedLogin(accountKey, loginRateLimit.accountMaxAttempts, loginRateLimit.windowMs)) await this.userAudits(userRealmName)?.record("security", "rate_limited", {
+					userRealm: name,
+					resourceId: user.id,
+					success: false,
+					description: "Account temporarily locked due to too many failed login attempts",
+					metadata: { userId: user.id }
+				});
 				throw new InvalidCredentialsError();
 			}
 			await this.userAudits(userRealmName)?.recordAuth("login", {
@@ -2247,9 +2450,20 @@ var SessionService = class {
 			await this.ensureAdminRole(existing, userRealmName);
 			return existing;
 		}
+		const realmSettings = await realm.getSettings();
+		const adminEmails = realmSettings?.adminEmails ?? [];
+		const isAdmin = profile.email && adminEmails.includes(profile.email);
+		if (realmSettings?.registrationAllowed === false && !isAdmin) {
+			this.log.warn("Registration not allowed for realm via OAuth2", {
+				provider,
+				userRealmName
+			});
+			throw new BadRequestError("Account doesn't exist");
+		}
+		const username = await this.generateUniqueUsername(profile, realmSettings, users);
 		const user = await users.create({
 			realm: realm.name,
-			username: profile.email.split("@")[0],
+			username,
 			email: profile.email,
 			emailVerified: true,
 			roles: ["user"]
@@ -2311,90 +2525,6 @@ var SessionService = class {
 	}
 };
 //#endregion
-//#region ../../src/api/users/buckets/UserBuckets.ts
-/**
-* User-specific file storage wrapper service.
-*
-* This service provides file storage for user-related files such as:
-* - User avatars/profile pictures
-*
-* It is lazy-loaded when the `avatars` feature is enabled in the realm.
-*/
-var UserBuckets = class {
-	/**
-	* Bucket for user avatar storage.
-	*/
-	avatars = $bucket({
-		maxSize: 5 * 1024 * 1024,
-		mimeTypes: [
-			"image/jpeg",
-			"image/png",
-			"image/gif",
-			"image/webp"
-		]
-	});
-};
-//#endregion
-//#region ../../src/api/users/jobs/UserJobs.ts
-/**
-* User-specific jobs wrapper service.
-*
-* This service handles user-related scheduled jobs such as:
-* - Session purge (cleaning up expired sessions)
-* - Verification code cleanup
-* - Inactive user notifications
-*
-* It is lazy-loaded when the `sessionPurge` feature is enabled in the realm.
-*/
-var UserJobs = class {
-	log = $logger();
-	dateTimeProvider = $inject(DateTimeProvider);
-	sessionRepository = $repository(sessions);
-	/**
-	* Purge expired sessions from the database.
-	*
-	* This job runs daily at 3:00 AM and removes all sessions
-	* where the `expiresAt` timestamp has passed.
-	*/
-	purgeExpiredSessions = $job({
-		cron: "0 0 * * *",
-		handler: async () => {
-			const now = this.dateTimeProvider.nowISOString();
-			this.log.info("Starting expired sessions purge", { cutoffTime: now });
-			const expiredSessions = await this.sessionRepository.findMany({ where: { expiresAt: { lt: now } } });
-			if (expiredSessions.length === 0) {
-				this.log.info("No expired sessions found");
-				return;
-			}
-			this.log.info("Found expired sessions", { count: expiredSessions.length });
-			const deletedIds = await this.sessionRepository.deleteMany({ expiresAt: { lt: now } });
-			this.log.info("Expired sessions purged successfully", { deletedCount: deletedIds.length });
-		}
-	});
-};
-//#endregion
-//#region ../../src/api/users/parameters/UserParameters.ts
-/**
-* User-specific parameter service.
-*
-* This service wraps the core ParameterProvider to provide realm settings management.
-* It is lazy-loaded when the `parameters` feature is enabled in the realm.
-*/
-var UserParameters = class {
-	/**
-	* Realm authentication settings parameter.
-	*
-	* Controls user registration, login methods, verification requirements,
-	* and password policies for the realm.
-	*/
-	realmSettings = $parameter({
-		name: "api.users.realmSettings",
-		description: "Realm authentication and registration settings",
-		schema: realmAuthSettingsAtom.schema,
-		default: realmAuthSettingsAtom.options.default
-	});
-};
-//#endregion
 //#region ../../src/api/users/primitives/$realm.ts
 /**
 * Already configured realm for user management.
@@ -2417,7 +2547,7 @@ const $realm = (options = {}) => {
 	const name = options.issuer?.name ?? "default";
 	options.settings ??= {};
 	const features = {
-		sessionPurge: false,
+		jobs: false,
 		notifications: false,
 		apiKeys: false,
 		parameters: false,
@@ -2433,12 +2563,11 @@ const $realm = (options = {}) => {
 	const realmRegistration = realmProvider.register(name, options);
 	if (features.avatars) alepha.with(UserBuckets);
 	if (features.audits) alepha.with(UserAudits);
-	if (features.sessionPurge) alepha.with(UserJobs);
+	if (features.jobs) alepha.with(UserJobs);
 	if (features.notifications) {
 		alepha.with(UserNotifications);
 		alepha.with(AlephaApiVerification);
 	}
-	if (features.parameters) alepha.with(AlephaApiParameters);
 	const customResolvers = [...options.issuer?.resolvers ?? []];
 	if (features.apiKeys) {
 		alepha.with(AlephaApiKeys);
@@ -2494,6 +2623,17 @@ const $realm = (options = {}) => {
 		if (identities.github) auth.github = $authGithub(realm);
 		alepha.with(() => auth);
 	}
+	if (features.parameters) {
+		alepha.with(AlephaApiParameters);
+		const settingsParam = $parameter({
+			name: `api.realms.settings.${name}`,
+			description: `Authentication and registration settings for realm "${name}"`,
+			schema: realmAuthSettingsAtom.schema,
+			default: realmRegistration.settings
+		});
+		realmRegistration.settingsParameter = settingsParam;
+		alepha.with(() => ({ [`realmSettings_${name}`]: settingsParam }));
+	}
 	return realm;
 };
 //#endregion
@@ -2570,7 +2710,6 @@ const resetPasswordSchema = t.object({
 const AlephaApiUsers = $module({
 	name: "alepha.api.users",
 	services: [
-		AlephaEmail,
 		RealmProvider,
 		SessionService,
 		SessionCrudService,
@@ -2582,10 +2721,17 @@ const AlephaApiUsers = $module({
 		AdminUserController,
 		AdminSessionController,
 		AdminIdentityController,
-		RealmController
-	]
+		RealmController,
+		UserJobs,
+		UserNotifications,
+		UserAudits,
+		UserBuckets
+	],
+	register: (alepha) => {
+		alepha.with(RealmProvider).with(SessionService).with(SessionCrudService).with(CredentialService).with(RegistrationService).with(UserService).with(IdentityService).with(UserController).with(AdminUserController).with(AdminSessionController).with(AdminIdentityController).with(RealmController);
+	}
 });
 //#endregion
-export { $realm, AdminIdentityController, AdminSessionController, AdminUserController, AlephaApiUsers, CredentialService, DEFAULT_USER_REALM_NAME, IdentityService, RealmController, RealmProvider, RegistrationService, SessionCrudService, SessionService, UserAudits, UserBuckets, UserController, UserJobs, UserNotifications, UserParameters, UserService, completePasswordResetRequestSchema, completeRegistrationRequestSchema, createUserSchema, identities, identityQuerySchema, identityResourceSchema, loginSchema, passwordResetIntentResponseSchema, realmAuthSettingsAtom, realmConfigSchema, registerSchema, registrationIntentResponseSchema, resetPasswordRequestSchema, resetPasswordSchema, sessionQuerySchema, sessionResourceSchema, sessions, updateUserSchema, userQuerySchema, userResourceSchema, users };
+export { $realm, AdminIdentityController, AdminSessionController, AdminUserController, AlephaApiUsers, CredentialService, DEFAULT_USER_REALM_NAME, IdentityService, RealmController, RealmProvider, RegistrationService, SessionCrudService, SessionService, UserAudits, UserBuckets, UserController, UserJobs, UserNotifications, UserService, completePasswordResetRequestSchema, completeRegistrationRequestSchema, createUserSchema, identities, identityQuerySchema, identityResourceSchema, loginSchema, passwordResetIntentResponseSchema, realmAuthSettingsAtom, realmConfigSchema, registerSchema, registrationIntentResponseSchema, resetPasswordRequestSchema, resetPasswordSchema, sessionQuerySchema, sessionResourceSchema, sessions, updateUserSchema, userQuerySchema, userResourceSchema, users };
 
 //# sourceMappingURL=index.js.map