alepha 0.19.0 → 0.19.2

package/src/api/users/__tests__/$realm.spec.ts

@@ -0,0 +1,191 @@
+import { Alepha } from "alepha";
+import { AlephaOrmPostgres } from "alepha/orm/postgres";
+import { AlephaSecurity, CryptoProvider } from "alepha/security";
+import { describe, it } from "vitest";
+import {
+  $realm,
+  RealmProvider,
+  RegistrationService,
+  SessionService,
+  UserService,
+} from "../index.ts";
+
+describe("alepha/api/users - $realm with parameters", () => {
+  it("should create settingsParameter when features.parameters is true", async ({
+    expect,
+  }) => {
+    const alepha = Alepha.create();
+    alepha.with(AlephaOrmPostgres);
+    alepha.with(AlephaSecurity);
+    alepha.with(() => {
+      return { realm: $realm({ features: { parameters: true } }) };
+    });
+    await alepha.start();
+
+    const realmProvider = alepha.inject(RealmProvider);
+    const realm = realmProvider.getRealm();
+
+    expect(realm.settingsParameter).toBeDefined();
+    expect(realm.settingsParameter!.name).toBe("api.realms.settings.default");
+  });
+
+  it("should not create settingsParameter when features.parameters is false", async ({
+    expect,
+  }) => {
+    const alepha = Alepha.create();
+    alepha.with(AlephaOrmPostgres);
+    alepha.with(AlephaSecurity);
+    alepha.with(() => {
+      return { realm: $realm() };
+    });
+    await alepha.start();
+
+    const realmProvider = alepha.inject(RealmProvider);
+    const realm = realmProvider.getRealm();
+
+    expect(realm.settingsParameter).toBeUndefined();
+  });
+
+  it("should return dynamic settings via getSettings() after parameter set", async ({
+    expect,
+  }) => {
+    const alepha = Alepha.create();
+    alepha.with(AlephaOrmPostgres);
+    alepha.with(AlephaSecurity);
+    alepha.with(() => {
+      return { realm: $realm({ features: { parameters: true } }) };
+    });
+    await alepha.start();
+
+    const realmProvider = alepha.inject(RealmProvider);
+    const realm = realmProvider.getRealm();
+
+    // Default settings
+    const settingsA = await realm.getSettings();
+    expect(settingsA.registrationAllowed).toBe(true);
+
+    // Update via parameter
+    await realm.settingsParameter!.set({
+      ...settingsA,
+      registrationAllowed: false,
+    });
+
+    // New settings reflected
+    const settingsB = await realm.getSettings();
+    expect(settingsB.registrationAllowed).toBe(false);
+  });
+
+  it("should use build-time settings as parameter default", async ({
+    expect,
+  }) => {
+    const alepha = Alepha.create();
+    alepha.with(AlephaOrmPostgres);
+    alepha.with(AlephaSecurity);
+    alepha.with(() => {
+      return {
+        realm: $realm({
+          features: { parameters: true },
+          settings: { registrationAllowed: false },
+        }),
+      };
+    });
+    await alepha.start();
+
+    const realmProvider = alepha.inject(RealmProvider);
+    const realm = realmProvider.getRealm();
+
+    // Default should be the build-time config, not the atom default
+    const settings = await realm.getSettings();
+    expect(settings.registrationAllowed).toBe(false);
+  });
+
+  it("should enforce dynamically changed registration setting", async ({
+    expect,
+  }) => {
+    const alepha = Alepha.create();
+    alepha.with(AlephaOrmPostgres);
+    alepha.with(AlephaSecurity);
+    alepha.with(() => {
+      return { realm: $realm({ features: { parameters: true } }) };
+    });
+    await alepha.start();
+
+    const realmProvider = alepha.inject(RealmProvider);
+    const registrationService = alepha.inject(RegistrationService);
+    const realm = realmProvider.getRealm();
+
+    // Registration works with defaults
+    const intent = await registrationService.createRegistrationIntent({
+      email: "test@example.com",
+      password: "SecurePassword123!",
+    });
+    expect(intent.intentId).toBeDefined();
+
+    // Disable registration via parameter
+    const currentSettings = await realm.getSettings();
+    await realm.settingsParameter!.set({
+      ...currentSettings,
+      registrationAllowed: false,
+    });
+
+    // Registration now rejected
+    await expect(
+      registrationService.createRegistrationIntent({
+        email: "test2@example.com",
+        password: "SecurePassword123!",
+      }),
+    ).rejects.toThrow("Registration is not allowed");
+  });
+
+  it("should enforce dynamically changed adminEmails setting", async ({
+    expect,
+  }) => {
+    const alepha = Alepha.create();
+    alepha.with(AlephaOrmPostgres);
+    alepha.with(AlephaSecurity);
+    alepha.with(() => {
+      return { realm: $realm({ features: { parameters: true } }) };
+    });
+    await alepha.start();
+
+    const realmProvider = alepha.inject(RealmProvider);
+    const sessionService = alepha.inject(SessionService);
+    const realm = realmProvider.getRealm();
+
+    // Create a user
+    const userService = alepha.inject(UserService);
+    const cryptoProvider = alepha.inject(CryptoProvider);
+    const user = await userService.users().create({
+      email: "admin-promo@example.com",
+      roles: ["user"],
+    });
+    await sessionService.identities().create({
+      userId: user.id,
+      provider: "credentials",
+      password: await cryptoProvider.hashPassword("SecurePassword123!"),
+    });
+
+    // Login — user should NOT be admin
+    const loggedIn = await sessionService.login(
+      "credentials",
+      "admin-promo@example.com",
+      "SecurePassword123!",
+    );
+    expect(loggedIn.roles).not.toContain("admin");
+
+    // Add email to adminEmails via parameter
+    const currentSettings = await realm.getSettings();
+    await realm.settingsParameter!.set({
+      ...currentSettings,
+      adminEmails: ["admin-promo@example.com"],
+    });
+
+    // Login again — user should now be promoted to admin
+    const loggedIn2 = await sessionService.login(
+      "credentials",
+      "admin-promo@example.com",
+      "SecurePassword123!",
+    );
+    expect(loggedIn2.roles).toContain("admin");
+  });
+});

package/src/api/users/__tests__/RealmProvider.spec.ts

@@ -0,0 +1,53 @@
+import { Alepha } from "alepha";
+import { AlephaOrmPostgres } from "alepha/orm/postgres";
+import { AlephaSecurity } from "alepha/security";
+import { describe, it } from "vitest";
+import { AlephaApiUsers, RealmProvider } from "../index.ts";
+
+describe("alepha/api/users - RealmProvider", () => {
+  it("should return settings via getSettings()", async ({ expect }) => {
+    const alepha = Alepha.create();
+    alepha.with(AlephaOrmPostgres);
+    alepha.with(AlephaSecurity);
+    alepha.with(AlephaApiUsers);
+    await alepha.start();
+
+    const realmProvider = alepha.inject(RealmProvider);
+    const realm = realmProvider.getRealm();
+
+    const settings = await realm.getSettings();
+    expect(settings.registrationAllowed).toBe(true);
+    expect(settings.email).toBe("required");
+    expect(settings.loginRateLimit.ipMaxAttempts).toBe(15);
+  });
+
+  it("should reject realm names containing dots", async ({ expect }) => {
+    const alepha = Alepha.create();
+    alepha.with(AlephaOrmPostgres);
+    alepha.with(AlephaSecurity);
+    alepha.with(AlephaApiUsers);
+    await alepha.start();
+
+    const realmProvider = alepha.inject(RealmProvider);
+    expect(() => realmProvider.register("my.realm")).toThrow(
+      "must not contain dots",
+    );
+  });
+
+  it("should return custom settings when configured", async ({ expect }) => {
+    const alepha = Alepha.create();
+    alepha.with(AlephaOrmPostgres);
+    alepha.with(AlephaSecurity);
+    alepha.with(AlephaApiUsers);
+    await alepha.start();
+
+    const realmProvider = alepha.inject(RealmProvider);
+    realmProvider.register("custom", {
+      settings: { registrationAllowed: false } as never,
+    });
+
+    const realm = realmProvider.getRealm("custom");
+    const settings = await realm.getSettings();
+    expect(settings.registrationAllowed).toBe(false);
+  });
+});