alepha 0.19.0 → 0.19.2

package/src/api/users/{jobs → __tests__}/UserJobs.spec.ts

@@ -5,7 +5,7 @@ import { AlephaOrmPostgres } from "alepha/orm/postgres";
 import { describe, test, vi } from "vitest";
 import { sessions } from "../entities/sessions.ts";
 import { users } from "../entities/users.ts";
-import { UserJobs } from "./UserJobs.ts";
+import { UserJobs } from "../jobs/UserJobs.ts";
 
 describe("UserJobs", () => {
   describe("purgeExpiredSessions", () => {

package/src/api/users/atoms/realmAuthSettingsAtom.ts

@@ -89,6 +89,25 @@ export const realmAuthSettingsAtom = $atom({
         description: "Require at least one special character",
       }),
     }),
+    loginRateLimit: t.object({
+      ipMaxAttempts: t.integer({
+        description:
+          "Max failed login attempts per IP before temporary lockout",
+        default: 15,
+        minimum: 1,
+      }),
+      accountMaxAttempts: t.integer({
+        description:
+          "Max failed login attempts per account before temporary lockout",
+        default: 5,
+        minimum: 1,
+      }),
+      windowMs: t.integer({
+        description: "Rate limit window duration in milliseconds",
+        default: 15 * 60 * 1000,
+        minimum: 1000,
+      }),
+    }),
   }),
   default: {
     // for a fresh hello world setup, we accept registration and email login
@@ -111,6 +130,11 @@ export const realmAuthSettingsAtom = $atom({
       requireNumbers: true,
       requireSpecialCharacters: false,
     },
+    loginRateLimit: {
+      ipMaxAttempts: 15,
+      accountMaxAttempts: 5,
+      windowMs: 15 * 60 * 1000,
+    },
   },
 });
 

package/src/api/users/controllers/RealmController.ts

@@ -23,23 +23,17 @@ export class RealmController {
     group: this.group,
     method: "GET",
     path: `${this.url}/config`,
-    use: [
-      $etag({
-        control: {
-          maxAge: [24, "hours"],
-        },
-      }),
-    ],
+    use: [$etag()],
     schema: {
       query: t.object({
         realmName: t.optional(t.string()),
       }),
       response: realmConfigSchema,
     },
-    handler: ({ query }) => {
-      const { name: realmName, settings } = this.realmProvider.getRealm(
-        query.realmName,
-      );
+    handler: async ({ query }) => {
+      const realm = this.realmProvider.getRealm(query.realmName);
+      const settings = await realm.getSettings();
+      const realmName = realm.name;
 
       const authenticationMethods =
         this.serverAuthProvider.getAuthenticationProviders({

package/src/api/users/entities/users.ts

@@ -1,5 +1,5 @@
 import { type Static, t } from "alepha";
-import { $entity, db } from "alepha/orm";
+import { $entity, db, sql } from "alepha/orm";
 
 export const DEFAULT_USER_REALM_NAME = "default";
 
@@ -16,7 +16,7 @@ export const users = $entity({
     username: t.optional(
       t.shortText({
         minLength: 3,
-        maxLength: 50,
+        maxLength: 30,
         // pattern is handled at the realm settings level
       }),
     ),
@@ -32,9 +32,15 @@ export const users = $entity({
     enabled: db.default(t.boolean(), true),
 
     emailVerified: db.default(t.boolean(), false),
+
+    organizationId: db.organization(),
   }),
   indexes: [
-    { columns: ["realm", "username"], unique: true },
+    {
+      expressions: (self) => [self.realm, sql`LOWER(${self.username})`],
+      unique: true,
+      name: "users_realm_username_lower_idx",
+    },
     { columns: ["realm", "email"], unique: true },
     { columns: ["realm", "phoneNumber"], unique: true },
   ],

package/src/api/users/index.ts

@@ -1,10 +1,13 @@
 import { $module } from "alepha";
-import { AlephaEmail } from "alepha/email";
+import { UserAudits } from "./audits/UserAudits.ts";
+import { UserBuckets } from "./buckets/UserBuckets.ts";
 import { AdminIdentityController } from "./controllers/AdminIdentityController.ts";
 import { AdminSessionController } from "./controllers/AdminSessionController.ts";
 import { AdminUserController } from "./controllers/AdminUserController.ts";
 import { RealmController } from "./controllers/RealmController.ts";
 import { UserController } from "./controllers/UserController.ts";
+import { UserJobs } from "./jobs/UserJobs.ts";
+import { UserNotifications } from "./notifications/UserNotifications.ts";
 import { RealmProvider } from "./providers/RealmProvider.ts";
 import { CredentialService } from "./services/CredentialService.ts";
 import { IdentityService } from "./services/IdentityService.ts";
@@ -28,7 +31,6 @@ export * from "./entities/sessions.ts";
 export * from "./entities/users.ts";
 export * from "./jobs/UserJobs.ts";
 export * from "./notifications/UserNotifications.ts";
-export * from "./parameters/UserParameters.ts";
 export * from "./primitives/$realm.ts";
 export * from "./providers/RealmProvider.ts";
 export * from "./schemas/completePasswordResetRequestSchema.ts";
@@ -74,7 +76,6 @@ export * from "./services/UserService.ts";
 export const AlephaApiUsers = $module({
   name: "alepha.api.users",
   services: [
-    AlephaEmail,
     RealmProvider,
     SessionService,
     SessionCrudService,
@@ -87,5 +88,24 @@ export const AlephaApiUsers = $module({
     AdminSessionController,
     AdminIdentityController,
     RealmController,
+    UserJobs,
+    UserNotifications,
+    UserAudits,
+    UserBuckets,
   ],
+  register: (alepha) => {
+    alepha
+      .with(RealmProvider)
+      .with(SessionService)
+      .with(SessionCrudService)
+      .with(CredentialService)
+      .with(RegistrationService)
+      .with(UserService)
+      .with(IdentityService)
+      .with(UserController)
+      .with(AdminUserController)
+      .with(AdminSessionController)
+      .with(AdminIdentityController)
+      .with(RealmController);
+  },
 });

package/src/api/users/primitives/$realm.ts

@@ -1,6 +1,6 @@
 import { $context } from "alepha";
 import { AlephaApiKeys, ApiKeyService } from "alepha/api/keys";
-import { AlephaApiParameters } from "alepha/api/parameters";
+import { $parameter, AlephaApiParameters } from "alepha/api/parameters";
 import { AlephaApiVerification } from "alepha/api/verifications";
 import type { Repository } from "alepha/orm";
 import {
@@ -21,7 +21,10 @@ import {
   type WithLinkFn,
   type WithLoginFn,
 } from "alepha/server/auth";
-import type { RealmAuthSettings } from "../atoms/realmAuthSettingsAtom.ts";
+import {
+  type RealmAuthSettings,
+  realmAuthSettingsAtom,
+} from "../atoms/realmAuthSettingsAtom.ts";
 import { UserAudits } from "../audits/UserAudits.ts";
 import { UserBuckets } from "../buckets/UserBuckets.ts";
 import type { identities } from "../entities/identities.ts";
@@ -60,7 +63,7 @@ export const $realm = (options: RealmOptions = {}): RealmPrimitive => {
 
   // Merge features with defaults
   const features: RealmFeatures = {
-    sessionPurge: false,
+    jobs: false,
     notifications: false,
     apiKeys: false,
     parameters: false,
@@ -92,7 +95,7 @@ export const $realm = (options: RealmOptions = {}): RealmPrimitive => {
     alepha.with(UserAudits);
   }
 
-  if (features.sessionPurge) {
+  if (features.jobs) {
     alepha.with(UserJobs);
   }
 
@@ -101,11 +104,6 @@ export const $realm = (options: RealmOptions = {}): RealmPrimitive => {
     alepha.with(AlephaApiVerification);
   }
 
-  if (features.parameters) {
-    // for now, we don't have $parameter related to users, we just register the module
-    alepha.with(AlephaApiParameters);
-  }
-
   // -------------------------------------------------------------------------------------------------------------------
 
   // Collect custom resolvers that will be registered during $issuer.onInit()
@@ -210,6 +208,18 @@ export const $realm = (options: RealmOptions = {}): RealmPrimitive => {
     alepha.with(() => auth);
   }
 
+  if (features.parameters) {
+    alepha.with(AlephaApiParameters);
+    const settingsParam = $parameter({
+      name: `api.realms.settings.${name}`,
+      description: `Authentication and registration settings for realm "${name}"`,
+      schema: realmAuthSettingsAtom.schema,
+      default: realmRegistration.settings,
+    });
+    realmRegistration.settingsParameter = settingsParam;
+    alepha.with(() => ({ [`realmSettings_${name}`]: settingsParam }));
+  }
+
   return realm;
 };
 
@@ -217,11 +227,13 @@ export const $realm = (options: RealmOptions = {}): RealmPrimitive => {
 
 export interface RealmFeatures {
   /**
-   * Enable session purge functionality for cleaning up expired sessions.
+   * Will enable Job module.
+   *
+   * - Enable session purge functionality for cleaning up expired sessions.
    *
    * @default false
    */
-  sessionPurge?: boolean;
+  jobs?: boolean;
 
   /**
    * Enable notification system for password reset, verification emails, etc.

package/src/api/users/providers/RealmProvider.ts

@@ -1,4 +1,5 @@
 import { $inject, Alepha, AlephaError } from "alepha";
+import type { ParameterPrimitive } from "alepha/api/parameters";
 import { $repository, type Repository } from "alepha/orm";
 import {
   type RealmAuthSettings,
@@ -20,6 +21,8 @@ export interface Realm {
   repositories: RealmRepositories;
   settings: RealmAuthSettings;
   features: RealmFeatures;
+  settingsParameter?: ParameterPrimitive<typeof realmAuthSettingsAtom.schema>;
+  getSettings(): Promise<RealmAuthSettings>;
 }
 
 export class RealmProvider {
@@ -32,9 +35,15 @@ export class RealmProvider {
   protected realms = new Map<string, Realm>();
 
   public register(realmName: string, realmOptions: RealmOptions = {}) {
+    if (realmName.includes(".")) {
+      throw new AlephaError(
+        `Realm name "${realmName}" must not contain dots — dots are reserved for parameter tree paths`,
+      );
+    }
+
     // Merge features with defaults
     const features: RealmFeatures = {
-      sessionPurge: false,
+      jobs: false,
       notifications: false,
       apiKeys: false,
       parameters: false,
@@ -43,7 +52,7 @@ export class RealmProvider {
       ...realmOptions.features,
     };
 
-    this.realms.set(realmName, {
+    const realm: Realm = {
       name: realmName,
       repositories: {
         identities: realmOptions.entities?.identities ?? this.defaultIdentities,
@@ -58,9 +67,20 @@ export class RealmProvider {
           ...realmAuthSettingsAtom.options.default.passwordPolicy,
           ...realmOptions.settings?.passwordPolicy,
         },
+        loginRateLimit: {
+          ...realmAuthSettingsAtom.options.default.loginRateLimit,
+          ...realmOptions.settings?.loginRateLimit,
+        },
       },
       features,
-    });
+      getSettings: async function () {
+        if (this.settingsParameter) {
+          return await this.settingsParameter.get();
+        }
+        return this.settings;
+      },
+    };
+    this.realms.set(realmName, realm);
     return this.getRealm(realmName);
   }
 

package/src/api/users/services/RegistrationService.ts

@@ -88,7 +88,8 @@ export class RegistrationService {
       userRealmName,
     });
 
-    const realmSettings = this.realmProvider.getRealm(userRealmName).settings;
+    const realm = this.realmProvider.getRealm(userRealmName);
+    const realmSettings = await realm.getSettings();
 
     // Check if registration is allowed
     if (realmSettings?.registrationAllowed === false) {
@@ -338,7 +339,7 @@ export class RegistrationService {
 
     if (body.username) {
       const existingUser = await userRepository.findOne({
-        where: { username: { eq: body.username } },
+        where: { username: { ilike: body.username } },
       });
       if (existingUser) {
         this.log.debug("Username already taken", { username: body.username });

package/src/api/users/services/SessionService.ts

@@ -1,6 +1,7 @@
 import { randomInt } from "node:crypto";
 import { $inject, Alepha } from "alepha";
 import type { FileController } from "alepha/api/files";
+import { CacheProvider } from "alepha/cache";
 import { DateTimeProvider } from "alepha/datetime";
 import { $logger } from "alepha/logger";
 import {
@@ -8,7 +9,7 @@ import {
   InvalidCredentialsError,
   type UserAccount,
 } from "alepha/security";
-import { UnauthorizedError } from "alepha/server";
+import { BadRequestError, UnauthorizedError } from "alepha/server";
 import type { OAuth2Profile } from "alepha/server/auth";
 import { $client } from "alepha/server/links";
 import { FileSystemProvider } from "alepha/system";
@@ -24,6 +25,7 @@ export class SessionService {
   protected readonly log = $logger();
   protected readonly realmProvider = $inject(RealmProvider);
   protected readonly fileController = $client<FileController>();
+  protected readonly cacheProvider = $inject(CacheProvider);
 
   protected userAudits(realmName?: string) {
     const realm = this.realmProvider.getRealm(realmName);
@@ -60,7 +62,9 @@ export class SessionService {
   ): Promise<boolean> {
     if (user.roles.includes("admin")) return false;
 
-    const { settings, name } = this.realmProvider.getRealm(userRealmName);
+    const realm = this.realmProvider.getRealm(userRealmName);
+    const settings = await realm.getSettings();
+    const { name } = realm;
     const adminEmails = settings.adminEmails ?? [];
     const adminUsernames = settings.adminUsernames ?? [];
 
@@ -94,6 +98,78 @@ export class SessionService {
     return true;
   }
 
+  /**
+   * Generate a unique username from an OAuth profile.
+   *
+   * 1. Extract candidate from email prefix
+   * 2. Sanitize against realm's usernameRegExp (strip invalid chars, truncate)
+   * 3. Check case-insensitive uniqueness, append suffix (2, 3, ...) if taken
+   * 4. Fall back to "user" + random 6-char alphanumeric if all else fails
+   */
+  protected async generateUniqueUsername(
+    profile: OAuth2Profile,
+    realmSettings: any,
+    users: any,
+  ): Promise<string> {
+    const maxLength = 30;
+    const maxSuffixAttempts = 10;
+
+    // Extract candidate from email or profile name
+    let candidate = profile.email?.split("@")[0] ?? profile.name ?? "";
+
+    // Strip characters not allowed in usernames (keep alphanumeric, underscore, dot, hyphen)
+    candidate = candidate.replace(/[^a-zA-Z0-9_.-]/g, "");
+
+    // If realm has a custom regex, further sanitize
+    if (realmSettings?.usernameRegExp) {
+      try {
+        const regex = new RegExp(realmSettings.usernameRegExp);
+        if (!regex.test(candidate)) {
+          // Strip to basic alphanumeric as safe fallback
+          candidate = candidate.replace(/[^a-zA-Z0-9_]/g, "");
+        }
+      } catch {
+        // Invalid regex, continue with sanitized candidate
+      }
+    }
+
+    // Ensure minimum length
+    if (candidate.length < 3) {
+      candidate = `user${candidate}`;
+    }
+
+    // Truncate to leave room for suffix
+    candidate = candidate.slice(0, maxLength - 2);
+
+    // Check uniqueness (case-insensitive)
+    const isAvailable = async (name: string) => {
+      const existing = await users.findMany({
+        where: { username: { contains: name } },
+        limit: 1,
+      });
+      // Case-insensitive check
+      return !existing.some(
+        (u: any) => u.username?.toLowerCase() === name.toLowerCase(),
+      );
+    };
+
+    if (await isAvailable(candidate)) {
+      return candidate;
+    }
+
+    // Try with numeric suffix
+    for (let i = 2; i <= maxSuffixAttempts + 1; i++) {
+      const withSuffix = `${candidate}${i}`;
+      if (withSuffix.length <= maxLength && (await isAvailable(withSuffix))) {
+        return withSuffix;
+      }
+    }
+
+    // Final fallback: random username
+    const random = Math.random().toString(36).slice(2, 8);
+    return `user${random}`;
+  }
+
   /**
    * Random delay to prevent timing attacks (50-200ms)
    * Uses cryptographically secure random number generation
@@ -102,6 +178,59 @@ export class SessionService {
     return new Promise((resolve) => setTimeout(resolve, randomInt(50, 201)));
   }
 
+  protected static readonly LOGIN_CACHE_NAME = "login-rate-limit";
+
+  /**
+   * Check if a login key is currently locked out.
+   * Read-only — does not increment the counter.
+   */
+  protected async isLoginLocked(key: string, max: number): Promise<boolean> {
+    try {
+      const count = await this.cacheProvider.getTyped<number>(
+        SessionService.LOGIN_CACHE_NAME,
+        key,
+      );
+      return count != null && count >= max;
+    } catch (error) {
+      this.log.warn(
+        "Failed to check login rate limit, allowing attempt",
+        error,
+      );
+      return false;
+    }
+  }
+
+  /**
+   * Record a failed login attempt. Uses getTyped + setTyped (not incr) so that
+   * each write refreshes the TTL — implementing sliding-window behavior.
+   *
+   * Returns `true` if this failure just crossed the lockout threshold.
+   */
+  protected async recordFailedLogin(
+    key: string,
+    max: number,
+    windowMs: number,
+  ): Promise<boolean> {
+    try {
+      const count =
+        (await this.cacheProvider.getTyped<number>(
+          SessionService.LOGIN_CACHE_NAME,
+          key,
+        )) ?? 0;
+      const newCount = count + 1;
+      await this.cacheProvider.setTyped(
+        SessionService.LOGIN_CACHE_NAME,
+        key,
+        newCount,
+        { ttl: windowMs },
+      );
+      return newCount === max;
+    } catch (error) {
+      this.log.warn("Failed to record failed login attempt", error);
+      return false;
+    }
+  }
+
   /**
    * Validate user credentials and return the user if valid.
    */
@@ -111,13 +240,33 @@ export class SessionService {
     password: string,
     userRealmName?: string,
   ): Promise<UserEntity> {
-    const { settings, name } = this.realmProvider.getRealm(userRealmName);
+    const realm = this.realmProvider.getRealm(userRealmName);
+    const settings = await realm.getSettings();
+    const { name } = realm;
+    const { loginRateLimit } = settings;
     const isEmail = username.includes("@");
     const isPhone = /^[+\d][\d\s()-]+$/.test(username);
     const isUsername = !isEmail && !isPhone;
     const identities = this.identities(userRealmName);
     const users = this.users(userRealmName);
 
+    // IP rate limit check (global, cross-realm) — before any DB work
+    const request = this.alepha.store.get("alepha.http.request");
+    const ipKey = request?.ip ? `login:ip:${request.ip}` : undefined;
+
+    if (ipKey) {
+      const ipLocked = await this.isLoginLocked(
+        ipKey,
+        loginRateLimit.ipMaxAttempts,
+      );
+      if (ipLocked) {
+        this.log.warn("Login blocked — IP rate limit exceeded", {
+          ip: request?.ip,
+        });
+        throw new InvalidCredentialsError();
+      }
+    }
+
     await this.randomDelay();
 
     try {
@@ -145,7 +294,7 @@ export class SessionService {
             throw new InvalidCredentialsError();
           }
         }
-        where.username = username;
+        where.username = { ilike: username };
       } else if (settings.email !== "none" && isEmail) {
         where.email = username;
       } else if (settings.phoneNumber !== "none" && isPhone) {
@@ -180,6 +329,42 @@ export class SessionService {
           metadata: { provider, username },
         });
 
+        // Only increment IP counter (no user ID to track)
+        if (ipKey) {
+          const justLocked = await this.recordFailedLogin(
+            ipKey,
+            loginRateLimit.ipMaxAttempts,
+            loginRateLimit.windowMs,
+          );
+          if (justLocked) {
+            await this.userAudits(userRealmName)?.record(
+              "security",
+              "rate_limited",
+              {
+                userRealm: name,
+                success: false,
+                description:
+                  "IP temporarily locked due to too many failed login attempts",
+                metadata: { ip: request?.ip },
+              },
+            );
+          }
+        }
+
+        throw new InvalidCredentialsError();
+      }
+
+      // Account rate limit check (per-realm)
+      const accountKey = `login:account:${name}:${user.id}`;
+      const accountLocked = await this.isLoginLocked(
+        accountKey,
+        loginRateLimit.accountMaxAttempts,
+      );
+      if (accountLocked) {
+        this.log.warn("Login blocked — account rate limit exceeded", {
+          userId: user.id,
+          realm: name,
+        });
         throw new InvalidCredentialsError();
       }
 
@@ -220,6 +405,48 @@ export class SessionService {
           metadata: { provider, username },
         });
 
+        // Record failed attempt on both IP and account counters
+        if (ipKey) {
+          const ipJustLocked = await this.recordFailedLogin(
+            ipKey,
+            loginRateLimit.ipMaxAttempts,
+            loginRateLimit.windowMs,
+          );
+          if (ipJustLocked) {
+            await this.userAudits(userRealmName)?.record(
+              "security",
+              "rate_limited",
+              {
+                userRealm: name,
+                success: false,
+                description:
+                  "IP temporarily locked due to too many failed login attempts",
+                metadata: { ip: request?.ip },
+              },
+            );
+          }
+        }
+
+        const accountJustLocked = await this.recordFailedLogin(
+          accountKey,
+          loginRateLimit.accountMaxAttempts,
+          loginRateLimit.windowMs,
+        );
+        if (accountJustLocked) {
+          await this.userAudits(userRealmName)?.record(
+            "security",
+            "rate_limited",
+            {
+              userRealm: name,
+              resourceId: user.id,
+              success: false,
+              description:
+                "Account temporarily locked due to too many failed login attempts",
+              metadata: { userId: user.id },
+            },
+          );
+        }
+
         throw new InvalidCredentialsError();
       }
 
@@ -238,7 +465,6 @@ export class SessionService {
       return user;
     } catch (error) {
       if (error instanceof InvalidCredentialsError) {
-        // TODO: store failed login attempts (with request data) and lock account after threshold
         throw error;
       }
 
@@ -442,12 +668,27 @@ export class SessionService {
       return existing;
     }
 
-    // TODO: check usernames for uniqueness, add suffix if needed (e.g. john.doe1)
-    // TODO: username must match a-zA-Z0-9._-
+    const realmSettings = await realm.getSettings();
+    const adminEmails = realmSettings?.adminEmails ?? [];
+    const isAdmin = profile.email && adminEmails.includes(profile.email);
+
+    if (realmSettings?.registrationAllowed === false && !isAdmin) {
+      this.log.warn("Registration not allowed for realm via OAuth2", {
+        provider,
+        userRealmName,
+      });
+      throw new BadRequestError("Account doesn't exist");
+    }
+
+    const username = await this.generateUniqueUsername(
+      profile,
+      realmSettings,
+      users,
+    );
 
     const user = await users.create({
       realm: realm.name,
-      username: profile.email.split("@")[0],
+      username,
       email: profile.email,
       // we trust the OAuth2 provider
       emailVerified: true,

package/src/api/users/services/UserService.ts

@@ -276,7 +276,7 @@ export class UserService {
     // Check for existing user based on provided unique fields
     if (data.username) {
       const existingUser = await this.users(userRealmName).findOne({
-        where: { username: { eq: data.username } },
+        where: { username: { ilike: data.username } },
       });
 
       if (existingUser) {