alepha 0.19.1 → 0.19.2

package/dist/api/users/index.js

@@ -1,23 +1,75 @@
 import { $atom, $context, $inject, $module, Alepha, AlephaError, t } from "alepha";
-import { $cache, AlephaCache, CacheProvider } from "alepha/cache";
-import { AlephaEmail } from "alepha/email";
+import { AuditService } from "alepha/api/audits";
+import { $bucket } from "alepha/bucket";
 import { $issuer, $permission, $secure, CryptoProvider, InvalidCredentialsError, SecurityProvider } from "alepha/security";
 import { $action, BadRequestError, ConflictError, HttpError, UnauthorizedError, okSchema } from "alepha/server";
-import { $entity, $repository, db, pageQuerySchema, parseQueryString } from "alepha/orm";
+import { $entity, $repository, db, pageQuerySchema, parseQueryString, sql } from "alepha/orm";
 import { $logger } from "alepha/logger";
-import { AuditService } from "alepha/api/audits";
 import { $client } from "alepha/server/links";
 import { $notification } from "alepha/api/notifications";
 import { $authCredentials, $authGithub, $authGoogle, ServerAuthProvider, authenticationProviderSchema } from "alepha/server/auth";
 import { $etag } from "alepha/server/etag";
 import { randomInt, randomUUID } from "node:crypto";
+import { $cache, CacheProvider } from "alepha/cache";
 import { DateTimeProvider } from "alepha/datetime";
-import { FileSystemProvider } from "alepha/system";
-import { $bucket } from "alepha/bucket";
 import { $job } from "alepha/api/jobs";
+import { FileSystemProvider } from "alepha/system";
 import { AlephaApiKeys, ApiKeyService } from "alepha/api/keys";
 import { $parameter, AlephaApiParameters } from "alepha/api/parameters";
 import { AlephaApiVerification } from "alepha/api/verifications";
+//#region ../../src/api/users/audits/UserAudits.ts
+/**
+* User-specific audit wrapper service.
+*
+* This service wraps the core AuditService to provide user-related audit logging.
+* It is lazy-loaded when the `audits` feature is enabled in the realm.
+*/
+var UserAudits = class {
+	auditService = $inject(AuditService);
+	/**
+	* Record a user-related audit event.
+	*/
+	recordUser(action, context) {
+		return this.auditService.recordUser(action, context);
+	}
+	/**
+	* Record an authentication-related audit event.
+	*/
+	recordAuth(action, context) {
+		return this.auditService.recordAuth(action, context);
+	}
+	/**
+	* Record a generic audit event.
+	*/
+	record(category, action, context) {
+		return this.auditService.record(category, action, context);
+	}
+};
+//#endregion
+//#region ../../src/api/users/buckets/UserBuckets.ts
+/**
+* User-specific file storage wrapper service.
+*
+* This service provides file storage for user-related files such as:
+* - User avatars/profile pictures
+*
+* It is lazy-loaded when the `avatars` feature is enabled in the realm.
+*/
+var UserBuckets = class {
+	/**
+	* Bucket for user avatar storage.
+	*/
+	avatars = $bucket({
+		maxSize: 5 * 1024 * 1024,
+		mimeTypes: [
+			"image/jpeg",
+			"image/png",
+			"image/gif",
+			"image/webp"
+		]
+	});
+};
+//#endregion
 //#region ../../src/api/users/schemas/identityQuerySchema.ts
 const identityQuerySchema = t.extend(pageQuerySchema, {
 	userId: t.optional(t.uuid()),
@@ -36,7 +88,7 @@ const users = $entity({
 		realm: db.default(t.text(), DEFAULT_USER_REALM_NAME),
 		username: t.optional(t.shortText({
 			minLength: 3,
-			maxLength: 50
+			maxLength: 30
 		})),
 		email: t.optional(t.string({ format: "email" })),
 		phoneNumber: t.optional(t.e164()),
@@ -45,12 +97,14 @@ const users = $entity({
 		lastName: t.optional(t.string()),
 		picture: t.optional(t.string()),
 		enabled: db.default(t.boolean(), true),
-		emailVerified: db.default(t.boolean(), false)
+		emailVerified: db.default(t.boolean(), false),
+		organizationId: db.organization()
 	}),
 	indexes: [
 		{
-			columns: ["realm", "username"],
-			unique: true
+			expressions: (self) => [self.realm, sql`LOWER(${self.username})`],
+			unique: true,
+			name: "users_realm_username_lower_idx"
 		},
 		{
 			columns: ["realm", "email"],
@@ -91,35 +145,6 @@ const identities = $entity({
 //#region ../../src/api/users/schemas/identityResourceSchema.ts
 const identityResourceSchema = t.omit(identities.schema, ["password"]);
 //#endregion
-//#region ../../src/api/users/audits/UserAudits.ts
-/**
-* User-specific audit wrapper service.
-*
-* This service wraps the core AuditService to provide user-related audit logging.
-* It is lazy-loaded when the `audits` feature is enabled in the realm.
-*/
-var UserAudits = class {
-	auditService = $inject(AuditService);
-	/**
-	* Record a user-related audit event.
-	*/
-	recordUser(action, context) {
-		return this.auditService.recordUser(action, context);
-	}
-	/**
-	* Record an authentication-related audit event.
-	*/
-	recordAuth(action, context) {
-		return this.auditService.recordAuth(action, context);
-	}
-	/**
-	* Record a generic audit event.
-	*/
-	record(category, action, context) {
-		return this.auditService.record(category, action, context);
-	}
-};
-//#endregion
 //#region ../../src/api/users/atoms/realmAuthSettingsAtom.ts
 const fieldRequirement = (description) => t.union([
 	t.const("none"),
@@ -241,7 +266,7 @@ var RealmProvider = class {
 	register(realmName, realmOptions = {}) {
 		if (realmName.includes(".")) throw new AlephaError(`Realm name "${realmName}" must not contain dots — dots are reserved for parameter tree paths`);
 		const features = {
-			sessionPurge: false,
+			jobs: false,
 			notifications: false,
 			apiKeys: false,
 			parameters: false,
@@ -912,7 +937,7 @@ var UserService = class {
 		});
 		const realm = this.realmProvider.getRealm(userRealmName);
 		if (data.username) {
-			if (await this.users(userRealmName).findOne({ where: { username: { eq: data.username } } })) {
+			if (await this.users(userRealmName).findOne({ where: { username: { ilike: data.username } } })) {
 				this.log.debug("Username already taken", { username: data.username });
 				throw new BadRequestError("User with this username already exists");
 			}
@@ -1640,7 +1665,7 @@ var RegistrationService = class {
 	async checkUserAvailability(body, userRealmName) {
 		const userRepository = this.realmProvider.userRepository(userRealmName);
 		if (body.username) {
-			if (await userRepository.findOne({ where: { username: { eq: body.username } } })) {
+			if (await userRepository.findOne({ where: { username: { ilike: body.username } } })) {
 				this.log.debug("Username already taken", { username: body.username });
 				throw new ConflictError("User with this username already exists");
 			}
@@ -1963,6 +1988,44 @@ var UserController = class {
 	});
 };
 //#endregion
+//#region ../../src/api/users/jobs/UserJobs.ts
+/**
+* User-specific jobs wrapper service.
+*
+* This service handles user-related scheduled jobs such as:
+* - Session purge (cleaning up expired sessions)
+* - Verification code cleanup
+* - Inactive user notifications
+*
+* It is lazy-loaded when the `sessionPurge` feature is enabled in the realm.
+*/
+var UserJobs = class {
+	log = $logger();
+	dateTimeProvider = $inject(DateTimeProvider);
+	sessionRepository = $repository(sessions);
+	/**
+	* Purge expired sessions from the database.
+	*
+	* This job runs daily at 3:00 AM and removes all sessions
+	* where the `expiresAt` timestamp has passed.
+	*/
+	purgeExpiredSessions = $job({
+		cron: "0 0 * * *",
+		handler: async () => {
+			const now = this.dateTimeProvider.nowISOString();
+			this.log.info("Starting expired sessions purge", { cutoffTime: now });
+			const expiredSessions = await this.sessionRepository.findMany({ where: { expiresAt: { lt: now } } });
+			if (expiredSessions.length === 0) {
+				this.log.info("No expired sessions found");
+				return;
+			}
+			this.log.info("Found expired sessions", { count: expiredSessions.length });
+			const deletedIds = await this.sessionRepository.deleteMany({ expiresAt: { lt: now } });
+			this.log.info("Expired sessions purged successfully", { deletedCount: deletedIds.length });
+		}
+	});
+};
+//#endregion
 //#region ../../src/api/users/services/SessionService.ts
 var SessionService = class SessionService {
 	alepha = $inject(Alepha);
@@ -2022,6 +2085,37 @@ var SessionService = class SessionService {
 		return true;
 	}
 	/**
+	* Generate a unique username from an OAuth profile.
+	*
+	* 1. Extract candidate from email prefix
+	* 2. Sanitize against realm's usernameRegExp (strip invalid chars, truncate)
+	* 3. Check case-insensitive uniqueness, append suffix (2, 3, ...) if taken
+	* 4. Fall back to "user" + random 6-char alphanumeric if all else fails
+	*/
+	async generateUniqueUsername(profile, realmSettings, users) {
+		const maxLength = 30;
+		const maxSuffixAttempts = 10;
+		let candidate = profile.email?.split("@")[0] ?? profile.name ?? "";
+		candidate = candidate.replace(/[^a-zA-Z0-9_.-]/g, "");
+		if (realmSettings?.usernameRegExp) try {
+			if (!new RegExp(realmSettings.usernameRegExp).test(candidate)) candidate = candidate.replace(/[^a-zA-Z0-9_]/g, "");
+		} catch {}
+		if (candidate.length < 3) candidate = `user${candidate}`;
+		candidate = candidate.slice(0, maxLength - 2);
+		const isAvailable = async (name) => {
+			return !(await users.findMany({
+				where: { username: { contains: name } },
+				limit: 1
+			})).some((u) => u.username?.toLowerCase() === name.toLowerCase());
+		};
+		if (await isAvailable(candidate)) return candidate;
+		for (let i = 2; i <= maxSuffixAttempts + 1; i++) {
+			const withSuffix = `${candidate}${i}`;
+			if (withSuffix.length <= maxLength && await isAvailable(withSuffix)) return withSuffix;
+		}
+		return `user${Math.random().toString(36).slice(2, 8)}`;
+	}
+	/**
 	* Random delay to prevent timing attacks (50-200ms)
 	* Uses cryptographically secure random number generation
 	*/
@@ -2102,7 +2196,7 @@ var SessionService = class SessionService {
 						throw new InvalidCredentialsError();
 					}
 				}
-				where.username = username;
+				where.username = { ilike: username };
 			} else if (settings.email !== "none" && isEmail) where.email = username;
 			else if (settings.phoneNumber !== "none" && isPhone) where.phoneNumber = username;
 			else {
@@ -2356,9 +2450,20 @@ var SessionService = class SessionService {
 			await this.ensureAdminRole(existing, userRealmName);
 			return existing;
 		}
+		const realmSettings = await realm.getSettings();
+		const adminEmails = realmSettings?.adminEmails ?? [];
+		const isAdmin = profile.email && adminEmails.includes(profile.email);
+		if (realmSettings?.registrationAllowed === false && !isAdmin) {
+			this.log.warn("Registration not allowed for realm via OAuth2", {
+				provider,
+				userRealmName
+			});
+			throw new BadRequestError("Account doesn't exist");
+		}
+		const username = await this.generateUniqueUsername(profile, realmSettings, users);
 		const user = await users.create({
 			realm: realm.name,
-			username: profile.email.split("@")[0],
+			username,
 			email: profile.email,
 			emailVerified: true,
 			roles: ["user"]
@@ -2420,68 +2525,6 @@ var SessionService = class SessionService {
 	}
 };
 //#endregion
-//#region ../../src/api/users/buckets/UserBuckets.ts
-/**
-* User-specific file storage wrapper service.
-*
-* This service provides file storage for user-related files such as:
-* - User avatars/profile pictures
-*
-* It is lazy-loaded when the `avatars` feature is enabled in the realm.
-*/
-var UserBuckets = class {
-	/**
-	* Bucket for user avatar storage.
-	*/
-	avatars = $bucket({
-		maxSize: 5 * 1024 * 1024,
-		mimeTypes: [
-			"image/jpeg",
-			"image/png",
-			"image/gif",
-			"image/webp"
-		]
-	});
-};
-//#endregion
-//#region ../../src/api/users/jobs/UserJobs.ts
-/**
-* User-specific jobs wrapper service.
-*
-* This service handles user-related scheduled jobs such as:
-* - Session purge (cleaning up expired sessions)
-* - Verification code cleanup
-* - Inactive user notifications
-*
-* It is lazy-loaded when the `sessionPurge` feature is enabled in the realm.
-*/
-var UserJobs = class {
-	log = $logger();
-	dateTimeProvider = $inject(DateTimeProvider);
-	sessionRepository = $repository(sessions);
-	/**
-	* Purge expired sessions from the database.
-	*
-	* This job runs daily at 3:00 AM and removes all sessions
-	* where the `expiresAt` timestamp has passed.
-	*/
-	purgeExpiredSessions = $job({
-		cron: "0 0 * * *",
-		handler: async () => {
-			const now = this.dateTimeProvider.nowISOString();
-			this.log.info("Starting expired sessions purge", { cutoffTime: now });
-			const expiredSessions = await this.sessionRepository.findMany({ where: { expiresAt: { lt: now } } });
-			if (expiredSessions.length === 0) {
-				this.log.info("No expired sessions found");
-				return;
-			}
-			this.log.info("Found expired sessions", { count: expiredSessions.length });
-			const deletedIds = await this.sessionRepository.deleteMany({ expiresAt: { lt: now } });
-			this.log.info("Expired sessions purged successfully", { deletedCount: deletedIds.length });
-		}
-	});
-};
-//#endregion
 //#region ../../src/api/users/primitives/$realm.ts
 /**
 * Already configured realm for user management.
@@ -2504,7 +2547,7 @@ const $realm = (options = {}) => {
 	const name = options.issuer?.name ?? "default";
 	options.settings ??= {};
 	const features = {
-		sessionPurge: false,
+		jobs: false,
 		notifications: false,
 		apiKeys: false,
 		parameters: false,
@@ -2520,7 +2563,7 @@ const $realm = (options = {}) => {
 	const realmRegistration = realmProvider.register(name, options);
 	if (features.avatars) alepha.with(UserBuckets);
 	if (features.audits) alepha.with(UserAudits);
-	if (features.sessionPurge) alepha.with(UserJobs);
+	if (features.jobs) alepha.with(UserJobs);
 	if (features.notifications) {
 		alepha.with(UserNotifications);
 		alepha.with(AlephaApiVerification);
@@ -2667,8 +2710,6 @@ const resetPasswordSchema = t.object({
 const AlephaApiUsers = $module({
 	name: "alepha.api.users",
 	services: [
-		AlephaEmail,
-		AlephaCache,
 		RealmProvider,
 		SessionService,
 		SessionCrudService,
@@ -2680,8 +2721,15 @@ const AlephaApiUsers = $module({
 		AdminUserController,
 		AdminSessionController,
 		AdminIdentityController,
-		RealmController
-	]
+		RealmController,
+		UserJobs,
+		UserNotifications,
+		UserAudits,
+		UserBuckets
+	],
+	register: (alepha) => {
+		alepha.with(RealmProvider).with(SessionService).with(SessionCrudService).with(CredentialService).with(RegistrationService).with(UserService).with(IdentityService).with(UserController).with(AdminUserController).with(AdminSessionController).with(AdminIdentityController).with(RealmController);
+	}
 });
 //#endregion
 export { $realm, AdminIdentityController, AdminSessionController, AdminUserController, AlephaApiUsers, CredentialService, DEFAULT_USER_REALM_NAME, IdentityService, RealmController, RealmProvider, RegistrationService, SessionCrudService, SessionService, UserAudits, UserBuckets, UserController, UserJobs, UserNotifications, UserService, completePasswordResetRequestSchema, completeRegistrationRequestSchema, createUserSchema, identities, identityQuerySchema, identityResourceSchema, loginSchema, passwordResetIntentResponseSchema, realmAuthSettingsAtom, realmConfigSchema, registerSchema, registrationIntentResponseSchema, resetPasswordRequestSchema, resetPasswordSchema, sessionQuerySchema, sessionResourceSchema, sessions, updateUserSchema, userQuerySchema, userResourceSchema, users };