alepha 0.19.1 → 0.19.2

package/src/api/organizations/__tests__/OrganizationService.spec.ts

@@ -0,0 +1,193 @@
+import { Alepha } from "alepha";
+import { currentUserAtom } from "alepha/security";
+import { describe, it } from "vitest";
+import { AlephaApiOrganizations, OrganizationService } from "../index.ts";
+
+const setup = async () => {
+  const alepha = Alepha.create({
+    env: { DATABASE_URL: "sqlite://:memory:", LOG_LEVEL: "error" },
+  });
+
+  alepha.with(AlephaApiOrganizations);
+
+  await alepha.start();
+
+  const service = alepha.inject(OrganizationService);
+
+  return { alepha, service };
+};
+
+describe("alepha/api/organizations - OrganizationService", () => {
+  describe("create", () => {
+    it("should create an organization", async ({ expect }) => {
+      const { service } = await setup();
+
+      const org = await service.create({
+        name: "Acme Corp",
+        slug: "acme-corp",
+      });
+
+      expect(org.id).toBeDefined();
+      expect(org.name).toBe("Acme Corp");
+      expect(org.slug).toBe("acme-corp");
+      expect(org.enabled).toBe(true);
+      expect(org.createdAt).toBeDefined();
+    });
+
+    it("should create a disabled organization", async ({ expect }) => {
+      const { service } = await setup();
+
+      const org = await service.create({
+        name: "Disabled Org",
+        slug: "disabled-org",
+        enabled: false,
+      });
+
+      expect(org.enabled).toBe(false);
+    });
+  });
+
+  describe("getById", () => {
+    it("should retrieve an organization by ID", async ({ expect }) => {
+      const { service } = await setup();
+
+      const created = await service.create({
+        name: "Test Org",
+        slug: "test-org",
+      });
+
+      const retrieved = await service.getById(created.id);
+
+      expect(retrieved.id).toBe(created.id);
+      expect(retrieved.name).toBe("Test Org");
+    });
+  });
+
+  describe("getBySlug", () => {
+    it("should retrieve an organization by slug", async ({ expect }) => {
+      const { service } = await setup();
+
+      await service.create({ name: "Slug Org", slug: "my-slug" });
+
+      const retrieved = await service.getBySlug("my-slug");
+
+      expect(retrieved.name).toBe("Slug Org");
+      expect(retrieved.slug).toBe("my-slug");
+    });
+  });
+
+  describe("update", () => {
+    it("should update an organization", async ({ expect }) => {
+      const { service } = await setup();
+
+      const org = await service.create({
+        name: "Old Name",
+        slug: "old-slug",
+      });
+
+      const updated = await service.update(org.id, { name: "New Name" });
+
+      expect(updated.name).toBe("New Name");
+      expect(updated.slug).toBe("old-slug");
+    });
+
+    it("should disable an organization", async ({ expect }) => {
+      const { service } = await setup();
+
+      const org = await service.create({
+        name: "Active Org",
+        slug: "active-org",
+      });
+
+      const updated = await service.update(org.id, { enabled: false });
+
+      expect(updated.enabled).toBe(false);
+    });
+  });
+
+  describe("delete", () => {
+    it("should delete an organization", async ({ expect }) => {
+      const { service } = await setup();
+
+      const org = await service.create({
+        name: "To Delete",
+        slug: "to-delete",
+      });
+
+      await service.delete(org.id);
+
+      const result = await service.find();
+      expect(result.content.find((o) => o.id === org.id)).toBeUndefined();
+    });
+  });
+
+  describe("find", () => {
+    it("should find organizations with pagination", async ({ expect }) => {
+      const { service } = await setup();
+
+      await service.create({ name: "Org A", slug: "org-a" });
+      await service.create({ name: "Org B", slug: "org-b" });
+      await service.create({ name: "Org C", slug: "org-c" });
+
+      const result = await service.find({ size: 2 });
+
+      expect(result.content).toHaveLength(2);
+      expect(result.page.totalElements).toBe(3);
+    });
+
+    it("should filter by name", async ({ expect }) => {
+      const { service } = await setup();
+
+      await service.create({ name: "Alpha Corp", slug: "alpha" });
+      await service.create({ name: "Beta Inc", slug: "beta" });
+
+      const result = await service.find({ name: "Alpha" });
+
+      expect(result.content).toHaveLength(1);
+      expect(result.content[0].name).toBe("Alpha Corp");
+    });
+
+    it("should filter by enabled status", async ({ expect }) => {
+      const { service } = await setup();
+
+      await service.create({ name: "Active", slug: "active" });
+      await service.create({
+        name: "Inactive",
+        slug: "inactive",
+        enabled: false,
+      });
+
+      const result = await service.find({ enabled: true });
+
+      expect(result.content).toHaveLength(1);
+      expect(result.content[0].name).toBe("Active");
+    });
+
+    it("should sort by createdAt descending by default", async ({ expect }) => {
+      const { service } = await setup();
+
+      await service.create({ name: "First", slug: "first" });
+      await new Promise((r) => setTimeout(r, 10));
+      await service.create({ name: "Second", slug: "second" });
+
+      const result = await service.find();
+
+      expect(result.content[0].name).toBe("Second");
+      expect(result.content[1].name).toBe("First");
+    });
+  });
+
+  describe("organization scoping on users", () => {
+    it("god user (no org) sees all organizations", async ({ expect }) => {
+      const { alepha, service } = await setup();
+
+      await service.create({ name: "Org A", slug: "org-a" });
+      await service.create({ name: "Org B", slug: "org-b" });
+
+      alepha.store.set(currentUserAtom, { id: "god-user" });
+
+      const result = await service.find();
+      expect(result.content).toHaveLength(2);
+    });
+  });
+});

package/src/api/organizations/controllers/AdminOrganizationController.ts

@@ -0,0 +1,103 @@
+import { $inject, t } from "alepha";
+import { $secure } from "alepha/security";
+import { $action, okSchema } from "alepha/server";
+import { createOrganizationSchema } from "../schemas/createOrganizationSchema.ts";
+import { organizationQuerySchema } from "../schemas/organizationQuerySchema.ts";
+import { organizationResourceSchema } from "../schemas/organizationResourceSchema.ts";
+import { updateOrganizationSchema } from "../schemas/updateOrganizationSchema.ts";
+import { OrganizationService } from "../services/OrganizationService.ts";
+
+export class AdminOrganizationController {
+  protected readonly url = "/organizations";
+  protected readonly group = "admin:organizations";
+  protected readonly organizationService = $inject(OrganizationService);
+
+  /**
+   * Find organizations with pagination and filtering.
+   */
+  public readonly findOrganizations = $action({
+    path: this.url,
+    group: this.group,
+    use: [$secure({ permissions: ["admin:organization:read"] })],
+    description: "Find organizations with pagination and filtering",
+    schema: {
+      query: organizationQuerySchema,
+      response: t.page(organizationResourceSchema),
+    },
+    handler: ({ query }) => this.organizationService.find(query),
+  });
+
+  /**
+   * Get an organization by ID.
+   */
+  public readonly getOrganization = $action({
+    path: `${this.url}/:id`,
+    group: this.group,
+    use: [$secure({ permissions: ["admin:organization:read"] })],
+    description: "Get an organization by ID",
+    schema: {
+      params: t.object({
+        id: t.uuid(),
+      }),
+      response: organizationResourceSchema,
+    },
+    handler: ({ params }) => this.organizationService.getById(params.id),
+  });
+
+  /**
+   * Create a new organization.
+   */
+  public readonly createOrganization = $action({
+    method: "POST",
+    path: this.url,
+    group: this.group,
+    use: [$secure({ permissions: ["admin:organization:create"] })],
+    description: "Create a new organization",
+    schema: {
+      body: createOrganizationSchema,
+      response: organizationResourceSchema,
+    },
+    handler: ({ body }) => this.organizationService.create(body),
+  });
+
+  /**
+   * Update an organization.
+   */
+  public readonly updateOrganization = $action({
+    method: "PATCH",
+    path: `${this.url}/:id`,
+    group: this.group,
+    use: [$secure({ permissions: ["admin:organization:update"] })],
+    description: "Update an organization",
+    schema: {
+      params: t.object({
+        id: t.uuid(),
+      }),
+      body: updateOrganizationSchema,
+      response: organizationResourceSchema,
+    },
+    handler: ({ params, body }) =>
+      this.organizationService.update(params.id, body),
+  });
+
+  /**
+   * Delete an organization.
+   */
+  public readonly deleteOrganization = $action({
+    method: "DELETE",
+    path: `${this.url}/:id`,
+    group: this.group,
+    use: [$secure({ permissions: ["admin:organization:delete"] })],
+    description: "Delete an organization",
+    schema: {
+      params: t.object({
+        id: t.uuid(),
+      }),
+      response: okSchema,
+    },
+    handler: async ({ params }) => {
+      await this.organizationService.delete(params.id);
+      return { ok: true, id: params.id };
+    },
+  });
+}

package/src/api/organizations/entities/organizations.ts

@@ -0,0 +1,20 @@
+import type { Static } from "alepha";
+import { t } from "alepha";
+import { $entity, db } from "alepha/orm";
+
+export const organizations = $entity({
+  name: "organizations",
+  schema: t.object({
+    id: db.primaryKey(t.uuid()),
+    version: db.version(),
+    createdAt: db.createdAt(),
+    updatedAt: db.updatedAt(),
+
+    name: t.text(),
+    slug: t.text({ minLength: 2, maxLength: 100 }),
+    enabled: db.default(t.boolean(), true),
+  }),
+  indexes: [{ columns: ["slug"], unique: true }],
+});
+
+export type OrganizationEntity = Static<typeof organizations.schema>;

package/src/api/organizations/index.browser.ts

@@ -0,0 +1,10 @@
+// Browser exports for api-organizations module
+// Only exports types and schemas that are safe for browser usage
+
+export type { AdminOrganizationController } from "./controllers/AdminOrganizationController.ts";
+export * from "./entities/organizations.ts";
+export * from "./schemas/createOrganizationSchema.ts";
+export * from "./schemas/organizationQuerySchema.ts";
+export * from "./schemas/organizationResourceSchema.ts";
+export * from "./schemas/updateOrganizationSchema.ts";
+export type { OrganizationService } from "./services/OrganizationService.ts";

package/src/api/organizations/index.ts

@@ -0,0 +1,31 @@
+import { $module } from "alepha";
+import { AdminOrganizationController } from "./controllers/AdminOrganizationController.ts";
+import { OrganizationService } from "./services/OrganizationService.ts";
+
+// ---------------------------------------------------------------------------------------------------------------------
+
+export * from "./controllers/AdminOrganizationController.ts";
+export * from "./entities/organizations.ts";
+export * from "./schemas/createOrganizationSchema.ts";
+export * from "./schemas/organizationQuerySchema.ts";
+export * from "./schemas/organizationResourceSchema.ts";
+export * from "./schemas/updateOrganizationSchema.ts";
+export * from "./services/OrganizationService.ts";
+
+// ---------------------------------------------------------------------------------------------------------------------
+
+/**
+ * Organization management for multi-tenancy.
+ *
+ * **Features:**
+ * - Admin CRUD for organizations
+ * - Organization scoping via `db.organization()` on entities
+ * - User with no organization = god mode (sees all resources)
+ * - User with an organization = scoped to that organization
+ *
+ * @module alepha.api.organizations
+ */
+export const AlephaApiOrganizations = $module({
+  name: "alepha.api.organizations",
+  services: [OrganizationService, AdminOrganizationController],
+});

package/src/api/organizations/schemas/createOrganizationSchema.ts

@@ -0,0 +1,10 @@
+import type { Static } from "alepha";
+import { t } from "alepha";
+
+export const createOrganizationSchema = t.object({
+  name: t.text(),
+  slug: t.text({ minLength: 2, maxLength: 100 }),
+  enabled: t.optional(t.boolean()),
+});
+
+export type CreateOrganization = Static<typeof createOrganizationSchema>;

package/src/api/organizations/schemas/organizationQuerySchema.ts

@@ -0,0 +1,10 @@
+import type { Static } from "alepha";
+import { t } from "alepha";
+import { pageQuerySchema } from "alepha/orm";
+
+export const organizationQuerySchema = t.extend(pageQuerySchema, {
+  name: t.optional(t.text({ description: "Filter by name (partial match)" })),
+  enabled: t.optional(t.boolean({ description: "Filter by enabled status" })),
+});
+
+export type OrganizationQuery = Static<typeof organizationQuerySchema>;

package/src/api/organizations/schemas/organizationResourceSchema.ts

@@ -0,0 +1,6 @@
+import type { Static } from "alepha";
+import { organizations } from "../entities/organizations.ts";
+
+export const organizationResourceSchema = organizations.schema;
+
+export type OrganizationResource = Static<typeof organizationResourceSchema>;

package/src/api/organizations/schemas/updateOrganizationSchema.ts

@@ -0,0 +1,7 @@
+import type { Static } from "alepha";
+import { t } from "alepha";
+import { createOrganizationSchema } from "./createOrganizationSchema.ts";
+
+export const updateOrganizationSchema = t.partial(createOrganizationSchema);
+
+export type UpdateOrganization = Static<typeof updateOrganizationSchema>;

package/src/api/organizations/services/OrganizationService.ts

@@ -0,0 +1,75 @@
+import { $inject, Alepha } from "alepha";
+import { $logger } from "alepha/logger";
+import { $repository, type Page } from "alepha/orm";
+import {
+  type OrganizationEntity,
+  organizations,
+} from "../entities/organizations.ts";
+import type { CreateOrganization } from "../schemas/createOrganizationSchema.ts";
+import type { OrganizationQuery } from "../schemas/organizationQuerySchema.ts";
+import type { UpdateOrganization } from "../schemas/updateOrganizationSchema.ts";
+
+export class OrganizationService {
+  protected readonly alepha = $inject(Alepha);
+  protected readonly log = $logger();
+  protected readonly repo = $repository(organizations);
+
+  /**
+   * Find organizations with pagination and filtering.
+   */
+  public async find(
+    query: OrganizationQuery = {},
+  ): Promise<Page<OrganizationEntity>> {
+    query.sort ??= "-createdAt";
+
+    const where = this.repo.createQueryWhere();
+
+    if (query.name) {
+      where.name = { like: `%${query.name}%` };
+    }
+
+    if (query.enabled !== undefined) {
+      where.enabled = { eq: query.enabled };
+    }
+
+    return this.repo.paginate(query, { where }, { count: true });
+  }
+
+  /**
+   * Get an organization by ID.
+   */
+  public async getById(id: string): Promise<OrganizationEntity> {
+    return this.repo.getById(id);
+  }
+
+  /**
+   * Get an organization by slug.
+   */
+  public async getBySlug(slug: string): Promise<OrganizationEntity> {
+    return this.repo.getOne({ where: { slug: { eq: slug } } });
+  }
+
+  /**
+   * Create a new organization.
+   */
+  public async create(data: CreateOrganization): Promise<OrganizationEntity> {
+    return this.repo.create(data);
+  }
+
+  /**
+   * Update an organization.
+   */
+  public async update(
+    id: string,
+    data: UpdateOrganization,
+  ): Promise<OrganizationEntity> {
+    return this.repo.updateById(id, data);
+  }
+
+  /**
+   * Delete an organization.
+   */
+  public async delete(id: string): Promise<void> {
+    await this.repo.deleteById(id);
+  }
+}

package/src/api/parameters/services/ParameterProvider.ts

@@ -54,7 +54,12 @@ export class ParameterProvider {
   /**
    * Unique identifier for this instance (to avoid self-updates).
    */
-  protected readonly instanceId = this.crypto.randomUUID();
+  protected get instanceId(): string {
+    this._instanceId ??= this.crypto.randomUUID();
+    return this._instanceId;
+  }
+
+  protected _instanceId: string | undefined;
 
   /**
    * In-memory cache of registered parameter primitives.

package/src/api/users/{services → __tests__}/SessionService.spec.ts

@@ -7,6 +7,7 @@ import {
   CryptoProvider,
   InvalidCredentialsError,
 } from "alepha/security";
+import { BadRequestError } from "alepha/server";
 import { describe, it } from "vitest";
 import {
   AlephaApiUsers,
@@ -709,3 +710,69 @@ describe("alepha/api/users - SessionService.login", () => {
     });
   });
 });
+
+describe("alepha/api/users - SessionService.link", () => {
+  it("should reject OAuth2 account creation when registration is disabled", async ({
+    expect,
+  }) => {
+    const { sessionService, alepha } = await setup();
+
+    const realmProvider = alepha.inject(RealmProvider);
+    realmProvider.register("closed", {
+      settings: {
+        registrationAllowed: false,
+      } as never,
+    });
+
+    await expect(
+      sessionService.link(
+        "google",
+        {
+          sub: "google-123",
+          email: "newuser@example.com",
+          name: "New User",
+        },
+        "closed",
+      ),
+    ).rejects.toThrowError(BadRequestError);
+  });
+
+  it("should allow OAuth2 login for existing users when registration is disabled", async ({
+    expect,
+  }) => {
+    const { sessionService, userService, alepha } = await setup();
+
+    const realmProvider = alepha.inject(RealmProvider);
+    realmProvider.register("closed", {
+      settings: {
+        registrationAllowed: false,
+      } as never,
+    });
+
+    // Create existing user and identity
+    const user = await userService.users("closed").create({
+      realm: "closed",
+      email: "existing@example.com",
+      roles: ["user"],
+    });
+
+    await sessionService.identities("closed").create({
+      provider: "google",
+      providerUserId: "google-existing",
+      userId: user.id,
+    });
+
+    // Existing identity should still work
+    const result = await sessionService.link(
+      "google",
+      {
+        sub: "google-existing",
+        email: "existing@example.com",
+        name: "Existing User",
+      },
+      "closed",
+    );
+
+    expect(result.id).toBe(user.id);
+  });
+});

package/src/api/users/{jobs → __tests__}/UserJobs.spec.ts

@@ -5,7 +5,7 @@ import { AlephaOrmPostgres } from "alepha/orm/postgres";
 import { describe, test, vi } from "vitest";
 import { sessions } from "../entities/sessions.ts";
 import { users } from "../entities/users.ts";
-import { UserJobs } from "./UserJobs.ts";
+import { UserJobs } from "../jobs/UserJobs.ts";
 
 describe("UserJobs", () => {
   describe("purgeExpiredSessions", () => {

package/src/api/users/entities/users.ts

@@ -1,5 +1,5 @@
 import { type Static, t } from "alepha";
-import { $entity, db } from "alepha/orm";
+import { $entity, db, sql } from "alepha/orm";
 
 export const DEFAULT_USER_REALM_NAME = "default";
 
@@ -16,7 +16,7 @@ export const users = $entity({
     username: t.optional(
       t.shortText({
         minLength: 3,
-        maxLength: 50,
+        maxLength: 30,
         // pattern is handled at the realm settings level
       }),
     ),
@@ -32,9 +32,15 @@ export const users = $entity({
     enabled: db.default(t.boolean(), true),
 
     emailVerified: db.default(t.boolean(), false),
+
+    organizationId: db.organization(),
   }),
   indexes: [
-    { columns: ["realm", "username"], unique: true },
+    {
+      expressions: (self) => [self.realm, sql`LOWER(${self.username})`],
+      unique: true,
+      name: "users_realm_username_lower_idx",
+    },
     { columns: ["realm", "email"], unique: true },
     { columns: ["realm", "phoneNumber"], unique: true },
   ],

package/src/api/users/index.ts

@@ -1,11 +1,13 @@
 import { $module } from "alepha";
-import { AlephaCache } from "alepha/cache";
-import { AlephaEmail } from "alepha/email";
+import { UserAudits } from "./audits/UserAudits.ts";
+import { UserBuckets } from "./buckets/UserBuckets.ts";
 import { AdminIdentityController } from "./controllers/AdminIdentityController.ts";
 import { AdminSessionController } from "./controllers/AdminSessionController.ts";
 import { AdminUserController } from "./controllers/AdminUserController.ts";
 import { RealmController } from "./controllers/RealmController.ts";
 import { UserController } from "./controllers/UserController.ts";
+import { UserJobs } from "./jobs/UserJobs.ts";
+import { UserNotifications } from "./notifications/UserNotifications.ts";
 import { RealmProvider } from "./providers/RealmProvider.ts";
 import { CredentialService } from "./services/CredentialService.ts";
 import { IdentityService } from "./services/IdentityService.ts";
@@ -74,8 +76,6 @@ export * from "./services/UserService.ts";
 export const AlephaApiUsers = $module({
   name: "alepha.api.users",
   services: [
-    AlephaEmail,
-    AlephaCache,
     RealmProvider,
     SessionService,
     SessionCrudService,
@@ -88,5 +88,24 @@ export const AlephaApiUsers = $module({
     AdminSessionController,
     AdminIdentityController,
     RealmController,
+    UserJobs,
+    UserNotifications,
+    UserAudits,
+    UserBuckets,
   ],
+  register: (alepha) => {
+    alepha
+      .with(RealmProvider)
+      .with(SessionService)
+      .with(SessionCrudService)
+      .with(CredentialService)
+      .with(RegistrationService)
+      .with(UserService)
+      .with(IdentityService)
+      .with(UserController)
+      .with(AdminUserController)
+      .with(AdminSessionController)
+      .with(AdminIdentityController)
+      .with(RealmController);
+  },
 });