alepha 0.19.1 → 0.19.2

package/src/queue/core/providers/WorkerProvider.ts

@@ -2,7 +2,7 @@ import {
   $atom,
   $hook,
   $inject,
-  $use,
+  $state,
   Alepha,
   type Static,
   type TSchema,
@@ -61,7 +61,7 @@ declare module "alepha" {
 
 export class WorkerProvider {
   protected readonly log = $logger();
-  protected readonly options = $use(queueWorkerOptions);
+  protected readonly options = $state(queueWorkerOptions);
   protected readonly alepha = $inject(Alepha);
   protected readonly queueProvider = $inject(QueueProvider);
   protected readonly dateTimeProvider = $inject(DateTimeProvider);

package/src/queue/redis/providers/RedisQueueProvider.ts

@@ -1,4 +1,4 @@
-import { $atom, $inject, $use, type Static, t } from "alepha";
+import { $atom, $inject, $state, type Static, t } from "alepha";
 import type { QueueProvider } from "alepha/queue";
 import { RedisProvider } from "alepha/redis";
 
@@ -31,7 +31,7 @@ declare module "alepha" {
 // ---------------------------------------------------------------------------------------------------------------------
 
 export class RedisQueueProvider implements QueueProvider {
-  protected readonly options = $use(redisQueueOptions);
+  protected readonly options = $state(redisQueueOptions);
   protected readonly redisProvider: RedisProvider = $inject(RedisProvider);
 
   public prefix(queue: string): string {

package/src/react/core/{hooks → __tests__}/useAction.browser.spec.tsx

@@ -4,7 +4,7 @@ import { AlephaDateTime } from "alepha/datetime";
 import type { ReactNode } from "react";
 import { describe, test, vi } from "vitest";
 import { AlephaContext } from "../contexts/AlephaContext.ts";
-import { useAction } from "./useAction.ts";
+import { useAction } from "../hooks/useAction.ts";
 
 describe("useAction", () => {
   test("should handle successful action", async ({ expect }) => {

package/src/react/core/hooks/useAction.ts

@@ -134,8 +134,10 @@ export function useAction<Args extends any[], Result = void>(
   const isMountedRef = useRef(true);
   const intervalRef = useRef<Interval | undefined>(undefined);
 
-  // Cleanup on unmount
+  // Track mount state — must set true in body for React StrictMode double-invoke
   useEffect(() => {
+    isMountedRef.current = true;
+
     return () => {
       isMountedRef.current = false;
 
@@ -179,12 +181,11 @@ export function useAction<Args extends any[], Result = void>(
       setLoading(true);
       setError(undefined);
 
-      await alepha.events.emit("react:action:begin", {
-        type: "custom",
-        id: options.id,
-      });
-
       try {
+        await alepha.events.emit("react:action:begin", {
+          type: "custom",
+          id: options.id,
+        });
         // Pass abort signal as last argument to handler
         const result = await options.handler(...args, {
           signal: abortController.signal,

package/src/react/head/{providers → __tests__}/BrowserHeadProvider.browser.spec.ts

@@ -1,7 +1,7 @@
 import { Alepha } from "alepha";
 import { beforeEach, describe, expect, it } from "vitest";
 import type { Head } from "../interfaces/Head.ts";
-import { BrowserHeadProvider } from "./BrowserHeadProvider.ts";
+import { BrowserHeadProvider } from "../providers/BrowserHeadProvider.ts";
 
 describe("BrowserHeadProvider", () => {
   let alepha: Alepha;

package/src/react/head/{helpers → __tests__}/SeoExpander.spec.ts

@@ -1,6 +1,6 @@
 import { Alepha } from "alepha";
 import { describe, it } from "vitest";
-import { SeoExpander } from "./SeoExpander.ts";
+import { SeoExpander } from "../helpers/SeoExpander.ts";
 
 describe("SeoExpander", () => {
   it("should expand basic SEO configuration", ({ expect }) => {

package/src/react/i18n/{providers → __tests__}/I18nProvider.spec.ts

@@ -2,7 +2,7 @@ import { Alepha } from "alepha";
 import { describe, test } from "vitest";
 import { AlephaReactI18n } from "../index.ts";
 import { $dictionary } from "../primitives/$dictionary.ts";
-import { I18nProvider } from "./I18nProvider.ts";
+import { I18nProvider } from "../providers/I18nProvider.ts";
 
 describe("I18nProvider", () => {
   test("should register dictionaries on initialization", async ({ expect }) => {

package/src/react/i18n/{hooks → __tests__}/useI18n.browser.spec.tsx

@@ -4,10 +4,10 @@ import { AlephaContext } from "alepha/react";
 import type { ReactNode } from "react";
 import { act } from "react";
 import { describe, test } from "vitest";
+import { useI18n } from "../hooks/useI18n.ts";
 import { AlephaReactI18n } from "../index.ts";
 import { $dictionary } from "../primitives/$dictionary.ts";
 import { I18nProvider } from "../providers/I18nProvider.ts";
-import { useI18n } from "./useI18n.ts";
 
 describe("useI18n hook", () => {
   const renderWithAlepha = (alepha: Alepha, element: ReactNode) => {

package/src/react/intro/components/GettingStartedDevtoolsSlide.tsx

@@ -6,7 +6,7 @@ import type { GettingStartedSlide } from "./GettingStarted.tsx";
  * Returns undefined if devtools are not available.
  */
 export const useDevtoolsSlide = (): GettingStartedSlide | undefined => {
-  if (!import.meta.env.VITE_ALEPHA_DEVTOOLS) {
+  if (!import.meta.env?.VITE_ALEPHA_DEVTOOLS) {
     return undefined;
   }
 

package/src/react/router/{providers → __tests__}/ReactBrowserProvider.browser.spec.ts

@@ -1,6 +1,6 @@
 import { Alepha } from "alepha";
 import { beforeEach, describe, expect, it, vi } from "vitest";
-import { ReactBrowserProvider } from "./ReactBrowserProvider.ts";
+import { ReactBrowserProvider } from "../providers/ReactBrowserProvider.ts";
 
 class TestReactBrowserProvider extends ReactBrowserProvider {
   public testGetHydrationState = this.getHydrationState.bind(this);

package/src/react/router/providers/ReactBrowserProvider.ts

@@ -2,7 +2,7 @@ import {
   $atom,
   $hook,
   $inject,
-  $use,
+  $state,
   Alepha,
   type State,
   type Static,
@@ -54,7 +54,7 @@ export class ReactBrowserProvider {
   protected readonly dateTimeProvider = $inject(DateTimeProvider);
   protected readonly browserHeadProvider = $inject(BrowserHeadProvider);
 
-  protected readonly options = $use(reactBrowserOptions);
+  protected readonly options = $state(reactBrowserOptions);
 
   public get rootId() {
     return "root";

package/src/react/router/providers/ReactPageProvider.ts

@@ -2,7 +2,7 @@ import {
   $atom,
   $hook,
   $inject,
-  $use,
+  $state,
   Alepha,
   AlephaError,
   type TSchema,
@@ -60,7 +60,7 @@ export const reactPageOptions = $atom({
 export class ReactPageProvider {
   protected readonly dateTimeProvider = $inject(DateTimeProvider);
   protected readonly log = $logger();
-  protected readonly options = $use(reactPageOptions);
+  protected readonly options = $state(reactPageOptions);
   protected readonly alepha = $inject(Alepha);
   protected readonly pages: PageRoute[] = [];
   protected nextIdCursor = 0;

package/src/react/router/providers/ReactServerProvider.ts

@@ -4,7 +4,7 @@ import {
   $env,
   $hook,
   $inject,
-  $use,
+  $state,
   Alepha,
   type Middleware,
   OPTIONS,
@@ -72,8 +72,8 @@ export class ReactServerProvider {
    */
   protected hasServerLinksProvider = false;
 
-  protected readonly options = $use(reactServerOptions);
-  protected readonly pageOptions = $use(reactPageOptions);
+  protected readonly options = $state(reactServerOptions);
+  protected readonly pageOptions = $state(reactPageOptions);
 
   /**
    * Configure the React server provider.

package/src/redis/{providers → __tests__}/BunRedisProvider.bun.spec.ts

@@ -1,10 +1,10 @@
 import { afterAll, beforeAll, describe, expect, it } from "bun:test";
 import { randomUUID } from "node:crypto";
 import { Alepha } from "alepha";
-import { BunRedisProvider } from "./BunRedisProvider.ts";
-import { BunRedisSubscriberProvider } from "./BunRedisSubscriberProvider.ts";
-import { RedisProvider } from "./RedisProvider.ts";
-import { RedisSubscriberProvider } from "./RedisSubscriberProvider.ts";
+import { BunRedisProvider } from "../providers/BunRedisProvider.ts";
+import { BunRedisSubscriberProvider } from "../providers/BunRedisSubscriberProvider.ts";
+import { RedisProvider } from "../providers/RedisProvider.ts";
+import { RedisSubscriberProvider } from "../providers/RedisSubscriberProvider.ts";
 
 // -------------------------------------------------------------------------------------------------------------------
 

package/src/retry/{primitives → __tests__}/$retry.middleware.spec.ts

@@ -1,6 +1,6 @@
 import { $pipeline, Alepha } from "alepha";
 import { describe, test } from "vitest";
-import { $retry } from "./$retry.ts";
+import { $retry } from "../primitives/$retry.ts";
 
 describe("$retry middleware", () => {
   test("retries handler on failure", async ({ expect }) => {

package/src/router/{TemplatedPathParser.spec.ts → __tests__/TemplatedPathParser.spec.ts}

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { TemplatedPathParser } from "./TemplatedPathParser.ts";
+import { TemplatedPathParser } from "../TemplatedPathParser.ts";
 
 describe("TemplatedPathParser", () => {
   describe("normalize", () => {

package/src/scheduler/primitives/$scheduler.ts

@@ -2,7 +2,7 @@ import {
   $atom,
   $inject,
   $pipeline,
-  $use,
+  $state,
   Alepha,
   type Async,
   createPrimitive,
@@ -93,7 +93,7 @@ declare module "alepha" {
 
 export class SchedulerPrimitive extends Primitive<SchedulerPrimitiveOptions> {
   protected readonly log = $logger();
-  protected readonly settings = $use(schedulerOptions);
+  protected readonly settings = $state(schedulerOptions);
   protected readonly alepha = $inject(Alepha);
   protected readonly dateTimeProvider = $inject(DateTimeProvider);
   protected readonly cronProvider = $inject(CronProvider);

package/src/security/{primitives → __tests__}/$secure-browser.spec.ts

@@ -1,7 +1,7 @@
 import { $pipeline, Alepha } from "alepha";
 import { describe, it } from "vitest";
 import { currentUserAtom } from "../atoms/currentUserAtom.ts";
-import { $secure } from "./$secure.browser.ts";
+import { $secure } from "../primitives/$secure.browser.ts";
 
 describe("$secure (browser)", () => {
   describe("authentication", () => {

package/src/security/{primitives → __tests__}/$secure.spec.ts

@@ -3,8 +3,8 @@ import { ForbiddenError, UnauthorizedError } from "alepha/server";
 import { describe, test } from "vitest";
 import { currentUserAtom } from "../atoms/currentUserAtom.ts";
 import type { UserAccountToken } from "../interfaces/UserAccountToken.ts";
+import { $secure } from "../primitives/$secure.ts";
 import { SecurityProvider } from "../providers/SecurityProvider.ts";
-import { $secure } from "./$secure.ts";
 
 // -----------------------------------------------------------------------------------------------------------------
 // Test helpers

package/src/security/primitives/$issuer.ts

@@ -311,7 +311,7 @@ export class IssuerPrimitive extends Primitive<IssuerPrimitiveOptions> {
         preferred_username: user.username,
         picture: user.picture,
         // our claims
-        organizations: user.organizations,
+        organization: user.organization,
         roles: user.roles,
       },
       this.name,

package/src/security/providers/JwtProvider.ts

@@ -37,27 +37,23 @@ export class JwtProvider {
    */
   public setKeyLoader(name: string, secretKeyOrJwks: string | JSONWebKeySet) {
     if (typeof secretKeyOrJwks === "object") {
-      this.log.info(
-        `will verify JWTs from key '${name}' with JWKS object (x${secretKeyOrJwks.keys.length})`,
-      );
+      this.log.debug(`will verify JWTs from key '${name}' with JWKS object`);
       this.keystore.push({
         name,
         keyLoader: createLocalJWKSet(secretKeyOrJwks),
       });
     } else if (this.isSecretKey(secretKeyOrJwks)) {
       const secretKey = this.encoder.encode(secretKeyOrJwks);
-      this.log.info(
-        `will verify JWTs from issuer '${name}' with secret key (${secretKey.length} bytes)`,
-      );
+      this.log.debug(`will verify JWTs from issuer '${name}' with secret key`);
       this.keystore.push({
         name,
         secretKey: secretKeyOrJwks,
         keyLoader: () => Promise.resolve(createSecretKey(secretKey)),
       });
     } else {
-      this.log.info(
-        `will verify JWTs from issuer '${name}' with JWKS ${secretKeyOrJwks}`,
-      );
+      this.log.debug(`will verify JWTs from issuer '${name}' with JWKS`, {
+        url: secretKeyOrJwks,
+      });
       this.keystore.push({
         name,
         keyLoader: createRemoteJWKSet(new URL(secretKeyOrJwks)),
@@ -187,7 +183,7 @@ export interface ExtendedJWTPayload extends JWTPayload {
   name?: string;
   roles?: string[];
   email?: string;
-  organizations?: string[];
+  organization?: string;
   // keycloak specific
   realm_access?: { roles: string[] };
 }

package/src/security/providers/SecurityProvider.ts

@@ -295,7 +295,7 @@ export class SecurityProvider {
     const username = this.getUsernameFromPayload(payload);
     const picture = this.getPictureFromPayload(payload);
     const name = this.getNameFromPayload(payload);
-    const organizations = this.getOrganizationsFromPayload(payload);
+    const organization = this.getOrganizationFromPayload(payload);
     const rolesFromSystem = this.getRoles(realmName);
     const roles = rolesFromPayload
       .reduce<Role[]>(
@@ -317,7 +317,7 @@ export class SecurityProvider {
       email,
       username,
       picture,
-      organizations,
+      organization,
       sessionId,
     };
   }
@@ -916,20 +916,15 @@ export class SecurityProvider {
     return this.UNKNOWN_USER_NAME;
   }
 
-  public getOrganizationsFromPayload(
+  public getOrganizationFromPayload(
     payload: Record<string, any>,
-  ): string[] | undefined {
+  ): string | undefined {
     if (!payload) {
       return;
     }
 
-    if (payload.organization) {
-      if (typeof payload.organization === "string") {
-        return [payload.organization];
-      }
-      if (Array.isArray(payload.organization)) {
-        return payload.organization;
-      }
+    if (typeof payload.organization === "string") {
+      return payload.organization;
     }
   }
 }

package/src/security/schemas/userAccountInfoSchema.ts

@@ -39,9 +39,9 @@ export const userAccountInfoSchema = t.object({
 
   // -------------------------------------------------------------------------------------------------------------------
 
-  organizations: t.optional(
-    t.array(t.text(), {
-      description: "List of organizations the user belongs to.",
+  organization: t.optional(
+    t.uuid({
+      description: "Organization the user belongs to.",
     }),
   ),
 

package/src/server/auth/providers/ServerAuthProvider.ts

@@ -50,6 +50,7 @@ export class ServerAuthProvider {
       realm: t.optional(t.text()),
       codeVerifier: t.optional(t.text({ size: "long" })),
       redirectUri: t.optional(t.text({ size: "long" })),
+      loginUri: t.optional(t.text({ size: "long" })),
       state: t.optional(t.text()),
       nonce: t.optional(t.text()),
     }),
@@ -278,7 +279,11 @@ export class ServerAuthProvider {
         redirect_uri: t.optional(t.text({ size: "rich" })),
       }),
     },
-    handler: async ({ query, url, reply }) => {
+    handler: async ({ query, url, reply, headers }) => {
+      const loginUri = headers.referer
+        ? new URL(headers.referer).pathname + new URL(headers.referer).search
+        : undefined;
+
       const provider = this.provider({
         provider: query.provider,
         realm: query.realm,
@@ -318,6 +323,7 @@ export class ServerAuthProvider {
           state,
           nonce: parameters.nonce,
           redirectUri: query.redirect_uri ?? "/",
+          loginUri,
           provider: query.provider,
           realm: query.realm,
         });
@@ -345,6 +351,7 @@ export class ServerAuthProvider {
       this.authorizationCode.set({
         codeVerifier,
         redirectUri: query.redirect_uri ?? "/",
+        loginUri,
         provider: query.provider,
         realm: query.realm,
       });
@@ -374,6 +381,7 @@ export class ServerAuthProvider {
       }
 
       const redirectUri = authorizationCode.redirectUri ?? "/";
+      const loginUri = authorizationCode.loginUri;
 
       const externalTokens = await authorizationCodeGrant(oauth, url, {
         pkceCodeVerifier: authorizationCode.codeVerifier,
@@ -405,7 +413,21 @@ export class ServerAuthProvider {
 
       // internal, we need to create our own tokens
 
-      const user = await provider.user(externalTokens);
+      let user: UserAccount;
+      try {
+        user = await provider.user(externalTokens);
+      } catch (e) {
+        this.log.warn("OAuth2 account linking failed", e);
+        const errorTarget = loginUri || redirectUri;
+        const errorUrl = new URL(errorTarget, url.origin);
+        errorUrl.searchParams.set(
+          "error",
+          e instanceof BadRequestError ? e.message : "Authentication failed",
+        );
+        reply.redirect(errorUrl.pathname + errorUrl.search, 302);
+        return;
+      }
+
       const tokens = await issuer.createToken(user);
 
       this.setTokens(

package/src/server/cookies/{services → __tests__}/CookieParser.spec.ts

@@ -1,6 +1,6 @@
 import { describe, it } from "vitest";
 import type { Cookie } from "../primitives/$cookie.ts";
-import { CookieParser } from "./CookieParser.ts";
+import { CookieParser } from "../services/CookieParser.ts";
 
 const parser = new CookieParser();
 

package/src/server/core/{primitives → __tests__}/$circuit.spec.ts

@@ -1,7 +1,7 @@
 import { $pipeline, Alepha } from "alepha";
 import { DateTimeProvider } from "alepha/datetime";
 import { describe, test } from "vitest";
-import { $circuit } from "./$circuit.ts";
+import { $circuit } from "../primitives/$circuit.ts";
 
 // -----------------------------------------------------------------------------------------------------------------
 // $circuit — core behavior

package/src/server/core/{providers → __tests__}/NodeHttpServerProvider.spec.ts

@@ -1,6 +1,6 @@
 import { Alepha } from "alepha";
 import { afterEach, describe, expect, test } from "vitest";
-import { NodeHttpServerProvider } from "./NodeHttpServerProvider.ts";
+import { NodeHttpServerProvider } from "../providers/NodeHttpServerProvider.ts";
 
 describe("NodeHttpServerProvider", () => {
   describe("graceful shutdown", () => {

package/src/server/core/{providers → __tests__}/ServerBodyParserProvider.spec.ts

@@ -5,7 +5,7 @@ import { $action, HttpError } from "../index.ts";
 import {
   bodyParserOptions,
   ServerBodyParserProvider,
-} from "./ServerBodyParserProvider.ts";
+} from "../providers/ServerBodyParserProvider.ts";
 
 describe("ServerBodyParserProvider", () => {
   it("should parse JSON body", async ({ expect }) => {
@@ -309,6 +309,36 @@ describe("ServerBodyParserProvider", () => {
     expect(result).toBeUndefined();
   });
 
+  it("should cancel stream reader when body exceeds limit", async ({
+    expect,
+  }) => {
+    const alepha = Alepha.create();
+    alepha.store.mut(bodyParserOptions, () => ({
+      inflate: true,
+      limit: 10,
+    }));
+    const parser = alepha.inject(ServerBodyParserProvider);
+    await alepha.start();
+
+    let readerCancelled = false;
+
+    // Stream must stay open (not closed) so cancel() is invocable
+    const stream = new ReadableStream({
+      pull(controller) {
+        controller.enqueue(new TextEncoder().encode("A".repeat(20)));
+      },
+      cancel() {
+        readerCancelled = true;
+      },
+    });
+
+    await expect(parser.parseText(stream)).rejects.toThrowError(
+      "Request body size limit exceeded",
+    );
+
+    expect(readerCancelled).toBe(true);
+  });
+
   it("should return undefined for unsupported content-type", async ({
     expect,
   }) => {

package/src/server/core/{providers → __tests__}/ServerCompressProvider.spec.ts

@@ -1,7 +1,7 @@
 import { Alepha } from "alepha";
 import { $action, $route, AlephaServer, ServerProvider } from "alepha/server";
 import { describe, it } from "vitest";
-import { compressOptions } from "./ServerCompressProvider.ts";
+import { compressOptions } from "../providers/ServerCompressProvider.ts";
 
 class App {
   hello = $action({

package/src/server/core/{providers → __tests__}/ServerHelmetProvider.spec.ts

@@ -1,7 +1,10 @@
 import { Alepha } from "alepha";
 import { $action, AlephaServer, ServerProvider } from "alepha/server";
 import { describe, expect, test } from "vitest";
-import { type HelmetOptions, helmetOptions } from "./ServerHelmetProvider.ts";
+import {
+  type HelmetOptions,
+  helmetOptions,
+} from "../providers/ServerHelmetProvider.ts";
 
 class TestApp {
   ping = $action({ handler: () => "pong" });

package/src/server/core/{providers → __tests__}/ServerMultipartProvider.spec.ts

@@ -1,7 +1,7 @@
 import { Alepha, t } from "alepha";
 import { $action, AlephaServer, ServerProvider } from "alepha/server";
 import { describe, test } from "vitest";
-import { multipartOptions } from "./ServerMultipartProvider.ts";
+import { multipartOptions } from "../providers/ServerMultipartProvider.ts";
 
 class App {
   upload = $action({

package/src/server/core/{services → __tests__}/ServerRequestParser.spec.ts

@@ -2,7 +2,7 @@ import { Alepha } from "alepha";
 import { describe, it } from "vitest";
 import { CryptoProvider } from "../../../crypto/index.ts";
 import type { ServerRequestData } from "../interfaces/ServerRequest.ts";
-import { ServerRequestParser } from "./ServerRequestParser.ts";
+import { ServerRequestParser } from "../services/ServerRequestParser.ts";
 
 const createMockRequestData = (
   headers: Record<string, string> = {},

package/src/server/core/primitives/$action.ts

@@ -1,7 +1,7 @@
 import {
   $atom,
   $inject,
-  $use,
+  $state,
   AlephaError,
   type Async,
   createPrimitive,
@@ -235,7 +235,7 @@ export class ActionPrimitive<
   TConfig extends RequestConfigSchema,
 > extends PipelinePrimitive<ActionPrimitiveOptions<TConfig>> {
   protected readonly log = $logger();
-  protected readonly settings = $use(serverApiOptions);
+  protected readonly settings = $state(serverApiOptions);
   protected readonly httpClient = $inject(HttpClient);
   protected readonly serverProvider = $inject(ServerProvider);
   protected readonly serverRouterProvider = $inject(ServerRouterProvider);

package/src/server/core/primitives/$sse.ts

@@ -1,6 +1,6 @@
 import {
   $inject,
-  $use,
+  $state,
   AlephaError,
   type Async,
   createPrimitive,
@@ -392,7 +392,7 @@ export class SsePrimitive<
   TConfig extends SseConfigSchema,
 > extends PipelinePrimitive<SsePrimitiveOptions<TConfig>> {
   protected readonly log = $logger();
-  protected readonly settings = $use(serverApiOptions);
+  protected readonly settings = $state(serverApiOptions);
   protected readonly serverProvider = $inject(ServerProvider);
   protected readonly serverRouterProvider = $inject(ServerRouterProvider);