alepha 0.19.3 → 0.19.5

package/src/api/users/__tests__/SessionService.spec.ts

@@ -7,7 +7,7 @@ import {
   CryptoProvider,
   InvalidCredentialsError,
 } from "alepha/security";
-import { BadRequestError } from "alepha/server";
+import { BadRequestError, UnauthorizedError } from "alepha/server";
 import { describe, it } from "vitest";
 import {
   AlephaApiUsers,
@@ -320,6 +320,32 @@ describe("alepha/api/users - SessionService.login", () => {
     ).rejects.toThrowError(InvalidCredentialsError);
   });
 
+  it("should reject login for disabled user", async ({ expect }) => {
+    const { sessionService, userService, cryptoProvider, identities } =
+      await setup();
+
+    const password = "disabledUserPass123!";
+    const hashedPassword = await cryptoProvider.hashPassword(password);
+
+    const user = await userService.users().create({
+      username: "disableduser",
+      email: "disabled@example.com",
+      roles: ["user"],
+      enabled: false,
+    });
+
+    await identities.create({
+      provider: "local",
+      providerUserId: "disabled@example.com",
+      userId: user.id,
+      password: hashedPassword,
+    });
+
+    await expect(
+      sessionService.login("local", "disabled@example.com", password),
+    ).rejects.toThrowError(InvalidCredentialsError);
+  });
+
   describe("login rate limiting", () => {
     it("should block account after max failed attempts", async ({ expect }) => {
       const { sessionService, userService, cryptoProvider, identities } =
@@ -775,4 +801,119 @@ describe("alepha/api/users - SessionService.link", () => {
 
     expect(result.id).toBe(user.id);
   });
+
+  it("should refuse auto-link when OAuth provider says email_verified is false", async ({
+    expect,
+  }) => {
+    const { sessionService, userService } = await setup();
+
+    await userService.users().create({
+      username: "verifieduser",
+      email: "verified@example.com",
+      roles: ["user"],
+    });
+
+    await expect(
+      sessionService.link("google", {
+        sub: "google-unverified",
+        email: "verified@example.com",
+        name: "Unverified User",
+        email_verified: false,
+      }),
+    ).rejects.toThrowError(BadRequestError);
+  });
+
+  it("should allow auto-link when email_verified is true or undefined", async ({
+    expect,
+  }) => {
+    const { sessionService, userService } = await setup();
+
+    const user = await userService.users().create({
+      username: "linkableuser",
+      email: "linkable@example.com",
+      roles: ["user"],
+    });
+
+    const result = await sessionService.link("google", {
+      sub: "google-verified",
+      email: "linkable@example.com",
+      name: "Verified User",
+      email_verified: true,
+    });
+
+    expect(result.id).toBe(user.id);
+  });
+
+  it("should use defaultRoles from realm settings for new OAuth users", async ({
+    expect,
+  }) => {
+    const { sessionService, alepha } = await setup();
+
+    const realmProvider = alepha.inject(RealmProvider);
+    realmProvider.register("custom-roles", {
+      settings: {
+        registrationAllowed: true,
+        defaultRoles: ["member", "viewer"],
+      } as never,
+    });
+
+    const result = await sessionService.link(
+      "google",
+      {
+        sub: "google-newuser-roles",
+        email: "newuser-roles@example.com",
+        name: "New Role User",
+      },
+      "custom-roles",
+    );
+
+    expect("roles" in result && result.roles).toEqual(["member", "viewer"]);
+  });
+});
+
+describe("alepha/api/users - SessionService.refreshSession", () => {
+  it("should reject refresh for disabled user and delete session", async ({
+    expect,
+  }) => {
+    const { sessionService, userService, cryptoProvider, identities } =
+      await setup();
+
+    const password = "refreshDisabledPass!";
+    const hashedPassword = await cryptoProvider.hashPassword(password);
+
+    const user = await userService.users().create({
+      username: "refreshdisableduser",
+      email: "refresh-disabled@example.com",
+      roles: ["user"],
+    });
+
+    await identities.create({
+      provider: "local",
+      providerUserId: "refresh-disabled@example.com",
+      userId: user.id,
+      password: hashedPassword,
+    });
+
+    // Login to get a session with refresh token
+    await sessionService.login(
+      "local",
+      "refresh-disabled@example.com",
+      password,
+    );
+
+    const { refreshToken } = await sessionService.createSession(user, 3600);
+
+    // Disable the user
+    await userService.users().updateById(user.id, { enabled: false });
+
+    // Refresh should fail with UnauthorizedError
+    await expect(
+      sessionService.refreshSession(refreshToken),
+    ).rejects.toThrowError(UnauthorizedError);
+
+    // Session should be deleted — a second refresh should also fail
+    await expect(
+      sessionService.refreshSession(refreshToken),
+    ).rejects.toThrowError();
+  });
 });

package/src/api/users/atoms/realmAuthSettingsAtom.ts

@@ -70,6 +70,15 @@ export const realmAuthSettingsAtom = $atom({
       description:
         "List of usernames that are automatically promoted to admin role on login",
     }),
+    defaultRoles: t.array(t.string(), {
+      description: "Default roles assigned to newly registered users",
+    }),
+    verifyEmailUrl: t.optional(
+      t.string({
+        description:
+          "Base URL for email verification links (used when verification method is 'link'). Token and email are appended as query params.",
+      }),
+    ),
     passwordPolicy: t.object({
       minLength: t.integer({
         description: "Minimum password length",
@@ -122,7 +131,7 @@ export const realmAuthSettingsAtom = $atom({
     firstNameLastName: "none" as FieldRequirement,
     adminEmails: [],
     adminUsernames: [],
-    // TODO: not implemented yet
+    defaultRoles: ["user"],
     passwordPolicy: {
       minLength: 8,
       requireUppercase: true,

package/src/api/users/controllers/UserController.ts

@@ -1,4 +1,5 @@
 import { $inject, t } from "alepha";
+import { $secure } from "alepha/security";
 import { $action, okSchema } from "alepha/server";
 import { completePasswordResetRequestSchema } from "../schemas/completePasswordResetRequestSchema.ts";
 import { completeRegistrationRequestSchema } from "../schemas/completeRegistrationRequestSchema.ts";
@@ -216,13 +217,7 @@ export class UserController {
           t.enum(["code", "link"], {
             default: "code",
             description:
-              'Verification method: "code" sends a 6-digit code, "link" sends a clickable verification link.',
-          }),
-        ),
-        verifyUrl: t.optional(
-          t.string({
-            description:
-              'Base URL for verification link. Required when method is "link". Token and email will be appended as query params.',
+              'Verification method: "code" sends a 6-digit code, "link" sends a clickable verification link. When using "link", configure verifyEmailUrl in realm settings.',
           }),
         ),
       }),
@@ -240,7 +235,6 @@ export class UserController {
         body.email,
         query.userRealmName,
         method,
-        query.verifyUrl,
       );
 
       return {
@@ -293,6 +287,7 @@ export class UserController {
   public checkEmailVerification = $action({
     path: "/users/email-verification/check",
     group: this.group,
+    use: [$secure()],
     schema: {
       query: t.object({
         email: t.email(),

package/src/api/users/notifications/UserNotifications.ts

@@ -109,6 +109,29 @@ export class UserNotifications {
     }),
   });
 
+  public readonly accountLockout = $notification({
+    category: "security",
+    description:
+      "Email sent to users when their account is temporarily locked due to too many failed login attempts.",
+    critical: true,
+    sensitive: true,
+    email: {
+      subject: "Account temporarily locked",
+      body: (it) => `
+				<h1>Account Temporarily Locked</h1>
+				<p>Hi ${it.email},</p>
+				<p>Your account has been temporarily locked due to too many failed login attempts.</p>
+				<p>If this was you, please wait ${it.lockoutMinutes} minutes before trying again. If you've forgotten your password, you can reset it using the password reset feature.</p>
+				<p>If this wasn't you, someone may be trying to access your account. We recommend changing your password as soon as possible.</p>
+				<p>Best regards,<br>The Team</p>
+			`,
+    },
+    schema: t.object({
+      email: t.string({ format: "email" }),
+      lockoutMinutes: t.number(),
+    }),
+  });
+
   public readonly emailVerificationLink = $notification({
     category: "security",
     description:

package/src/api/users/primitives/$realm.ts

@@ -12,9 +12,13 @@ import {
   SecurityProvider,
 } from "alepha/security";
 import {
+  $authApple,
   $authCredentials,
+  $authFacebook,
+  $authFranceConnect,
   $authGithub,
   $authGoogle,
+  $authMicrosoft,
   type AuthPrimitive,
   type Credentials,
   type LinkAccountOptions,
@@ -205,6 +209,22 @@ export const $realm = (options: RealmOptions = {}): RealmPrimitive => {
       auth.github = $authGithub(realm);
     }
 
+    if (identities.apple) {
+      auth.apple = $authApple(realm);
+    }
+
+    if (identities.facebook) {
+      auth.facebook = $authFacebook(realm);
+    }
+
+    if (identities.microsoft) {
+      auth.microsoft = $authMicrosoft(realm);
+    }
+
+    if (identities.franceconnect) {
+      auth.franceconnect = $authFranceConnect(realm);
+    }
+
     alepha.with(() => auth);
   }
 
@@ -315,6 +335,10 @@ export interface RealmOptions {
     credentials?: true;
     google?: true;
     github?: true;
+    apple?: true;
+    facebook?: true;
+    microsoft?: true;
+    franceconnect?: true;
   };
 
   /**

package/src/api/users/schemas/loginSchema.ts

@@ -8,7 +8,7 @@ export const loginSchema = t.object({
     description: "Username or email address for login",
   }),
   password: t.text({
-    minLength: 6,
+    minLength: 8,
     description: "User password",
   }),
 });

package/src/api/users/services/CredentialService.ts

@@ -7,6 +7,7 @@ import { $logger } from "alepha/logger";
 import { CryptoProvider } from "alepha/security";
 import { BadRequestError, HttpError } from "alepha/server";
 import { $client } from "alepha/server/links";
+import type { RealmAuthSettings } from "../atoms/realmAuthSettingsAtom.ts";
 import { UserAudits } from "../audits/UserAudits.ts";
 import { UserNotifications } from "../notifications/UserNotifications.ts";
 import { RealmProvider } from "../providers/RealmProvider.ts";
@@ -67,6 +68,38 @@ export class CredentialService {
     return this.realmProvider.identityRepository(userRealmName);
   }
 
+  /**
+   * Validate a password against the realm's password policy.
+   */
+  public validatePasswordPolicy(
+    password: string,
+    policy: RealmAuthSettings["passwordPolicy"],
+  ): void {
+    if (password.length < policy.minLength) {
+      throw new BadRequestError(
+        `Password must be at least ${policy.minLength} characters`,
+      );
+    }
+    if (policy.requireUppercase && !/[A-Z]/.test(password)) {
+      throw new BadRequestError(
+        "Password must contain at least one uppercase letter",
+      );
+    }
+    if (policy.requireLowercase && !/[a-z]/.test(password)) {
+      throw new BadRequestError(
+        "Password must contain at least one lowercase letter",
+      );
+    }
+    if (policy.requireNumbers && !/\d/.test(password)) {
+      throw new BadRequestError("Password must contain at least one number");
+    }
+    if (policy.requireSpecialCharacters && !/[^a-zA-Z0-9]/.test(password)) {
+      throw new BadRequestError(
+        "Password must contain at least one special character",
+      );
+    }
+  }
+
   /**
    * Phase 1: Create a password reset intent.
    *
@@ -90,6 +123,14 @@ export class CredentialService {
       .add(INTENT_TTL_MINUTES, "minutes")
       .toISOString();
 
+    // Check if password reset is allowed for this realm
+    const realm = this.realmProvider.getRealm(userRealmName);
+    const realmSettings = await realm.getSettings();
+    if (realmSettings.resetPasswordAllowed === false) {
+      this.log.debug("Password reset not allowed for realm", { userRealmName });
+      return { intentId, expiresAt };
+    }
+
     // Find user by email (silent fail for security)
     const user = await this.users(userRealmName).findOne({
       where: { email: { eq: email } },
@@ -187,6 +228,11 @@ export class CredentialService {
       });
     }
 
+    // Validate password against realm policy before consuming the verification code
+    const realm = this.realmProvider.getRealm(intent.realmName);
+    const realmSettings = await realm.getSettings();
+    this.validatePasswordPolicy(body.newPassword, realmSettings.passwordPolicy);
+
     // Verify code using verification controller
     const result = await this.verificationController
       .validateVerificationCode({
@@ -210,9 +256,6 @@ export class CredentialService {
       throw new BadRequestError("Verification code has already been used");
     }
 
-    // Atomically delete cache key to prevent replay
-    await this.intentCache.invalidate(body.intentId);
-
     // Hash the new password
     const hashedPassword = await this.cryptoProvider.hashPassword(
       body.newPassword,
@@ -228,13 +271,17 @@ export class CredentialService {
       userId: { eq: intent.userId },
     });
 
+    // Invalidate intent after all operations succeed,
+    // so the user can retry if password update or session cleanup fails.
+    // The verification code was already consumed (verifiedAt set), so replay is
+    // prevented even if the intent is still in cache.
+    await this.intentCache.invalidate(body.intentId);
+
     this.log.info("Password reset completed", {
       userId: intent.userId,
       email: intent.email,
     });
 
-    const realm = this.realmProvider.getRealm(intent.realmName);
-
     // Audit: password reset
     await this.userAudits(intent.realmName)?.recordUser("update", {
       userId: intent.userId,
@@ -320,6 +367,11 @@ export class CredentialService {
       throw new BadRequestError("Invalid or expired reset token");
     }
 
+    // Validate password against realm policy
+    const realm = this.realmProvider.getRealm(userRealmName);
+    const realmSettings = await realm.getSettings();
+    this.validatePasswordPolicy(newPassword, realmSettings.passwordPolicy);
+
     // Find user and identity
     const user = await this.users(userRealmName).getOne({
       where: { email: { eq: email } },
@@ -345,8 +397,6 @@ export class CredentialService {
       userId: { eq: user.id },
     });
 
-    const realm = this.realmProvider.getRealm(userRealmName);
-
     // Audit: password reset (legacy method)
     await this.userAudits(userRealmName)?.recordUser("update", {
       userId: user.id,

package/src/api/users/services/RegistrationService.ts

@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto";
 import { $inject, Alepha, AlephaError } from "alepha";
 import type { VerificationController } from "alepha/api/verifications";
 import { $cache } from "alepha/cache";
+import { CaptchaProvider } from "alepha/captcha";
 import { DateTimeProvider } from "alepha/datetime";
 import { $logger } from "alepha/logger";
 import { CryptoProvider } from "alepha/security";
@@ -14,6 +15,7 @@ import { RealmProvider } from "../providers/RealmProvider.ts";
 import type { CompleteRegistrationRequest } from "../schemas/completeRegistrationRequestSchema.ts";
 import type { RegisterRequest } from "../schemas/registerRequestSchema.ts";
 import type { RegistrationIntentResponse } from "../schemas/registrationIntentResponseSchema.ts";
+import { CredentialService } from "./CredentialService.ts";
 
 /**
  * Intent stored in cache during the registration flow.
@@ -46,12 +48,19 @@ export class RegistrationService {
   protected readonly cryptoProvider = $inject(CryptoProvider);
   protected readonly verificationController = $client<VerificationController>();
   protected readonly realmProvider = $inject(RealmProvider);
+  protected readonly credentialService = $inject(CredentialService);
+  protected readonly captchaProvider = $inject(CaptchaProvider);
 
   protected readonly intentCache = $cache<RegistrationIntent>({
     name: "api:users:registrations",
     ttl: [INTENT_TTL_MINUTES, "minutes"],
   });
 
+  protected readonly rateLimitCache = $cache<number>({
+    name: "api:users:registration-rate-limit",
+    ttl: [15, "minutes"],
+  });
+
   protected userAudits(realmName?: string) {
     const realm = this.realmProvider.getRealm(realmName);
     if (realm.features.audits) {
@@ -88,6 +97,20 @@ export class RegistrationService {
       userRealmName,
     });
 
+    // IP rate limiting
+    const request = this.alepha.store.get("alepha.http.request");
+    const ipKey = request?.ip ? `register:ip:${request.ip}` : undefined;
+    if (ipKey) {
+      const count = (await this.rateLimitCache.get(ipKey)) ?? 0;
+      if (count >= 10) {
+        this.log.warn("Registration rate limit exceeded", { ip: request?.ip });
+        throw new BadRequestError(
+          "Too many registration attempts, please try again later",
+        );
+      }
+      await this.rateLimitCache.set(ipKey, count + 1);
+    }
+
     const realm = this.realmProvider.getRealm(userRealmName);
     const realmSettings = await realm.getSettings();
 
@@ -106,6 +129,9 @@ export class RegistrationService {
     }
 
     if (body.username) {
+      // Security note: usernameRegExp is admin-controlled (from realmAuthSettingsAtom),
+      // not user input. Default is ^[a-zA-Z0-9_]{3,30}$ which is ReDoS-safe.
+      // No need for regex timeout or safe-regex validation here.
       const usernameRegExp = realmSettings?.usernameRegExp;
       if (usernameRegExp) {
         const regex = new RegExp(usernameRegExp);
@@ -138,6 +164,12 @@ export class RegistrationService {
     // Check for existing users (username, email, phone)
     await this.checkUserAvailability(body, userRealmName);
 
+    // Validate password against realm policy
+    this.credentialService.validatePasswordPolicy(
+      body.password,
+      realmSettings.passwordPolicy,
+    );
+
     // Hash the password
     const passwordHash = await this.cryptoProvider.hashPassword(body.password);
 
@@ -261,12 +293,16 @@ export class RegistrationService {
       await this.verifyPhoneCode(intent.data.phoneNumber, body.phoneCode);
     }
 
-    // Validate captcha if required (placeholder for future implementation)
+    // Validate captcha if required
     if (intent.requirements.captcha) {
       if (!body.captchaToken) {
         throw new BadRequestError("Captcha verification is required");
       }
-      // TODO: Validate captcha token
+
+      const valid = await this.captchaProvider.verify(body.captchaToken);
+      if (!valid) {
+        throw new BadRequestError("Captcha verification failed");
+      }
     }
 
     // Final availability check (race condition guard)
@@ -279,19 +315,19 @@ export class RegistrationService {
       userRealmName,
     );
 
-    // Atomically delete cache key to prevent replay
-    await this.intentCache.invalidate(body.intentId);
+    const realm = this.realmProvider.getRealm(userRealmName);
+    const realmSettings = await realm.getSettings();
 
     // Create the user
     const user = await userRepository.create({
-      realm: userRealmName,
+      realm: realm.name,
       username: intent.data.username,
       email: intent.data.email,
       phoneNumber: intent.data.phoneNumber,
       firstName: intent.data.firstName,
       lastName: intent.data.lastName,
       picture: intent.data.picture,
-      roles: ["user"],
+      roles: realmSettings.defaultRoles,
       enabled: true,
       emailVerified: intent.requirements.email, // Marked as verified if we verified during registration
     });
@@ -303,14 +339,16 @@ export class RegistrationService {
       password: intent.data.passwordHash,
     });
 
+    // Invalidate intent after both user and identity creation succeed,
+    // so the user can retry if either operation fails.
+    await this.intentCache.invalidate(body.intentId);
+
     this.log.info("User registered successfully", {
       userId: user.id,
       email: user.email,
       username: user.username,
     });
 
-    const realm = this.realmProvider.getRealm(userRealmName);
-
     await this.userAudits(userRealmName)?.recordUser("create", {
       userId: user.id,
       userEmail: user.email ?? undefined,
@@ -335,11 +373,12 @@ export class RegistrationService {
     body: Pick<RegisterRequest, "username" | "email" | "phoneNumber">,
     userRealmName?: string,
   ): Promise<void> {
+    const realm = this.realmProvider.getRealm(userRealmName);
     const userRepository = this.realmProvider.userRepository(userRealmName);
 
     if (body.username) {
       const existingUser = await userRepository.findOne({
-        where: { username: { ilike: body.username } },
+        where: { realm: realm.name, username: { ilike: body.username } },
       });
       if (existingUser) {
         this.log.debug("Username already taken", { username: body.username });
@@ -349,7 +388,7 @@ export class RegistrationService {
 
     if (body.email) {
       const existingUser = await userRepository.findOne({
-        where: { email: { eq: body.email } },
+        where: { realm: realm.name, email: { eq: body.email } },
       });
       if (existingUser) {
         this.log.debug("Email already taken", { email: body.email });
@@ -359,7 +398,7 @@ export class RegistrationService {
 
     if (body.phoneNumber) {
       const existingUser = await userRepository.findOne({
-        where: { phoneNumber: { eq: body.phoneNumber } },
+        where: { realm: realm.name, phoneNumber: { eq: body.phoneNumber } },
       });
       if (existingUser) {
         this.log.debug("Phone number already taken", {