alepha 0.19.3 → 0.19.5

package/src/api/users/services/SessionService.ts

@@ -15,6 +15,7 @@ import { $client } from "alepha/server/links";
 import { FileSystemProvider } from "alepha/system";
 import { UserAudits } from "../audits/UserAudits.ts";
 import type { UserEntity } from "../entities/users.ts";
+import { UserNotifications } from "../notifications/UserNotifications.ts";
 import { RealmProvider } from "../providers/RealmProvider.ts";
 
 export class SessionService {
@@ -35,6 +36,14 @@ export class SessionService {
     return undefined;
   }
 
+  protected userNotifications(realmName?: string) {
+    const realm = this.realmProvider.getRealm(realmName);
+    if (realm.features.notifications) {
+      return this.alepha.inject(UserNotifications);
+    }
+    return undefined;
+  }
+
   public users(userRealmName?: string) {
     return this.realmProvider.userRepository(userRealmName);
   }
@@ -141,16 +150,12 @@ export class SessionService {
     // Truncate to leave room for suffix
     candidate = candidate.slice(0, maxLength - 2);
 
-    // Check uniqueness (case-insensitive)
+    // Check uniqueness (case-insensitive exact match)
     const isAvailable = async (name: string) => {
-      const existing = await users.findMany({
-        where: { username: { contains: name } },
-        limit: 1,
+      const existing = await users.findOne({
+        where: { username: { ilike: name } },
       });
-      // Case-insensitive check
-      return !existing.some(
-        (u: any) => u.username?.toLowerCase() === name.toLowerCase(),
-      );
+      return !existing;
     };
 
     if (await isAvailable(candidate)) {
@@ -354,6 +359,23 @@ export class SessionService {
         throw new InvalidCredentialsError();
       }
 
+      // Check if user account is enabled
+      if (!user.enabled) {
+        this.log.warn("Login attempt for disabled account", {
+          userId: user.id,
+          realm: name,
+        });
+
+        await this.userAudits(userRealmName)?.recordAuth("login_failed", {
+          userRealm: name,
+          resourceId: user.id,
+          description: "Login attempt for disabled account",
+          metadata: { provider, username },
+        });
+
+        throw new InvalidCredentialsError();
+      }
+
       // Account rate limit check (per-realm)
       const accountKey = `login:account:${name}:${user.id}`;
       const accountLocked = await this.isLoginLocked(
@@ -445,6 +467,15 @@ export class SessionService {
               metadata: { userId: user.id },
             },
           );
+
+          // Notify user about account lockout
+          if (user.email) {
+            const lockoutMinutes = Math.round(loginRateLimit.windowMs / 60_000);
+            await this.userNotifications(userRealmName)?.accountLockout.push({
+              contact: user.email,
+              variables: { email: user.email, lockoutMinutes },
+            });
+          }
         }
 
         throw new InvalidCredentialsError();
@@ -512,6 +543,8 @@ export class SessionService {
   public async refreshSession(refreshToken: string, userRealmName?: string) {
     this.log.trace("Refreshing session");
 
+    // getOne() throws DbEntityNotFoundError if not found — never returns null.
+    // No null check needed here.
     const session = await this.sessions(userRealmName).getOne({
       where: {
         refreshToken: { eq: refreshToken },
@@ -536,6 +569,16 @@ export class SessionService {
       },
     });
 
+    // Check if user account is still enabled
+    if (!user.enabled) {
+      this.log.warn("Session refresh for disabled account", {
+        userId: user.id,
+        sessionId: session.id,
+      });
+      await this.sessions(userRealmName).deleteById(session.id);
+      throw new UnauthorizedError("Account disabled");
+    }
+
     // Auto-promote to admin if configured (handles "I promote you admin" case)
     await this.ensureAdminRole(user, userRealmName);
 
@@ -636,11 +679,23 @@ export class SessionService {
 
     const existing = await users.findOne({
       where: {
+        realm: realm.name,
         email: profile.email,
       },
     });
 
     if (existing) {
+      // Refuse auto-link if the OAuth provider explicitly says email is not verified
+      if (profile.email_verified === false) {
+        this.log.warn(
+          "OAuth2 profile email not verified by provider, refusing auto-link",
+          { provider, email: profile.email, userId: existing.id },
+        );
+        throw new BadRequestError(
+          "Cannot link account: email not verified by provider",
+        );
+      }
+
       this.log.debug("Linking OAuth2 profile to existing user by email", {
         provider,
         profileSub: profile.sub,
@@ -692,7 +747,7 @@ export class SessionService {
       email: profile.email,
       // we trust the OAuth2 provider
       emailVerified: true,
-      roles: ["user"], // TODO: make default roles configurable via realm settings
+      roles: realmSettings.defaultRoles,
     });
 
     if (profile.picture) {

package/src/api/users/services/UserService.ts

@@ -49,7 +49,6 @@ export class UserService {
     email: string,
     userRealmName?: string,
     method: "code" | "link" = "code",
-    verifyUrl?: string,
   ): Promise<boolean> {
     this.log.trace("Requesting email verification", {
       email,
@@ -84,12 +83,15 @@ export class UserService {
         });
 
       if (method === "link") {
-        // Build verification URL with token
-        const url = new URL(verifyUrl || "/verify-email", "http://localhost");
+        // Build verification URL from realm settings (server-controlled, not user input)
+        const realm = this.realmProvider.getRealm(userRealmName);
+        const realmSettings = await realm.getSettings();
+        const baseUrl = realmSettings.verifyEmailUrl ?? "/verify-email";
+        const url = new URL(baseUrl, "http://localhost");
         url.searchParams.set("email", email);
         url.searchParams.set("token", verification.token);
-        const fullVerifyUrl = verifyUrl
-          ? `${verifyUrl}${url.search}`
+        const fullVerifyUrl = realmSettings.verifyEmailUrl
+          ? `${baseUrl}${url.search}`
           : url.pathname + url.search;
 
         await this.userNotifications(userRealmName)?.emailVerificationLink.push(
@@ -270,13 +272,12 @@ export class UserService {
     });
 
     const realm = this.realmProvider.getRealm(userRealmName);
+    const realmSettings = await realm.getSettings();
 
-    // TODO: one query instead of 3
-
-    // Check for existing user based on provided unique fields
+    // Check for existing user based on provided unique fields (scoped to realm)
     if (data.username) {
       const existingUser = await this.users(userRealmName).findOne({
-        where: { username: { ilike: data.username } },
+        where: { realm: realm.name, username: { ilike: data.username } },
       });
 
       if (existingUser) {
@@ -287,7 +288,7 @@ export class UserService {
 
     if (data.email) {
       const existingUser = await this.users(userRealmName).findOne({
-        where: { email: { eq: data.email } },
+        where: { realm: realm.name, email: { eq: data.email } },
       });
 
       if (existingUser) {
@@ -298,7 +299,7 @@ export class UserService {
 
     if (data.phoneNumber) {
       const existingUser = await this.users(userRealmName).findOne({
-        where: { phoneNumber: { eq: data.phoneNumber } },
+        where: { realm: realm.name, phoneNumber: { eq: data.phoneNumber } },
       });
 
       if (existingUser) {
@@ -311,7 +312,7 @@ export class UserService {
 
     const user = await this.users(userRealmName).create({
       ...data,
-      roles: data.roles ?? ["user"], // TODO: Default roles from realm settings
+      roles: data.roles ?? realmSettings.defaultRoles,
       realm: realm.name,
     });
 
@@ -386,6 +387,14 @@ export class UserService {
     this.log.trace("Deleting user", { id, userRealmName });
     const user = await this.getUserById(id, userRealmName);
 
+    // Clean up related sessions and identities before deleting the user
+    await this.realmProvider
+      .sessionRepository(userRealmName)
+      .deleteMany({ userId: { eq: id } });
+    await this.realmProvider
+      .identityRepository(userRealmName)
+      .deleteMany({ userId: { eq: id } });
+
     await this.users(userRealmName).deleteById(id);
     this.log.info("User deleted", { userId: id });