alepha 0.20.4 → 0.20.6

package/dist/api/users/index.js

@@ -12,6 +12,7 @@ import { $authApple, $authCredentials, $authFacebook, $authFranceConnect, $authG
 import { $etag } from "alepha/server/etag";
 import { randomInt, randomUUID } from "node:crypto";
 import { $cache, CacheProvider } from "alepha/cache";
+import { DatabaseCacheProvider } from "alepha/cache/database";
 import { DateTimeProvider } from "alepha/datetime";
 import { $job } from "alepha/api/jobs";
 import { FileSystemProvider } from "alepha/system";
@@ -155,6 +156,12 @@ const fieldRequirement = (description) => t.union([
 	t.const("optional"),
 	t.const("required")
 ], { description });
+const usernameFieldRequirement = (description) => t.union([
+	t.const("none"),
+	t.const("optional"),
+	t.const("required"),
+	t.const("email")
+], { description });
 const realmAuthSettingsAtom = $atom({
 	name: "alepha.api.users.realmAuthSettings",
 	schema: t.object({
@@ -163,8 +170,9 @@ const realmAuthSettingsAtom = $atom({
 		logoUrl: t.optional(t.string({ description: "Logo URL for auth pages" })),
 		registrationAllowed: t.boolean({ description: "Enable user self-registration" }),
 		email: fieldRequirement("Email address field requirement for user accounts"),
-		username: fieldRequirement("Username field requirement for user accounts"),
+		username: usernameFieldRequirement("Username field requirement for user accounts"),
 		usernameRegExp: t.string({ description: "Regular expression that usernames must match (if username is enabled)" }),
+		usernameBlocklist: t.array(t.text(), { description: "Usernames that the slugger / manual registration must reject. Default empty so apps can register `admin`/`root`/`me`/etc. if they want; populate it explicitly for handles you want to keep off-limits." }),
 		phoneNumber: fieldRequirement("Phone number field requirement for user accounts"),
 		verifyEmailRequired: t.boolean({ description: "Require email verification for user accounts" }),
 		verifyPhoneRequired: t.boolean({ description: "Require phone verification for user accounts" }),
@@ -212,7 +220,8 @@ const realmAuthSettingsAtom = $atom({
 		registrationAllowed: true,
 		email: "required",
 		username: "none",
-		usernameRegExp: "^[a-zA-Z0-9_]{3,30}$",
+		usernameRegExp: "^[a-zA-Z0-9_-]{3,30}$",
+		usernameBlocklist: [],
 		phoneNumber: "none",
 		verifyEmailRequired: false,
 		verifyPhoneRequired: false,
@@ -562,6 +571,19 @@ var SessionCrudService = class {
 		await this.sessions(userRealmName).deleteById(id);
 		this.log.info("Session deleted", { id });
 	}
+	/**
+	* Delete many sessions by ID in one repository call.
+	*/
+	async deleteSessions(ids, userRealmName) {
+		if (ids.length === 0) return [];
+		this.log.trace("Deleting sessions", {
+			count: ids.length,
+			userRealmName
+		});
+		const deleted = await this.sessions(userRealmName).deleteMany({ id: { inArray: ids } });
+		this.log.info("Sessions deleted", { count: deleted.length });
+		return deleted.map(String);
+	}
 };
 //#endregion
 //#region ../../src/api/users/controllers/AdminSessionController.ts
@@ -623,6 +645,27 @@ var AdminSessionController = class {
 			};
 		}
 	});
+	/**
+	* Delete many sessions in one repository call.
+	*/
+	deleteSessions = $action({
+		method: "POST",
+		path: `${this.url}/delete`,
+		group: this.group,
+		use: [$secure({ permissions: ["admin:session:delete"] })],
+		description: "Delete many sessions",
+		schema: {
+			query: t.object({ userRealmName: t.optional(t.string()) }),
+			body: t.object({ ids: t.array(t.uuid(), {
+				minItems: 1,
+				maxItems: 1e3
+			}) }),
+			response: t.object({ deleted: t.array(t.string()) })
+		},
+		handler: async ({ body, query }) => {
+			return { deleted: await this.sessionService.deleteSessions(body.ids, query.userRealmName) };
+		}
+	});
 };
 //#endregion
 //#region ../../src/api/users/schemas/createUserSchema.ts
@@ -1176,6 +1219,34 @@ var AdminUserController = class {
 			};
 		}
 	});
+	/**
+	* Delete many users in one request. Each id is processed sequentially so
+	* cascades and side-effects run as if called one-by-one. Errors on a single
+	* id surface with that id in the response.
+	*/
+	deleteUsers = $action({
+		method: "POST",
+		path: `${this.url}/delete`,
+		group: this.group,
+		use: [$secure({ permissions: ["admin:user:delete"] })],
+		description: "Delete many users",
+		schema: {
+			query: t.object({ userRealmName: t.optional(t.string()) }),
+			body: t.object({ ids: t.array(t.uuid(), {
+				minItems: 1,
+				maxItems: 1e3
+			}) }),
+			response: t.object({ deleted: t.array(t.uuid()) })
+		},
+		handler: async ({ body, query }) => {
+			const deleted = [];
+			for (const id of body.ids) {
+				await this.userService.deleteUser(id, query.userRealmName);
+				deleted.push(id);
+			}
+			return { deleted };
+		}
+	});
 };
 //#endregion
 //#region ../../src/api/users/schemas/realmConfigSchema.ts
@@ -1331,6 +1402,7 @@ var CredentialService = class {
 		if (this.realmProvider.getRealm(realmName).features.notifications) return this.alepha.inject(UserNotifications);
 	}
 	intentCache = $cache({
+		provider: DatabaseCacheProvider,
 		name: "api:users:password-reset-intents",
 		ttl: [INTENT_TTL_MINUTES$1, "minutes"]
 	});
@@ -1558,6 +1630,139 @@ var CredentialService = class {
 	}
 };
 //#endregion
+//#region ../../src/api/users/services/UsernameSlugger.ts
+/**
+* Derive stable, URL-safe usernames from email addresses.
+*
+* Used by the registration flow when `realm.settings.username === "email"`,
+* and reusable from any custom user-creation site (e.g. an OAuth-only flow
+* that wants the same handle convention).
+*
+* **Slug rule** — the local-part of the email is kept as-is (gmail
+* `+suffix` retained for predictability). Everything outside `[a-z0-9]` is
+* replaced with `-`, runs of `-` are collapsed, leading/trailing `-` are
+* trimmed, lowercased. If the result is shorter than {@link MIN_LENGTH} it
+* is padded with random alphanumerics. Result is clamped to
+* {@link MAX_LENGTH}.
+*
+* **Collision retry** — `pickAvailable()` checks the realm's `users` table
+* and the realm's `usernameBlocklist`. On hit, it appends `-<4 random>` and
+* retries up to {@link MAX_RETRIES} times. Best-effort against concurrent
+* registrations: the unique index on `(realm, lower(username))` is the
+* authoritative race guard, callers that hit a unique-violation should
+* call `pickAvailable` again with a fresh suffix.
+*
+* @see RegistrationService.createRegistrationIntent
+*/
+var UsernameSlugger = class UsernameSlugger {
+	realmProvider = $inject(RealmProvider);
+	log = $logger();
+	/**
+	* Floor for derived usernames. Shorter slugs are padded with random
+	* alphanumerics. Matches the lower bound of the default `usernameRegExp`.
+	*/
+	static MIN_LENGTH = 3;
+	/**
+	* Ceiling for derived usernames. Matches the upper bound of the default
+	* `usernameRegExp` and gives enough headroom for the random suffix added
+	* on collisions.
+	*/
+	static MAX_LENGTH = 30;
+	/**
+	* Length of the random suffix appended on collision (e.g. `-3dp6`).
+	* 36⁴ ≈ 1.6M variants per base — plenty for a tiny number of retries.
+	*/
+	static SUFFIX_LENGTH = 4;
+	/**
+	* How many times `pickAvailable` retries before giving up.
+	*/
+	static MAX_RETRIES = 5;
+	/**
+	* Alphabet used for the random suffix and for padding short slugs.
+	*/
+	static ALPHABET = "abcdefghijklmnopqrstuvwxyz0123456789";
+	/**
+	* Default replacement when the email's local-part contains no
+	* `[a-z0-9]` characters at all (rare but possible: `é@example.com`).
+	*/
+	static EMPTY_LOCAL_FALLBACK = "user";
+	/**
+	* Sanitize an email into a base username slug.
+	*
+	* Pure function — no DB access. Always returns a string that satisfies
+	* `^[a-z0-9-]{MIN_LENGTH,MAX_LENGTH}$`.
+	*
+	* @example
+	* slug("ni.foures+testkv@gmail.com") // "ni-foures-testkv"
+	* slug("john.doe@example.com")       // "john-doe"
+	* slug("é@example.com")              // "user-XXX" (padded)
+	*/
+	slug(email) {
+		const raw = (email ?? "").trim();
+		const at = raw.indexOf("@");
+		let result = (at > 0 ? raw.slice(0, at) : raw).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || UsernameSlugger.EMPTY_LOCAL_FALLBACK;
+		if (result.length < UsernameSlugger.MIN_LENGTH) {
+			const needed = UsernameSlugger.MIN_LENGTH - result.length;
+			result += this.randomSuffix(needed);
+		}
+		return this.clamp(result);
+	}
+	/**
+	* Find an available username for the realm, starting from `base`.
+	*
+	* Returns `base` when nothing collides. On a hit (existing row OR
+	* blocklisted name) appends `-<4 random>` and tries again, up to
+	* {@link MAX_RETRIES} times.
+	*
+	* The check is best-effort: a concurrent registration may still claim
+	* the same value before the caller's INSERT runs, in which case the DB
+	* unique index throws and the caller should retry.
+	*/
+	async pickAvailable(realmName, base) {
+		const blocklist = await this.getBlocklist(realmName);
+		const repo = this.realmProvider.userRepository(realmName);
+		const realm = this.realmProvider.getRealm(realmName);
+		const isAvailable = async (candidate) => {
+			if (this.isBlockedAgainst(candidate, blocklist)) return false;
+			return !await repo.findOne({ where: {
+				realm: { eq: realm.name },
+				username: { ilike: candidate }
+			} });
+		};
+		if (await isAvailable(base)) return base;
+		const reserve = 1 + UsernameSlugger.SUFFIX_LENGTH;
+		const trimmedBase = base.length > UsernameSlugger.MAX_LENGTH - reserve ? base.slice(0, UsernameSlugger.MAX_LENGTH - reserve) : base;
+		for (let i = 0; i < UsernameSlugger.MAX_RETRIES; i++) {
+			const candidate = `${trimmedBase}-${this.randomSuffix(UsernameSlugger.SUFFIX_LENGTH)}`;
+			if (await isAvailable(candidate)) return candidate;
+		}
+		throw new AlephaError(`Could not find an available username starting from "${base}" after ${UsernameSlugger.MAX_RETRIES} attempts.`);
+	}
+	/**
+	* Check a name against the realm's `usernameBlocklist`. Case-insensitive.
+	*/
+	async isBlocked(realmName, name) {
+		const blocklist = await this.getBlocklist(realmName);
+		return this.isBlockedAgainst(name, blocklist);
+	}
+	async getBlocklist(realmName) {
+		const list = (await this.realmProvider.getRealm(realmName).getSettings())?.usernameBlocklist ?? [];
+		return new Set(list.map((b) => b.toLowerCase()));
+	}
+	isBlockedAgainst(name, blocklist) {
+		return blocklist.has(name.toLowerCase());
+	}
+	clamp(s) {
+		return s.length > UsernameSlugger.MAX_LENGTH ? s.slice(0, UsernameSlugger.MAX_LENGTH) : s;
+	}
+	randomSuffix(length) {
+		const chars = UsernameSlugger.ALPHABET;
+		let out = "";
+		for (let i = 0; i < length; i++) out += chars[Math.floor(Math.random() * chars.length)];
+		return out;
+	}
+};
+//#endregion
 //#region ../../src/api/users/services/RegistrationService.ts
 const INTENT_TTL_MINUTES = 10;
 var RegistrationService = class {
@@ -1569,11 +1774,14 @@ var RegistrationService = class {
 	realmProvider = $inject(RealmProvider);
 	credentialService = $inject(CredentialService);
 	captchaProvider = $inject(CaptchaProvider);
+	usernameSlugger = $inject(UsernameSlugger);
 	intentCache = $cache({
+		provider: DatabaseCacheProvider,
 		name: "api:users:registrations",
 		ttl: [INTENT_TTL_MINUTES, "minutes"]
 	});
 	rateLimitCache = $cache({
+		provider: DatabaseCacheProvider,
 		name: "api:users:registration-rate-limit",
 		ttl: [15, "minutes"]
 	});
@@ -1615,6 +1823,7 @@ var RegistrationService = class {
 			this.log.debug("Registration rejected: username required", { userRealmName });
 			throw new BadRequestError("Username is required");
 		}
+		if (realmSettings?.username === "email") body.username = void 0;
 		if (body.username) {
 			const usernameRegExp = realmSettings?.usernameRegExp;
 			if (usernameRegExp) {
@@ -1626,6 +1835,13 @@ var RegistrationService = class {
 					throw new BadRequestError("Username does not meet the required format");
 				}
 			}
+			if (await this.usernameSlugger.isBlocked(userRealmName, body.username)) {
+				this.log.debug("Registration rejected: username is blocked", {
+					userRealmName,
+					username: body.username
+				});
+				throw new BadRequestError("This username is not available");
+			}
 		}
 		if (realmSettings?.email === "required" && !body.email) {
 			this.log.debug("Registration rejected: email required", { userRealmName });
@@ -1635,6 +1851,11 @@ var RegistrationService = class {
 			this.log.debug("Registration rejected: phone required", { userRealmName });
 			throw new BadRequestError("Phone number is required");
 		}
+		if (realmSettings?.username === "email") {
+			if (!body.email) throw new BadRequestError("Email is required to derive a username from email");
+			const base = this.usernameSlugger.slug(body.email);
+			body.username = await this.usernameSlugger.pickAvailable(userRealmName, base);
+		}
 		await this.checkUserAvailability(body, userRealmName);
 		this.credentialService.validatePasswordPolicy(body.password, realmSettings.passwordPolicy);
 		if (realmSettings?.captchaRequired === true) {
@@ -2166,6 +2387,7 @@ var SessionService = class SessionService {
 	realmProvider = $inject(RealmProvider);
 	fileController = $client();
 	cacheProvider = $inject(CacheProvider);
+	usernameSlugger = $inject(UsernameSlugger);
 	userAudits(realmName) {
 		if (this.realmProvider.getRealm(realmName).features.audits) return this.alepha.inject(UserAudits);
 	}
@@ -2220,30 +2442,16 @@ var SessionService = class SessionService {
 	/**
 	* Generate a unique username from an OAuth profile.
 	*
-	* 1. Extract candidate from email prefix
-	* 2. Sanitize against realm's usernameRegExp (strip invalid chars, truncate)
-	* 3. Check case-insensitive uniqueness, append suffix (2, 3, ...) if taken
-	* 4. Fall back to "user" + random 6-char alphanumeric if all else fails
-	*/
-	async generateUniqueUsername(profile, realmSettings, users) {
-		const maxLength = 30;
-		const maxSuffixAttempts = 10;
-		let candidate = profile.email?.split("@")[0] ?? profile.name ?? "";
-		candidate = candidate.replace(/[^a-zA-Z0-9_.-]/g, "");
-		if (realmSettings?.usernameRegExp) try {
-			if (!new RegExp(realmSettings.usernameRegExp).test(candidate)) candidate = candidate.replace(/[^a-zA-Z0-9_]/g, "");
-		} catch {}
-		if (candidate.length < 3) candidate = `user${candidate}`;
-		candidate = candidate.slice(0, maxLength - 2);
-		const isAvailable = async (name) => {
-			return !await users.findOne({ where: { username: { ilike: name } } });
-		};
-		if (await isAvailable(candidate)) return candidate;
-		for (let i = 2; i <= maxSuffixAttempts + 1; i++) {
-			const withSuffix = `${candidate}${i}`;
-			if (withSuffix.length <= maxLength && await isAvailable(withSuffix)) return withSuffix;
-		}
-		return `user${Math.random().toString(36).slice(2, 8)}`;
+	* Routes through {@link UsernameSlugger}, which is the same code path as
+	* `username: "email"` registration. The OAuth profile's email is the
+	* primary signal; if absent (rare — most IDPs return one), we fall back
+	* to `profile.name`, then to a random handle. The slugger applies the
+	* realm's `usernameBlocklist` and retries on collision.
+	*/
+	async generateUniqueUsername(profile, _realmSettings, _users, realmName) {
+		const seed = profile.email ?? profile.name ?? `user-${Math.random().toString(36).slice(2, 8)}`;
+		const base = this.usernameSlugger.slug(seed);
+		return this.usernameSlugger.pickAvailable(realmName, base);
 	}
 	/**
 	* Random delay to prevent timing attacks (50-200ms)
@@ -2654,7 +2862,7 @@ var SessionService = class SessionService {
 			});
 			throw new BadRequestError("Account doesn't exist");
 		}
-		const username = await this.generateUniqueUsername(profile, realmSettings, users);
+		const username = await this.generateUniqueUsername(profile, realmSettings, users, userRealmName);
 		const user = await users.create({
 			realm: realm.name,
 			username,
@@ -2921,6 +3129,7 @@ const AlephaApiUsers = $module({
 		CredentialService,
 		RegistrationService,
 		UserService,
+		UsernameSlugger,
 		IdentityService,
 		UserController,
 		AdminUserController,
@@ -2936,6 +3145,6 @@ const AlephaApiUsers = $module({
 	]
 });
 //#endregion
-export { $realm, AdminIdentityController, AdminSessionController, AdminUserController, AlephaApiUsers, CredentialService, DEFAULT_USER_REALM_NAME, IdentityService, RealmController, RealmProvider, RegistrationService, SessionCrudService, SessionService, UserAudits, UserBuckets, UserController, UserJobs, UserNotifications, UserService, completePasswordResetRequestSchema, completeRegistrationRequestSchema, createUserSchema, identities, identityQuerySchema, identityResourceSchema, loginSchema, passwordResetIntentResponseSchema, realmAuthSettingsAtom, realmConfigSchema, registerSchema, registrationIntentResponseSchema, resetPasswordRequestSchema, resetPasswordSchema, sessionQuerySchema, sessionResourceSchema, sessions, updateUserSchema, userQuerySchema, userResourceSchema, users };
+export { $realm, AdminIdentityController, AdminSessionController, AdminUserController, AlephaApiUsers, CredentialService, DEFAULT_USER_REALM_NAME, IdentityService, RealmController, RealmProvider, RegistrationService, SessionCrudService, SessionService, UserAudits, UserBuckets, UserController, UserJobs, UserNotifications, UserService, UsernameSlugger, completePasswordResetRequestSchema, completeRegistrationRequestSchema, createUserSchema, identities, identityQuerySchema, identityResourceSchema, loginSchema, passwordResetIntentResponseSchema, realmAuthSettingsAtom, realmConfigSchema, registerSchema, registrationIntentResponseSchema, resetPasswordRequestSchema, resetPasswordSchema, sessionQuerySchema, sessionResourceSchema, sessions, updateUserSchema, userQuerySchema, userResourceSchema, users };
 
 //# sourceMappingURL=index.js.map