alepha 0.21.2 → 0.23.0

package/dist/api/users/index.js

@@ -1,5 +1,5 @@
 import { $atom, $context, $inject, $module, Alepha, AlephaError, t } from "alepha";
-import { AuditService } from "alepha/api/audits";
+import { $audit } from "alepha/api/audits";
 import { $bucket } from "alepha/bucket";
 import { $issuer, $permission, $secure, CryptoProvider, InvalidCredentialsError, SecurityProvider } from "alepha/security";
 import { $action, BadRequestError, ConflictError, HttpError, UnauthorizedError, okSchema } from "alepha/server";
@@ -8,7 +8,7 @@ import { $logger } from "alepha/logger";
 import { $client } from "alepha/server/links";
 import { $notification } from "alepha/api/notifications";
 import { CaptchaProvider } from "alepha/captcha";
-import { $authApple, $authCredentials, $authFacebook, $authFranceConnect, $authGithub, $authGoogle, $authMicrosoft, ServerAuthProvider, authenticationProviderSchema } from "alepha/server/auth";
+import { $authApple, $authCredentials, $authFacebook, $authFederationClient, $authFranceConnect, $authGithub, $authGoogle, $authMicrosoft, ServerAuthProvider, authenticationProviderSchema } from "alepha/server/auth";
 import { $etag } from "alepha/server/etag";
 import { AlephaApiVerification, VerificationService } from "alepha/api/verifications";
 import { $cache, CacheProvider } from "alepha/cache";
@@ -21,35 +21,65 @@ import { AlephaApiKeys, ApiKeyService } from "alepha/api/keys";
 import { AlephaOAuth, OAuthClientService, oauthOptions } from "alepha/api/oauth";
 import { $parameter, AlephaApiParameters } from "alepha/api/parameters";
 import { mcpStreamableHttpOptions } from "alepha/mcp";
-//#region ../../src/api/users/audits/UserAudits.ts
+//#region ../../src/api/users/audits/SessionAudits.ts
 /**
-* User-specific audit wrapper service.
+* Authentication & session-security audit events.
 *
-* This service wraps the core AuditService to provide user-related audit logging.
+* Holds two audit types:
+* - `auth` — login / logout / token refresh / MFA.
+* - `security` — rate limiting, session invalidation, and related guards.
 *
-* Declared as a module variant — not auto-injected. It is instantiated
-* lazily the first time something calls `alepha.inject(UserAudits)`.
+* Failed events are logged with `success: false`; severity (`warning`) is
+* derived centrally in `AuditService.create`. Register as a module variant
+* and log via the exposed primitives:
+* `sessionAudits(realm)?.auth.log("login", { success: false, … })`.
+*/
+var SessionAudits = class {
+	auth = $audit({
+		type: "auth",
+		description: "Authentication events (login, logout, token refresh, MFA).",
+		actions: [
+			"login",
+			"logout",
+			"token_refresh",
+			"mfa_setup",
+			"mfa_verify"
+		]
+	});
+	security = $audit({
+		type: "security",
+		description: "Security events (rate limiting, session invalidation, blocked access).",
+		actions: [
+			"rate_limited",
+			"sessions_invalidated",
+			"permission_denied",
+			"blocked"
+		]
+	});
+};
+//#endregion
+//#region ../../src/api/users/audits/UserAudits.ts
+/**
+* User-management audit events.
+*
+* Holds the `user` audit type. Mirrors the `$notification`/`$job` holder
+* pattern (see {@link UserNotifications}) — register as a module variant and
+* log via the exposed primitive: `userAudits(realm)?.user.log("create", …)`.
 */
 var UserAudits = class {
-	auditService = $inject(AuditService);
-	/**
-	* Record a user-related audit event.
-	*/
-	recordUser(action, context) {
-		return this.auditService.recordUser(action, context);
-	}
-	/**
-	* Record an authentication-related audit event.
-	*/
-	recordAuth(action, context) {
-		return this.auditService.recordAuth(action, context);
-	}
-	/**
-	* Record a generic audit event.
-	*/
-	record(category, action, context) {
-		return this.auditService.record(category, action, context);
-	}
+	user = $audit({
+		type: "user",
+		description: "User management events (create, update, delete, role/password changes).",
+		actions: [
+			"create",
+			"update",
+			"delete",
+			"role_change",
+			"password_change",
+			"enable",
+			"disable"
+		]
+	});
 };
 //#endregion
 //#region ../../src/api/users/buckets/UserBuckets.ts
@@ -105,6 +135,7 @@ const users = $entity({
 		picture: t.optional(t.string()),
 		enabled: db.default(t.boolean(), true),
 		emailVerified: db.default(t.boolean(), false),
+		lastLoginAt: t.optional(t.datetime()),
 		organizationId: db.organization()
 	}),
 	indexes: [
@@ -281,6 +312,12 @@ const sessions = $entity({
 		*/
 		lastUsedAt: t.optional(t.datetime()),
 		ip: t.optional(t.text()),
+		/**
+		* ISO 3166-1 alpha-2 country code derived from the request geo headers
+		* (`cf-ipcountry` on Cloudflare, CDN equivalents elsewhere) at login time.
+		* `null` on pre-migration rows and where geo isn't available.
+		*/
+		country: t.optional(t.text({ maxLength: 2 })),
 		userAgent: t.optional(t.object({
 			os: t.text(),
 			browser: t.text(),
@@ -343,6 +380,10 @@ var RealmProvider = class {
 				}
 			},
 			features,
+			federated: realmOptions.identities?.federated ? {
+				brokerUrl: realmOptions.identities.federated.brokerUrl,
+				providers: realmOptions.identities.federated.providers
+			} : void 0,
 			getSettings: async function() {
 				if (this.settingsParameter) return await this.settingsParameter.get();
 				return this.settings;
@@ -437,7 +478,8 @@ var IdentityService = class {
 			userId: identity.userId
 		});
 		const realm = this.realmProvider.getRealm(userRealmName);
-		await this.userAudits(userRealmName)?.recordUser("update", {
+		await this.userAudits(userRealmName)?.user.log("update", {
+			resourceType: "user",
 			userRealm: realm.name,
 			resourceId: identity.userId,
 			description: `Identity provider disconnected: ${identity.provider}`,
@@ -515,6 +557,22 @@ var AdminIdentityController = class {
 const sessionQuerySchema = t.extend(pageQuerySchema, { userId: t.optional(t.uuid()) });
 //#endregion
 //#region ../../src/api/users/schemas/sessionResourceSchema.ts
+/**
+* Slim view of the session's owner — embedded by the admin listing so the
+* UI can render a human-readable identifier instead of just a UUID. Comes
+* back via a left join, so it's optional (a session whose user was deleted
+* still returns; `user` is undefined).
+*/
+const sessionUserSummarySchema = t.object({
+	id: t.uuid(),
+	email: t.optional(t.string({ format: "email" })),
+	username: t.optional(t.shortText({
+		minLength: 3,
+		maxLength: 30
+	})),
+	firstName: t.optional(t.string()),
+	lastName: t.optional(t.string())
+});
 const sessionResourceSchema = t.object({
 	id: t.uuid(),
 	version: t.number(),
@@ -524,6 +582,7 @@ const sessionResourceSchema = t.object({
 	userId: t.uuid(),
 	expiresAt: t.datetime(),
 	ip: t.optional(t.string()),
+	country: t.optional(t.string()),
 	userAgent: t.optional(t.object({
 		os: t.string(),
 		browser: t.string(),
@@ -532,10 +591,21 @@ const sessionResourceSchema = t.object({
 			"DESKTOP",
 			"TABLET"
 		])
-	}))
+	})),
+	user: t.optional(sessionUserSummarySchema)
 });
 //#endregion
 //#region ../../src/api/users/services/SessionCrudService.ts
+/**
+* Relation map embedding a slim user summary on every session row, so the
+* admin UI can render `user.email`/`user.username` instead of a bare UUID.
+* Left-join (default) so sessions whose owner was deleted still come back
+* with `user: undefined`.
+*/
+const withUser = { user: {
+	join: users,
+	on: ["userId", users.cols.id]
+} };
 var SessionCrudService = class {
 	log = $logger();
 	realmProvider = $inject(RealmProvider);
@@ -553,7 +623,10 @@ var SessionCrudService = class {
 		q.sort ??= "-createdAt";
 		const where = this.sessions(userRealmName).createQueryWhere();
 		if (q.userId) where.userId = { eq: q.userId };
-		const result = await this.sessions(userRealmName).paginate(q, { where }, { count: true });
+		const result = await this.sessions(userRealmName).paginate(q, {
+			where,
+			with: withUser
+		}, { count: true });
 		this.log.debug("Sessions found", {
 			count: result.content.length,
 			total: result.page.totalElements
@@ -568,7 +641,10 @@ var SessionCrudService = class {
 			id,
 			userRealmName
 		});
-		const session = await this.sessions(userRealmName).getById(id);
+		const session = await this.sessions(userRealmName).getOne({
+			where: { id: { eq: id } },
+			with: withUser
+		});
 		this.log.debug("Session retrieved", {
 			id,
 			userId: session.userId
@@ -692,13 +768,18 @@ const updateUserSchema = t.partial(t.omit(users.insertSchema, [
 	"id",
 	"version",
 	"createdAt",
-	"updatedAt",
-	"username",
-	"emailVerified"
+	"updatedAt"
 ]));
 //#endregion
 //#region ../../src/api/users/schemas/userQuerySchema.ts
 const userQuerySchema = t.extend(pageQuerySchema, {
+	/**
+	* Free-text search applied (case-insensitive) across `email`,
+	* `username`, `firstName`, and `lastName`. Matches with a leading and
+	* trailing wildcard, so `?search=foo` finds any user whose email,
+	* username, or name contains `foo`.
+	*/
+	search: t.optional(t.string()),
 	email: t.optional(t.string()),
 	enabled: t.optional(t.boolean()),
 	emailVerified: t.optional(t.boolean()),
@@ -863,6 +944,7 @@ var UserService = class {
 	log = $logger();
 	verificationController = $client();
 	realmProvider = $inject(RealmProvider);
+	cryptoProvider = $inject(CryptoProvider);
 	userAudits(realmName) {
 		if (this.realmProvider.getRealm(realmName).features.audits) return this.alepha.inject(UserAudits);
 	}
@@ -977,7 +1059,8 @@ var UserService = class {
 			type
 		});
 		const realm = this.realmProvider.getRealm(userRealmName);
-		await this.userAudits(userRealmName)?.recordUser("update", {
+		await this.userAudits(userRealmName)?.user.log("update", {
+			resourceType: "user",
 			userId: user.id,
 			userEmail: email,
 			userRealm: realm.name,
@@ -1009,6 +1092,15 @@ var UserService = class {
 		});
 		q.sort ??= "-createdAt";
 		const where = this.users(userRealmName).createQueryWhere();
+		if (q.search) {
+			const pattern = `%${q.search}%`;
+			where.or = [
+				{ email: { ilike: pattern } },
+				{ username: { ilike: pattern } },
+				{ firstName: { ilike: pattern } },
+				{ lastName: { ilike: pattern } }
+			];
+		}
 		if (q.email) where.email = { like: q.email };
 		if (q.enabled !== void 0) where.enabled = { eq: q.enabled };
 		if (q.emailVerified !== void 0) where.emailVerified = { eq: q.emailVerified };
@@ -1078,7 +1170,8 @@ var UserService = class {
 			username: user.username,
 			email: user.email
 		});
-		await this.userAudits(userRealmName)?.recordUser("create", {
+		await this.userAudits(userRealmName)?.user.log("create", {
+			resourceType: "user",
 			userRealm: realm.name,
 			resourceId: user.id,
 			description: "User created",
@@ -1099,16 +1192,33 @@ var UserService = class {
 			userRealmName
 		});
 		const before = await this.getUserById(id, userRealmName);
-		const user = await this.users(userRealmName).updateById(id, data);
-		this.log.debug("User updated", { userId: id });
 		const realm = this.realmProvider.getRealm(userRealmName);
+		const users = this.users(userRealmName);
+		if (data.username !== void 0 && data.username !== null && data.username !== before.username) {
+			const existing = await users.findOne({ where: {
+				realm: realm.name,
+				username: { ilike: data.username }
+			} });
+			if (existing && existing.id !== id) throw new ConflictError("User with this username already exists");
+		}
+		if (data.email !== void 0 && data.email !== null && data.email !== before.email) {
+			const existing = await users.findOne({ where: {
+				realm: realm.name,
+				email: { eq: data.email }
+			} });
+			if (existing && existing.id !== id) throw new ConflictError("User with this email already exists");
+			data.emailVerified = false;
+		}
+		const user = await users.updateById(id, data);
+		this.log.debug("User updated", { userId: id });
 		const changes = {};
 		for (const key of Object.keys(data)) if (data[key] !== void 0 && before[key] !== data[key]) changes[key] = {
 			from: before[key],
 			to: data[key]
 		};
 		const isRoleChange = data.roles !== void 0 && JSON.stringify(before.roles) !== JSON.stringify(data.roles);
-		await this.userAudits(userRealmName)?.recordUser(isRoleChange ? "role_change" : "update", {
+		await this.userAudits(userRealmName)?.user.log(isRoleChange ? "role_change" : "update", {
+			resourceType: "user",
 			userRealm: realm.name,
 			resourceId: user.id,
 			description: isRoleChange ? "User roles changed" : `User updated: ${Object.keys(changes).join(", ")}`,
@@ -1117,6 +1227,46 @@ var UserService = class {
 		return user;
 	}
 	/**
+	* Set (or reset) a user's password. Upserts a "credentials" identity
+	* with the new hash. Used by admin password-set flows; does NOT
+	* verify any old password or token — the caller is responsible for
+	* authorization.
+	*/
+	async setPassword(id, newPassword, userRealmName) {
+		this.log.trace("Setting password", {
+			id,
+			userRealmName
+		});
+		const user = await this.getUserById(id, userRealmName);
+		const realm = this.realmProvider.getRealm(userRealmName);
+		const settings = await realm.getSettings();
+		if (settings.passwordPolicy) {
+			const policy = settings.passwordPolicy;
+			if (policy.minLength && newPassword.length < policy.minLength) throw new BadRequestError(`Password must be at least ${policy.minLength} characters`);
+		}
+		const hash = await this.cryptoProvider.hashPassword(newPassword);
+		const identities = this.realmProvider.identityRepository(userRealmName);
+		const existing = await identities.findOne({ where: {
+			userId: { eq: id },
+			provider: { eq: "credentials" }
+		} });
+		if (existing) await identities.updateById(existing.id, { password: hash });
+		else await identities.create({
+			userId: id,
+			provider: "credentials",
+			password: hash
+		});
+		await this.userAudits(userRealmName)?.user.log("password_change", {
+			resourceType: "user",
+			userId: id,
+			userEmail: user.email ?? void 0,
+			userRealm: realm.name,
+			resourceId: id,
+			severity: "warning",
+			description: "Password set by admin"
+		});
+	}
+	/**
 	* Delete a user by ID.
 	*/
 	async deleteUser(id, userRealmName) {
@@ -1130,7 +1280,8 @@ var UserService = class {
 		await this.users(userRealmName).deleteById(id);
 		this.log.info("User deleted", { userId: id });
 		const realm = this.realmProvider.getRealm(userRealmName);
-		await this.userAudits(userRealmName)?.recordUser("delete", {
+		await this.userAudits(userRealmName)?.user.log("delete", {
+			resourceType: "user",
 			userRealm: realm.name,
 			resourceId: id,
 			severity: "warning",
@@ -1148,6 +1299,32 @@ var AdminUserController = class {
 	url = "/users";
 	group = "admin:users";
 	userService = $inject(UserService);
+	securityProvider = $inject(SecurityProvider);
+	/**
+	* List roles available in a realm. Used by the admin UI to render the
+	* role picker and grey out defaults (which cannot be removed).
+	*/
+	findRoles = $action({
+		path: "/metadata/roles",
+		group: this.group,
+		use: [$secure({ permissions: ["admin:user:read"] })],
+		description: "List roles available in a realm",
+		schema: {
+			query: t.object({ userRealmName: t.optional(t.string()) }),
+			response: t.array(t.object({
+				name: t.string(),
+				default: t.optional(t.boolean()),
+				description: t.optional(t.string())
+			}))
+		},
+		handler: ({ query }) => {
+			return this.securityProvider.getRoles(query.userRealmName).map((r) => ({
+				name: r.name,
+				default: r.default,
+				description: r.description
+			}));
+		}
+	});
 	/**
 	* Find users with pagination and filtering.
 	*/
@@ -1214,6 +1391,31 @@ var AdminUserController = class {
 		handler: ({ params, body, query }) => this.userService.updateUser(params.id, body, query.userRealmName)
 	});
 	/**
+	* Set (or reset) a user's password. Admin-only flow — does NOT
+	* require knowing the previous password. Hash is stored as a
+	* "credentials" identity for the user (upsert).
+	*/
+	setUserPassword = $action({
+		method: "POST",
+		path: `${this.url}/:id/password`,
+		group: this.group,
+		use: [$secure({ permissions: ["admin:user:update"] })],
+		description: "Set a user's password",
+		schema: {
+			params: t.object({ id: t.uuid() }),
+			query: t.object({ userRealmName: t.optional(t.string()) }),
+			body: t.object({ password: t.string({ minLength: 1 }) }),
+			response: okSchema
+		},
+		handler: async ({ params, body, query }) => {
+			await this.userService.setPassword(params.id, body.password, query.userRealmName);
+			return {
+				ok: true,
+				id: params.id
+			};
+		}
+	});
+	/**
 	* Delete a user.
 	*/
 	deleteUser = $action({
@@ -1270,7 +1472,15 @@ const realmConfigSchema = t.object({
 	settings: realmAuthSettingsAtom.schema,
 	realmName: t.string(),
 	authenticationMethods: t.array(authenticationProviderSchema),
-	captchaSiteKey: t.optional(t.string({ description: "Public site key for the captcha widget (when settings.captchaRequired is true)" }))
+	captchaSiteKey: t.optional(t.string({ description: "Public site key for the captcha widget (when settings.captchaRequired is true)" })),
+	/**
+	* Federated (broker) social login. When present, the login UI renders one
+	* button per provider linking to `{brokerUrl}/auth/federated/start`.
+	*/
+	federated: t.optional(t.object({
+		brokerUrl: t.string({ description: "Broker origin that performs the OIDC dance." }),
+		providers: t.array(t.union([t.const("google"), t.const("apple")]), { description: "Federated providers to surface as login buttons." })
+	}))
 });
 //#endregion
 //#region ../../src/api/users/controllers/RealmController.ts
@@ -1305,7 +1515,8 @@ var RealmController = class {
 				settings,
 				realmName,
 				authenticationMethods: this.serverAuthProvider.getAuthenticationProviders({ realmName }),
-				captchaSiteKey: settings.captchaRequired ? this.captchaProvider.getSiteKey() : void 0
+				captchaSiteKey: settings.captchaRequired ? this.captchaProvider.getSiteKey() : void 0,
+				federated: realm.federated
 			};
 		}
 	});
@@ -1421,6 +1632,9 @@ var CredentialService = class {
 	userAudits(realmName) {
 		if (this.realmProvider.getRealm(realmName).features.audits) return this.alepha.inject(UserAudits);
 	}
+	sessionAudits(realmName) {
+		if (this.realmProvider.getRealm(realmName).features.audits) return this.alepha.inject(SessionAudits);
+	}
 	userNotifications(realmName) {
 		if (this.realmProvider.getRealm(realmName).features.notifications) return this.alepha.inject(UserNotifications);
 	}
@@ -1572,7 +1786,8 @@ var CredentialService = class {
 			userId: intent.userId,
 			email: intent.email
 		});
-		await this.userAudits(intent.realmName)?.recordUser("update", {
+		await this.userAudits(intent.realmName)?.user.log("update", {
+			resourceType: "user",
 			userId: intent.userId,
 			userEmail: intent.email,
 			userRealm: realm.name,
@@ -1580,7 +1795,7 @@ var CredentialService = class {
 			description: "Password reset completed",
 			metadata: { email: intent.email }
 		});
-		await this.userAudits(intent.realmName)?.record("security", "sessions_invalidated", {
+		await this.sessionAudits(intent.realmName)?.security.log("sessions_invalidated", {
 			userId: intent.userId,
 			userEmail: intent.email,
 			userRealm: realm.name,
@@ -1629,7 +1844,8 @@ var CredentialService = class {
 		const hashedPassword = await this.cryptoProvider.hashPassword(newPassword);
 		await this.identities(userRealmName).updateById(identity.id, { password: hashedPassword });
 		await this.sessions(userRealmName).deleteMany({ userId: { eq: user.id } });
-		await this.userAudits(userRealmName)?.recordUser("update", {
+		await this.userAudits(userRealmName)?.user.log("update", {
+			resourceType: "user",
 			userId: user.id,
 			userEmail: email,
 			userRealm: realm.name,
@@ -1637,7 +1853,7 @@ var CredentialService = class {
 			description: "Password reset completed (legacy)",
 			metadata: { email }
 		});
-		await this.userAudits(userRealmName)?.record("security", "sessions_invalidated", {
+		await this.sessionAudits(userRealmName)?.security.log("sessions_invalidated", {
 			userId: user.id,
 			userEmail: email,
 			userRealm: realm.name,
@@ -1986,7 +2202,8 @@ var RegistrationService = class {
 			email: user.email,
 			username: user.username
 		});
-		await this.userAudits(userRealmName)?.recordUser("create", {
+		await this.userAudits(userRealmName)?.user.log("create", {
+			resourceType: "user",
 			userId: user.id,
 			userEmail: user.email ?? void 0,
 			userRealm: realm.name,
@@ -2409,6 +2626,9 @@ var SessionService = class SessionService {
 	userAudits(realmName) {
 		if (this.realmProvider.getRealm(realmName).features.audits) return this.alepha.inject(UserAudits);
 	}
+	sessionAudits(realmName) {
+		if (this.realmProvider.getRealm(realmName).features.audits) return this.alepha.inject(SessionAudits);
+	}
 	userNotifications(realmName) {
 		if (this.realmProvider.getRealm(realmName).features.notifications) return this.alepha.inject(UserNotifications);
 	}
@@ -2444,7 +2664,8 @@ var SessionService = class SessionService {
 			username: user.username,
 			realm: name
 		});
-		await this.userAudits(userRealmName)?.recordUser("role_change", {
+		await this.userAudits(userRealmName)?.user.log("role_change", {
+			resourceType: "user",
 			userId: user.id,
 			userEmail: user.email ?? void 0,
 			userRealm: name,
@@ -2541,8 +2762,9 @@ var SessionService = class SessionService {
 							username,
 							realm: name
 						});
-						await this.userAudits(userRealmName)?.recordAuth("login_failed", {
+						await this.sessionAudits(userRealmName)?.auth.log("login", {
 							userRealm: name,
+							success: false,
 							description: "Username does not match required format",
 							metadata: {
 								provider,
@@ -2561,8 +2783,9 @@ var SessionService = class SessionService {
 					username,
 					realm: name
 				});
-				await this.userAudits(userRealmName)?.recordAuth("login_failed", {
+				await this.sessionAudits(userRealmName)?.auth.log("login", {
 					userRealm: name,
+					success: false,
 					description: "Invalid login identifier format",
 					metadata: {
 						provider,
@@ -2578,8 +2801,9 @@ var SessionService = class SessionService {
 					username,
 					realm: name
 				});
-				await this.userAudits(userRealmName)?.recordAuth("login_failed", {
+				await this.sessionAudits(userRealmName)?.auth.log("login", {
 					userRealm: name,
+					success: false,
 					description: "User not found",
 					metadata: {
 						provider,
@@ -2587,7 +2811,7 @@ var SessionService = class SessionService {
 					}
 				});
 				if (ipKey) {
-					if (await this.recordFailedLogin(ipKey, loginRateLimit.ipMaxAttempts, loginRateLimit.windowMs)) await this.userAudits(userRealmName)?.record("security", "rate_limited", {
+					if (await this.recordFailedLogin(ipKey, loginRateLimit.ipMaxAttempts, loginRateLimit.windowMs)) await this.sessionAudits(userRealmName)?.security.log("rate_limited", {
 						userRealm: name,
 						success: false,
 						description: "IP temporarily locked due to too many failed login attempts",
@@ -2601,8 +2825,9 @@ var SessionService = class SessionService {
 					userId: user.id,
 					realm: name
 				});
-				await this.userAudits(userRealmName)?.recordAuth("login_failed", {
+				await this.sessionAudits(userRealmName)?.auth.log("login", {
 					userRealm: name,
+					success: false,
 					resourceId: user.id,
 					description: "Login attempt for disabled account",
 					metadata: {
@@ -2640,8 +2865,9 @@ var SessionService = class SessionService {
 					username,
 					realm: name
 				});
-				await this.userAudits(userRealmName)?.recordAuth("login_failed", {
+				await this.sessionAudits(userRealmName)?.auth.log("login", {
 					userRealm: name,
+					success: false,
 					resourceId: user.id,
 					description: "Invalid password",
 					metadata: {
@@ -2650,7 +2876,7 @@ var SessionService = class SessionService {
 					}
 				});
 				if (ipKey) {
-					if (await this.recordFailedLogin(ipKey, loginRateLimit.ipMaxAttempts, loginRateLimit.windowMs)) await this.userAudits(userRealmName)?.record("security", "rate_limited", {
+					if (await this.recordFailedLogin(ipKey, loginRateLimit.ipMaxAttempts, loginRateLimit.windowMs)) await this.sessionAudits(userRealmName)?.security.log("rate_limited", {
 						userRealm: name,
 						success: false,
 						description: "IP temporarily locked due to too many failed login attempts",
@@ -2658,7 +2884,7 @@ var SessionService = class SessionService {
 					});
 				}
 				if (await this.recordFailedLogin(accountKey, loginRateLimit.accountMaxAttempts, loginRateLimit.windowMs)) {
-					await this.userAudits(userRealmName)?.record("security", "rate_limited", {
+					await this.sessionAudits(userRealmName)?.security.log("rate_limited", {
 						userRealm: name,
 						resourceId: user.id,
 						success: false,
@@ -2678,7 +2904,7 @@ var SessionService = class SessionService {
 				}
 				throw new InvalidCredentialsError();
 			}
-			await this.userAudits(userRealmName)?.recordAuth("login", {
+			await this.sessionAudits(userRealmName)?.auth.log("login", {
 				userId: user.id,
 				userEmail: user.email ?? void 0,
 				userRealm: name,
@@ -2705,15 +2931,18 @@ var SessionService = class SessionService {
 		const request = this.alepha.store.get("alepha.http.request");
 		const refreshToken = this.cryptoProvider.randomUUID();
 		const expiresAt = this.dateTimeProvider.now().add(expiresIn, "seconds").toISOString();
+		const nowIso = this.dateTimeProvider.nowISOString();
 		const session = await this.sessions(userRealmName).create({
 			userId: user.id,
 			expiresAt,
-			lastUsedAt: this.dateTimeProvider.nowISOString(),
+			lastUsedAt: nowIso,
 			ip: request?.ip,
+			country: request?.geo?.country,
 			userAgent: request?.userAgent,
 			refreshToken,
 			clientId
 		});
+		await this.users(userRealmName).updateById(user.id, { lastLoginAt: nowIso });
 		this.log.info("Session created", {
 			sessionId: session.id,
 			userId: user.id,
@@ -2780,7 +3009,7 @@ var SessionService = class SessionService {
 		this.log.debug("Session deleted");
 		if (session) {
 			const { name } = this.realmProvider.getRealm(userRealmName);
-			await this.userAudits(userRealmName)?.recordAuth("logout", {
+			await this.sessionAudits(userRealmName)?.auth.log("logout", {
 				userId: session.userId,
 				userRealm: name,
 				sessionId: session.id,
@@ -2808,7 +3037,7 @@ var SessionService = class SessionService {
 				userId: identity.userId
 			});
 			const user = await users.getById(identity.userId);
-			await this.userAudits(userRealmName)?.recordAuth("login", {
+			await this.sessionAudits(userRealmName)?.auth.log("login", {
 				userId: user.id,
 				userEmail: user.email ?? void 0,
 				userRealm: realm.name,
@@ -2856,7 +3085,7 @@ var SessionService = class SessionService {
 				providerUserId: profile.sub,
 				userId: existing.id
 			});
-			await this.userAudits(userRealmName)?.recordAuth("login", {
+			await this.sessionAudits(userRealmName)?.auth.log("login", {
 				userId: existing.id,
 				userEmail: existing.email ?? void 0,
 				userRealm: realm.name,
@@ -2918,7 +3147,8 @@ var SessionService = class SessionService {
 			email: user.email,
 			username: user.username
 		});
-		await this.userAudits(userRealmName)?.recordUser("create", {
+		await this.userAudits(userRealmName)?.user.log("create", {
+			resourceType: "user",
 			userId: user.id,
 			userEmail: user.email ?? void 0,
 			userRealm: realm.name,
@@ -2931,7 +3161,7 @@ var SessionService = class SessionService {
 				email: user.email
 			}
 		});
-		await this.userAudits(userRealmName)?.recordAuth("login", {
+		await this.sessionAudits(userRealmName)?.auth.log("login", {
 			userId: user.id,
 			userEmail: user.email ?? void 0,
 			userRealm: realm.name,
@@ -2986,7 +3216,10 @@ const $realm = (options = {}) => {
 	}
 	const realmRegistration = realmProvider.register(name, options);
 	if (features.avatars) alepha.with(UserBuckets);
-	if (features.audits) alepha.with(UserAudits);
+	if (features.audits) {
+		alepha.with(UserAudits);
+		alepha.with(SessionAudits);
+	}
 	if (features.jobs) alepha.with(UserJobs);
 	if (features.notifications) {
 		alepha.with(UserNotifications);
@@ -3008,6 +3241,7 @@ const $realm = (options = {}) => {
 			permissions: [{ name: "*" }]
 		}, {
 			name: "user",
+			default: true,
 			permissions: [{
 				name: "*",
 				ownership: true,
@@ -3088,6 +3322,14 @@ const $realm = (options = {}) => {
 		if (identities.microsoft) auth.microsoft = $authMicrosoft(realm);
 		if (identities.franceconnect) auth.franceconnect = $authFranceConnect(realm);
 		alepha.with(() => auth);
+		if (identities.federated) {
+			const fed = $authFederationClient({
+				realm,
+				brokerUrl: identities.federated.brokerUrl,
+				publicKeyPem: identities.federated.publicKey
+			});
+			alepha.with(() => ({ federationCallback: fed.callback }));
+		}
 	}
 	if (features.parameters) {
 		alepha.with(AlephaApiParameters);
@@ -3194,10 +3436,11 @@ const AlephaApiUsers = $module({
 		UserJobs,
 		UserNotifications,
 		UserAudits,
+		SessionAudits,
 		UserBuckets
 	]
 });
 //#endregion
-export { $realm, AdminIdentityController, AdminSessionController, AdminUserController, AlephaApiUsers, CredentialService, DEFAULT_USER_REALM_NAME, IdentityService, RealmController, RealmProvider, RegistrationService, SessionCrudService, SessionService, UserAudits, UserBuckets, UserController, UserJobs, UserNotifications, UserService, UsernameSlugger, completePasswordResetRequestSchema, completeRegistrationRequestSchema, createUserSchema, identities, identityQuerySchema, identityResourceSchema, loginSchema, passwordResetIntentResponseSchema, realmAuthSettingsAtom, realmConfigSchema, registerSchema, registrationIntentResponseSchema, resetPasswordRequestSchema, resetPasswordSchema, sessionQuerySchema, sessionResourceSchema, sessions, updateUserSchema, userQuerySchema, userResourceSchema, users };
+export { $realm, AdminIdentityController, AdminSessionController, AdminUserController, AlephaApiUsers, CredentialService, DEFAULT_USER_REALM_NAME, IdentityService, RealmController, RealmProvider, RegistrationService, SessionAudits, SessionCrudService, SessionService, UserAudits, UserBuckets, UserController, UserJobs, UserNotifications, UserService, UsernameSlugger, completePasswordResetRequestSchema, completeRegistrationRequestSchema, createUserSchema, identities, identityQuerySchema, identityResourceSchema, loginSchema, passwordResetIntentResponseSchema, realmAuthSettingsAtom, realmConfigSchema, registerSchema, registrationIntentResponseSchema, resetPasswordRequestSchema, resetPasswordSchema, sessionQuerySchema, sessionResourceSchema, sessionUserSummarySchema, sessions, updateUserSchema, userQuerySchema, userResourceSchema, users };
 
 //# sourceMappingURL=index.js.map