alepha 0.22.0 → 0.24.0

package/dist/security/index.js

@@ -1,4 +1,4 @@
-import { $atom, $context, $hook, $inject, $module, Alepha, AlephaError, AppNotStartedError, ContainerLockedError, KIND, Primitive, createMiddleware, createPrimitive, t } from "alepha";
+import { $atom, $context, $hook, $inject, $module, Alepha, AlephaError, AppNotStartedError, ContainerLockedError, KIND, Primitive, createMiddleware, createPrimitive, z } from "alepha";
 import { DateTimeProvider } from "alepha/datetime";
 import { $logger } from "alepha/logger";
 import { createSecretKey, timingSafeEqual } from "node:crypto";
@@ -30,23 +30,25 @@ export * from "alepha/crypto";
 */
 const currentTenantAtom = $atom({
 	name: "alepha.security.tenant",
-	schema: t.optional(t.object({ id: t.text({ description: "Tenant identifier (slug, UUID, or composite)." }) }))
+	schema: z.object({ id: z.text({ description: "Tenant identifier (slug, UUID, or composite)." }) }).optional()
 });
 //#endregion
 //#region ../../src/security/schemas/userAccountInfoSchema.ts
-const userAccountInfoSchema = t.object({
-	id: t.text({ description: "Unique identifier for the user." }),
-	name: t.optional(t.text({ description: "Full name of the user." })),
-	email: t.optional(t.text({
+const userAccountInfoSchema = z.object({
+	id: z.text({ description: "Unique identifier for the user." }),
+	name: z.text({ description: "Full name of the user." }).optional(),
+	firstName: z.text({ description: "Given name of the user (OIDC `given_name`)." }).optional(),
+	lastName: z.text({ description: "Family name of the user (OIDC `family_name`)." }).optional(),
+	email: z.text({
 		description: "Email address of the user.",
 		format: "email"
-	})),
-	username: t.optional(t.text({ description: "Preferred username of the user." })),
-	picture: t.optional(t.text({ description: "URL to the user's profile picture." })),
-	sessionId: t.optional(t.text({ description: "Session identifier for the user, if applicable." })),
-	organization: t.optional(t.uuid({ description: "Organization the user belongs to." })),
-	roles: t.optional(t.array(t.text(), { description: "List of roles assigned to the user." })),
-	realm: t.optional(t.text({ description: "The realm (issuer) the user was authenticated from." }))
+	}).optional(),
+	username: z.text({ description: "Preferred username of the user." }).optional(),
+	picture: z.text({ description: "URL to the user's profile picture." }).optional(),
+	sessionId: z.text({ description: "Session identifier for the user, if applicable." }).optional(),
+	organization: z.uuid().describe("Organization the user belongs to.").optional(),
+	roles: z.array(z.text()).describe("List of roles assigned to the user.").optional(),
+	realm: z.text({ description: "The realm (issuer) the user was authenticated from." }).optional()
 });
 //#endregion
 //#region ../../src/security/atoms/currentUserAtom.ts
@@ -58,7 +60,7 @@ const userAccountInfoSchema = t.object({
 */
 const currentUserAtom = $atom({
 	name: "alepha.security.user",
-	schema: t.optional(userAccountInfoSchema)
+	schema: userAccountInfoSchema.optional()
 });
 //#endregion
 //#region ../../src/security/errors/SecurityError.ts
@@ -617,11 +619,11 @@ const handleKeyObject = (keyObject, alg) => {
 		}, extractable, [isPublic ? "verify" : "sign"]);
 	}
 	if (keyObject.asymmetricKeyType === "ec") {
-		const namedCurve = new Map([
+		const namedCurve = (/* @__PURE__ */ new Map([
 			["prime256v1", "P-256"],
 			["secp384r1", "P-384"],
 			["secp521r1", "P-521"]
-		]).get(keyObject.asymmetricKeyDetails?.namedCurve);
+		])).get(keyObject.asymmetricKeyDetails?.namedCurve);
 		if (!namedCurve) throw new TypeError(unusableForAlg);
 		const expectedCurve = {
 			ES256: "P-256",
@@ -652,7 +654,8 @@ async function normalizeKey(key, alg) {
 		} catch (err) {
 			if (err instanceof TypeError) throw err;
 		}
-		return handleJWK(key, key.export({ format: "jwk" }), alg);
+		let jwk = key.export({ format: "jwk" });
+		return handleJWK(key, jwk, alg);
 	}
 	if (isJWK(key)) {
 		if (key.k) return decode(key.k);
@@ -661,7 +664,208 @@ async function normalizeKey(key, alg) {
 	throw new Error("unreachable");
 }
 //#endregion
+//#region ../../../../node_modules/jose/dist/webapi/lib/asn1.js
+const bytesEqual = (a, b) => {
+	if (a.byteLength !== b.length) return false;
+	for (let i = 0; i < a.byteLength; i++) if (a[i] !== b[i]) return false;
+	return true;
+};
+const createASN1State = (data) => ({
+	data,
+	pos: 0
+});
+const parseLength = (state) => {
+	const first = state.data[state.pos++];
+	if (first & 128) {
+		const lengthOfLen = first & 127;
+		let length = 0;
+		for (let i = 0; i < lengthOfLen; i++) length = length << 8 | state.data[state.pos++];
+		return length;
+	}
+	return first;
+};
+const expectTag = (state, expectedTag, errorMessage) => {
+	if (state.data[state.pos++] !== expectedTag) throw new Error(errorMessage);
+};
+const getSubarray = (state, length) => {
+	const result = state.data.subarray(state.pos, state.pos + length);
+	state.pos += length;
+	return result;
+};
+const parseAlgorithmOID = (state) => {
+	expectTag(state, 6, "Expected algorithm OID");
+	const oidLen = parseLength(state);
+	return getSubarray(state, oidLen);
+};
+function parsePKCS8Header(state) {
+	expectTag(state, 48, "Invalid PKCS#8 structure");
+	parseLength(state);
+	expectTag(state, 2, "Expected version field");
+	const verLen = parseLength(state);
+	state.pos += verLen;
+	expectTag(state, 48, "Expected algorithm identifier");
+	const algIdLen = parseLength(state);
+	return {
+		algIdStart: state.pos,
+		algIdLength: algIdLen
+	};
+}
+const parseECAlgorithmIdentifier = (state) => {
+	const algOid = parseAlgorithmOID(state);
+	if (bytesEqual(algOid, [
+		43,
+		101,
+		110
+	])) return "X25519";
+	if (!bytesEqual(algOid, [
+		42,
+		134,
+		72,
+		206,
+		61,
+		2,
+		1
+	])) throw new Error("Unsupported key algorithm");
+	expectTag(state, 6, "Expected curve OID");
+	const curveOidLen = parseLength(state);
+	const curveOid = getSubarray(state, curveOidLen);
+	for (const { name, oid } of [
+		{
+			name: "P-256",
+			oid: [
+				42,
+				134,
+				72,
+				206,
+				61,
+				3,
+				1,
+				7
+			]
+		},
+		{
+			name: "P-384",
+			oid: [
+				43,
+				129,
+				4,
+				0,
+				34
+			]
+		},
+		{
+			name: "P-521",
+			oid: [
+				43,
+				129,
+				4,
+				0,
+				35
+			]
+		}
+	]) if (bytesEqual(curveOid, oid)) return name;
+	throw new Error("Unsupported named curve");
+};
+const genericImport = async (keyFormat, keyData, alg, options) => {
+	let algorithm;
+	let keyUsages;
+	const isPublic = keyFormat === "spki";
+	const getSigUsages = () => isPublic ? ["verify"] : ["sign"];
+	const getEncUsages = () => isPublic ? ["encrypt", "wrapKey"] : ["decrypt", "unwrapKey"];
+	switch (alg) {
+		case "PS256":
+		case "PS384":
+		case "PS512":
+			algorithm = {
+				name: "RSA-PSS",
+				hash: `SHA-${alg.slice(-3)}`
+			};
+			keyUsages = getSigUsages();
+			break;
+		case "RS256":
+		case "RS384":
+		case "RS512":
+			algorithm = {
+				name: "RSASSA-PKCS1-v1_5",
+				hash: `SHA-${alg.slice(-3)}`
+			};
+			keyUsages = getSigUsages();
+			break;
+		case "RSA-OAEP":
+		case "RSA-OAEP-256":
+		case "RSA-OAEP-384":
+		case "RSA-OAEP-512":
+			algorithm = {
+				name: "RSA-OAEP",
+				hash: `SHA-${parseInt(alg.slice(-3), 10) || 1}`
+			};
+			keyUsages = getEncUsages();
+			break;
+		case "ES256":
+		case "ES384":
+		case "ES512":
+			algorithm = {
+				name: "ECDSA",
+				namedCurve: {
+					ES256: "P-256",
+					ES384: "P-384",
+					ES512: "P-521"
+				}[alg]
+			};
+			keyUsages = getSigUsages();
+			break;
+		case "ECDH-ES":
+		case "ECDH-ES+A128KW":
+		case "ECDH-ES+A192KW":
+		case "ECDH-ES+A256KW":
+			try {
+				const namedCurve = options.getNamedCurve(keyData);
+				algorithm = namedCurve === "X25519" ? { name: "X25519" } : {
+					name: "ECDH",
+					namedCurve
+				};
+			} catch (cause) {
+				throw new JOSENotSupported("Invalid or unsupported key format");
+			}
+			keyUsages = isPublic ? [] : ["deriveBits"];
+			break;
+		case "Ed25519":
+		case "EdDSA":
+			algorithm = { name: "Ed25519" };
+			keyUsages = getSigUsages();
+			break;
+		case "ML-DSA-44":
+		case "ML-DSA-65":
+		case "ML-DSA-87":
+			algorithm = { name: alg };
+			keyUsages = getSigUsages();
+			break;
+		default: throw new JOSENotSupported("Invalid or unsupported \"alg\" (Algorithm) value");
+	}
+	return crypto.subtle.importKey(keyFormat, keyData, algorithm, options?.extractable ?? (isPublic ? true : false), keyUsages);
+};
+const processPEMData = (pem, pattern) => {
+	return decodeBase64(pem.replace(pattern, ""));
+};
+const fromPKCS8 = (pem, alg, options) => {
+	const keyData = processPEMData(pem, /(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g);
+	let opts = options;
+	if (alg?.startsWith?.("ECDH-ES")) {
+		opts ||= {};
+		opts.getNamedCurve = (keyData) => {
+			const state = createASN1State(keyData);
+			parsePKCS8Header(state);
+			return parseECAlgorithmIdentifier(state);
+		};
+	}
+	return genericImport("pkcs8", keyData, alg, opts);
+};
+//#endregion
 //#region ../../../../node_modules/jose/dist/webapi/key/import.js
+async function importPKCS8(pkcs8, alg, options) {
+	if (typeof pkcs8 !== "string" || pkcs8.indexOf("-----BEGIN PRIVATE KEY-----") !== 0) throw new TypeError("\"pkcs8\" must be PKCS#8 formatted string");
+	return fromPKCS8(pkcs8, alg, options);
+}
 async function importJWK(jwk, alg, options) {
 	if (!isObject(jwk)) throw new TypeError("JWK must be an object");
 	let ext;
@@ -695,6 +899,26 @@ async function importJWK(jwk, alg, options) {
 	}
 }
 //#endregion
+//#region ../../../../node_modules/jose/dist/webapi/lib/key_to_jwk.js
+async function keyToJWK(key) {
+	if (isKeyObject(key)) if (key.type === "secret") key = key.export();
+	else return key.export({ format: "jwk" });
+	if (key instanceof Uint8Array) return {
+		kty: "oct",
+		k: encode(key)
+	};
+	if (!isCryptoKey(key)) throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "Uint8Array"));
+	if (!key.extractable) throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");
+	const { ext, key_ops, alg, use, ...jwk } = await crypto.subtle.exportKey("jwk", key);
+	if (jwk.kty === "AKP") jwk.alg = alg;
+	return jwk;
+}
+//#endregion
+//#region ../../../../node_modules/jose/dist/webapi/key/export.js
+async function exportJWK(key) {
+	return keyToJWK(key);
+}
+//#endregion
 //#region ../../../../node_modules/jose/dist/webapi/lib/validate_crit.js
 function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
 	if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0) throw new Err("\"crit\" (Critical) Header Parameter MUST be integrity protected");
@@ -826,7 +1050,7 @@ async function flattenedVerify(jws, key, options) {
 		...parsedProt,
 		...jws.header
 	};
-	const extensions = validateCrit(JWSInvalid, new Map([["b64", true]]), options?.crit, parsedProt, joseHeader);
+	const extensions = validateCrit(JWSInvalid, /* @__PURE__ */ new Map([["b64", true]]), options?.crit, parsedProt, joseHeader);
 	let b64 = true;
 	if (extensions.has("b64")) {
 		b64 = parsedProt.b64;
@@ -845,7 +1069,7 @@ async function flattenedVerify(jws, key, options) {
 		resolvedKey = true;
 	}
 	checkKeyType(alg, key, "verify");
-	const data = concat(jws.protected !== void 0 ? encode$1(jws.protected) : new Uint8Array(), encode$1("."), typeof jws.payload === "string" ? b64 ? encode$1(jws.payload) : encoder.encode(jws.payload) : jws.payload);
+	const data = concat(jws.protected !== void 0 ? encode$1(jws.protected) : /* @__PURE__ */ new Uint8Array(), encode$1("."), typeof jws.payload === "string" ? b64 ? encode$1(jws.payload) : encoder.encode(jws.payload) : jws.payload);
 	const signature = decodeBase64url(jws.signature, "signature", JWSInvalid);
 	const k = await normalizeKey(key, alg);
 	if (!await verify(alg, k, signature, data)) throw new JWSSignatureVerificationFailed();
@@ -1090,7 +1314,7 @@ var FlattenedSign = class {
 			...this.#protectedHeader,
 			...this.#unprotectedHeader
 		};
-		const extensions = validateCrit(JWSInvalid, new Map([["b64", true]]), options?.crit, this.#protectedHeader, joseHeader);
+		const extensions = validateCrit(JWSInvalid, /* @__PURE__ */ new Map([["b64", true]]), options?.crit, this.#protectedHeader, joseHeader);
 		let b64 = true;
 		if (extensions.has("b64")) {
 			b64 = this.#protectedHeader.b64;
@@ -1115,7 +1339,7 @@ var FlattenedSign = class {
 			protectedHeaderBytes = encode$1(protectedHeaderString);
 		} else {
 			protectedHeaderString = "";
-			protectedHeaderBytes = new Uint8Array();
+			protectedHeaderBytes = /* @__PURE__ */ new Uint8Array();
 		}
 		const data = concat(protectedHeaderBytes, encode$1("."), payloadB);
 		const jws = {
@@ -1428,6 +1652,114 @@ function createRemoteJWKSet(url, options) {
 	return remoteJWKSet;
 }
 //#endregion
+//#region ../../../../node_modules/jose/dist/webapi/key/generate_key_pair.js
+function getModulusLengthOption(options) {
+	const modulusLength = options?.modulusLength ?? 2048;
+	if (typeof modulusLength !== "number" || modulusLength < 2048) throw new JOSENotSupported("Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used");
+	return modulusLength;
+}
+async function generateKeyPair(alg, options) {
+	let algorithm;
+	let keyUsages;
+	switch (alg) {
+		case "PS256":
+		case "PS384":
+		case "PS512":
+			algorithm = {
+				name: "RSA-PSS",
+				hash: `SHA-${alg.slice(-3)}`,
+				publicExponent: Uint8Array.of(1, 0, 1),
+				modulusLength: getModulusLengthOption(options)
+			};
+			keyUsages = ["sign", "verify"];
+			break;
+		case "RS256":
+		case "RS384":
+		case "RS512":
+			algorithm = {
+				name: "RSASSA-PKCS1-v1_5",
+				hash: `SHA-${alg.slice(-3)}`,
+				publicExponent: Uint8Array.of(1, 0, 1),
+				modulusLength: getModulusLengthOption(options)
+			};
+			keyUsages = ["sign", "verify"];
+			break;
+		case "RSA-OAEP":
+		case "RSA-OAEP-256":
+		case "RSA-OAEP-384":
+		case "RSA-OAEP-512":
+			algorithm = {
+				name: "RSA-OAEP",
+				hash: `SHA-${parseInt(alg.slice(-3), 10) || 1}`,
+				publicExponent: Uint8Array.of(1, 0, 1),
+				modulusLength: getModulusLengthOption(options)
+			};
+			keyUsages = [
+				"decrypt",
+				"unwrapKey",
+				"encrypt",
+				"wrapKey"
+			];
+			break;
+		case "ES256":
+			algorithm = {
+				name: "ECDSA",
+				namedCurve: "P-256"
+			};
+			keyUsages = ["sign", "verify"];
+			break;
+		case "ES384":
+			algorithm = {
+				name: "ECDSA",
+				namedCurve: "P-384"
+			};
+			keyUsages = ["sign", "verify"];
+			break;
+		case "ES512":
+			algorithm = {
+				name: "ECDSA",
+				namedCurve: "P-521"
+			};
+			keyUsages = ["sign", "verify"];
+			break;
+		case "Ed25519":
+		case "EdDSA":
+			keyUsages = ["sign", "verify"];
+			algorithm = { name: "Ed25519" };
+			break;
+		case "ML-DSA-44":
+		case "ML-DSA-65":
+		case "ML-DSA-87":
+			keyUsages = ["sign", "verify"];
+			algorithm = { name: alg };
+			break;
+		case "ECDH-ES":
+		case "ECDH-ES+A128KW":
+		case "ECDH-ES+A192KW":
+		case "ECDH-ES+A256KW": {
+			keyUsages = ["deriveBits"];
+			const crv = options?.crv ?? "P-256";
+			switch (crv) {
+				case "P-256":
+				case "P-384":
+				case "P-521":
+					algorithm = {
+						name: "ECDH",
+						namedCurve: crv
+					};
+					break;
+				case "X25519":
+					algorithm = { name: "X25519" };
+					break;
+				default: throw new JOSENotSupported("Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519");
+			}
+			break;
+		}
+		default: throw new JOSENotSupported("Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value");
+	}
+	return crypto.subtle.generateKey(algorithm, options?.extractable ?? false, keyUsages);
+}
+//#endregion
 //#region ../../src/security/providers/JwtProvider.ts
 /**
 * Provides utilities for working with JSON Web Tokens (JWT).
@@ -1435,6 +1767,7 @@ function createRemoteJWKSet(url, options) {
 var JwtProvider = class {
 	log = $logger();
 	keystore = [];
+	signers = /* @__PURE__ */ new Map();
 	dateTimeProvider = $inject(DateTimeProvider);
 	encoder = new TextEncoder();
 	/**
@@ -1467,6 +1800,50 @@ var JwtProvider = class {
 		}
 	}
 	/**
+	* Configure an asymmetric signing key for a realm/issuer. Tokens minted for
+	* `name` are then signed with `alg` + `kid`, and a local verify loader is
+	* registered so this process can verify its own tokens (refresh tokens,
+	* authorization codes, id_tokens). Public keys are published via `getJwks`.
+	*
+	* `privateKey` is a PKCS#8 PEM (from env). When it is empty/undefined an
+	* **ephemeral per-process keypair** is generated so dev/test work with no env
+	* key configured — the published JWKS still resolves; tokens just don't
+	* survive a restart. Additive: realms without a signing key keep the HS256
+	* path untouched.
+	*/
+	async setSigningKey(name, signing) {
+		const key = signing.privateKey ? await importPKCS8(signing.privateKey, signing.alg, { extractable: true }) : (await generateKeyPair(signing.alg, { extractable: true })).privateKey;
+		const { d, p, q, dp, dq, qi, ...pub } = await exportJWK(key);
+		const publicJwk = {
+			...pub,
+			kid: signing.kid,
+			use: "sig",
+			alg: signing.alg
+		};
+		this.signers.set(name, {
+			alg: signing.alg,
+			kid: signing.kid,
+			key,
+			publicJwk
+		});
+		this.log.debug(`will sign + verify JWTs for '${name}'`, {
+			alg: signing.alg,
+			kid: signing.kid
+		});
+		this.keystore.push({
+			name,
+			keyLoader: createLocalJWKSet({ keys: [publicJwk] })
+		});
+	}
+	/**
+	* Public JWK Set for a realm/issuer configured with an asymmetric signing
+	* key. Returns an empty set for HS256 / external (URL-based) realms.
+	*/
+	async getJwks(name) {
+		const signer = this.signers.get(name);
+		return { keys: signer ? [signer.publicJwk] : [] };
+	}
+	/**
 	* Retrieves the payload from a JSON Web Token (JWT).
 	*
 	* @param token - The JWT to extract the payload from.
@@ -1509,6 +1886,17 @@ var JwtProvider = class {
 	* @returns The signed JWT token.
 	*/
 	async create(payload, keyName, signOptions) {
+		const signerName = keyName ?? this.keystore[0]?.name;
+		const signer = signerName ? this.signers.get(signerName) : void 0;
+		if (signer) {
+			const signJwt = new SignJWT(payload);
+			signJwt.setProtectedHeader({
+				alg: signer.alg,
+				kid: signer.kid,
+				...signOptions?.header
+			});
+			return await signJwt.sign(signer.key);
+		}
 		const secretKey = keyName ? this.keystore.find((it) => it.name === keyName)?.secretKey : this.keystore[0]?.secretKey;
 		if (!secretKey) throw new AlephaError("No secret key found in the keystore");
 		const signJwt = new SignJWT(payload);
@@ -1579,7 +1967,8 @@ var SecurityProvider = class {
 		on: "start",
 		handler: async () => {
 			for (const realm of this.realms) {
-				if (realm.secret) {
+				if (realm.signing) await this.jwt.setSigningKey(realm.name, realm.signing);
+				else if (realm.secret) {
 					const secret = typeof realm.secret === "function" ? realm.secret() : realm.secret;
 					this.jwt.setKeyLoader(realm.name, secret);
 				}
@@ -1710,6 +2099,8 @@ var SecurityProvider = class {
 		const username = this.getUsernameFromPayload(payload);
 		const picture = this.getPictureFromPayload(payload);
 		const name = this.getNameFromPayload(payload);
+		const firstName = typeof payload.given_name === "string" ? payload.given_name : void 0;
+		const lastName = typeof payload.family_name === "string" ? payload.family_name : void 0;
 		const organization = this.getOrganizationFromPayload(payload);
 		const rolesFromSystem = this.getRoles(realmName);
 		const roles = rolesFromPayload.reduce((arr, roleName) => arr.concat(rolesFromSystem.filter((it) => it.name === roleName)), []).map((it) => it.name);
@@ -1719,6 +2110,8 @@ var SecurityProvider = class {
 			id,
 			roles,
 			name,
+			firstName,
+			lastName,
 			email,
 			username,
 			picture,
@@ -1925,6 +2318,24 @@ var SecurityProvider = class {
 		return this.realms;
 	}
 	/**
+	* Resolve the realm an authenticated admin action is allowed to operate on.
+	*
+	* Admin endpoints accept a client-supplied target realm (e.g. a
+	* `userRealmName` query param). Without scoping, a realm-A admin could act on
+	* realm-B resources by simply naming realm B — a cross-tenant escalation
+	* whenever realms are used as tenant boundaries. This binds the target realm
+	* to the caller's own realm: omitting the target means "my realm"; naming a
+	* *different* realm than the caller's is refused.
+	*
+	* Returns the effective realm to use (may be `undefined` in single-realm apps
+	* where neither the caller nor the request carries a realm).
+	*/
+	assertRealmScope(user, requestedRealm) {
+		const callerRealm = user?.realm;
+		if (requestedRealm && callerRealm && requestedRealm !== callerRealm) throw new ForbiddenError(`Cross-realm access denied: authenticated in realm '${callerRealm}', requested realm '${requestedRealm}'.`);
+		return requestedRealm ?? callerRealm;
+	}
+	/**
 	* Retrieves the user account from the provided user ID.
 	*
 	* @param realm
@@ -2095,6 +2506,7 @@ var IssuerPrimitive = class extends Primitive {
 			name: this.name,
 			profile: this.options.profile,
 			secret: "jwks" in this.options ? this.options.jwks : this.options.secret,
+			signing: this.options.signing,
 			roles,
 			resolvers: []
 		});
@@ -2188,6 +2600,7 @@ var IssuerPrimitive = class extends Primitive {
 			aud: this.name
 		});
 		const tenant = this.alepha.store.get(currentTenantAtom)?.id;
+		const composedName = user.name ?? ([user.firstName, user.lastName].filter((s) => !!s?.trim()).join(" ").trim() || void 0);
 		return {
 			access_token: await this.jwt.create({
 				sub: user.id,
@@ -2195,7 +2608,9 @@ var IssuerPrimitive = class extends Primitive {
 				iat,
 				aud: this.name,
 				sid,
-				name: user.name,
+				name: composedName,
+				given_name: user.firstName,
+				family_name: user.lastName,
 				email: user.email,
 				preferred_username: user.username,
 				picture: user.picture,
@@ -2661,23 +3076,23 @@ const $serviceAccount = (options) => {
 };
 //#endregion
 //#region ../../src/security/schemas/permissionSchema.ts
-const permissionSchema = t.object({
-	name: t.text({ description: "Name of the permission." }),
-	group: t.optional(t.text({ description: "Group of the permission." })),
-	description: t.optional(t.text({ description: "Describe the permission." })),
-	method: t.optional(t.text({ description: "HTTP method of the permission. When available." })),
-	path: t.optional(t.text({ description: "Pathname of the permission. When available." }))
+const permissionSchema = z.object({
+	name: z.text({ description: "Name of the permission." }),
+	group: z.text({ description: "Group of the permission." }).optional(),
+	description: z.text({ description: "Describe the permission." }).optional(),
+	method: z.text({ description: "HTTP method of the permission. When available." }).optional(),
+	path: z.text({ description: "Pathname of the permission. When available." }).optional()
 });
 //#endregion
 //#region ../../src/security/schemas/roleSchema.ts
-const roleSchema = t.object({
-	name: t.text({ description: "Name of the role." }),
-	description: t.optional(t.text({ description: "Describe the role." })),
-	default: t.optional(t.boolean({ description: "If true, this role will be assigned to all users by default." })),
-	permissions: t.array(t.object({
-		name: t.text({ description: "Name of the permission." }),
-		ownership: t.optional(t.boolean({ description: "If true, user will only have access to it's own resources." })),
-		exclude: t.optional(t.array(t.text(), { description: "Exclude some permissions. Useful when 'name' is a wildcard." }))
+const roleSchema = z.object({
+	name: z.text({ description: "Name of the role." }),
+	description: z.text({ description: "Describe the role." }).optional(),
+	default: z.boolean().describe("If true, this role will be assigned to all users by default.").optional(),
+	permissions: z.array(z.object({
+		name: z.text({ description: "Name of the permission." }),
+		ownership: z.boolean().describe("If true, user will only have access to it's own resources.").optional(),
+		exclude: z.array(z.text()).describe("Exclude some permissions. Useful when 'name' is a wildcard.").optional()
 	}))
 });
 //#endregion