alepha 0.22.0 → 0.24.0

package/src/api/users/__tests__/ApiKeys-integration.spec.ts

@@ -1,5 +1,5 @@
 import { randomUUID } from "node:crypto";
-import { Alepha, t } from "alepha";
+import { Alepha, z } from "alepha";
 import { AdminApiKeyController, ApiKeyController } from "alepha/api/keys";
 import { DateTimeProvider } from "alepha/datetime";
 import { AlephaEmail } from "alepha/email";
@@ -15,9 +15,9 @@ import { $realm, AlephaApiUsers } from "../index.ts";
 const adminUser = { id: randomUUID(), roles: ["admin"] };
 
 // Schema for generating fake user data
-const userDataSchema = t.object({
-  username: t.string(),
-  email: t.email(),
+const userDataSchema = z.object({
+  username: z.string(),
+  email: z.email(),
 });
 
 const setup = async () => {
@@ -44,9 +44,9 @@ const setup = async () => {
       group: "profile",
       use: [$secure()],
       schema: {
-        response: t.object({
-          userId: t.string(),
-          roles: t.array(t.string()),
+        response: z.object({
+          userId: z.string(),
+          roles: z.array(z.string()),
         }),
       },
       handler: (request) => ({
@@ -62,10 +62,10 @@ const setup = async () => {
       group: "admin:stats",
       use: [$secure({ permissions: ["admin:stats"] })],
       schema: {
-        response: t.object({
-          message: t.string(),
-          adminId: t.string(),
-          roles: t.array(t.string()),
+        response: z.object({
+          message: z.string(),
+          adminId: z.string(),
+          roles: z.array(z.string()),
         }),
       },
       handler: (request) => ({

package/src/api/users/atoms/realmAuthSettingsAtom.ts

@@ -1,4 +1,4 @@
-import { $atom, type Static, t } from "alepha";
+import { $atom, type Static, z } from "alepha";
 
 /**
  * Tri-state field requirement for realm auth settings.
@@ -10,9 +10,9 @@ import { $atom, type Static, t } from "alepha";
 export type FieldRequirement = "none" | "optional" | "required";
 
 const fieldRequirement = (description: string) =>
-  t.union([t.const("none"), t.const("optional"), t.const("required")], {
-    description,
-  });
+  z
+    .union([z.const("none"), z.const("optional"), z.const("required")])
+    .describe(description);
 
 /**
  * Username-specific field requirement, extending {@link FieldRequirement}
@@ -27,151 +27,143 @@ const fieldRequirement = (description: string) =>
 export type UsernameFieldRequirement = FieldRequirement | "email";
 
 const usernameFieldRequirement = (description: string) =>
-  t.union(
-    [
-      t.const("none"),
-      t.const("optional"),
-      t.const("required"),
-      t.const("email"),
-    ],
-    {
-      description,
-    },
-  );
+  z
+    .union([
+      z.const("none"),
+      z.const("optional"),
+      z.const("required"),
+      z.const("email"),
+    ])
+    .describe(description);
 
 export const realmAuthSettingsAtom = $atom({
   name: "alepha.api.users.realmAuthSettings",
-  schema: t.object({
+  schema: z.object({
     // Branding and display settings
-    displayName: t.optional(
-      t.string({
-        description:
-          "Display name shown on auth pages (e.g., 'Customer Portal')",
-      }),
-    ),
-    description: t.optional(
-      t.string({
-        description: "Description shown on auth pages",
-      }),
-    ),
-    logoUrl: t.optional(
-      t.string({
-        description: "Logo URL for auth pages",
-      }),
-    ),
+    displayName: z
+      .string()
+      .describe("Display name shown on auth pages (e.g., 'Customer Portal')")
+      .optional(),
+    description: z
+      .string()
+      .describe("Description shown on auth pages")
+      .optional(),
+    logoUrl: z.string().describe("Logo URL for auth pages").optional(),
 
     // Auth settings
-    registrationAllowed: t.boolean({
-      description: "Enable user self-registration",
-    }),
+    registrationAllowed: z.boolean().describe("Enable user self-registration"),
     email: fieldRequirement(
       "Email address field requirement for user accounts",
     ),
     username: usernameFieldRequirement(
       "Username field requirement for user accounts",
     ),
-    usernameRegExp: t.string({
-      description:
+    usernameRegExp: z
+      .string()
+      .describe(
         "Regular expression that usernames must match (if username is enabled)",
-    }),
-    usernameBlocklist: t.array(t.text(), {
-      description:
+      ),
+    usernameBlocklist: z
+      .array(z.text())
+      .describe(
         "Usernames that the slugger / manual registration must reject. " +
-        "Default empty so apps can register `admin`/`root`/`me`/etc. if " +
-        "they want; populate it explicitly for handles you want to keep " +
-        "off-limits.",
-    }),
+          "Default empty so apps can register `admin`/`root`/`me`/etc. if " +
+          "they want; populate it explicitly for handles you want to keep " +
+          "off-limits.",
+      ),
     phoneNumber: fieldRequirement(
       "Phone number field requirement for user accounts",
     ),
-    verifyEmailRequired: t.boolean({
-      description: "Require email verification for user accounts",
-    }),
-    verifyPhoneRequired: t.boolean({
-      description: "Require phone verification for user accounts",
-    }),
+    verifyEmailRequired: z
+      .boolean()
+      .describe("Require email verification for user accounts"),
+    verifyPhoneRequired: z
+      .boolean()
+      .describe("Require phone verification for user accounts"),
     firstNameLastName: fieldRequirement(
       "First and last name field requirement for user accounts",
     ),
-    resetPasswordAllowed: t.boolean({
-      description: "Enable forgot password functionality",
-    }),
-    captchaRequired: t.boolean({
-      description:
+    resetPasswordAllowed: z
+      .boolean()
+      .describe("Enable forgot password functionality"),
+    captchaRequired: z
+      .boolean()
+      .describe(
         "Require captcha verification on registration (needs a CaptchaProvider registered, e.g. TurnstileCaptchaProvider)",
-    }),
-    adminEmails: t.array(t.email(), {
-      description:
+      ),
+    adminEmails: z
+      .array(z.email())
+      .describe(
         "List of email addresses that are automatically promoted to admin role on login",
-    }),
-    adminUsernames: t.array(t.text(), {
-      description:
+      ),
+    adminUsernames: z
+      .array(z.text())
+      .describe(
         "List of usernames that are automatically promoted to admin role on login",
+      ),
+    defaultRoles: z
+      .array(z.string())
+      .describe("Default roles assigned to newly registered users"),
+    verifyEmailUrl: z
+      .string()
+      .describe(
+        "Base URL for email verification links (used when verification method is 'link'). Token and email are appended as query params.",
+      )
+      .optional(),
+    passwordPolicy: z.object({
+      minLength: z
+        .integer()
+        .min(1)
+        .describe("Minimum password length")
+        .default(8),
+      requireUppercase: z
+        .boolean()
+        .describe("Require at least one uppercase letter"),
+      requireLowercase: z
+        .boolean()
+        .describe("Require at least one lowercase letter"),
+      requireNumbers: z.boolean().describe("Require at least one number"),
+      requireSpecialCharacters: z
+        .boolean()
+        .describe("Require at least one special character"),
     }),
-    defaultRoles: t.array(t.string(), {
-      description: "Default roles assigned to newly registered users",
-    }),
-    verifyEmailUrl: t.optional(
-      t.string({
-        description:
-          "Base URL for email verification links (used when verification method is 'link'). Token and email are appended as query params.",
-      }),
-    ),
-    passwordPolicy: t.object({
-      minLength: t.integer({
-        description: "Minimum password length",
-        default: 8,
-        minimum: 1,
-      }),
-      requireUppercase: t.boolean({
-        description: "Require at least one uppercase letter",
-      }),
-      requireLowercase: t.boolean({
-        description: "Require at least one lowercase letter",
-      }),
-      requireNumbers: t.boolean({
-        description: "Require at least one number",
-      }),
-      requireSpecialCharacters: t.boolean({
-        description: "Require at least one special character",
-      }),
-    }),
-    loginRateLimit: t.object({
-      ipMaxAttempts: t.integer({
-        description:
-          "Max failed login attempts per IP before temporary lockout",
-        default: 15,
-        minimum: 1,
-      }),
-      accountMaxAttempts: t.integer({
-        description:
+    loginRateLimit: z.object({
+      ipMaxAttempts: z
+        .integer()
+        .min(1)
+        .describe("Max failed login attempts per IP before temporary lockout")
+        .default(15),
+      accountMaxAttempts: z
+        .integer()
+        .min(1)
+        .describe(
           "Max failed login attempts per account before temporary lockout",
-        default: 5,
-        minimum: 1,
-      }),
-      windowMs: t.integer({
-        description: "Rate limit window duration in milliseconds",
-        default: 15 * 60 * 1000,
-        minimum: 1000,
-      }),
+        )
+        .default(5),
+      windowMs: z
+        .integer()
+        .min(1000)
+        .describe("Rate limit window duration in milliseconds")
+        .default(15 * 60 * 1000),
     }),
-    registrationIpMaxAttempts: t.integer({
-      description:
+    registrationIpMaxAttempts: z
+      .integer()
+      .min(1)
+      .describe(
         "Max registration attempts per IP before temporary lockout. Default 10 protects against signup abuse; raise it in dev/e2e environments where a single localhost IP spawns many test users.",
-      default: 10,
-      minimum: 1,
-    }),
-    refreshToken: t.object({
-      expirationIdle: t.optional(
-        t.integer({
-          description:
-            "Maximum time in milliseconds a refresh token may stay unused before being invalidated. " +
+      )
+      .default(10),
+    refreshToken: z.object({
+      expirationIdle: z
+        .integer()
+        .min(1000)
+        .describe(
+          "Maximum time in milliseconds a refresh token may stay unused before being invalidated. " +
             "When set, sessions whose last refresh is older than this window are rejected and deleted, " +
             "even if the absolute `expiresAt` has not been reached. Recommended for SaaS auth posture " +
             "(SOC2/ISO27001). Leave undefined to disable idle invalidation (default).",
-          minimum: 1000,
-        }),
-      ),
+        )
+        .optional(),
     }),
   }),
   default: {

package/src/api/users/controllers/AdminIdentityController.ts

@@ -1,5 +1,5 @@
-import { $inject, t } from "alepha";
-import { $secure } from "alepha/security";
+import { $inject, z } from "alepha";
+import { $secure, SecurityProvider } from "alepha/security";
 import { $action, okSchema } from "alepha/server";
 import { identityQuerySchema } from "../schemas/identityQuerySchema.ts";
 import { identityResourceSchema } from "../schemas/identityResourceSchema.ts";
@@ -9,6 +9,7 @@ export class AdminIdentityController {
   protected readonly url = "/identities";
   protected readonly group = "admin:identities";
   protected readonly identityService = $inject(IdentityService);
+  protected readonly securityProvider = $inject(SecurityProvider);
 
   /**
    * Find identities with pagination and filtering.
@@ -19,14 +20,17 @@ export class AdminIdentityController {
     use: [$secure({ permissions: ["admin:identity:read"] })],
     description: "Find identities with pagination and filtering",
     schema: {
-      query: t.extend(identityQuerySchema, {
-        userRealmName: t.optional(t.string()),
+      query: identityQuerySchema.extend({
+        userRealmName: z.string().optional(),
       }),
-      response: t.page(identityResourceSchema),
+      response: z.page(identityResourceSchema),
     },
-    handler: ({ query }) => {
+    handler: ({ query, user }) => {
       const { userRealmName, ...q } = query;
-      return this.identityService.findIdentities(q, userRealmName);
+      return this.identityService.findIdentities(
+        q,
+        this.securityProvider.assertRealmScope(user, userRealmName),
+      );
     },
   });
 
@@ -39,16 +43,19 @@ export class AdminIdentityController {
     use: [$secure({ permissions: ["admin:identity:read"] })],
     description: "Get an identity by ID",
     schema: {
-      params: t.object({
-        id: t.uuid(),
+      params: z.object({
+        id: z.uuid(),
       }),
-      query: t.object({
-        userRealmName: t.optional(t.string()),
+      query: z.object({
+        userRealmName: z.string().optional(),
       }),
       response: identityResourceSchema,
     },
-    handler: ({ params, query }) =>
-      this.identityService.getIdentityById(params.id, query.userRealmName),
+    handler: ({ params, query, user }) =>
+      this.identityService.getIdentityById(
+        params.id,
+        this.securityProvider.assertRealmScope(user, query.userRealmName),
+      ),
   });
 
   /**
@@ -61,16 +68,19 @@ export class AdminIdentityController {
     use: [$secure({ permissions: ["admin:identity:delete"] })],
     description: "Delete an identity",
     schema: {
-      params: t.object({
-        id: t.uuid(),
+      params: z.object({
+        id: z.uuid(),
       }),
-      query: t.object({
-        userRealmName: t.optional(t.string()),
+      query: z.object({
+        userRealmName: z.string().optional(),
       }),
       response: okSchema,
     },
-    handler: async ({ params, query }) => {
-      await this.identityService.deleteIdentity(params.id, query.userRealmName);
+    handler: async ({ params, query, user }) => {
+      await this.identityService.deleteIdentity(
+        params.id,
+        this.securityProvider.assertRealmScope(user, query.userRealmName),
+      );
       return { ok: true, id: params.id };
     },
   });

package/src/api/users/controllers/AdminSessionController.ts

@@ -1,5 +1,5 @@
-import { $inject, t } from "alepha";
-import { $secure } from "alepha/security";
+import { $inject, z } from "alepha";
+import { $secure, SecurityProvider } from "alepha/security";
 import { $action, okSchema } from "alepha/server";
 import { sessionQuerySchema } from "../schemas/sessionQuerySchema.ts";
 import { sessionResourceSchema } from "../schemas/sessionResourceSchema.ts";
@@ -9,6 +9,7 @@ export class AdminSessionController {
   protected readonly url = "/sessions";
   protected readonly group = "admin:sessions";
   protected readonly sessionService = $inject(SessionCrudService);
+  protected readonly securityProvider = $inject(SecurityProvider);
 
   /**
    * Find sessions with pagination and filtering.
@@ -19,14 +20,17 @@ export class AdminSessionController {
     use: [$secure({ permissions: ["admin:session:read"] })],
     description: "Find sessions with pagination and filtering",
     schema: {
-      query: t.extend(sessionQuerySchema, {
-        userRealmName: t.optional(t.string()),
+      query: sessionQuerySchema.extend({
+        userRealmName: z.string().optional(),
       }),
-      response: t.page(sessionResourceSchema),
+      response: z.page(sessionResourceSchema),
     },
-    handler: ({ query }) => {
+    handler: ({ query, user }) => {
       const { userRealmName, ...q } = query;
-      return this.sessionService.findSessions(q, userRealmName);
+      return this.sessionService.findSessions(
+        q,
+        this.securityProvider.assertRealmScope(user, userRealmName),
+      );
     },
   });
 
@@ -39,16 +43,19 @@ export class AdminSessionController {
     use: [$secure({ permissions: ["admin:session:read"] })],
     description: "Get a session by ID",
     schema: {
-      params: t.object({
-        id: t.uuid(),
+      params: z.object({
+        id: z.uuid(),
       }),
-      query: t.object({
-        userRealmName: t.optional(t.string()),
+      query: z.object({
+        userRealmName: z.string().optional(),
       }),
       response: sessionResourceSchema,
     },
-    handler: ({ params, query }) =>
-      this.sessionService.getSessionById(params.id, query.userRealmName),
+    handler: ({ params, query, user }) =>
+      this.sessionService.getSessionById(
+        params.id,
+        this.securityProvider.assertRealmScope(user, query.userRealmName),
+      ),
   });
 
   /**
@@ -61,16 +68,19 @@ export class AdminSessionController {
     use: [$secure({ permissions: ["admin:session:delete"] })],
     description: "Delete a session",
     schema: {
-      params: t.object({
-        id: t.uuid(),
+      params: z.object({
+        id: z.uuid(),
       }),
-      query: t.object({
-        userRealmName: t.optional(t.string()),
+      query: z.object({
+        userRealmName: z.string().optional(),
       }),
       response: okSchema,
     },
-    handler: async ({ params, query }) => {
-      await this.sessionService.deleteSession(params.id, query.userRealmName);
+    handler: async ({ params, query, user }) => {
+      await this.sessionService.deleteSession(
+        params.id,
+        this.securityProvider.assertRealmScope(user, query.userRealmName),
+      );
       return { ok: true, id: params.id };
     },
   });
@@ -85,20 +95,20 @@ export class AdminSessionController {
     use: [$secure({ permissions: ["admin:session:delete"] })],
     description: "Delete many sessions",
     schema: {
-      query: t.object({
-        userRealmName: t.optional(t.string()),
+      query: z.object({
+        userRealmName: z.string().optional(),
       }),
-      body: t.object({
-        ids: t.array(t.uuid(), { minItems: 1, maxItems: 1000 }),
+      body: z.object({
+        ids: z.array(z.uuid()).min(1).max(1000),
       }),
-      response: t.object({
-        deleted: t.array(t.string()),
+      response: z.object({
+        deleted: z.array(z.string()),
       }),
     },
-    handler: async ({ body, query }) => {
+    handler: async ({ body, query, user }) => {
       const deleted = await this.sessionService.deleteSessions(
         body.ids,
-        query.userRealmName,
+        this.securityProvider.assertRealmScope(user, query.userRealmName),
       );
       return { deleted };
     },