alepha 0.22.0 → 0.24.0

package/src/api/users/controllers/AdminUserController.ts

@@ -1,4 +1,4 @@
-import { $inject, t } from "alepha";
+import { $inject, z } from "alepha";
 import { $secure, SecurityProvider } from "alepha/security";
 import { $action, okSchema } from "alepha/server";
 import { createUserSchema } from "../schemas/createUserSchema.ts";
@@ -23,19 +23,21 @@ export class AdminUserController {
     use: [$secure({ permissions: ["admin:user:read"] })],
     description: "List roles available in a realm",
     schema: {
-      query: t.object({
-        userRealmName: t.optional(t.string()),
+      query: z.object({
+        userRealmName: z.string().optional(),
       }),
-      response: t.array(
-        t.object({
-          name: t.string(),
-          default: t.optional(t.boolean()),
-          description: t.optional(t.string()),
+      response: z.array(
+        z.object({
+          name: z.string(),
+          default: z.boolean().optional(),
+          description: z.string().optional(),
         }),
       ),
     },
-    handler: ({ query }) => {
-      const roles = this.securityProvider.getRoles(query.userRealmName);
+    handler: ({ query, user }) => {
+      const roles = this.securityProvider.getRoles(
+        this.securityProvider.assertRealmScope(user, query.userRealmName),
+      );
       return roles.map((r) => ({
         name: r.name,
         default: r.default,
@@ -53,14 +55,17 @@ export class AdminUserController {
     use: [$secure({ permissions: ["admin:user:read"] })],
     description: "Find users with pagination and filtering",
     schema: {
-      query: t.extend(userQuerySchema, {
-        userRealmName: t.optional(t.string()),
+      query: userQuerySchema.extend({
+        userRealmName: z.string().optional(),
       }),
-      response: t.page(userResourceSchema),
+      response: z.page(userResourceSchema),
     },
-    handler: ({ query }) => {
+    handler: ({ query, user }) => {
       const { userRealmName, ...q } = query;
-      return this.userService.findUsers(q, userRealmName);
+      return this.userService.findUsers(
+        q,
+        this.securityProvider.assertRealmScope(user, userRealmName),
+      );
     },
   });
 
@@ -73,16 +78,19 @@ export class AdminUserController {
     use: [$secure({ permissions: ["admin:user:read"] })],
     description: "Get a user by ID",
     schema: {
-      params: t.object({
-        id: t.uuid(),
+      params: z.object({
+        id: z.uuid(),
       }),
-      query: t.object({
-        userRealmName: t.optional(t.string()),
+      query: z.object({
+        userRealmName: z.string().optional(),
       }),
       response: userResourceSchema,
     },
-    handler: ({ params, query }) =>
-      this.userService.getUserById(params.id, query.userRealmName),
+    handler: ({ params, query, user }) =>
+      this.userService.getUserById(
+        params.id,
+        this.securityProvider.assertRealmScope(user, query.userRealmName),
+      ),
   });
 
   /**
@@ -95,14 +103,17 @@ export class AdminUserController {
     use: [$secure({ permissions: ["admin:user:create"] })],
     description: "Create a new user",
     schema: {
-      query: t.object({
-        userRealmName: t.optional(t.string()),
+      query: z.object({
+        userRealmName: z.string().optional(),
       }),
       body: createUserSchema,
       response: userResourceSchema,
     },
-    handler: ({ body, query }) =>
-      this.userService.createUser(body, query.userRealmName),
+    handler: ({ body, query, user }) =>
+      this.userService.createUser(
+        body,
+        this.securityProvider.assertRealmScope(user, query.userRealmName),
+      ),
   });
 
   /**
@@ -115,17 +126,21 @@ export class AdminUserController {
     use: [$secure({ permissions: ["admin:user:update"] })],
     description: "Update a user",
     schema: {
-      params: t.object({
-        id: t.uuid(),
+      params: z.object({
+        id: z.uuid(),
       }),
-      query: t.object({
-        userRealmName: t.optional(t.string()),
+      query: z.object({
+        userRealmName: z.string().optional(),
       }),
       body: updateUserSchema,
       response: userResourceSchema,
     },
-    handler: ({ params, body, query }) =>
-      this.userService.updateUser(params.id, body, query.userRealmName),
+    handler: ({ params, body, query, user }) =>
+      this.userService.updateUser(
+        params.id,
+        body,
+        this.securityProvider.assertRealmScope(user, query.userRealmName),
+      ),
   });
 
   /**
@@ -140,22 +155,22 @@ export class AdminUserController {
     use: [$secure({ permissions: ["admin:user:update"] })],
     description: "Set a user's password",
     schema: {
-      params: t.object({
-        id: t.uuid(),
+      params: z.object({
+        id: z.uuid(),
       }),
-      query: t.object({
-        userRealmName: t.optional(t.string()),
+      query: z.object({
+        userRealmName: z.string().optional(),
       }),
-      body: t.object({
-        password: t.string({ minLength: 1 }),
+      body: z.object({
+        password: z.string().min(1),
       }),
       response: okSchema,
     },
-    handler: async ({ params, body, query }) => {
+    handler: async ({ params, body, query, user }) => {
       await this.userService.setPassword(
         params.id,
         body.password,
-        query.userRealmName,
+        this.securityProvider.assertRealmScope(user, query.userRealmName),
       );
       return { ok: true, id: params.id };
     },
@@ -171,16 +186,19 @@ export class AdminUserController {
     use: [$secure({ permissions: ["admin:user:delete"] })],
     description: "Delete a user",
     schema: {
-      params: t.object({
-        id: t.uuid(),
+      params: z.object({
+        id: z.uuid(),
       }),
-      query: t.object({
-        userRealmName: t.optional(t.string()),
+      query: z.object({
+        userRealmName: z.string().optional(),
       }),
       response: okSchema,
     },
-    handler: async ({ params, query }) => {
-      await this.userService.deleteUser(params.id, query.userRealmName);
+    handler: async ({ params, query, user }) => {
+      await this.userService.deleteUser(
+        params.id,
+        this.securityProvider.assertRealmScope(user, query.userRealmName),
+      );
       return { ok: true, id: params.id };
     },
   });
@@ -197,20 +215,24 @@ export class AdminUserController {
     use: [$secure({ permissions: ["admin:user:delete"] })],
     description: "Delete many users",
     schema: {
-      query: t.object({
-        userRealmName: t.optional(t.string()),
+      query: z.object({
+        userRealmName: z.string().optional(),
       }),
-      body: t.object({
-        ids: t.array(t.uuid(), { minItems: 1, maxItems: 1000 }),
+      body: z.object({
+        ids: z.array(z.uuid()).min(1).max(1000),
       }),
-      response: t.object({
-        deleted: t.array(t.uuid()),
+      response: z.object({
+        deleted: z.array(z.uuid()),
       }),
     },
-    handler: async ({ body, query }) => {
+    handler: async ({ body, query, user }) => {
+      const realm = this.securityProvider.assertRealmScope(
+        user,
+        query.userRealmName,
+      );
       const deleted: string[] = [];
       for (const id of body.ids) {
-        await this.userService.deleteUser(id, query.userRealmName);
+        await this.userService.deleteUser(id, realm);
         deleted.push(id);
       }
       return { deleted };

package/src/api/users/controllers/MySessionController.ts

@@ -0,0 +1,125 @@
+import { $inject, type Static, z } from "alepha";
+import { $secure } from "alepha/security";
+import { $action, NotFoundError } from "alepha/server";
+import { RealmProvider } from "../providers/RealmProvider.ts";
+
+/**
+ * A session as exposed to ITS OWNER — `refreshToken` is deliberately
+ * omitted (returning it would let any XSS exfiltrate a long-lived
+ * credential); `current` flags the session backing the calling request.
+ */
+export const mySessionSchema = z.object({
+  id: z.uuid(),
+  createdAt: z.datetime(),
+  expiresAt: z.datetime(),
+  lastUsedAt: z.datetime().optional(),
+  ip: z.string().optional(),
+  country: z.string().optional(),
+  userAgent: z
+    .object({
+      os: z.string(),
+      browser: z.string(),
+      device: z.enum(["MOBILE", "DESKTOP", "TABLET"]),
+    })
+    .optional(),
+  current: z.boolean(),
+});
+
+export type MySession = Static<typeof mySessionSchema>;
+
+/**
+ * Self-service session management — the "where am I signed in?" page of an
+ * account area. Counterpart of {@link AdminSessionController}, scoped to the
+ * CALLER's own sessions: list them, revoke one (a stolen laptop), or revoke
+ * everything except the current one.
+ */
+export class MySessionController {
+  protected readonly realmProvider = $inject(RealmProvider);
+
+  protected sessions(realm?: string) {
+    return this.realmProvider.sessionRepository(realm);
+  }
+
+  protected toMySession(
+    session: {
+      id: string;
+      createdAt: string;
+      expiresAt: string;
+      lastUsedAt?: string;
+      ip?: string;
+      country?: string;
+      userAgent?: { os: string; browser: string; device: string };
+    },
+    currentSessionId: string | undefined,
+  ): MySession {
+    return {
+      id: session.id,
+      createdAt: session.createdAt,
+      expiresAt: session.expiresAt,
+      lastUsedAt: session.lastUsedAt,
+      ip: session.ip,
+      country: session.country,
+      userAgent: session.userAgent as MySession["userAgent"],
+      current: session.id === currentSessionId,
+    };
+  }
+
+  listMySessions = $action({
+    method: "GET",
+    path: "/users/me/sessions",
+    use: [$secure()],
+    description: "List the caller's active sessions",
+    schema: {
+      response: z.array(mySessionSchema),
+    },
+    handler: async ({ user }) => {
+      const rows = await this.sessions(user.realm).findMany({
+        where: { userId: { eq: user.id } },
+        orderBy: [{ column: "createdAt", direction: "desc" }],
+      });
+      return rows.map((s) => this.toMySession(s, user.sessionId));
+    },
+  });
+
+  deleteMySession = $action({
+    method: "DELETE",
+    path: "/users/me/sessions/:id",
+    use: [$secure()],
+    description: "Revoke one of the caller's sessions",
+    schema: {
+      params: z.object({ id: z.uuid() }),
+      response: z.object({ ok: z.boolean() }),
+    },
+    handler: async ({ params, user }) => {
+      const repo = this.sessions(user.realm);
+      // Owner-scoped lookup: someone else's session id reads as missing.
+      const session = await repo.findOne({
+        where: { id: { eq: params.id }, userId: { eq: user.id } },
+      });
+      if (!session) throw new NotFoundError("Session not found");
+      await repo.deleteById(session.id);
+      return { ok: true };
+    },
+  });
+
+  deleteMyOtherSessions = $action({
+    method: "POST",
+    path: "/users/me/sessions/revoke-others",
+    use: [$secure()],
+    description: "Revoke every caller session except the current one",
+    schema: {
+      response: z.object({ revoked: z.integer() }),
+    },
+    handler: async ({ user }) => {
+      const repo = this.sessions(user.realm);
+      const rows = await repo.findMany({
+        where: { userId: { eq: user.id } },
+      });
+      const others = rows.filter((s) => s.id !== user.sessionId);
+      for (const s of others) {
+        await repo.deleteById(s.id);
+      }
+      return { revoked: others.length };
+    },
+  });
+}

package/src/api/users/controllers/RealmController.ts

@@ -1,4 +1,4 @@
-import { $inject, t } from "alepha";
+import { $inject, z } from "alepha";
 import { CaptchaProvider } from "alepha/captcha";
 import { $action } from "alepha/server";
 import { ServerAuthProvider } from "alepha/server/auth";
@@ -27,8 +27,8 @@ export class RealmController {
     path: `${this.url}/config`,
     use: [$etag()],
     schema: {
-      query: t.object({
-        realmName: t.optional(t.string()),
+      query: z.object({
+        realmName: z.string().optional(),
       }),
       response: realmConfigSchema,
     },
@@ -57,14 +57,14 @@ export class RealmController {
     group: this.group,
     path: `${this.url}/check-username`,
     schema: {
-      query: t.object({
-        realmName: t.optional(t.text()),
+      query: z.object({
+        realmName: z.text().optional(),
       }),
-      body: t.object({
-        username: t.text(),
+      body: z.object({
+        username: z.text(),
       }),
-      response: t.object({
-        available: t.boolean(),
+      response: z.object({
+        available: z.boolean(),
       }),
     },
     handler: async ({ query, body }) => {

package/src/api/users/controllers/UserController.ts

@@ -1,4 +1,4 @@
-import { $inject, t } from "alepha";
+import { $inject, z } from "alepha";
 import { $secure } from "alepha/security";
 import { $action, okSchema } from "alepha/server";
 import { completePasswordResetRequestSchema } from "../schemas/completePasswordResetRequestSchema.ts";
@@ -63,11 +63,11 @@ export class UserController {
     method: "POST",
     path: `${this.url}/password-reset`,
     schema: {
-      query: t.object({
-        userRealmName: t.optional(t.string()),
+      query: z.object({
+        userRealmName: z.string().optional(),
       }),
-      body: t.object({
-        email: t.email(),
+      body: z.object({
+        email: z.email(),
       }),
       response: passwordResetIntentResponseSchema,
     },
@@ -105,15 +105,15 @@ export class UserController {
     path: "/users/password-reset/request",
     group: this.group,
     schema: {
-      query: t.object({
-        userRealmName: t.optional(t.string()),
+      query: z.object({
+        userRealmName: z.string().optional(),
       }),
-      body: t.object({
-        email: t.email(),
+      body: z.object({
+        email: z.email(),
       }),
-      response: t.object({
-        success: t.boolean(),
-        message: t.string(),
+      response: z.object({
+        success: z.boolean(),
+        message: z.string(),
       }),
     },
     handler: async ({ body, query }) => {
@@ -137,14 +137,14 @@ export class UserController {
     path: "/users/password-reset/validate",
     group: this.group,
     schema: {
-      query: t.object({
-        email: t.email(),
-        token: t.string(),
-        userRealmName: t.optional(t.string()),
+      query: z.object({
+        email: z.email(),
+        token: z.string(),
+        userRealmName: z.string().optional(),
       }),
-      response: t.object({
-        valid: t.boolean(),
-        email: t.optional(t.email()),
+      response: z.object({
+        valid: z.boolean(),
+        email: z.email().optional(),
       }),
     },
     handler: async ({ query }) => {
@@ -173,17 +173,17 @@ export class UserController {
     path: "/users/password-reset/reset",
     group: this.group,
     schema: {
-      query: t.object({
-        userRealmName: t.optional(t.string()),
+      query: z.object({
+        userRealmName: z.string().optional(),
       }),
-      body: t.object({
-        email: t.email(),
-        token: t.string(),
-        newPassword: t.string({ minLength: 8 }),
+      body: z.object({
+        email: z.email(),
+        token: z.string(),
+        newPassword: z.string().min(8),
       }),
-      response: t.object({
-        success: t.boolean(),
-        message: t.string(),
+      response: z.object({
+        success: z.boolean(),
+        message: z.string(),
       }),
     },
     handler: async ({ body, query }) => {
@@ -211,22 +211,22 @@ export class UserController {
     path: "/users/email-verification/request",
     group: this.group,
     schema: {
-      query: t.object({
-        userRealmName: t.optional(t.string()),
-        method: t.optional(
-          t.enum(["code", "link"], {
-            default: "code",
-            description:
-              'Verification method: "code" sends a 6-digit code, "link" sends a clickable verification link. When using "link", configure verifyEmailUrl in realm settings.',
-          }),
-        ),
+      query: z.object({
+        userRealmName: z.string().optional(),
+        method: z
+          .enum(["code", "link"])
+          .describe(
+            'Verification method: "code" sends a 6-digit code, "link" sends a clickable verification link. When using "link", configure verifyEmailUrl in realm settings.',
+          )
+          .default("code")
+          .optional(),
       }),
-      body: t.object({
-        email: t.email(),
+      body: z.object({
+        email: z.email(),
       }),
-      response: t.object({
-        success: t.boolean(),
-        message: t.string(),
+      response: z.object({
+        success: z.boolean(),
+        message: z.string(),
       }),
     },
     handler: async ({ body, query }) => {
@@ -255,16 +255,16 @@ export class UserController {
     path: "/users/email-verification/verify",
     group: this.group,
     schema: {
-      query: t.object({
-        userRealmName: t.optional(t.string()),
+      query: z.object({
+        userRealmName: z.string().optional(),
       }),
-      body: t.object({
-        email: t.email(),
-        token: t.string(),
+      body: z.object({
+        email: z.email(),
+        token: z.string(),
       }),
-      response: t.object({
-        success: t.boolean(),
-        message: t.string(),
+      response: z.object({
+        success: z.boolean(),
+        message: z.string(),
       }),
     },
     handler: async ({ body, query }) => {
@@ -289,12 +289,12 @@ export class UserController {
     group: this.group,
     use: [$secure()],
     schema: {
-      query: t.object({
-        email: t.email(),
-        userRealmName: t.optional(t.string()),
+      query: z.object({
+        email: z.email(),
+        userRealmName: z.string().optional(),
       }),
-      response: t.object({
-        verified: t.boolean(),
+      response: z.object({
+        verified: z.boolean(),
       }),
     },
     handler: async ({ query }) => {

package/src/api/users/entities/identities.ts

@@ -1,19 +1,19 @@
-import { type Static, t } from "alepha";
+import { type Static, z } from "alepha";
 import { $entity, db } from "alepha/orm";
 import { users } from "./users.ts";
 
 export const identities = $entity({
   name: "identities",
-  schema: t.object({
-    id: db.primaryKey(t.uuid()),
+  schema: z.object({
+    id: db.primaryKey(z.uuid()),
     version: db.version(),
     createdAt: db.createdAt(),
     updatedAt: db.updatedAt(),
-    userId: db.ref(t.uuid(), () => users.cols.id),
-    password: t.optional(t.text()),
-    provider: t.text(),
-    providerUserId: t.optional(t.text()),
-    providerData: t.optional(t.json()),
+    userId: db.ref(z.uuid(), () => users.cols.id),
+    password: z.text().optional(),
+    provider: z.text(),
+    providerUserId: z.text().optional(),
+    providerData: z.json().optional(),
   }),
   indexes: [
     "userId",

package/src/api/users/entities/sessions.ts

@@ -1,16 +1,16 @@
-import { type Static, t } from "alepha";
+import { type Static, z } from "alepha";
 import { $entity, db } from "alepha/orm";
 import { users } from "./users.ts";
 
 export const sessions = $entity({
   name: "sessions",
-  schema: t.object({
-    id: db.primaryKey(t.uuid()),
+  schema: z.object({
+    id: db.primaryKey(z.uuid()),
     version: db.version(),
     createdAt: db.createdAt(),
     updatedAt: db.updatedAt(),
-    refreshToken: t.uuid(),
-    userId: db.ref(t.uuid(), () => users.cols.id),
+    refreshToken: z.uuid(),
+    userId: db.ref(z.uuid(), () => users.cols.id),
     /**
      * OAuth client this session was minted for, when it was created via the
      * OAuth 2.1 authorization flow — the `client_id` of an `oauth_clients`
@@ -18,28 +18,28 @@ export const sessions = $entity({
      * key: `sessions` is a core entity and must not depend on the optional
      * OAuth module's table; the join to `oauth_clients` is done at query time.
      */
-    clientId: t.optional(t.text({ maxLength: 64 })),
-    expiresAt: t.datetime(),
+    clientId: z.text({ maxLength: 64 }).optional(),
+    expiresAt: z.datetime(),
     /**
      * Last time the session was used to refresh an access token.
      * Used by realm `refreshToken.expirationIdle` to invalidate idle sessions.
      * `null` on existing rows pre-migration — falls back to `createdAt`.
      */
-    lastUsedAt: t.optional(t.datetime()),
-    ip: t.optional(t.text()),
+    lastUsedAt: z.datetime().optional(),
+    ip: z.text().optional(),
     /**
      * ISO 3166-1 alpha-2 country code derived from the request geo headers
      * (`cf-ipcountry` on Cloudflare, CDN equivalents elsewhere) at login time.
      * `null` on pre-migration rows and where geo isn't available.
      */
-    country: t.optional(t.text({ maxLength: 2 })),
-    userAgent: t.optional(
-      t.object({
-        os: t.text(),
-        browser: t.text(),
-        device: t.enum(["MOBILE", "DESKTOP", "TABLET"]),
-      }),
-    ),
+    country: z.text({ maxLength: 2 }).optional(),
+    userAgent: z
+      .object({
+        os: z.text(),
+        browser: z.text(),
+        device: z.enum(["MOBILE", "DESKTOP", "TABLET"]),
+      })
+      .optional(),
   }),
   indexes: ["userId", "expiresAt", { column: "refreshToken", unique: true }],
 });