alepha 0.22.0 → 0.24.0

package/src/api/users/schemas/registrationIntentResponseSchema.ts

@@ -1,27 +1,23 @@
-import { type Static, t } from "alepha";
+import { type Static, z } from "alepha";
 
-export const registrationIntentResponseSchema = t.object({
-  intentId: t.uuid({
-    description: "Unique identifier for the registration intent",
-  }),
-  expectCaptcha: t.boolean({
-    description: "Whether captcha verification is required",
-  }),
-  captchaSiteKey: t.optional(
-    t.string({
-      description:
-        "Public site key the client should render (when expectCaptcha is true)",
-    }),
-  ),
-  expectEmailVerification: t.boolean({
-    description: "Whether email verification is required",
-  }),
-  expectPhoneVerification: t.boolean({
-    description: "Whether phone verification is required",
-  }),
-  expiresAt: t.datetime({
-    description: "When the registration intent expires",
-  }),
+export const registrationIntentResponseSchema = z.object({
+  intentId: z.uuid().describe("Unique identifier for the registration intent"),
+  expectCaptcha: z
+    .boolean()
+    .describe("Whether captcha verification is required"),
+  captchaSiteKey: z
+    .string()
+    .describe(
+      "Public site key the client should render (when expectCaptcha is true)",
+    )
+    .optional(),
+  expectEmailVerification: z
+    .boolean()
+    .describe("Whether email verification is required"),
+  expectPhoneVerification: z
+    .boolean()
+    .describe("Whether phone verification is required"),
+  expiresAt: z.datetime().describe("When the registration intent expires"),
 });
 
 export type RegistrationIntentResponse = Static<

package/src/api/users/schemas/resetPasswordSchema.ts

@@ -1,24 +1,17 @@
 import type { Static } from "alepha";
-import { t } from "alepha";
+import { z } from "alepha";
 
-export const resetPasswordRequestSchema = t.object({
-  email: t.email({
-    description: "Email address to send password reset link",
-  }),
+export const resetPasswordRequestSchema = z.object({
+  email: z.email().describe("Email address to send password reset link"),
 });
 
-export const resetPasswordSchema = t.object({
-  token: t.string({
-    description: "Password reset token from email",
-  }),
-  password: t.string({
-    minLength: 8,
-    description: "New password",
-  }),
-  confirmPassword: t.string({
-    minLength: 8,
-    description: "Confirmation of the new password",
-  }),
+export const resetPasswordSchema = z.object({
+  token: z.string().describe("Password reset token from email"),
+  password: z.string().min(8).describe("New password"),
+  confirmPassword: z
+    .string()
+    .min(8)
+    .describe("Confirmation of the new password"),
 });
 
 export type ResetPasswordRequest = Static<typeof resetPasswordRequestSchema>;

package/src/api/users/schemas/sessionQuerySchema.ts

@@ -1,9 +1,9 @@
 import type { Static } from "alepha";
-import { t } from "alepha";
+import { z } from "alepha";
 import { pageQuerySchema } from "alepha/orm";
 
-export const sessionQuerySchema = t.extend(pageQuerySchema, {
-  userId: t.optional(t.uuid()),
+export const sessionQuerySchema = pageQuerySchema.extend({
+  userId: z.uuid().optional(),
 });
 
 export type SessionQuery = Static<typeof sessionQuerySchema>;

package/src/api/users/schemas/sessionResourceSchema.ts

@@ -1,5 +1,5 @@
 import type { Static } from "alepha";
-import { t } from "alepha";
+import { z } from "alepha";
 
 /**
  * Slim view of the session's owner — embedded by the admin listing so the
@@ -7,32 +7,32 @@ import { t } from "alepha";
  * back via a left join, so it's optional (a session whose user was deleted
  * still returns; `user` is undefined).
  */
-export const sessionUserSummarySchema = t.object({
-  id: t.uuid(),
-  email: t.optional(t.string({ format: "email" })),
-  username: t.optional(t.shortText({ minLength: 3, maxLength: 30 })),
-  firstName: t.optional(t.string()),
-  lastName: t.optional(t.string()),
+export const sessionUserSummarySchema = z.object({
+  id: z.uuid(),
+  email: z.string().meta({ format: "email" }).optional(),
+  username: z.shortText({ minLength: 3, maxLength: 30 }).optional(),
+  firstName: z.string().optional(),
+  lastName: z.string().optional(),
 });
 
-export const sessionResourceSchema = t.object({
-  id: t.uuid(),
-  version: t.number(),
-  createdAt: t.datetime(),
-  updatedAt: t.datetime(),
-  refreshToken: t.uuid(),
-  userId: t.uuid(),
-  expiresAt: t.datetime(),
-  ip: t.optional(t.string()),
-  country: t.optional(t.string()),
-  userAgent: t.optional(
-    t.object({
-      os: t.string(),
-      browser: t.string(),
-      device: t.enum(["MOBILE", "DESKTOP", "TABLET"]),
-    }),
-  ),
-  user: t.optional(sessionUserSummarySchema),
+export const sessionResourceSchema = z.object({
+  id: z.uuid(),
+  version: z.number(),
+  createdAt: z.datetime(),
+  updatedAt: z.datetime(),
+  refreshToken: z.uuid(),
+  userId: z.uuid(),
+  expiresAt: z.datetime(),
+  ip: z.string().optional(),
+  country: z.string().optional(),
+  userAgent: z
+    .object({
+      os: z.string(),
+      browser: z.string(),
+      device: z.enum(["MOBILE", "DESKTOP", "TABLET"]),
+    })
+    .optional(),
+  user: sessionUserSummarySchema.optional(),
 });
 
 export type SessionResource = Static<typeof sessionResourceSchema>;

package/src/api/users/schemas/updateUserSchema.ts

@@ -1,9 +1,8 @@
 import type { Static } from "alepha";
-import { t } from "alepha";
 import { users } from "../entities/users.ts";
 
-export const updateUserSchema = t.partial(
-  t.omit(users.insertSchema, ["id", "version", "createdAt", "updatedAt"]),
-);
+export const updateUserSchema = users.insertSchema
+  .omit({ id: true, version: true, createdAt: true, updatedAt: true })
+  .partial();
 
 export type UpdateUser = Static<typeof updateUserSchema>;

package/src/api/users/schemas/userQuerySchema.ts

@@ -1,19 +1,19 @@
 import type { Static } from "alepha";
-import { t } from "alepha";
+import { z } from "alepha";
 import { pageQuerySchema } from "alepha/orm";
 
-export const userQuerySchema = t.extend(pageQuerySchema, {
+export const userQuerySchema = pageQuerySchema.extend({
   /**
    * Free-text search applied (case-insensitive) across `email`,
    * `username`, `firstName`, and `lastName`. Matches with a leading and
    * trailing wildcard, so `?search=foo` finds any user whose email,
    * username, or name contains `foo`.
    */
-  search: t.optional(t.string()),
-  email: t.optional(t.string()),
-  enabled: t.optional(t.boolean()),
-  emailVerified: t.optional(t.boolean()),
-  roles: t.optional(t.array(t.string())),
+  search: z.string().optional(),
+  email: z.string().optional(),
+  enabled: z.boolean().optional(),
+  emailVerified: z.boolean().optional(),
+  roles: z.array(z.string()).optional(),
 });
 
 export type UserQuery = Static<typeof userQuerySchema>;

package/src/api/users/services/RegistrationService.ts

@@ -1,5 +1,8 @@
 import { $inject, Alepha, AlephaError } from "alepha";
-import type { VerificationController } from "alepha/api/verifications";
+import {
+  type VerificationController,
+  VerificationService,
+} from "alepha/api/verifications";
 import { $cache } from "alepha/cache";
 import { DatabaseCacheProvider } from "alepha/cache/database";
 import { CaptchaProvider } from "alepha/captcha";
@@ -47,7 +50,10 @@ export class RegistrationService {
   protected readonly log = $logger();
   protected readonly dateTimeProvider = $inject(DateTimeProvider);
   protected readonly cryptoProvider = $inject(CryptoProvider);
+  // Validation goes through the public controller; code *creation* uses the
+  // service directly so the raw token is never exposed over HTTP.
   protected readonly verificationController = $client<VerificationController>();
+  protected readonly verificationService = $inject(VerificationService);
   protected readonly realmProvider = $inject(RealmProvider);
   protected readonly credentialService = $inject(CredentialService);
   protected readonly captchaProvider = $inject(CaptchaProvider);
@@ -193,6 +199,16 @@ export class RegistrationService {
       throw new BadRequestError("Phone number is required");
     }
 
+    if (
+      realmSettings?.firstNameLastName === "required" &&
+      (!body.firstName?.trim() || !body.lastName?.trim())
+    ) {
+      this.log.debug("Registration rejected: first/last name required", {
+        userRealmName,
+      });
+      throw new BadRequestError("First name and last name are required");
+    }
+
     // In "email" mode, derive the username from the email *now* so that
     // checkUserAvailability picks it up too, the DB unique index sees a
     // concrete value, and the persisted intent already carries the final
@@ -474,11 +490,10 @@ export class RegistrationService {
   ): Promise<void> {
     this.log.debug("Sending email verification code", { email });
 
-    const verification =
-      await this.verificationController.requestVerificationCode({
-        params: { type: "code" },
-        body: { target: email },
-      });
+    const verification = await this.verificationService.createVerification({
+      type: "code",
+      target: email,
+    });
 
     await this.userNotifications(realmName).emailVerification.push({
       contact: email,
@@ -501,11 +516,10 @@ export class RegistrationService {
   ): Promise<void> {
     this.log.debug("Sending phone verification code", { phoneNumber });
     try {
-      const verification =
-        await this.verificationController.requestVerificationCode({
-          params: { type: "code" },
-          body: { target: phoneNumber },
-        });
+      const verification = await this.verificationService.createVerification({
+        type: "code",
+        target: phoneNumber,
+      });
 
       await this.userNotifications(realmName).phoneVerification.push({
         contact: phoneNumber,

package/src/api/users/services/UserService.ts

@@ -1,5 +1,8 @@
 import { $inject, Alepha } from "alepha";
-import type { VerificationController } from "alepha/api/verifications";
+import {
+  type VerificationController,
+  VerificationService,
+} from "alepha/api/verifications";
 import { $logger } from "alepha/logger";
 import type { Page } from "alepha/orm";
 import { CryptoProvider } from "alepha/security";
@@ -16,7 +19,11 @@ import type { UserQuery } from "../schemas/userQuerySchema.ts";
 export class UserService {
   protected readonly alepha = $inject(Alepha);
   protected readonly log = $logger();
+  // Validation (`validateVerificationCode`) goes through the public controller;
+  // code *creation* uses the service directly so the raw token is never exposed
+  // over HTTP (the controller no longer has a token-returning request action).
   protected readonly verificationController = $client<VerificationController>();
+  protected readonly verificationService = $inject(VerificationService);
   protected readonly realmProvider = $inject(RealmProvider);
   protected readonly cryptoProvider = $inject(CryptoProvider);
 
@@ -78,11 +85,10 @@ export class UserService {
     }
 
     try {
-      const verification =
-        await this.verificationController.requestVerificationCode({
-          params: { type: method },
-          body: { target: email },
-        });
+      const verification = await this.verificationService.createVerification({
+        type: method,
+        target: email,
+      });
 
       if (method === "link") {
         // Build verification URL from realm settings (server-controlled, not user input)

package/src/api/verifications/__tests__/CodeVerification.spec.ts

@@ -6,6 +6,7 @@ import {
   AlephaApiVerification,
   VerificationController,
   VerificationParameters,
+  VerificationService,
 } from "../index.ts";
 
 const createTest = async () => {
@@ -14,6 +15,7 @@ const createTest = async () => {
     .with(AlephaApiVerification);
   const parameters = alepha.inject(VerificationParameters).get("code");
   const controller = alepha.inject(VerificationController);
+  const service = alepha.inject(VerificationService);
   const dateTimeProvider = alepha.inject(DateTimeProvider);
   const target = "+33633115544";
 
@@ -21,6 +23,7 @@ const createTest = async () => {
 
   return {
     alepha,
+    service,
     parameters,
     controller,
     dateTimeProvider,
@@ -30,16 +33,9 @@ const createTest = async () => {
 
 describe("Code Verification", () => {
   it("should verify phone with 6-digit code correctly", async ({ expect }) => {
-    const { parameters, controller, target } = await createTest();
+    const { parameters, controller, target, service } = await createTest();
 
-    const request = await controller.requestVerificationCode({
-      params: {
-        type: "code",
-      },
-      body: {
-        target,
-      },
-    });
+    const request = await service.createVerification({ type: "code", target });
 
     expect(request.codeExpiration).toEqual(parameters.codeExpiration);
     expect(request.verificationCooldown).toEqual(
@@ -84,17 +80,44 @@ describe("Code Verification", () => {
     });
   });
 
+  it("rejects a wrong code even after the target is already verified", async ({
+    expect,
+  }) => {
+    const { controller, target, service } = await createTest();
+
+    const request = await service.createVerification({ type: "code", target });
+
+    // First, verify legitimately with the real code.
+    expect(
+      await controller.validateVerificationCode({
+        params: { type: "code" },
+        body: { target, token: request.token },
+      }),
+    ).toEqual({ ok: true });
+
+    // A bogus code submitted afterwards must NOT be accepted just because
+    // the target was already verified — otherwise any flow re-using
+    // verifyCode as an authz gate accepts an attacker's guess.
+    await expect(() =>
+      controller.validateVerificationCode({
+        params: { type: "code" },
+        body: { target, token: "000000" },
+      }),
+    ).rejects.toThrowError("Invalid verification code");
+
+    // The real code still short-circuits as already-verified.
+    expect(
+      await controller.validateVerificationCode({
+        params: { type: "code" },
+        body: { target, token: request.token },
+      }),
+    ).toEqual({ ok: true, alreadyVerified: true });
+  });
+
   it("should handle invalid code", async ({ expect }) => {
-    const { controller, target } = await createTest();
+    const { controller, target, service } = await createTest();
 
-    await controller.requestVerificationCode({
-      params: {
-        type: "code",
-      },
-      body: {
-        target,
-      },
-    });
+    await service.createVerification({ type: "code", target });
 
     await expect(() =>
       controller.validateVerificationCode({
@@ -110,16 +133,9 @@ describe("Code Verification", () => {
   });
 
   it("should handle max attempts", async ({ expect }) => {
-    const { parameters, controller, target } = await createTest();
+    const { parameters, controller, target, service } = await createTest();
 
-    await controller.requestVerificationCode({
-      params: {
-        type: "code",
-      },
-      body: {
-        target,
-      },
-    });
+    await service.createVerification({ type: "code", target });
 
     for (let i = 0; i < parameters.maxAttempts; i++) {
       await controller
@@ -149,27 +165,13 @@ describe("Code Verification", () => {
   });
 
   it("should handle cooldown", async ({ expect }) => {
-    const { dateTimeProvider, parameters, controller, target } =
+    const { dateTimeProvider, parameters, target, service } =
       await createTest();
 
-    await controller.requestVerificationCode({
-      params: {
-        type: "code",
-      },
-      body: {
-        target,
-      },
-    });
+    await service.createVerification({ type: "code", target });
 
     await expect(() =>
-      controller.requestVerificationCode({
-        params: {
-          type: "code",
-        },
-        body: {
-          target,
-        },
-      }),
+      service.createVerification({ type: "code", target }),
     ).rejects.toThrowError("Verification is on cooldown for ");
 
     await dateTimeProvider.travel(
@@ -177,14 +179,7 @@ describe("Code Verification", () => {
       "seconds",
     );
 
-    const response = await controller.requestVerificationCode({
-      params: {
-        type: "code",
-      },
-      body: {
-        target,
-      },
-    });
+    const response = await service.createVerification({ type: "code", target });
 
     expect(response.codeExpiration).toEqual(parameters.codeExpiration);
     expect(response.verificationCooldown).toEqual(
@@ -195,7 +190,7 @@ describe("Code Verification", () => {
   });
 
   it("should respect rate limit per day", async ({ expect }) => {
-    const { parameters, controller, dateTimeProvider, target } =
+    const { parameters, dateTimeProvider, target, service } =
       await createTest();
 
     // Anchor test time at noon to keep all `limitPerDay` inserts inside the
@@ -213,14 +208,7 @@ describe("Code Verification", () => {
     }
 
     for (let i = 0; i < parameters.limitPerDay; i++) {
-      await controller.requestVerificationCode({
-        params: {
-          type: "code",
-        },
-        body: {
-          target,
-        },
-      });
+      await service.createVerification({ type: "code", target });
       await dateTimeProvider.travel(
         parameters.verificationCooldown + 1,
         "seconds",
@@ -228,31 +216,17 @@ describe("Code Verification", () => {
     }
 
     await expect(() =>
-      controller.requestVerificationCode({
-        params: {
-          type: "code",
-        },
-        body: {
-          target,
-        },
-      }),
+      service.createVerification({ type: "code", target }),
     ).rejects.toThrowError(
       `Maximum number of verification requests per day reached (${parameters.limitPerDay})`,
     );
   });
 
   it("should handle code expiration", async ({ expect }) => {
-    const { parameters, controller, dateTimeProvider, target } =
+    const { parameters, controller, dateTimeProvider, target, service } =
       await createTest();
 
-    const response = await controller.requestVerificationCode({
-      params: {
-        type: "code",
-      },
-      body: {
-        target,
-      },
-    });
+    const response = await service.createVerification({ type: "code", target });
 
     const code = response.token;
 
@@ -273,16 +247,12 @@ describe("Code Verification", () => {
   });
 
   it("should generate different codes for each request", async ({ expect }) => {
-    const { controller, dateTimeProvider, parameters, target } =
+    const { dateTimeProvider, parameters, target, service } =
       await createTest();
 
-    const response1 = await controller.requestVerificationCode({
-      params: {
-        type: "code",
-      },
-      body: {
-        target,
-      },
+    const response1 = await service.createVerification({
+      type: "code",
+      target,
     });
 
     const code1 = response1.token;
@@ -292,13 +262,9 @@ describe("Code Verification", () => {
       "seconds",
     );
 
-    const response2 = await controller.requestVerificationCode({
-      params: {
-        type: "code",
-      },
-      body: {
-        target,
-      },
+    const response2 = await service.createVerification({
+      type: "code",
+      target,
     });
 
     const code2 = response2.token;
@@ -310,18 +276,14 @@ describe("Code Verification", () => {
   });
 
   it("should pad codes with leading zeros", async ({ expect }) => {
-    const { controller, target } = await createTest();
+    const { target, service } = await createTest();
 
     // Request multiple codes to increase chance of getting one with leading zeros
     const codes: string[] = [];
     for (let i = 0; i < 5; i++) {
-      const response = await controller.requestVerificationCode({
-        params: {
-          type: "code",
-        },
-        body: {
-          target: `${target}${i}`,
-        },
+      const response = await service.createVerification({
+        type: "code",
+        target: `${target}${i}`,
       });
       codes.push(response.token);
     }