alepha 0.22.0 → 0.24.0

package/src/api/verifications/__tests__/LinkVerification.spec.ts

@@ -6,6 +6,7 @@ import {
   AlephaApiVerification,
   VerificationController,
   VerificationParameters,
+  VerificationService,
 } from "../index.ts";
 
 const createTest = async () => {
@@ -14,6 +15,7 @@ const createTest = async () => {
     .with(AlephaApiVerification);
   const parameters = alepha.inject(VerificationParameters).get("link");
   const controller = alepha.inject(VerificationController);
+  const service = alepha.inject(VerificationService);
   const dateTimeProvider = alepha.inject(DateTimeProvider);
   const target = "test@example.com";
 
@@ -21,6 +23,7 @@ const createTest = async () => {
 
   return {
     alepha,
+    service,
     parameters,
     controller,
     dateTimeProvider,
@@ -30,16 +33,9 @@ const createTest = async () => {
 
 describe("Link Verification", () => {
   it("should verify link with UUID token correctly", async ({ expect }) => {
-    const { parameters, controller, target } = await createTest();
-
-    const request = await controller.requestVerificationCode({
-      params: {
-        type: "link",
-      },
-      body: {
-        target,
-      },
-    });
+    const { parameters, controller, target, service } = await createTest();
+
+    const request = await service.createVerification({ type: "link", target });
 
     expect(request.codeExpiration).toEqual(parameters.codeExpiration);
     expect(request.verificationCooldown).toEqual(
@@ -85,16 +81,9 @@ describe("Link Verification", () => {
   });
 
   it("should handle invalid token", async ({ expect }) => {
-    const { controller, target } = await createTest();
-
-    await controller.requestVerificationCode({
-      params: {
-        type: "link",
-      },
-      body: {
-        target,
-      },
-    });
+    const { controller, target, service } = await createTest();
+
+    await service.createVerification({ type: "link", target });
 
     await expect(() =>
       controller.validateVerificationCode({
@@ -110,16 +99,9 @@ describe("Link Verification", () => {
   });
 
   it("should handle max attempts", async ({ expect }) => {
-    const { parameters, controller, target } = await createTest();
-
-    await controller.requestVerificationCode({
-      params: {
-        type: "link",
-      },
-      body: {
-        target,
-      },
-    });
+    const { parameters, controller, target, service } = await createTest();
+
+    await service.createVerification({ type: "link", target });
 
     for (let i = 0; i < parameters.maxAttempts; i++) {
       await controller
@@ -149,27 +131,13 @@ describe("Link Verification", () => {
   });
 
   it("should handle cooldown", async ({ expect }) => {
-    const { dateTimeProvider, parameters, controller, target } =
+    const { dateTimeProvider, parameters, target, service } =
       await createTest();
 
-    await controller.requestVerificationCode({
-      params: {
-        type: "link",
-      },
-      body: {
-        target,
-      },
-    });
+    await service.createVerification({ type: "link", target });
 
     await expect(() =>
-      controller.requestVerificationCode({
-        params: {
-          type: "link",
-        },
-        body: {
-          target,
-        },
-      }),
+      service.createVerification({ type: "link", target }),
     ).rejects.toThrowError("Verification is on cooldown for ");
 
     await dateTimeProvider.travel(
@@ -177,14 +145,7 @@ describe("Link Verification", () => {
       "seconds",
     );
 
-    const response = await controller.requestVerificationCode({
-      params: {
-        type: "link",
-      },
-      body: {
-        target,
-      },
-    });
+    const response = await service.createVerification({ type: "link", target });
 
     expect(response.codeExpiration).toEqual(parameters.codeExpiration);
     expect(response.verificationCooldown).toEqual(
@@ -195,7 +156,7 @@ describe("Link Verification", () => {
   });
 
   it("should respect rate limit per day", async ({ expect }) => {
-    const { parameters, controller, dateTimeProvider, target } =
+    const { parameters, dateTimeProvider, target, service } =
       await createTest();
 
     // Anchor test time at noon to keep all `limitPerDay` inserts inside the
@@ -213,14 +174,7 @@ describe("Link Verification", () => {
     }
 
     for (let i = 0; i < parameters.limitPerDay; i++) {
-      await controller.requestVerificationCode({
-        params: {
-          type: "link",
-        },
-        body: {
-          target,
-        },
-      });
+      await service.createVerification({ type: "link", target });
       await dateTimeProvider.travel(
         parameters.verificationCooldown + 1,
         "seconds",
@@ -228,31 +182,17 @@ describe("Link Verification", () => {
     }
 
     await expect(() =>
-      controller.requestVerificationCode({
-        params: {
-          type: "link",
-        },
-        body: {
-          target,
-        },
-      }),
+      service.createVerification({ type: "link", target }),
     ).rejects.toThrowError(
       `Maximum number of verification requests per day reached (${parameters.limitPerDay})`,
     );
   });
 
   it("should handle token expiration", async ({ expect }) => {
-    const { parameters, controller, dateTimeProvider, target } =
+    const { parameters, controller, dateTimeProvider, target, service } =
       await createTest();
 
-    const response = await controller.requestVerificationCode({
-      params: {
-        type: "link",
-      },
-      body: {
-        target,
-      },
-    });
+    const response = await service.createVerification({ type: "link", target });
 
     const token = response.token;
 
@@ -273,18 +213,9 @@ describe("Link Verification", () => {
   });
 
   it("should return token in response", async ({ expect }) => {
-    const { parameters, controller, target } = await createTest();
-
-    const expectedMinutes = Math.floor(parameters.codeExpiration / 60);
+    const { parameters, target, service } = await createTest();
 
-    const response = await controller.requestVerificationCode({
-      params: {
-        type: "link",
-      },
-      body: {
-        target,
-      },
-    });
+    const response = await service.createVerification({ type: "link", target });
 
     expect(response.token).toBeTruthy();
     expect(response.codeExpiration).toBe(parameters.codeExpiration);

package/src/api/verifications/controllers/VerificationController.ts

@@ -1,6 +1,5 @@
-import { $inject, t } from "alepha";
+import { $inject, z } from "alepha";
 import { $action } from "alepha/server";
-import { requestVerificationCodeResponseSchema } from "../schemas/requestVerificationCodeResponseSchema.ts";
 import { validateVerificationCodeResponseSchema } from "../schemas/validateVerificationCodeResponseSchema.ts";
 import { verificationTypeEnumSchema } from "../schemas/verificationTypeEnumSchema.ts";
 import { VerificationService } from "../services/VerificationService.ts";
@@ -11,38 +10,25 @@ export class VerificationController {
   public readonly url = "/verifications";
   public readonly group = "verifications";
 
-  public readonly requestVerificationCode = $action({
-    path: `${this.url}/:type`,
-    group: this.group,
-    method: "POST",
-    schema: {
-      params: t.object({
-        type: verificationTypeEnumSchema,
-      }),
-      body: t.object({
-        target: t.text(),
-      }),
-      response: requestVerificationCodeResponseSchema,
-    },
-    handler: async ({ body, params }) => {
-      return await this.verificationService.createVerification({
-        type: params.type,
-        target: body.target,
-      });
-    },
-  });
-
+  // SECURITY: there is deliberately NO public "request a code" action here.
+  // `VerificationService.createVerification` returns the raw token so that the
+  // *caller* can deliver it out-of-band (email/SMS). Exposing that over HTTP —
+  // as a previous `requestVerificationCode` action did, with no `$secure` — let
+  // anyone request a code for any target and read it straight from the response,
+  // defeating verification entirely. Verification requests are driven
+  // server-side (RegistrationService / UserService call the service directly and
+  // send the code); only code *submission* is public, below.
   public readonly validateVerificationCode = $action({
     path: `${this.url}/:type/validate`,
     group: this.group,
     method: "POST",
     schema: {
-      params: t.object({
+      params: z.object({
         type: verificationTypeEnumSchema,
       }),
-      body: t.object({
-        target: t.text(),
-        token: t.text({
+      body: z.object({
+        target: z.text(),
+        token: z.text({
           description:
             "The verification token (6-digit code for phone, UUID for email).",
         }),

package/src/api/verifications/entities/verifications.ts

@@ -1,12 +1,12 @@
 import type { Static } from "alepha";
-import { t } from "alepha";
+import { z } from "alepha";
 import { $entity, db } from "alepha/orm";
 import { verificationTypeEnumSchema } from "../schemas/verificationTypeEnumSchema.ts";
 
 export const verifications = $entity({
   name: "verification",
-  schema: t.object({
-    id: db.primaryKey(t.bigint()),
+  schema: z.object({
+    id: db.primaryKey(z.bigint()),
 
     createdAt: db.createdAt(),
 
@@ -16,32 +16,31 @@ export const verifications = $entity({
 
     type: verificationTypeEnumSchema,
 
-    target: t.text({
+    target: z.text({
       description: "Can be a phone (E.164 format) or email address",
     }),
 
     purpose: db.default(
-      t.text({
+      z.text({
         description:
           "Logical purpose bucket (e.g. 'default', 'password-reset'). Scopes the cooldown and daily-limit checks so unrelated flows that share the same (type, target) — most notably email verification and password reset — don't collide.",
       }),
       "default",
     ),
 
-    code: t.text({
+    code: z.text({
       description: "Hashed verification token (n-digit code or UUID)",
     }),
 
-    verifiedAt: t.optional(
-      t.datetime({
-        description: "When it was successfully verified",
-      }),
-    ),
+    verifiedAt: z
+      .datetime()
+      .describe("When it was successfully verified")
+      .optional(),
 
     attempts: db.default(
-      t.integer({
-        description: "Number of failed attempts (to prevent brute-force)",
-      }),
+      z
+        .integer()
+        .describe("Number of failed attempts (to prevent brute-force)"),
       0,
     ),
   }),

package/src/api/verifications/schemas/requestVerificationCodeResponseSchema.ts

@@ -1,22 +1,25 @@
 import type { Static } from "alepha";
-import { t } from "alepha";
+import { z } from "alepha";
 
-export const requestVerificationCodeResponseSchema = t.object({
-  token: t.string({
-    description:
+export const requestVerificationCodeResponseSchema = z.object({
+  token: z
+    .string()
+    .describe(
       "The verification token (6-digit code for phone, UUID for email). The caller should send this to the user via their preferred notification method.",
-  }),
-  codeExpiration: t.integer({
-    description: "Time in seconds before your verification token expires.",
-  }),
-  verificationCooldown: t.integer({
-    description:
+    ),
+  codeExpiration: z
+    .integer()
+    .describe("Time in seconds before your verification token expires."),
+  verificationCooldown: z
+    .integer()
+    .describe(
       "Cooldown period in seconds before you can request another verification.",
-  }),
-  maxVerificationAttempts: t.integer({
-    description:
+    ),
+  maxVerificationAttempts: z
+    .integer()
+    .describe(
       "Maximum number of verification attempts allowed before the token is locked.",
-  }),
+    ),
 });
 
 export type RequestVerificationResponse = Static<

package/src/api/verifications/schemas/validateVerificationCodeResponseSchema.ts

@@ -1,15 +1,14 @@
 import type { Static } from "alepha";
-import { t } from "alepha";
+import { z } from "alepha";
 
-export const validateVerificationCodeResponseSchema = t.object({
-  ok: t.boolean({
-    description: "Indicates whether the verification was successful.",
-  }),
-  alreadyVerified: t.optional(
-    t.boolean({
-      description: "Indicates whether the target was already verified.",
-    }),
-  ),
+export const validateVerificationCodeResponseSchema = z.object({
+  ok: z
+    .boolean()
+    .describe("Indicates whether the verification was successful."),
+  alreadyVerified: z
+    .boolean()
+    .describe("Indicates whether the target was already verified.")
+    .optional(),
 });
 
 export type ValidateVerificationCodeResponse = Static<

package/src/api/verifications/schemas/verificationSettingsSchema.ts

@@ -1,76 +1,75 @@
 import type { Static } from "alepha";
-import { t } from "alepha";
+import { z } from "alepha";
 
-export const verificationSettingsSchema = t.object({
-  code: t.object(
-    {
-      maxAttempts: t.integer({
-        description:
+export const verificationSettingsSchema = z.object({
+  code: z
+    .object({
+      maxAttempts: z
+        .integer()
+        .min(1)
+        .max(10)
+        .describe(
           "Maximum number of attempts before locking the verification.",
-        minimum: 1,
-        maximum: 10,
-      }),
-      codeLength: t.integer({
-        description: "Length of the verification code.",
-        minimum: 4,
-        maximum: 12,
-      }),
-      codeExpiration: t.integer({
-        description: "Time in seconds before the verification code expires.",
-        minimum: 60, // 1 minute
-        maximum: 3600, // 1 hour
-      }),
-      verificationCooldown: t.integer({
-        description: "Cooldown period in seconds after a request verification.",
-        minimum: 0,
-        maximum: 3600, // 1 hour
-      }),
-      limitPerDay: t.integer({
-        description:
+        ),
+      codeLength: z
+        .integer()
+        .min(4)
+        .max(12)
+        .describe("Length of the verification code."),
+      codeExpiration: z
+        .integer()
+        .min(60)
+        .max(3600)
+        .describe("Time in seconds before the verification code expires."),
+      verificationCooldown: z
+        .integer()
+        .min(0)
+        .max(3600)
+        .describe("Cooldown period in seconds after a request verification."),
+      limitPerDay: z
+        .integer()
+        .min(1)
+        .max(100)
+        .describe(
           "Maximum number of verification requests per day for one entry.",
-        minimum: 1,
-        maximum: 100,
-      }),
-    },
-    {
-      description: "Settings specific to code verifications.",
-    },
-  ),
-  link: t.object(
-    {
-      maxAttempts: t.integer({
-        description:
+        ),
+    })
+    .describe("Settings specific to code verifications."),
+  link: z
+    .object({
+      maxAttempts: z
+        .integer()
+        .min(1)
+        .max(10)
+        .describe(
           "Maximum number of attempts before locking the verification.",
-        minimum: 1,
-        maximum: 10,
-      }),
-      codeExpiration: t.integer({
-        description: "Time in seconds before the verification token expires.",
-        minimum: 60, // 1 minute
-        maximum: 7200, // 2 hours
-      }),
-      verificationCooldown: t.integer({
-        description: "Cooldown period in seconds after a request verification.",
-        minimum: 0,
-        maximum: 3600, // 1 hour
-      }),
-      limitPerDay: t.integer({
-        description:
+        ),
+      codeExpiration: z
+        .integer()
+        .min(60)
+        .max(7200)
+        .describe("Time in seconds before the verification token expires."),
+      verificationCooldown: z
+        .integer()
+        .min(0)
+        .max(3600)
+        .describe("Cooldown period in seconds after a request verification."),
+      limitPerDay: z
+        .integer()
+        .min(1)
+        .max(100)
+        .describe(
           "Maximum number of verification requests per day for one entry.",
-        minimum: 1,
-        maximum: 100,
-      }),
-    },
-    {
-      description: "Settings specific to link verifications.",
-    },
-  ),
-  purgeDays: t.integer({
-    description:
+        ),
+    })
+    .describe("Settings specific to link verifications."),
+  purgeDays: z
+    .integer()
+    .min(0)
+    .max(365)
+    .describe(
       "Number of days after which expired verifications are automatically deleted. Set to 0 to disable auto-deletion.",
-    minimum: 0,
-    maximum: 365,
-  }),
+    ),
 });
 
 export type VerificationSettings = Static<typeof verificationSettingsSchema>;

package/src/api/verifications/schemas/verificationTypeEnumSchema.ts

@@ -1,5 +1,5 @@
 import type { Static } from "alepha";
-import { t } from "alepha";
+import { z } from "alepha";
 
-export const verificationTypeEnumSchema = t.enum(["code", "link"]);
+export const verificationTypeEnumSchema = z.enum(["code", "link"]);
 export type VerificationTypeEnum = Static<typeof verificationTypeEnumSchema>;

package/src/api/verifications/services/VerificationService.ts

@@ -170,6 +170,18 @@ export class VerificationService {
 
     const verification = await this.findByEntry(entry);
     if (verification.verifiedAt) {
+      // Already verified — but STILL require the submitted code to match the
+      // record. Short-circuiting on `verifiedAt` alone means any code (or a
+      // blank one) passes once the target has been verified, so any flow
+      // re-using verifyCode as an authz gate would accept an attacker's guess.
+      if (verification.code !== this.hashCode(code)) {
+        this.log.warn("Invalid code submitted for already-verified entry", {
+          id: verification.id,
+          type: entry.type,
+          target: entry.target,
+        });
+        throw new BadRequestError("Invalid verification code");
+      }
       this.log.debug("Verification already verified", {
         id: verification.id,
         type: entry.type,

package/src/background/__tests__/BackgroundTaskProvider.spec.ts

@@ -72,6 +72,42 @@ describe("BackgroundTaskProvider", () => {
       await background.flush();
     });
 
+    it("keeps waitUntil isolated across concurrent invocations", async () => {
+      // One CF isolate serves overlapping requests. Each must defer into ITS
+      // OWN executionCtx — if the handle is shared, the later request's
+      // waitUntil captures the earlier request's background work (and throws
+      // "waitUntil after response" once it has returned).
+      const alepha = Alepha.create();
+      alepha.with({
+        provide: BackgroundTaskProvider,
+        use: WorkerdBackgroundTaskProvider,
+      });
+      const background = alepha.inject(BackgroundTaskProvider);
+      await alepha.start();
+
+      const invoke = (captured: Promise<unknown>[]) =>
+        alepha.context.run(
+          async () => {
+            // Yield so both invocations are open at the same time.
+            await new Promise((resolve) => setTimeout(resolve, 0));
+            background.defer(async () => {});
+          },
+          {
+            "cloudflare.waitUntil": (p: Promise<unknown>) => captured.push(p),
+          },
+        );
+
+      const capturedA: Promise<unknown>[] = [];
+      const capturedB: Promise<unknown>[] = [];
+      await Promise.all([invoke(capturedA), invoke(capturedB)]);
+
+      // Each invocation's own execution context received exactly its own task.
+      expect(capturedA).toHaveLength(1);
+      expect(capturedB).toHaveLength(1);
+
+      await background.flush();
+    });
+
     it("falls back to fire-and-track when no waitUntil is in scope", async () => {
       const alepha = Alepha.create();
       alepha.with({