alepha 0.22.0 → 0.24.0

package/src/server/auth/helpers/jtiReplayGuard.ts

@@ -0,0 +1,41 @@
+/**
+ * Single-use guard for short-lived assertion `jti`s. Bounded + self-pruning so
+ * it can't grow without limit in a long-lived process. Best-effort per-instance
+ * (assertions are also `aud`-bound + ~60s TTL, so a cross-isolate replay window
+ * is tiny); use a shared store if you need a hard cross-instance guarantee.
+ */
+export class JtiReplayGuard {
+  protected readonly seen = new Map<string, number>(); // jti -> expiry epoch ms
+
+  constructor(
+    protected readonly ttlMs = 120_000,
+    protected readonly maxEntries = 10_000,
+  ) {}
+
+  /** Records `jti` and returns true if fresh; false if already used (replay). */
+  check(jti: string, now: number = Date.now()): boolean {
+    this.prune(now);
+    if (this.seen.has(jti)) {
+      return false;
+    }
+    this.seen.set(jti, now + this.ttlMs);
+    return true;
+  }
+
+  protected prune(now: number): void {
+    for (const [k, exp] of this.seen) {
+      if (exp <= now) {
+        this.seen.delete(k);
+      }
+    }
+    // Hard cap: if still over budget after dropping expired, evict oldest-first
+    // (Map preserves insertion order).
+    while (this.seen.size >= this.maxEntries) {
+      const oldest = this.seen.keys().next().value;
+      if (oldest === undefined) {
+        break;
+      }
+      this.seen.delete(oldest);
+    }
+  }
+}

package/src/server/auth/helpers/safeRedirectPath.ts

@@ -0,0 +1,19 @@
+/**
+ * Returns a safe in-app redirect target: a single absolute path on the current
+ * origin. Rejects protocol-relative (`//host`), absolute URLs, and backslash
+ * tricks so a crafted `redirect` query can't become a post-auth open redirect.
+ */
+export function safeRedirectPath(
+  redirect: string | undefined,
+  fallback = "/",
+): string {
+  if (
+    typeof redirect === "string" &&
+    redirect.startsWith("/") &&
+    !redirect.startsWith("//") &&
+    !redirect.includes("\\")
+  ) {
+    return redirect;
+  }
+  return fallback;
+}

package/src/server/auth/index.ts

@@ -5,6 +5,7 @@ import { ServerAuthProvider } from "./providers/ServerAuthProvider.ts";
 
 // ---------------------------------------------------------------------------------------------------------------------
 
+export * from "./helpers/appleClientSecret.ts";
 export * from "./index.shared.ts";
 export * from "./primitives/$auth.ts";
 export * from "./primitives/$authApple.ts";

package/src/server/auth/primitives/$auth.ts

@@ -478,12 +478,12 @@ export class AuthPrimitive extends Primitive<AuthPrimitiveOptions> {
         );
       };
 
-      // Defer OIDC discovery in serverless/dev to avoid cold start penalty
-      if (this.alepha.isServerless() || !this.alepha.isProduction()) {
-        this.oauthInitializer = discoverOidc;
-      } else {
-        this.oauthConfig = await discoverOidc();
-      }
+      // OIDC discovery is always lazy (resolved on first auth-flow use via the
+      // `oauthConfiguration` getter). It must never be a hard boot dependency:
+      // a relying party has to boot even when its IdP is briefly unreachable
+      // (cross-service start order, deploys), and deferring also avoids the
+      // serverless cold-start fetch.
+      this.oauthInitializer = discoverOidc;
     }
 
     if ("oauth" in this.options) {

package/src/server/auth/primitives/$authApple.ts

@@ -1,4 +1,4 @@
-import { $context, AlephaError, t } from "alepha";
+import { $context, AlephaError, z } from "alepha";
 import type { IssuerPrimitive } from "alepha/security";
 import type { OAuth2Profile } from "../providers/ServerAuthProvider.ts";
 import {
@@ -45,19 +45,19 @@ export const $authApple = (
   const { alepha } = $context();
 
   const env = alepha.parseEnv(
-    t.object({
-      APPLE_CLIENT_ID: t.optional(
-        t.text({
+    z.object({
+      APPLE_CLIENT_ID: z
+        .text({
           description:
             "The Service ID obtained from the Apple Developer Console.",
-        }),
-      ),
-      APPLE_CLIENT_SECRET: t.optional(
-        t.text({
+        })
+        .optional(),
+      APPLE_CLIENT_SECRET: z
+        .text({
           description:
             "The signed ES256 JWT client secret generated from your Apple private key.",
-        }),
-      ),
+        })
+        .optional(),
     }),
   );
 

package/src/server/auth/primitives/$authFacebook.ts

@@ -1,4 +1,4 @@
-import { $context, AlephaError, t } from "alepha";
+import { $context, AlephaError, z } from "alepha";
 import type { IssuerPrimitive } from "alepha/security";
 import type { OAuth2Profile } from "../providers/ServerAuthProvider.ts";
 import {
@@ -25,18 +25,18 @@ export const $authFacebook = (
   const { alepha } = $context();
 
   const env = alepha.parseEnv(
-    t.object({
-      FACEBOOK_CLIENT_ID: t.optional(
-        t.text({
+    z.object({
+      FACEBOOK_CLIENT_ID: z
+        .text({
           description: "The App ID obtained from the Meta Developer Console.",
-        }),
-      ),
-      FACEBOOK_CLIENT_SECRET: t.optional(
-        t.text({
+        })
+        .optional(),
+      FACEBOOK_CLIENT_SECRET: z
+        .text({
           description:
             "The App Secret obtained from the Meta Developer Console.",
-        }),
-      ),
+        })
+        .optional(),
     }),
   );
 

package/src/server/auth/primitives/$authFranceConnect.ts

@@ -1,4 +1,4 @@
-import { $context, AlephaError, t } from "alepha";
+import { $context, AlephaError, z } from "alepha";
 import type { IssuerPrimitive } from "alepha/security";
 import {
   $auth,
@@ -41,19 +41,19 @@ export const $authFranceConnect = (
   const { alepha } = $context();
 
   const env = alepha.parseEnv(
-    t.object({
-      FRANCECONNECT_CLIENT_ID: t.optional(
-        t.text({
+    z.object({
+      FRANCECONNECT_CLIENT_ID: z
+        .text({
           description:
             "The OAuth 2.0 client ID for your France Connect service provider, obtained from partenaires.franceconnect.gouv.fr.",
-        }),
-      ),
-      FRANCECONNECT_CLIENT_SECRET: t.optional(
-        t.text({
+        })
+        .optional(),
+      FRANCECONNECT_CLIENT_SECRET: z
+        .text({
           description:
             "The OAuth 2.0 client secret for your France Connect service provider, obtained from partenaires.franceconnect.gouv.fr.",
-        }),
-      ),
+        })
+        .optional(),
     }),
   );
 

package/src/server/auth/primitives/$authGithub.ts

@@ -1,4 +1,4 @@
-import { $context, AlephaError, t } from "alepha";
+import { $context, AlephaError, z } from "alepha";
 import type { IssuerPrimitive } from "alepha/security";
 import type { OAuth2Profile } from "../providers/ServerAuthProvider.ts";
 import {
@@ -25,19 +25,19 @@ export const $authGithub = (
   const { alepha } = $context();
 
   const env = alepha.parseEnv(
-    t.object({
-      GITHUB_CLIENT_ID: t.optional(
-        t.text({
+    z.object({
+      GITHUB_CLIENT_ID: z
+        .text({
           description:
             "The OAuth App client ID obtained from GitHub Developer Settings.",
-        }),
-      ),
-      GITHUB_CLIENT_SECRET: t.optional(
-        t.text({
+        })
+        .optional(),
+      GITHUB_CLIENT_SECRET: z
+        .text({
           description:
             "The OAuth App client secret obtained from GitHub Developer Settings.",
-        }),
-      ),
+        })
+        .optional(),
     }),
   );
 

package/src/server/auth/primitives/$authGoogle.ts

@@ -1,4 +1,4 @@
-import { $context, AlephaError, t } from "alepha";
+import { $context, AlephaError, z } from "alepha";
 import type { IssuerPrimitive } from "alepha/security";
 import {
   $auth,
@@ -24,19 +24,19 @@ export const $authGoogle = (
   const { alepha } = $context();
 
   const env = alepha.parseEnv(
-    t.object({
-      GOOGLE_CLIENT_ID: t.optional(
-        t.text({
+    z.object({
+      GOOGLE_CLIENT_ID: z
+        .text({
           description:
             "The OAuth 2.0 client ID obtained from the Google Developer Console.",
-        }),
-      ),
-      GOOGLE_CLIENT_SECRET: t.optional(
-        t.text({
+        })
+        .optional(),
+      GOOGLE_CLIENT_SECRET: z
+        .text({
           description:
             "The OAuth 2.0 client secret obtained from the Google Developer Console.",
-        }),
-      ),
+        })
+        .optional(),
     }),
   );
 

package/src/server/auth/primitives/$authMicrosoft.ts

@@ -1,4 +1,4 @@
-import { $context, AlephaError, t } from "alepha";
+import { $context, AlephaError, z } from "alepha";
 import type { IssuerPrimitive } from "alepha/security";
 import {
   $auth,
@@ -36,25 +36,25 @@ export const $authMicrosoft = (
   const { alepha } = $context();
 
   const env = alepha.parseEnv(
-    t.object({
-      MICROSOFT_CLIENT_ID: t.optional(
-        t.text({
+    z.object({
+      MICROSOFT_CLIENT_ID: z
+        .text({
           description:
             "The application (client) ID obtained from the Azure Portal.",
-        }),
-      ),
-      MICROSOFT_CLIENT_SECRET: t.optional(
-        t.text({
+        })
+        .optional(),
+      MICROSOFT_CLIENT_SECRET: z
+        .text({
           description:
             "The client secret value obtained from the Azure Portal.",
-        }),
-      ),
-      MICROSOFT_TENANT_ID: t.optional(
-        t.text({
+        })
+        .optional(),
+      MICROSOFT_TENANT_ID: z
+        .text({
           description:
             "The Azure AD tenant ID or 'common' for multi-tenant. Defaults to 'common'.",
-        }),
-      ),
+        })
+        .optional(),
     }),
   );
 

package/src/server/auth/providers/ServerAuthProvider.ts

@@ -1,8 +1,9 @@
-import { $hook, $inject, Alepha, t } from "alepha";
+import { $hook, $inject, Alepha, z } from "alepha";
 import { DateTimeProvider } from "alepha/datetime";
 import { $logger } from "alepha/logger";
 import {
   InvalidCredentialsError,
+  type IssuerPrimitive,
   SecurityError,
   type UserAccount,
 } from "alepha/security";
@@ -78,14 +79,14 @@ export class ServerAuthProvider {
     ttl: [15, "minutes"],
     httpOnly: true,
     encrypt: true,
-    schema: t.object({
-      provider: t.text(),
-      realm: t.optional(t.text()),
-      codeVerifier: t.optional(t.text({ size: "long" })),
-      redirectUri: t.optional(t.text({ size: "long" })),
-      loginUri: t.optional(t.text({ size: "long" })),
-      state: t.optional(t.text()),
-      nonce: t.optional(t.text()),
+    schema: z.object({
+      provider: z.text(),
+      realm: z.text().optional(),
+      codeVerifier: z.text({ size: "long" }).optional(),
+      redirectUri: z.text({ size: "long" }).optional(),
+      loginUri: z.text({ size: "long" }).optional(),
+      state: z.text().optional(),
+      nonce: z.text().optional(),
     }),
   });
 
@@ -154,30 +155,31 @@ export class ServerAuthProvider {
       response: userinfoResponseSchema,
     },
     handler: async ({ user, headers, cookies }) => {
-      const tokens = this.getTokens(cookies);
-      if (tokens) {
-        const provider = this.provider(tokens);
-        if (!("issuer" in provider.options)) {
-          const user = await provider.user(tokens);
-          const api = await this.serverLinksProvider.getUserApiLinks({
-            authorization: headers.authorization,
-            user,
-          });
-          return {
-            api,
-            user,
-          };
+      // Prefer the REQUEST's resolved user (the currentUserAtom): global
+      // `server:onRequest` hooks may have rewritten it — e.g. per-org role
+      // resolution on a multi-tenant relying party. Re-deriving from the raw
+      // tokens here would silently drop those roles, so the token path is
+      // only a FALLBACK for sessions whose resolvers don't populate the atom
+      // (plain external OAuth2/OIDC providers without an internal issuer).
+      let resolved = user;
+      if (!resolved) {
+        const tokens = this.getTokens(cookies);
+        if (tokens) {
+          const provider = this.provider(tokens);
+          if (!("issuer" in provider.options)) {
+            resolved = await provider.user(tokens);
+          }
         }
       }
 
       const api = await this.serverLinksProvider.getUserApiLinks({
         authorization: headers.authorization,
-        user,
+        user: resolved,
       });
 
       return {
         api,
-        user,
+        user: resolved,
       };
     },
   });
@@ -189,20 +191,20 @@ export class ServerAuthProvider {
     path: alephaServerAuthRoutes.refresh,
     method: "POST",
     schema: {
-      query: t.object({
-        provider: t.text(),
+      query: z.object({
+        provider: z.text(),
       }),
-      body: t.object({
-        refresh_token: t.text({
+      body: z.object({
+        refresh_token: z.text({
           size: "rich",
         }),
-        access_token: t.optional(
-          t.text({
+        access_token: z
+          .text({
             size: "rich",
             description:
               "Required if provider has stateless refresh token on credentials mode",
-          }),
-        ),
+          })
+          .optional(),
       }),
       response: tokensSchema,
     },
@@ -228,15 +230,15 @@ export class ServerAuthProvider {
     path: alephaServerAuthRoutes.token,
     method: "POST",
     schema: {
-      query: t.object({
-        provider: t.text(),
-        realm: t.optional(
-          t.text({ description: "Realm name for multi-realm setups" }),
-        ),
+      query: z.object({
+        provider: z.text(),
+        realm: z
+          .text({ description: "Realm name for multi-realm setups" })
+          .optional(),
       }),
-      body: t.object({
-        username: t.text(),
-        password: t.text(),
+      body: z.object({
+        username: z.text(),
+        password: z.text(),
       }),
       response: tokenResponseSchema,
     },
@@ -304,12 +306,12 @@ export class ServerAuthProvider {
   public readonly login = $route({
     path: alephaServerAuthRoutes.login,
     schema: {
-      query: t.object({
-        provider: t.text(),
-        realm: t.optional(
-          t.text({ description: "Realm name for multi-realm setups" }),
-        ),
-        redirect_uri: t.optional(t.text({ size: "rich" })),
+      query: z.object({
+        provider: z.text(),
+        realm: z
+          .text({ description: "Realm name for multi-realm setups" })
+          .optional(),
+        redirect_uri: z.text({ size: "rich" }).optional(),
       }),
     },
     handler: async ({ query, url, reply, headers }) => {
@@ -547,18 +549,31 @@ export class ServerAuthProvider {
       return;
     }
 
-    const tokens = await issuer.createToken(user);
+    await this.establishSession(user, issuer, provider.name, cookies);
 
+    reply.redirect(redirectUri, 302);
+  }
+
+  /**
+   * Establish a local session for an already-resolved user: mint realm tokens
+   * and write the `tokens` cookie. Used by the OAuth callback and by federated
+   * (broker) login. `issuer` is the realm issuer (provider.issuer / realm).
+   */
+  public async establishSession(
+    user: UserAccount,
+    issuer: IssuerPrimitive,
+    providerName: string,
+    cookies: Cookies,
+  ): Promise<void> {
+    const tokens = await issuer.createToken(user);
     this.setTokens(
       {
         ...tokens,
         issued_at: this.dateTimeProvider.now().unix(),
-        provider: provider.name,
+        provider: providerName,
       },
       cookies,
     );
-
-    reply.redirect(redirectUri, 302);
   }
 
   /**
@@ -591,8 +606,8 @@ export class ServerAuthProvider {
     path: alephaServerAuthRoutes.logout,
     method: "POST",
     schema: {
-      query: t.object({
-        post_logout_redirect_uri: t.optional(t.text()),
+      query: z.object({
+        post_logout_redirect_uri: z.text().optional(),
       }),
     },
     handler: async ({ query, reply, cookies }) => {

package/src/server/auth/schemas/authenticationProviderSchema.ts

@@ -1,18 +1,15 @@
-import { type Static, t } from "alepha";
+import { type Static, z } from "alepha";
 
-export const authenticationProviderSchema = t.object(
-  {
-    name: t.text({
+export const authenticationProviderSchema = z
+  .object({
+    name: z.text({
       description: "Name of the authentication provider.",
     }),
-    type: t.enum(["OAUTH2", "OIDC", "CREDENTIALS"], {
-      description: "Type of the authentication provider.",
-    }),
-  },
-  {
-    title: "AuthenticationProvider",
-  },
-);
+    type: z
+      .enum(["OAUTH2", "OIDC", "CREDENTIALS"])
+      .describe("Type of the authentication provider."),
+  })
+  .meta({ title: "AuthenticationProvider" });
 
 export type AuthenticationProvider = Static<
   typeof authenticationProviderSchema

package/src/server/auth/schemas/tokenResponseSchema.ts

@@ -1,9 +1,9 @@
-import { type Static, t } from "alepha";
+import type { Static } from "alepha";
 import { userAccountInfoSchema } from "alepha/security";
 import { apiRegistryResponseSchema } from "alepha/server/links";
 import { tokensSchema } from "./tokensSchema.ts";
 
-export const tokenResponseSchema = t.extend(tokensSchema, {
+export const tokenResponseSchema = tokensSchema.extend({
   user: userAccountInfoSchema,
   api: apiRegistryResponseSchema,
 });

package/src/server/auth/schemas/tokensSchema.ts

@@ -1,21 +1,21 @@
 import type { Static } from "alepha";
-import { t } from "alepha";
+import { z } from "alepha";
 
-export const tokensSchema = t.object({
-  provider: t.text(),
-  access_token: t.text({ size: "rich" }),
-  issued_at: t.number(),
-  expires_in: t.optional(t.number()),
-  refresh_token: t.optional(t.text({ size: "rich" })),
-  refresh_token_expires_in: t.optional(t.number()),
-  refresh_expires_in: t.optional(
-    t.number({
-      description:
-        "Alias of `refresh_token_expires_in` for compatibility with some providers.",
-    }),
-  ),
-  id_token: t.optional(t.text({ size: "rich" })),
-  scope: t.optional(t.text()),
+export const tokensSchema = z.object({
+  provider: z.text(),
+  access_token: z.text({ size: "rich" }),
+  issued_at: z.number(),
+  expires_in: z.number().optional(),
+  refresh_token: z.text({ size: "rich" }).optional(),
+  refresh_token_expires_in: z.number().optional(),
+  refresh_expires_in: z
+    .number()
+    .describe(
+      "Alias of `refresh_token_expires_in` for compatibility with some providers.",
+    )
+    .optional(),
+  id_token: z.text({ size: "rich" }).optional(),
+  scope: z.text().optional(),
 });
 
 export type Tokens = Static<typeof tokensSchema>;

package/src/server/auth/schemas/userinfoResponseSchema.ts

@@ -1,9 +1,9 @@
-import { type Static, t } from "alepha";
+import { type Static, z } from "alepha";
 import { userAccountInfoSchema } from "alepha/security";
 import { apiRegistryResponseSchema } from "alepha/server/links";
 
-export const userinfoResponseSchema = t.object({
-  user: t.optional(userAccountInfoSchema),
+export const userinfoResponseSchema = z.object({
+  user: userAccountInfoSchema.optional(),
   api: apiRegistryResponseSchema,
 });