alepha 0.23.0 → 0.24.0

package/src/api/users/entities/users.ts

@@ -1,39 +1,39 @@
-import { type Static, t } from "alepha";
+import { type Static, z } from "alepha";
 import { $entity, db, sql } from "alepha/orm";
 
 export const DEFAULT_USER_REALM_NAME = "default";
 
 export const users = $entity({
   name: "users",
-  schema: t.object({
-    id: db.primaryKey(t.uuid()),
+  schema: z.object({
+    id: db.primaryKey(z.uuid()),
     version: db.version(),
     createdAt: db.createdAt(),
     updatedAt: db.updatedAt(),
 
-    realm: db.default(t.text(), DEFAULT_USER_REALM_NAME),
+    realm: db.default(z.text(), DEFAULT_USER_REALM_NAME),
 
-    username: t.optional(
-      t.shortText({
+    username: z
+      .shortText({
         minLength: 3,
         maxLength: 30,
         // pattern is handled at the realm settings level
-      }),
-    ),
+      })
+      .optional(),
 
-    email: t.optional(t.string({ format: "email" })),
+    email: z.string().meta({ format: "email" }).optional(),
 
-    phoneNumber: t.optional(t.e164()),
+    phoneNumber: z.e164().optional(),
 
-    roles: db.default(t.array(t.string()), []),
-    firstName: t.optional(t.string()),
-    lastName: t.optional(t.string()),
-    picture: t.optional(t.string()),
-    enabled: db.default(t.boolean(), true),
+    roles: db.default(z.array(z.string()), []),
+    firstName: z.string().optional(),
+    lastName: z.string().optional(),
+    picture: z.string().optional(),
+    enabled: db.default(z.boolean(), true),
 
-    emailVerified: db.default(t.boolean(), false),
+    emailVerified: db.default(z.boolean(), false),
 
-    lastLoginAt: t.optional(t.datetime()),
+    lastLoginAt: z.datetime().optional(),
 
     organizationId: db.organization(),
   }),

package/src/api/users/index.ts

@@ -5,6 +5,7 @@ import { UserBuckets } from "./buckets/UserBuckets.ts";
 import { AdminIdentityController } from "./controllers/AdminIdentityController.ts";
 import { AdminSessionController } from "./controllers/AdminSessionController.ts";
 import { AdminUserController } from "./controllers/AdminUserController.ts";
+import { MySessionController } from "./controllers/MySessionController.ts";
 import { RealmController } from "./controllers/RealmController.ts";
 import { UserController } from "./controllers/UserController.ts";
 import { UserJobs } from "./jobs/UserJobs.ts";
@@ -27,6 +28,7 @@ export * from "./buckets/UserBuckets.ts";
 export * from "./controllers/AdminIdentityController.ts";
 export * from "./controllers/AdminSessionController.ts";
 export * from "./controllers/AdminUserController.ts";
+export * from "./controllers/MySessionController.ts";
 export * from "./controllers/RealmController.ts";
 export * from "./controllers/UserController.ts";
 export * from "./entities/identities.ts";
@@ -91,6 +93,7 @@ export const AlephaApiUsers = $module({
     UserController,
     AdminUserController,
     AdminSessionController,
+    MySessionController,
     AdminIdentityController,
     RealmController,
   ],

package/src/api/users/notifications/UserNotifications.ts

@@ -1,4 +1,4 @@
-import { t } from "alepha";
+import { z } from "alepha";
 import { $notification } from "alepha/api/notifications";
 
 export class UserNotifications {
@@ -25,10 +25,29 @@ export class UserNotifications {
 			<p>Best regards,<br>The Team</p>
 		`,
     },
-    schema: t.object({
-      email: t.string({ format: "email" }),
-      code: t.string(),
-      expiresInMinutes: t.number(),
+    translations: {
+      fr: {
+        email: {
+          subject: "Réinitialisez votre mot de passe",
+          body: (it) => `
+				<h1>Réinitialisez votre mot de passe</h1>
+				<p>Bonjour,</p>
+				<p>Nous avons reçu une demande de réinitialisation de votre mot de passe. Utilisez le code ci-dessous pour confirmer votre identité :</p>
+				<p style="margin: 30px 0; text-align: center;">
+					<span style="font-size: 32px; font-weight: bold; letter-spacing: 8px; font-family: monospace; background-color: #f5f5f5; padding: 16px 24px; border-radius: 8px; display: inline-block;">
+						${it.code}
+					</span>
+				</p>
+				<p>Ce code expire dans ${it.expiresInMinutes} minutes.</p>
+				<p>Si vous n'avez pas demandé de réinitialisation, vous pouvez ignorer cet e-mail : votre mot de passe restera inchangé.</p>
+			`,
+        },
+      },
+    },
+    schema: z.object({
+      email: z.string().meta({ format: "email" }),
+      code: z.string(),
+      expiresInMinutes: z.number(),
     }),
   });
 
@@ -54,10 +73,29 @@ export class UserNotifications {
 			<p>Best regards,<br>The Team</p>
 		`,
     },
-    schema: t.object({
-      email: t.string({ format: "email" }),
-      code: t.string(),
-      expiresInMinutes: t.number(),
+    translations: {
+      fr: {
+        email: {
+          subject: "Vérifiez votre adresse e-mail",
+          body: (it) => `
+				<h1>Vérifiez votre adresse e-mail</h1>
+				<p>Bonjour,</p>
+				<p>Merci de votre inscription ! Utilisez le code ci-dessous pour vérifier votre adresse e-mail :</p>
+				<p style="margin: 30px 0; text-align: center;">
+					<span style="font-size: 32px; font-weight: bold; letter-spacing: 8px; font-family: monospace; background-color: #f5f5f5; padding: 16px 24px; border-radius: 8px; display: inline-block;">
+						${it.code}
+					</span>
+				</p>
+				<p>Ce code expire dans ${it.expiresInMinutes} minutes.</p>
+				<p>Si vous n'avez pas créé de compte, ignorez cet e-mail.</p>
+			`,
+        },
+      },
+    },
+    schema: z.object({
+      email: z.string().meta({ format: "email" }),
+      code: z.string(),
+      expiresInMinutes: z.number(),
     }),
   });
 
@@ -71,10 +109,10 @@ export class UserNotifications {
       message: (it) =>
         `Your verification code is: ${it.code}. This code expires in ${it.expiresInMinutes} minutes.`,
     },
-    schema: t.object({
-      phoneNumber: t.string(),
-      code: t.string(),
-      expiresInMinutes: t.number(),
+    schema: z.object({
+      phoneNumber: z.string(),
+      code: z.string(),
+      expiresInMinutes: z.number(),
     }),
   });
 
@@ -102,10 +140,10 @@ export class UserNotifications {
 			<p>Best regards,<br>The Team</p>
 		`,
     },
-    schema: t.object({
-      email: t.string({ format: "email" }),
-      resetUrl: t.string(),
-      expiresInMinutes: t.number(),
+    schema: z.object({
+      email: z.string().meta({ format: "email" }),
+      resetUrl: z.string(),
+      expiresInMinutes: z.number(),
     }),
   });
 
@@ -126,9 +164,23 @@ export class UserNotifications {
 				<p>Best regards,<br>The Team</p>
 			`,
     },
-    schema: t.object({
-      email: t.string({ format: "email" }),
-      lockoutMinutes: t.number(),
+    translations: {
+      fr: {
+        email: {
+          subject: "Compte temporairement verrouillé",
+          body: (it) => `
+					<h1>Compte temporairement verrouillé</h1>
+					<p>Bonjour,</p>
+					<p>Votre compte a été temporairement verrouillé suite à un trop grand nombre de tentatives de connexion échouées.</p>
+					<p>Si c'était bien vous, patientez ${it.lockoutMinutes} minutes avant de réessayer. Mot de passe oublié ? Utilisez la réinitialisation de mot de passe.</p>
+					<p>Si ce n'était pas vous, quelqu'un essaie peut-être d'accéder à votre compte. Nous vous recommandons de changer votre mot de passe au plus vite.</p>
+				`,
+        },
+      },
+    },
+    schema: z.object({
+      email: z.string().meta({ format: "email" }),
+      lockoutMinutes: z.number(),
     }),
   });
 
@@ -156,10 +208,10 @@ export class UserNotifications {
 			<p>Best regards,<br>The Team</p>
 		`,
     },
-    schema: t.object({
-      email: t.string({ format: "email" }),
-      verifyUrl: t.string(),
-      expiresInMinutes: t.number(),
+    schema: z.object({
+      email: z.string().meta({ format: "email" }),
+      verifyUrl: z.string(),
+      expiresInMinutes: z.number(),
     }),
   });
 }

package/src/api/users/primitives/$realm.ts

@@ -16,12 +16,12 @@ import {
   type IssuerPrimitiveOptions,
   type IssuerResolver,
   SecurityProvider,
+  type SigningConfig,
 } from "alepha/security";
 import {
   $authApple,
   $authCredentials,
   $authFacebook,
-  $authFederationClient,
   $authFranceConnect,
   $authGithub,
   $authGoogle,
@@ -137,6 +137,7 @@ export const $realm = (options: RealmOptions = {}): RealmPrimitive => {
     ...options.issuer,
     name,
     secret: options.secret ?? securityProvider.secretKey,
+    signing: options.signing,
     resolvers: customResolvers,
     roles: options.issuer?.roles ?? [
       {
@@ -221,7 +222,10 @@ export const $realm = (options: RealmOptions = {}): RealmPrimitive => {
         id: user.id,
         roles: user.roles,
         name: composedName,
+        firstName: user.firstName,
+        lastName: user.lastName,
         email: user.email,
+        emailVerified: user.emailVerified,
         username: user.username,
         picture: user.picture,
         organization: user.organizationId ?? undefined,
@@ -307,15 +311,6 @@ export const $realm = (options: RealmOptions = {}): RealmPrimitive => {
     }
 
     alepha.with(() => auth);
-
-    if (identities.federated) {
-      const fed = $authFederationClient({
-        realm,
-        brokerUrl: identities.federated.brokerUrl,
-        publicKeyPem: identities.federated.publicKey,
-      });
-      alepha.with(() => ({ federationCallback: fed.callback }));
-    }
   }
 
   if (features.parameters) {
@@ -415,6 +410,13 @@ export interface RealmOptions {
    */
   secret?: string;
 
+  /**
+   * Asymmetric signing config for this realm's tokens (OIDC provider mode).
+   * When set, issued tokens are signed asymmetrically and the public keys are
+   * JWKS-publishable. Default is HS256 via `secret`.
+   */
+  signing?: SigningConfig;
+
   /**
    * Issuer configuration options.
    *
@@ -441,22 +443,6 @@ export interface RealmOptions {
     facebook?: true;
     microsoft?: true;
     franceconnect?: true;
-    /**
-     * Federated social login via a central broker (the platform).
-     *
-     * The broker performs the real OIDC dance with Google/Apple on a single
-     * shared OAuth client and hands this realm a short-lived, asymmetric-signed
-     * assertion. This realm verifies it (broker `publicKey`), links a local
-     * user, and establishes a session — no per-tenant OAuth client required.
-     */
-    federated?: {
-      /** Broker origin (assertion `iss`), e.g. https://alepha.club. */
-      brokerUrl: string;
-      /** Broker EdDSA public key (SPKI PEM) used to verify assertions. */
-      publicKey: string;
-      /** Providers to surface as broker login buttons. */
-      providers: Array<"google" | "apple">;
-    };
   };
 
   /**

package/src/api/users/providers/RealmProvider.ts

@@ -21,15 +21,6 @@ export interface Realm {
   repositories: RealmRepositories;
   settings: RealmAuthSettings;
   features: RealmFeatures;
-  /**
-   * Federated (broker) login config surfaced to the login UI, when the realm
-   * declares `identities.federated`. The broker public key is intentionally
-   * omitted — only the broker URL + provider list are client-facing.
-   */
-  federated?: {
-    brokerUrl: string;
-    providers: Array<"google" | "apple">;
-  };
   settingsParameter?: ParameterPrimitive<typeof realmAuthSettingsAtom.schema>;
   getSettings(): Promise<RealmAuthSettings>;
 }
@@ -86,12 +77,6 @@ export class RealmProvider {
         },
       },
       features,
-      federated: realmOptions.identities?.federated
-        ? {
-            brokerUrl: realmOptions.identities.federated.brokerUrl,
-            providers: realmOptions.identities.federated.providers,
-          }
-        : undefined,
       getSettings: async function () {
         if (this.settingsParameter) {
           return await this.settingsParameter.get();

package/src/api/users/schemas/completePasswordResetRequestSchema.ts

@@ -1,5 +1,5 @@
 import type { Static } from "alepha";
-import { t } from "alepha";
+import { z } from "alepha";
 
 /**
  * Request schema for completing a password reset.
@@ -7,17 +7,13 @@ import { t } from "alepha";
  * Requires the intent ID from Phase 1, the verification code,
  * and the new password.
  */
-export const completePasswordResetRequestSchema = t.object({
-  intentId: t.uuid({
-    description: "The intent ID from createPasswordResetIntent",
-  }),
-  code: t.string({
-    description: "6-digit verification code sent via email",
-  }),
-  newPassword: t.string({
-    minLength: 8,
-    description: "New password (minimum 8 characters)",
-  }),
+export const completePasswordResetRequestSchema = z.object({
+  intentId: z.uuid().describe("The intent ID from createPasswordResetIntent"),
+  code: z.string().describe("6-digit verification code sent via email"),
+  newPassword: z
+    .string()
+    .min(8)
+    .describe("New password (minimum 8 characters)"),
 });
 
 export type CompletePasswordResetRequest = Static<

package/src/api/users/schemas/completeRegistrationRequestSchema.ts

@@ -1,24 +1,21 @@
-import { type Static, t } from "alepha";
+import { type Static, z } from "alepha";
 
-export const completeRegistrationRequestSchema = t.object({
-  intentId: t.uuid({
-    description: "The registration intent ID from the first phase",
-  }),
-  emailCode: t.optional(
-    t.string({
-      description: "Email verification code (if email verification required)",
-    }),
-  ),
-  phoneCode: t.optional(
-    t.string({
-      description: "Phone verification code (if phone verification required)",
-    }),
-  ),
-  captchaToken: t.optional(
-    t.string({
-      description: "Captcha token (if captcha required)",
-    }),
-  ),
+export const completeRegistrationRequestSchema = z.object({
+  intentId: z
+    .uuid()
+    .describe("The registration intent ID from the first phase"),
+  emailCode: z
+    .string()
+    .describe("Email verification code (if email verification required)")
+    .optional(),
+  phoneCode: z
+    .string()
+    .describe("Phone verification code (if phone verification required)")
+    .optional(),
+  captchaToken: z
+    .string()
+    .describe("Captcha token (if captcha required)")
+    .optional(),
 });
 
 export type CompleteRegistrationRequest = Static<

package/src/api/users/schemas/createUserSchema.ts

@@ -1,6 +1,6 @@
-import { type Static, t } from "alepha";
+import type { Static } from "alepha";
 import { users } from "../entities/users.ts";
 
-export const createUserSchema = t.omit(users.insertSchema, ["realm"]);
+export const createUserSchema = users.insertSchema.omit({ realm: true });
 
 export type CreateUser = Static<typeof createUserSchema>;

package/src/api/users/schemas/identityQuerySchema.ts

@@ -1,10 +1,10 @@
 import type { Static } from "alepha";
-import { t } from "alepha";
+import { z } from "alepha";
 import { pageQuerySchema } from "alepha/orm";
 
-export const identityQuerySchema = t.extend(pageQuerySchema, {
-  userId: t.optional(t.uuid()),
-  provider: t.optional(t.string()),
+export const identityQuerySchema = pageQuerySchema.extend({
+  userId: z.uuid().optional(),
+  provider: z.string().optional(),
 });
 
 export type IdentityQuery = Static<typeof identityQuerySchema>;

package/src/api/users/schemas/identityResourceSchema.ts

@@ -1,7 +1,8 @@
 import type { Static } from "alepha";
-import { t } from "alepha";
 import { identities } from "../entities/identities.ts";
 
-export const identityResourceSchema = t.omit(identities.schema, ["password"]);
+export const identityResourceSchema = identities.schema.omit({
+  password: true,
+});
 
 export type IdentityResource = Static<typeof identityResourceSchema>;

package/src/api/users/schemas/loginSchema.ts

@@ -1,13 +1,13 @@
 import type { Static } from "alepha";
-import { t } from "alepha";
+import { z } from "alepha";
 
-export const loginSchema = t.object({
-  username: t.text({
+export const loginSchema = z.object({
+  username: z.text({
     minLength: 3,
     maxLength: 100,
     description: "Username or email address for login",
   }),
-  password: t.text({
+  password: z.text({
     minLength: 8,
     description: "User password",
   }),

package/src/api/users/schemas/passwordResetIntentResponseSchema.ts

@@ -1,5 +1,5 @@
 import type { Static } from "alepha";
-import { t } from "alepha";
+import { z } from "alepha";
 
 /**
  * Response schema for password reset intent creation.
@@ -7,13 +7,11 @@ import { t } from "alepha";
  * Contains the intent ID needed for Phase 2 completion,
  * along with expiration time.
  */
-export const passwordResetIntentResponseSchema = t.object({
-  intentId: t.uuid({
-    description: "Unique identifier for this password reset intent",
-  }),
-  expiresAt: t.datetime({
-    description: "ISO timestamp when this intent expires",
-  }),
+export const passwordResetIntentResponseSchema = z.object({
+  intentId: z
+    .uuid()
+    .describe("Unique identifier for this password reset intent"),
+  expiresAt: z.datetime().describe("ISO timestamp when this intent expires"),
 });
 
 export type PasswordResetIntentResponse = Static<

package/src/api/users/schemas/realmConfigSchema.ts

@@ -1,31 +1,17 @@
-import { type Static, t } from "alepha";
+import { type Static, z } from "alepha";
 import { authenticationProviderSchema } from "alepha/server/auth";
 import { realmAuthSettingsAtom } from "../atoms/realmAuthSettingsAtom.ts";
 
-export const realmConfigSchema = t.object({
+export const realmConfigSchema = z.object({
   settings: realmAuthSettingsAtom.schema,
-  realmName: t.string(),
-  authenticationMethods: t.array(authenticationProviderSchema),
-  captchaSiteKey: t.optional(
-    t.string({
-      description:
-        "Public site key for the captcha widget (when settings.captchaRequired is true)",
-    }),
-  ),
-  /**
-   * Federated (broker) social login. When present, the login UI renders one
-   * button per provider linking to `{brokerUrl}/auth/federated/start`.
-   */
-  federated: t.optional(
-    t.object({
-      brokerUrl: t.string({
-        description: "Broker origin that performs the OIDC dance.",
-      }),
-      providers: t.array(t.union([t.const("google"), t.const("apple")]), {
-        description: "Federated providers to surface as login buttons.",
-      }),
-    }),
-  ),
+  realmName: z.string(),
+  authenticationMethods: z.array(authenticationProviderSchema),
+  captchaSiteKey: z
+    .string()
+    .describe(
+      "Public site key for the captcha widget (when settings.captchaRequired is true)",
+    )
+    .optional(),
 });
 
 export type RealmConfig = Static<typeof realmConfigSchema>;

package/src/api/users/schemas/registerQuerySchema.ts

@@ -1,17 +1,17 @@
 import type { Static } from "alepha";
-import { t } from "alepha";
+import { z } from "alepha";
 
 /**
  * Schema for user registration query parameters.
  * Allows specifying a custom user realm.
  */
-export const registerQuerySchema = t.object({
-  userRealmName: t.optional(
-    t.text({
+export const registerQuerySchema = z.object({
+  userRealmName: z
+    .text({
       description:
         "The user realm to register the user in (defaults to 'default')",
-    }),
-  ),
+    })
+    .optional(),
 });
 
 export type RegisterQuery = Static<typeof registerQuerySchema>;

package/src/api/users/schemas/registerRequestSchema.ts

@@ -1,62 +1,40 @@
 import type { Static } from "alepha";
-import { t } from "alepha";
+import { z } from "alepha";
 
 /**
  * Schema for user registration request body.
  * Password is always required, other fields depend on realm settings.
  */
-export const registerRequestSchema = t.object({
+export const registerRequestSchema = z.object({
   // Password is always required
-  password: t.string({
-    minLength: 8,
-    description: "Password for the account",
-  }),
+  password: z.string().min(8).describe("Password for the account"),
 
   // Identity fields (requirements depend on realm settings)
-  username: t.optional(
-    t.string({
-      minLength: 3,
-      description: "Unique username for the account",
-    }),
-  ),
+  username: z
+    .string()
+    .min(3)
+    .describe("Unique username for the account")
+    .optional(),
 
   // Optional contact fields
-  email: t.optional(
-    t.string({
-      format: "email",
-      description: "User's email address",
-    }),
-  ),
-  phoneNumber: t.optional(
-    t.string({
-      description: "User's phone number",
-    }),
-  ),
+  email: z
+    .string()
+    .meta({ format: "email" })
+    .describe("User's email address")
+    .optional(),
+  phoneNumber: z.string().describe("User's phone number").optional(),
 
   // Optional user profile fields
-  firstName: t.optional(
-    t.string({
-      description: "User's first name",
-    }),
-  ),
-  lastName: t.optional(
-    t.string({
-      description: "User's last name",
-    }),
-  ),
-  picture: t.optional(
-    t.string({
-      description: "User's profile picture URL",
-    }),
-  ),
+  firstName: z.string().describe("User's first name").optional(),
+  lastName: z.string().describe("User's last name").optional(),
+  picture: z.string().describe("User's profile picture URL").optional(),
 
   // Captcha token — required when the realm has `captchaRequired: true`.
   // Validated at intent creation (before any verification email is sent).
-  captchaToken: t.optional(
-    t.string({
-      description: "Captcha response token (if captcha is required)",
-    }),
-  ),
+  captchaToken: z
+    .string()
+    .describe("Captcha response token (if captcha is required)")
+    .optional(),
 });
 
 export type RegisterRequest = Static<typeof registerRequestSchema>;

package/src/api/users/schemas/registerResponseSchema.ts

@@ -1,12 +1,12 @@
 import type { Static } from "alepha";
-import { t } from "alepha";
+import { z } from "alepha";
 import { users } from "../entities/users.ts";
 
 /**
  * Schema for user registration response.
  * Returns the created user without sensitive data.
  */
-export const registerResponseSchema = t.object({
+export const registerResponseSchema = z.object({
   user: users.schema,
 });