alepha 0.23.0 → 0.24.0

package/src/security/schemas/permissionSchema.ts

@@ -1,36 +1,36 @@
 import type { Static } from "alepha";
-import { t } from "alepha";
+import { z } from "alepha";
 
-export const permissionSchema = t.object({
-  name: t.text({
+export const permissionSchema = z.object({
+  name: z.text({
     description: "Name of the permission.",
   }),
 
-  group: t.optional(
-    t.text({
+  group: z
+    .text({
       description: "Group of the permission.",
-    }),
-  ),
+    })
+    .optional(),
 
-  description: t.optional(
-    t.text({
+  description: z
+    .text({
       description: "Describe the permission.",
-    }),
-  ),
+    })
+    .optional(),
 
   // HTTP Only
 
-  method: t.optional(
-    t.text({
+  method: z
+    .text({
       description: "HTTP method of the permission. When available.",
-    }),
-  ),
+    })
+    .optional(),
 
-  path: t.optional(
-    t.text({
+  path: z
+    .text({
       description: "Pathname of the permission. When available.",
-    }),
-  ),
+    })
+    .optional(),
 });
 
 export type Permission = Static<typeof permissionSchema>;

package/src/security/schemas/roleSchema.ts

@@ -1,41 +1,35 @@
 import type { Static } from "alepha";
-import { t } from "alepha";
+import { z } from "alepha";
 
-export const roleSchema = t.object({
-  name: t.text({
+export const roleSchema = z.object({
+  name: z.text({
     description: "Name of the role.",
   }),
 
-  description: t.optional(
-    t.text({
+  description: z
+    .text({
       description: "Describe the role.",
-    }),
-  ),
+    })
+    .optional(),
 
-  default: t.optional(
-    t.boolean({
-      description:
-        "If true, this role will be assigned to all users by default.",
-    }),
-  ),
+  default: z
+    .boolean()
+    .describe("If true, this role will be assigned to all users by default.")
+    .optional(),
 
-  permissions: t.array(
-    t.object({
-      name: t.text({
+  permissions: z.array(
+    z.object({
+      name: z.text({
         description: "Name of the permission.",
       }),
-      ownership: t.optional(
-        t.boolean({
-          description:
-            "If true, user will only have access to it's own resources.",
-        }),
-      ),
-      exclude: t.optional(
-        t.array(t.text(), {
-          description:
-            "Exclude some permissions. Useful when 'name' is a wildcard.",
-        }),
-      ),
+      ownership: z
+        .boolean()
+        .describe("If true, user will only have access to it's own resources.")
+        .optional(),
+      exclude: z
+        .array(z.text())
+        .describe("Exclude some permissions. Useful when 'name' is a wildcard.")
+        .optional(),
     }),
   ),
 });

package/src/security/schemas/userAccountInfoSchema.ts

@@ -1,61 +1,71 @@
 import type { Static } from "alepha";
-import { t } from "alepha";
+import { z } from "alepha";
 
-export const userAccountInfoSchema = t.object({
-  id: t.text({
+export const userAccountInfoSchema = z.object({
+  id: z.text({
     description: "Unique identifier for the user.",
   }),
 
-  name: t.optional(
-    t.text({
+  name: z
+    .text({
       description: "Full name of the user.",
-    }),
-  ),
+    })
+    .optional(),
 
-  email: t.optional(
-    t.text({
+  firstName: z
+    .text({
+      description: "Given name of the user (OIDC `given_name`).",
+    })
+    .optional(),
+
+  lastName: z
+    .text({
+      description: "Family name of the user (OIDC `family_name`).",
+    })
+    .optional(),
+
+  email: z
+    .text({
       description: "Email address of the user.",
       format: "email",
-    }),
-  ),
+    })
+    .optional(),
 
-  username: t.optional(
-    t.text({
+  username: z
+    .text({
       description: "Preferred username of the user.",
-    }),
-  ),
+    })
+    .optional(),
 
-  picture: t.optional(
-    t.text({
+  picture: z
+    .text({
       description: "URL to the user's profile picture.",
-    }),
-  ),
+    })
+    .optional(),
 
-  sessionId: t.optional(
-    t.text({
+  sessionId: z
+    .text({
       description: "Session identifier for the user, if applicable.",
-    }),
-  ),
+    })
+    .optional(),
 
   // -------------------------------------------------------------------------------------------------------------------
 
-  organization: t.optional(
-    t.uuid({
-      description: "Organization the user belongs to.",
-    }),
-  ),
+  organization: z
+    .uuid()
+    .describe("Organization the user belongs to.")
+    .optional(),
 
-  roles: t.optional(
-    t.array(t.text(), {
-      description: "List of roles assigned to the user.",
-    }),
-  ),
+  roles: z
+    .array(z.text())
+    .describe("List of roles assigned to the user.")
+    .optional(),
 
-  realm: t.optional(
-    t.text({
+  realm: z
+    .text({
       description: "The realm (issuer) the user was authenticated from.",
-    }),
-  ),
+    })
+    .optional(),
 });
 
 export type UserAccount = Static<typeof userAccountInfoSchema>;

package/src/server/auth/index.ts

@@ -6,14 +6,11 @@ import { ServerAuthProvider } from "./providers/ServerAuthProvider.ts";
 // ---------------------------------------------------------------------------------------------------------------------
 
 export * from "./helpers/appleClientSecret.ts";
-export * from "./helpers/federationAssertion.ts";
 export * from "./index.shared.ts";
 export * from "./primitives/$auth.ts";
 export * from "./primitives/$authApple.ts";
 export * from "./primitives/$authCredentials.ts";
 export * from "./primitives/$authFacebook.ts";
-export * from "./primitives/$authFederationBroker.ts";
-export * from "./primitives/$authFederationClient.ts";
 export * from "./primitives/$authFranceConnect.ts";
 export * from "./primitives/$authGithub.ts";
 export * from "./primitives/$authGoogle.ts";

package/src/server/auth/primitives/$auth.ts

@@ -478,12 +478,12 @@ export class AuthPrimitive extends Primitive<AuthPrimitiveOptions> {
         );
       };
 
-      // Defer OIDC discovery in serverless/dev to avoid cold start penalty
-      if (this.alepha.isServerless() || !this.alepha.isProduction()) {
-        this.oauthInitializer = discoverOidc;
-      } else {
-        this.oauthConfig = await discoverOidc();
-      }
+      // OIDC discovery is always lazy (resolved on first auth-flow use via the
+      // `oauthConfiguration` getter). It must never be a hard boot dependency:
+      // a relying party has to boot even when its IdP is briefly unreachable
+      // (cross-service start order, deploys), and deferring also avoids the
+      // serverless cold-start fetch.
+      this.oauthInitializer = discoverOidc;
     }
 
     if ("oauth" in this.options) {

package/src/server/auth/primitives/$authApple.ts

@@ -1,4 +1,4 @@
-import { $context, AlephaError, t } from "alepha";
+import { $context, AlephaError, z } from "alepha";
 import type { IssuerPrimitive } from "alepha/security";
 import type { OAuth2Profile } from "../providers/ServerAuthProvider.ts";
 import {
@@ -45,19 +45,19 @@ export const $authApple = (
   const { alepha } = $context();
 
   const env = alepha.parseEnv(
-    t.object({
-      APPLE_CLIENT_ID: t.optional(
-        t.text({
+    z.object({
+      APPLE_CLIENT_ID: z
+        .text({
           description:
             "The Service ID obtained from the Apple Developer Console.",
-        }),
-      ),
-      APPLE_CLIENT_SECRET: t.optional(
-        t.text({
+        })
+        .optional(),
+      APPLE_CLIENT_SECRET: z
+        .text({
           description:
             "The signed ES256 JWT client secret generated from your Apple private key.",
-        }),
-      ),
+        })
+        .optional(),
     }),
   );
 

package/src/server/auth/primitives/$authFacebook.ts

@@ -1,4 +1,4 @@
-import { $context, AlephaError, t } from "alepha";
+import { $context, AlephaError, z } from "alepha";
 import type { IssuerPrimitive } from "alepha/security";
 import type { OAuth2Profile } from "../providers/ServerAuthProvider.ts";
 import {
@@ -25,18 +25,18 @@ export const $authFacebook = (
   const { alepha } = $context();
 
   const env = alepha.parseEnv(
-    t.object({
-      FACEBOOK_CLIENT_ID: t.optional(
-        t.text({
+    z.object({
+      FACEBOOK_CLIENT_ID: z
+        .text({
           description: "The App ID obtained from the Meta Developer Console.",
-        }),
-      ),
-      FACEBOOK_CLIENT_SECRET: t.optional(
-        t.text({
+        })
+        .optional(),
+      FACEBOOK_CLIENT_SECRET: z
+        .text({
           description:
             "The App Secret obtained from the Meta Developer Console.",
-        }),
-      ),
+        })
+        .optional(),
     }),
   );
 

package/src/server/auth/primitives/$authFranceConnect.ts

@@ -1,4 +1,4 @@
-import { $context, AlephaError, t } from "alepha";
+import { $context, AlephaError, z } from "alepha";
 import type { IssuerPrimitive } from "alepha/security";
 import {
   $auth,
@@ -41,19 +41,19 @@ export const $authFranceConnect = (
   const { alepha } = $context();
 
   const env = alepha.parseEnv(
-    t.object({
-      FRANCECONNECT_CLIENT_ID: t.optional(
-        t.text({
+    z.object({
+      FRANCECONNECT_CLIENT_ID: z
+        .text({
           description:
             "The OAuth 2.0 client ID for your France Connect service provider, obtained from partenaires.franceconnect.gouv.fr.",
-        }),
-      ),
-      FRANCECONNECT_CLIENT_SECRET: t.optional(
-        t.text({
+        })
+        .optional(),
+      FRANCECONNECT_CLIENT_SECRET: z
+        .text({
           description:
             "The OAuth 2.0 client secret for your France Connect service provider, obtained from partenaires.franceconnect.gouv.fr.",
-        }),
-      ),
+        })
+        .optional(),
     }),
   );
 

package/src/server/auth/primitives/$authGithub.ts

@@ -1,4 +1,4 @@
-import { $context, AlephaError, t } from "alepha";
+import { $context, AlephaError, z } from "alepha";
 import type { IssuerPrimitive } from "alepha/security";
 import type { OAuth2Profile } from "../providers/ServerAuthProvider.ts";
 import {
@@ -25,19 +25,19 @@ export const $authGithub = (
   const { alepha } = $context();
 
   const env = alepha.parseEnv(
-    t.object({
-      GITHUB_CLIENT_ID: t.optional(
-        t.text({
+    z.object({
+      GITHUB_CLIENT_ID: z
+        .text({
           description:
             "The OAuth App client ID obtained from GitHub Developer Settings.",
-        }),
-      ),
-      GITHUB_CLIENT_SECRET: t.optional(
-        t.text({
+        })
+        .optional(),
+      GITHUB_CLIENT_SECRET: z
+        .text({
           description:
             "The OAuth App client secret obtained from GitHub Developer Settings.",
-        }),
-      ),
+        })
+        .optional(),
     }),
   );
 

package/src/server/auth/primitives/$authGoogle.ts

@@ -1,4 +1,4 @@
-import { $context, AlephaError, t } from "alepha";
+import { $context, AlephaError, z } from "alepha";
 import type { IssuerPrimitive } from "alepha/security";
 import {
   $auth,
@@ -24,19 +24,19 @@ export const $authGoogle = (
   const { alepha } = $context();
 
   const env = alepha.parseEnv(
-    t.object({
-      GOOGLE_CLIENT_ID: t.optional(
-        t.text({
+    z.object({
+      GOOGLE_CLIENT_ID: z
+        .text({
           description:
             "The OAuth 2.0 client ID obtained from the Google Developer Console.",
-        }),
-      ),
-      GOOGLE_CLIENT_SECRET: t.optional(
-        t.text({
+        })
+        .optional(),
+      GOOGLE_CLIENT_SECRET: z
+        .text({
           description:
             "The OAuth 2.0 client secret obtained from the Google Developer Console.",
-        }),
-      ),
+        })
+        .optional(),
     }),
   );
 

package/src/server/auth/primitives/$authMicrosoft.ts

@@ -1,4 +1,4 @@
-import { $context, AlephaError, t } from "alepha";
+import { $context, AlephaError, z } from "alepha";
 import type { IssuerPrimitive } from "alepha/security";
 import {
   $auth,
@@ -36,25 +36,25 @@ export const $authMicrosoft = (
   const { alepha } = $context();
 
   const env = alepha.parseEnv(
-    t.object({
-      MICROSOFT_CLIENT_ID: t.optional(
-        t.text({
+    z.object({
+      MICROSOFT_CLIENT_ID: z
+        .text({
           description:
             "The application (client) ID obtained from the Azure Portal.",
-        }),
-      ),
-      MICROSOFT_CLIENT_SECRET: t.optional(
-        t.text({
+        })
+        .optional(),
+      MICROSOFT_CLIENT_SECRET: z
+        .text({
           description:
             "The client secret value obtained from the Azure Portal.",
-        }),
-      ),
-      MICROSOFT_TENANT_ID: t.optional(
-        t.text({
+        })
+        .optional(),
+      MICROSOFT_TENANT_ID: z
+        .text({
           description:
             "The Azure AD tenant ID or 'common' for multi-tenant. Defaults to 'common'.",
-        }),
-      ),
+        })
+        .optional(),
     }),
   );
 

package/src/server/auth/providers/ServerAuthProvider.ts

@@ -1,4 +1,4 @@
-import { $hook, $inject, Alepha, t } from "alepha";
+import { $hook, $inject, Alepha, z } from "alepha";
 import { DateTimeProvider } from "alepha/datetime";
 import { $logger } from "alepha/logger";
 import {
@@ -79,14 +79,14 @@ export class ServerAuthProvider {
     ttl: [15, "minutes"],
     httpOnly: true,
     encrypt: true,
-    schema: t.object({
-      provider: t.text(),
-      realm: t.optional(t.text()),
-      codeVerifier: t.optional(t.text({ size: "long" })),
-      redirectUri: t.optional(t.text({ size: "long" })),
-      loginUri: t.optional(t.text({ size: "long" })),
-      state: t.optional(t.text()),
-      nonce: t.optional(t.text()),
+    schema: z.object({
+      provider: z.text(),
+      realm: z.text().optional(),
+      codeVerifier: z.text({ size: "long" }).optional(),
+      redirectUri: z.text({ size: "long" }).optional(),
+      loginUri: z.text({ size: "long" }).optional(),
+      state: z.text().optional(),
+      nonce: z.text().optional(),
     }),
   });
 
@@ -155,30 +155,31 @@ export class ServerAuthProvider {
       response: userinfoResponseSchema,
     },
     handler: async ({ user, headers, cookies }) => {
-      const tokens = this.getTokens(cookies);
-      if (tokens) {
-        const provider = this.provider(tokens);
-        if (!("issuer" in provider.options)) {
-          const user = await provider.user(tokens);
-          const api = await this.serverLinksProvider.getUserApiLinks({
-            authorization: headers.authorization,
-            user,
-          });
-          return {
-            api,
-            user,
-          };
+      // Prefer the REQUEST's resolved user (the currentUserAtom): global
+      // `server:onRequest` hooks may have rewritten it — e.g. per-org role
+      // resolution on a multi-tenant relying party. Re-deriving from the raw
+      // tokens here would silently drop those roles, so the token path is
+      // only a FALLBACK for sessions whose resolvers don't populate the atom
+      // (plain external OAuth2/OIDC providers without an internal issuer).
+      let resolved = user;
+      if (!resolved) {
+        const tokens = this.getTokens(cookies);
+        if (tokens) {
+          const provider = this.provider(tokens);
+          if (!("issuer" in provider.options)) {
+            resolved = await provider.user(tokens);
+          }
         }
       }
 
       const api = await this.serverLinksProvider.getUserApiLinks({
         authorization: headers.authorization,
-        user,
+        user: resolved,
       });
 
       return {
         api,
-        user,
+        user: resolved,
       };
     },
   });
@@ -190,20 +191,20 @@ export class ServerAuthProvider {
     path: alephaServerAuthRoutes.refresh,
     method: "POST",
     schema: {
-      query: t.object({
-        provider: t.text(),
+      query: z.object({
+        provider: z.text(),
       }),
-      body: t.object({
-        refresh_token: t.text({
+      body: z.object({
+        refresh_token: z.text({
           size: "rich",
         }),
-        access_token: t.optional(
-          t.text({
+        access_token: z
+          .text({
             size: "rich",
             description:
               "Required if provider has stateless refresh token on credentials mode",
-          }),
-        ),
+          })
+          .optional(),
       }),
       response: tokensSchema,
     },
@@ -229,15 +230,15 @@ export class ServerAuthProvider {
     path: alephaServerAuthRoutes.token,
     method: "POST",
     schema: {
-      query: t.object({
-        provider: t.text(),
-        realm: t.optional(
-          t.text({ description: "Realm name for multi-realm setups" }),
-        ),
+      query: z.object({
+        provider: z.text(),
+        realm: z
+          .text({ description: "Realm name for multi-realm setups" })
+          .optional(),
       }),
-      body: t.object({
-        username: t.text(),
-        password: t.text(),
+      body: z.object({
+        username: z.text(),
+        password: z.text(),
       }),
       response: tokenResponseSchema,
     },
@@ -305,12 +306,12 @@ export class ServerAuthProvider {
   public readonly login = $route({
     path: alephaServerAuthRoutes.login,
     schema: {
-      query: t.object({
-        provider: t.text(),
-        realm: t.optional(
-          t.text({ description: "Realm name for multi-realm setups" }),
-        ),
-        redirect_uri: t.optional(t.text({ size: "rich" })),
+      query: z.object({
+        provider: z.text(),
+        realm: z
+          .text({ description: "Realm name for multi-realm setups" })
+          .optional(),
+        redirect_uri: z.text({ size: "rich" }).optional(),
       }),
     },
     handler: async ({ query, url, reply, headers }) => {
@@ -605,8 +606,8 @@ export class ServerAuthProvider {
     path: alephaServerAuthRoutes.logout,
     method: "POST",
     schema: {
-      query: t.object({
-        post_logout_redirect_uri: t.optional(t.text()),
+      query: z.object({
+        post_logout_redirect_uri: z.text().optional(),
       }),
     },
     handler: async ({ query, reply, cookies }) => {