alepha 0.23.0 → 0.24.0

package/dist/api/users/index.js

@@ -1,16 +1,16 @@
-import { $atom, $context, $inject, $module, Alepha, AlephaError, t } from "alepha";
+import { $atom, $context, $inject, $module, Alepha, AlephaError, z } from "alepha";
 import { $audit } from "alepha/api/audits";
 import { $bucket } from "alepha/bucket";
 import { $issuer, $permission, $secure, CryptoProvider, InvalidCredentialsError, SecurityProvider } from "alepha/security";
-import { $action, BadRequestError, ConflictError, HttpError, UnauthorizedError, okSchema } from "alepha/server";
+import { $action, BadRequestError, ConflictError, HttpError, NotFoundError, UnauthorizedError, okSchema } from "alepha/server";
 import { $entity, $repository, db, pageQuerySchema, sql } from "alepha/orm";
 import { $logger } from "alepha/logger";
+import { AlephaApiVerification, VerificationService } from "alepha/api/verifications";
 import { $client } from "alepha/server/links";
 import { $notification } from "alepha/api/notifications";
 import { CaptchaProvider } from "alepha/captcha";
-import { $authApple, $authCredentials, $authFacebook, $authFederationClient, $authFranceConnect, $authGithub, $authGoogle, $authMicrosoft, ServerAuthProvider, authenticationProviderSchema } from "alepha/server/auth";
+import { $authApple, $authCredentials, $authFacebook, $authFranceConnect, $authGithub, $authGoogle, $authMicrosoft, ServerAuthProvider, authenticationProviderSchema } from "alepha/server/auth";
 import { $etag } from "alepha/server/etag";
-import { AlephaApiVerification, VerificationService } from "alepha/api/verifications";
 import { $cache, CacheProvider } from "alepha/cache";
 import { DatabaseCacheProvider } from "alepha/cache/database";
 import { DateTimeProvider } from "alepha/datetime";
@@ -108,34 +108,34 @@ var UserBuckets = class {
 };
 //#endregion
 //#region ../../src/api/users/schemas/identityQuerySchema.ts
-const identityQuerySchema = t.extend(pageQuerySchema, {
-	userId: t.optional(t.uuid()),
-	provider: t.optional(t.string())
+const identityQuerySchema = pageQuerySchema.extend({
+	userId: z.uuid().optional(),
+	provider: z.string().optional()
 });
 //#endregion
 //#region ../../src/api/users/entities/users.ts
 const DEFAULT_USER_REALM_NAME = "default";
 const users = $entity({
 	name: "users",
-	schema: t.object({
-		id: db.primaryKey(t.uuid()),
+	schema: z.object({
+		id: db.primaryKey(z.uuid()),
 		version: db.version(),
 		createdAt: db.createdAt(),
 		updatedAt: db.updatedAt(),
-		realm: db.default(t.text(), DEFAULT_USER_REALM_NAME),
-		username: t.optional(t.shortText({
+		realm: db.default(z.text(), DEFAULT_USER_REALM_NAME),
+		username: z.shortText({
 			minLength: 3,
 			maxLength: 30
-		})),
-		email: t.optional(t.string({ format: "email" })),
-		phoneNumber: t.optional(t.e164()),
-		roles: db.default(t.array(t.string()), []),
-		firstName: t.optional(t.string()),
-		lastName: t.optional(t.string()),
-		picture: t.optional(t.string()),
-		enabled: db.default(t.boolean(), true),
-		emailVerified: db.default(t.boolean(), false),
-		lastLoginAt: t.optional(t.datetime()),
+		}).optional(),
+		email: z.string().meta({ format: "email" }).optional(),
+		phoneNumber: z.e164().optional(),
+		roles: db.default(z.array(z.string()), []),
+		firstName: z.string().optional(),
+		lastName: z.string().optional(),
+		picture: z.string().optional(),
+		enabled: db.default(z.boolean(), true),
+		emailVerified: db.default(z.boolean(), false),
+		lastLoginAt: z.datetime().optional(),
 		organizationId: db.organization()
 	}),
 	indexes: [
@@ -158,16 +158,16 @@ const users = $entity({
 //#region ../../src/api/users/entities/identities.ts
 const identities = $entity({
 	name: "identities",
-	schema: t.object({
-		id: db.primaryKey(t.uuid()),
+	schema: z.object({
+		id: db.primaryKey(z.uuid()),
 		version: db.version(),
 		createdAt: db.createdAt(),
 		updatedAt: db.updatedAt(),
-		userId: db.ref(t.uuid(), () => users.cols.id),
-		password: t.optional(t.text()),
-		provider: t.text(),
-		providerUserId: t.optional(t.text()),
-		providerData: t.optional(t.json())
+		userId: db.ref(z.uuid(), () => users.cols.id),
+		password: z.text().optional(),
+		provider: z.text(),
+		providerUserId: z.text().optional(),
+		providerData: z.json().optional()
 	}),
 	indexes: [
 		"userId",
@@ -181,78 +181,55 @@ const identities = $entity({
 });
 //#endregion
 //#region ../../src/api/users/schemas/identityResourceSchema.ts
-const identityResourceSchema = t.omit(identities.schema, ["password"]);
+const identityResourceSchema = identities.schema.omit({ password: true });
 //#endregion
 //#region ../../src/api/users/atoms/realmAuthSettingsAtom.ts
-const fieldRequirement = (description) => t.union([
-	t.const("none"),
-	t.const("optional"),
-	t.const("required")
-], { description });
-const usernameFieldRequirement = (description) => t.union([
-	t.const("none"),
-	t.const("optional"),
-	t.const("required"),
-	t.const("email")
-], { description });
+const fieldRequirement = (description) => z.union([
+	z.const("none"),
+	z.const("optional"),
+	z.const("required")
+]).describe(description);
+const usernameFieldRequirement = (description) => z.union([
+	z.const("none"),
+	z.const("optional"),
+	z.const("required"),
+	z.const("email")
+]).describe(description);
 const realmAuthSettingsAtom = $atom({
 	name: "alepha.api.users.realmAuthSettings",
-	schema: t.object({
-		displayName: t.optional(t.string({ description: "Display name shown on auth pages (e.g., 'Customer Portal')" })),
-		description: t.optional(t.string({ description: "Description shown on auth pages" })),
-		logoUrl: t.optional(t.string({ description: "Logo URL for auth pages" })),
-		registrationAllowed: t.boolean({ description: "Enable user self-registration" }),
+	schema: z.object({
+		displayName: z.string().describe("Display name shown on auth pages (e.g., 'Customer Portal')").optional(),
+		description: z.string().describe("Description shown on auth pages").optional(),
+		logoUrl: z.string().describe("Logo URL for auth pages").optional(),
+		registrationAllowed: z.boolean().describe("Enable user self-registration"),
 		email: fieldRequirement("Email address field requirement for user accounts"),
 		username: usernameFieldRequirement("Username field requirement for user accounts"),
-		usernameRegExp: t.string({ description: "Regular expression that usernames must match (if username is enabled)" }),
-		usernameBlocklist: t.array(t.text(), { description: "Usernames that the slugger / manual registration must reject. Default empty so apps can register `admin`/`root`/`me`/etc. if they want; populate it explicitly for handles you want to keep off-limits." }),
+		usernameRegExp: z.string().describe("Regular expression that usernames must match (if username is enabled)"),
+		usernameBlocklist: z.array(z.text()).describe("Usernames that the slugger / manual registration must reject. Default empty so apps can register `admin`/`root`/`me`/etc. if they want; populate it explicitly for handles you want to keep off-limits."),
 		phoneNumber: fieldRequirement("Phone number field requirement for user accounts"),
-		verifyEmailRequired: t.boolean({ description: "Require email verification for user accounts" }),
-		verifyPhoneRequired: t.boolean({ description: "Require phone verification for user accounts" }),
+		verifyEmailRequired: z.boolean().describe("Require email verification for user accounts"),
+		verifyPhoneRequired: z.boolean().describe("Require phone verification for user accounts"),
 		firstNameLastName: fieldRequirement("First and last name field requirement for user accounts"),
-		resetPasswordAllowed: t.boolean({ description: "Enable forgot password functionality" }),
-		captchaRequired: t.boolean({ description: "Require captcha verification on registration (needs a CaptchaProvider registered, e.g. TurnstileCaptchaProvider)" }),
-		adminEmails: t.array(t.email(), { description: "List of email addresses that are automatically promoted to admin role on login" }),
-		adminUsernames: t.array(t.text(), { description: "List of usernames that are automatically promoted to admin role on login" }),
-		defaultRoles: t.array(t.string(), { description: "Default roles assigned to newly registered users" }),
-		verifyEmailUrl: t.optional(t.string({ description: "Base URL for email verification links (used when verification method is 'link'). Token and email are appended as query params." })),
-		passwordPolicy: t.object({
-			minLength: t.integer({
-				description: "Minimum password length",
-				default: 8,
-				minimum: 1
-			}),
-			requireUppercase: t.boolean({ description: "Require at least one uppercase letter" }),
-			requireLowercase: t.boolean({ description: "Require at least one lowercase letter" }),
-			requireNumbers: t.boolean({ description: "Require at least one number" }),
-			requireSpecialCharacters: t.boolean({ description: "Require at least one special character" })
-		}),
-		loginRateLimit: t.object({
-			ipMaxAttempts: t.integer({
-				description: "Max failed login attempts per IP before temporary lockout",
-				default: 15,
-				minimum: 1
-			}),
-			accountMaxAttempts: t.integer({
-				description: "Max failed login attempts per account before temporary lockout",
-				default: 5,
-				minimum: 1
-			}),
-			windowMs: t.integer({
-				description: "Rate limit window duration in milliseconds",
-				default: 900 * 1e3,
-				minimum: 1e3
-			})
+		resetPasswordAllowed: z.boolean().describe("Enable forgot password functionality"),
+		captchaRequired: z.boolean().describe("Require captcha verification on registration (needs a CaptchaProvider registered, e.g. TurnstileCaptchaProvider)"),
+		adminEmails: z.array(z.email()).describe("List of email addresses that are automatically promoted to admin role on login"),
+		adminUsernames: z.array(z.text()).describe("List of usernames that are automatically promoted to admin role on login"),
+		defaultRoles: z.array(z.string()).describe("Default roles assigned to newly registered users"),
+		verifyEmailUrl: z.string().describe("Base URL for email verification links (used when verification method is 'link'). Token and email are appended as query params.").optional(),
+		passwordPolicy: z.object({
+			minLength: z.integer().min(1).describe("Minimum password length").default(8),
+			requireUppercase: z.boolean().describe("Require at least one uppercase letter"),
+			requireLowercase: z.boolean().describe("Require at least one lowercase letter"),
+			requireNumbers: z.boolean().describe("Require at least one number"),
+			requireSpecialCharacters: z.boolean().describe("Require at least one special character")
 		}),
-		registrationIpMaxAttempts: t.integer({
-			description: "Max registration attempts per IP before temporary lockout. Default 10 protects against signup abuse; raise it in dev/e2e environments where a single localhost IP spawns many test users.",
-			default: 10,
-			minimum: 1
+		loginRateLimit: z.object({
+			ipMaxAttempts: z.integer().min(1).describe("Max failed login attempts per IP before temporary lockout").default(15),
+			accountMaxAttempts: z.integer().min(1).describe("Max failed login attempts per account before temporary lockout").default(5),
+			windowMs: z.integer().min(1e3).describe("Rate limit window duration in milliseconds").default(900 * 1e3)
 		}),
-		refreshToken: t.object({ expirationIdle: t.optional(t.integer({
-			description: "Maximum time in milliseconds a refresh token may stay unused before being invalidated. When set, sessions whose last refresh is older than this window are rejected and deleted, even if the absolute `expiresAt` has not been reached. Recommended for SaaS auth posture (SOC2/ISO27001). Leave undefined to disable idle invalidation (default).",
-			minimum: 1e3
-		})) })
+		registrationIpMaxAttempts: z.integer().min(1).describe("Max registration attempts per IP before temporary lockout. Default 10 protects against signup abuse; raise it in dev/e2e environments where a single localhost IP spawns many test users.").default(10),
+		refreshToken: z.object({ expirationIdle: z.integer().min(1e3).describe("Maximum time in milliseconds a refresh token may stay unused before being invalidated. When set, sessions whose last refresh is older than this window are rejected and deleted, even if the absolute `expiresAt` has not been reached. Recommended for SaaS auth posture (SOC2/ISO27001). Leave undefined to disable idle invalidation (default).").optional() })
 	}),
 	default: {
 		registrationAllowed: true,
@@ -289,13 +266,13 @@ const realmAuthSettingsAtom = $atom({
 //#region ../../src/api/users/entities/sessions.ts
 const sessions = $entity({
 	name: "sessions",
-	schema: t.object({
-		id: db.primaryKey(t.uuid()),
+	schema: z.object({
+		id: db.primaryKey(z.uuid()),
 		version: db.version(),
 		createdAt: db.createdAt(),
 		updatedAt: db.updatedAt(),
-		refreshToken: t.uuid(),
-		userId: db.ref(t.uuid(), () => users.cols.id),
+		refreshToken: z.uuid(),
+		userId: db.ref(z.uuid(), () => users.cols.id),
 		/**
 		* OAuth client this session was minted for, when it was created via the
 		* OAuth 2.1 authorization flow — the `client_id` of an `oauth_clients`
@@ -303,30 +280,30 @@ const sessions = $entity({
 		* key: `sessions` is a core entity and must not depend on the optional
 		* OAuth module's table; the join to `oauth_clients` is done at query time.
 		*/
-		clientId: t.optional(t.text({ maxLength: 64 })),
-		expiresAt: t.datetime(),
+		clientId: z.text({ maxLength: 64 }).optional(),
+		expiresAt: z.datetime(),
 		/**
 		* Last time the session was used to refresh an access token.
 		* Used by realm `refreshToken.expirationIdle` to invalidate idle sessions.
 		* `null` on existing rows pre-migration — falls back to `createdAt`.
 		*/
-		lastUsedAt: t.optional(t.datetime()),
-		ip: t.optional(t.text()),
+		lastUsedAt: z.datetime().optional(),
+		ip: z.text().optional(),
 		/**
 		* ISO 3166-1 alpha-2 country code derived from the request geo headers
 		* (`cf-ipcountry` on Cloudflare, CDN equivalents elsewhere) at login time.
 		* `null` on pre-migration rows and where geo isn't available.
 		*/
-		country: t.optional(t.text({ maxLength: 2 })),
-		userAgent: t.optional(t.object({
-			os: t.text(),
-			browser: t.text(),
-			device: t.enum([
+		country: z.text({ maxLength: 2 }).optional(),
+		userAgent: z.object({
+			os: z.text(),
+			browser: z.text(),
+			device: z.enum([
 				"MOBILE",
 				"DESKTOP",
 				"TABLET"
 			])
-		}))
+		}).optional()
 	}),
 	indexes: [
 		"userId",
@@ -380,10 +357,6 @@ var RealmProvider = class {
 				}
 			},
 			features,
-			federated: realmOptions.identities?.federated ? {
-				brokerUrl: realmOptions.identities.federated.brokerUrl,
-				providers: realmOptions.identities.federated.providers
-			} : void 0,
 			getSettings: async function() {
 				if (this.settingsParameter) return await this.settingsParameter.get();
 				return this.settings;
@@ -497,6 +470,7 @@ var AdminIdentityController = class {
 	url = "/identities";
 	group = "admin:identities";
 	identityService = $inject(IdentityService);
+	securityProvider = $inject(SecurityProvider);
 	/**
 	* Find identities with pagination and filtering.
 	*/
@@ -506,12 +480,12 @@ var AdminIdentityController = class {
 		use: [$secure({ permissions: ["admin:identity:read"] })],
 		description: "Find identities with pagination and filtering",
 		schema: {
-			query: t.extend(identityQuerySchema, { userRealmName: t.optional(t.string()) }),
-			response: t.page(identityResourceSchema)
+			query: identityQuerySchema.extend({ userRealmName: z.string().optional() }),
+			response: z.page(identityResourceSchema)
 		},
-		handler: ({ query }) => {
+		handler: ({ query, user }) => {
 			const { userRealmName, ...q } = query;
-			return this.identityService.findIdentities(q, userRealmName);
+			return this.identityService.findIdentities(q, this.securityProvider.assertRealmScope(user, userRealmName));
 		}
 	});
 	/**
@@ -523,11 +497,11 @@ var AdminIdentityController = class {
 		use: [$secure({ permissions: ["admin:identity:read"] })],
 		description: "Get an identity by ID",
 		schema: {
-			params: t.object({ id: t.uuid() }),
-			query: t.object({ userRealmName: t.optional(t.string()) }),
+			params: z.object({ id: z.uuid() }),
+			query: z.object({ userRealmName: z.string().optional() }),
 			response: identityResourceSchema
 		},
-		handler: ({ params, query }) => this.identityService.getIdentityById(params.id, query.userRealmName)
+		handler: ({ params, query, user }) => this.identityService.getIdentityById(params.id, this.securityProvider.assertRealmScope(user, query.userRealmName))
 	});
 	/**
 	* Delete an identity.
@@ -539,12 +513,12 @@ var AdminIdentityController = class {
 		use: [$secure({ permissions: ["admin:identity:delete"] })],
 		description: "Delete an identity",
 		schema: {
-			params: t.object({ id: t.uuid() }),
-			query: t.object({ userRealmName: t.optional(t.string()) }),
+			params: z.object({ id: z.uuid() }),
+			query: z.object({ userRealmName: z.string().optional() }),
 			response: okSchema
 		},
-		handler: async ({ params, query }) => {
-			await this.identityService.deleteIdentity(params.id, query.userRealmName);
+		handler: async ({ params, query, user }) => {
+			await this.identityService.deleteIdentity(params.id, this.securityProvider.assertRealmScope(user, query.userRealmName));
 			return {
 				ok: true,
 				id: params.id
@@ -554,7 +528,7 @@ var AdminIdentityController = class {
 };
 //#endregion
 //#region ../../src/api/users/schemas/sessionQuerySchema.ts
-const sessionQuerySchema = t.extend(pageQuerySchema, { userId: t.optional(t.uuid()) });
+const sessionQuerySchema = pageQuerySchema.extend({ userId: z.uuid().optional() });
 //#endregion
 //#region ../../src/api/users/schemas/sessionResourceSchema.ts
 /**
@@ -563,36 +537,36 @@ const sessionQuerySchema = t.extend(pageQuerySchema, { userId: t.optional(t.uuid
 * back via a left join, so it's optional (a session whose user was deleted
 * still returns; `user` is undefined).
 */
-const sessionUserSummarySchema = t.object({
-	id: t.uuid(),
-	email: t.optional(t.string({ format: "email" })),
-	username: t.optional(t.shortText({
+const sessionUserSummarySchema = z.object({
+	id: z.uuid(),
+	email: z.string().meta({ format: "email" }).optional(),
+	username: z.shortText({
 		minLength: 3,
 		maxLength: 30
-	})),
-	firstName: t.optional(t.string()),
-	lastName: t.optional(t.string())
+	}).optional(),
+	firstName: z.string().optional(),
+	lastName: z.string().optional()
 });
-const sessionResourceSchema = t.object({
-	id: t.uuid(),
-	version: t.number(),
-	createdAt: t.datetime(),
-	updatedAt: t.datetime(),
-	refreshToken: t.uuid(),
-	userId: t.uuid(),
-	expiresAt: t.datetime(),
-	ip: t.optional(t.string()),
-	country: t.optional(t.string()),
-	userAgent: t.optional(t.object({
-		os: t.string(),
-		browser: t.string(),
-		device: t.enum([
+const sessionResourceSchema = z.object({
+	id: z.uuid(),
+	version: z.number(),
+	createdAt: z.datetime(),
+	updatedAt: z.datetime(),
+	refreshToken: z.uuid(),
+	userId: z.uuid(),
+	expiresAt: z.datetime(),
+	ip: z.string().optional(),
+	country: z.string().optional(),
+	userAgent: z.object({
+		os: z.string(),
+		browser: z.string(),
+		device: z.enum([
 			"MOBILE",
 			"DESKTOP",
 			"TABLET"
 		])
-	})),
-	user: t.optional(sessionUserSummarySchema)
+	}).optional(),
+	user: sessionUserSummarySchema.optional()
 });
 //#endregion
 //#region ../../src/api/users/services/SessionCrudService.ts
@@ -683,6 +657,7 @@ var AdminSessionController = class {
 	url = "/sessions";
 	group = "admin:sessions";
 	sessionService = $inject(SessionCrudService);
+	securityProvider = $inject(SecurityProvider);
 	/**
 	* Find sessions with pagination and filtering.
 	*/
@@ -692,12 +667,12 @@ var AdminSessionController = class {
 		use: [$secure({ permissions: ["admin:session:read"] })],
 		description: "Find sessions with pagination and filtering",
 		schema: {
-			query: t.extend(sessionQuerySchema, { userRealmName: t.optional(t.string()) }),
-			response: t.page(sessionResourceSchema)
+			query: sessionQuerySchema.extend({ userRealmName: z.string().optional() }),
+			response: z.page(sessionResourceSchema)
 		},
-		handler: ({ query }) => {
+		handler: ({ query, user }) => {
 			const { userRealmName, ...q } = query;
-			return this.sessionService.findSessions(q, userRealmName);
+			return this.sessionService.findSessions(q, this.securityProvider.assertRealmScope(user, userRealmName));
 		}
 	});
 	/**
@@ -709,11 +684,11 @@ var AdminSessionController = class {
 		use: [$secure({ permissions: ["admin:session:read"] })],
 		description: "Get a session by ID",
 		schema: {
-			params: t.object({ id: t.uuid() }),
-			query: t.object({ userRealmName: t.optional(t.string()) }),
+			params: z.object({ id: z.uuid() }),
+			query: z.object({ userRealmName: z.string().optional() }),
 			response: sessionResourceSchema
 		},
-		handler: ({ params, query }) => this.sessionService.getSessionById(params.id, query.userRealmName)
+		handler: ({ params, query, user }) => this.sessionService.getSessionById(params.id, this.securityProvider.assertRealmScope(user, query.userRealmName))
 	});
 	/**
 	* Delete a session.
@@ -725,12 +700,12 @@ var AdminSessionController = class {
 		use: [$secure({ permissions: ["admin:session:delete"] })],
 		description: "Delete a session",
 		schema: {
-			params: t.object({ id: t.uuid() }),
-			query: t.object({ userRealmName: t.optional(t.string()) }),
+			params: z.object({ id: z.uuid() }),
+			query: z.object({ userRealmName: z.string().optional() }),
 			response: okSchema
 		},
-		handler: async ({ params, query }) => {
-			await this.sessionService.deleteSession(params.id, query.userRealmName);
+		handler: async ({ params, query, user }) => {
+			await this.sessionService.deleteSession(params.id, this.securityProvider.assertRealmScope(user, query.userRealmName));
 			return {
 				ok: true,
 				id: params.id
@@ -747,43 +722,40 @@ var AdminSessionController = class {
 		use: [$secure({ permissions: ["admin:session:delete"] })],
 		description: "Delete many sessions",
 		schema: {
-			query: t.object({ userRealmName: t.optional(t.string()) }),
-			body: t.object({ ids: t.array(t.uuid(), {
-				minItems: 1,
-				maxItems: 1e3
-			}) }),
-			response: t.object({ deleted: t.array(t.string()) })
+			query: z.object({ userRealmName: z.string().optional() }),
+			body: z.object({ ids: z.array(z.uuid()).min(1).max(1e3) }),
+			response: z.object({ deleted: z.array(z.string()) })
 		},
-		handler: async ({ body, query }) => {
-			return { deleted: await this.sessionService.deleteSessions(body.ids, query.userRealmName) };
+		handler: async ({ body, query, user }) => {
+			return { deleted: await this.sessionService.deleteSessions(body.ids, this.securityProvider.assertRealmScope(user, query.userRealmName)) };
 		}
 	});
 };
 //#endregion
 //#region ../../src/api/users/schemas/createUserSchema.ts
-const createUserSchema = t.omit(users.insertSchema, ["realm"]);
+const createUserSchema = users.insertSchema.omit({ realm: true });
 //#endregion
 //#region ../../src/api/users/schemas/updateUserSchema.ts
-const updateUserSchema = t.partial(t.omit(users.insertSchema, [
-	"id",
-	"version",
-	"createdAt",
-	"updatedAt"
-]));
+const updateUserSchema = users.insertSchema.omit({
+	id: true,
+	version: true,
+	createdAt: true,
+	updatedAt: true
+}).partial();
 //#endregion
 //#region ../../src/api/users/schemas/userQuerySchema.ts
-const userQuerySchema = t.extend(pageQuerySchema, {
+const userQuerySchema = pageQuerySchema.extend({
 	/**
 	* Free-text search applied (case-insensitive) across `email`,
 	* `username`, `firstName`, and `lastName`. Matches with a leading and
 	* trailing wildcard, so `?search=foo` finds any user whose email,
 	* username, or name contains `foo`.
 	*/
-	search: t.optional(t.string()),
-	email: t.optional(t.string()),
-	enabled: t.optional(t.boolean()),
-	emailVerified: t.optional(t.boolean()),
-	roles: t.optional(t.array(t.string()))
+	search: z.string().optional(),
+	email: z.string().optional(),
+	enabled: z.boolean().optional(),
+	emailVerified: z.boolean().optional(),
+	roles: z.array(z.string()).optional()
 });
 //#endregion
 //#region ../../src/api/users/schemas/userResourceSchema.ts
@@ -812,10 +784,25 @@ var UserNotifications = class {
 			<p>Best regards,<br>The Team</p>
 		`
 		},
-		schema: t.object({
-			email: t.string({ format: "email" }),
-			code: t.string(),
-			expiresInMinutes: t.number()
+		translations: { fr: { email: {
+			subject: "Réinitialisez votre mot de passe",
+			body: (it) => `
+				<h1>Réinitialisez votre mot de passe</h1>
+				<p>Bonjour,</p>
+				<p>Nous avons reçu une demande de réinitialisation de votre mot de passe. Utilisez le code ci-dessous pour confirmer votre identité :</p>
+				<p style="margin: 30px 0; text-align: center;">
+					<span style="font-size: 32px; font-weight: bold; letter-spacing: 8px; font-family: monospace; background-color: #f5f5f5; padding: 16px 24px; border-radius: 8px; display: inline-block;">
+						${it.code}
+					</span>
+				</p>
+				<p>Ce code expire dans ${it.expiresInMinutes} minutes.</p>
+				<p>Si vous n'avez pas demandé de réinitialisation, vous pouvez ignorer cet e-mail : votre mot de passe restera inchangé.</p>
+			`
+		} } },
+		schema: z.object({
+			email: z.string().meta({ format: "email" }),
+			code: z.string(),
+			expiresInMinutes: z.number()
 		})
 	});
 	emailVerification = $notification({
@@ -839,10 +826,25 @@ var UserNotifications = class {
 			<p>Best regards,<br>The Team</p>
 		`
 		},
-		schema: t.object({
-			email: t.string({ format: "email" }),
-			code: t.string(),
-			expiresInMinutes: t.number()
+		translations: { fr: { email: {
+			subject: "Vérifiez votre adresse e-mail",
+			body: (it) => `
+				<h1>Vérifiez votre adresse e-mail</h1>
+				<p>Bonjour,</p>
+				<p>Merci de votre inscription ! Utilisez le code ci-dessous pour vérifier votre adresse e-mail :</p>
+				<p style="margin: 30px 0; text-align: center;">
+					<span style="font-size: 32px; font-weight: bold; letter-spacing: 8px; font-family: monospace; background-color: #f5f5f5; padding: 16px 24px; border-radius: 8px; display: inline-block;">
+						${it.code}
+					</span>
+				</p>
+				<p>Ce code expire dans ${it.expiresInMinutes} minutes.</p>
+				<p>Si vous n'avez pas créé de compte, ignorez cet e-mail.</p>
+			`
+		} } },
+		schema: z.object({
+			email: z.string().meta({ format: "email" }),
+			code: z.string(),
+			expiresInMinutes: z.number()
 		})
 	});
 	phoneVerification = $notification({
@@ -851,10 +853,10 @@ var UserNotifications = class {
 		critical: true,
 		sensitive: true,
 		sms: { message: (it) => `Your verification code is: ${it.code}. This code expires in ${it.expiresInMinutes} minutes.` },
-		schema: t.object({
-			phoneNumber: t.string(),
-			code: t.string(),
-			expiresInMinutes: t.number()
+		schema: z.object({
+			phoneNumber: z.string(),
+			code: z.string(),
+			expiresInMinutes: z.number()
 		})
 	});
 	passwordResetLink = $notification({
@@ -880,10 +882,10 @@ var UserNotifications = class {
 			<p>Best regards,<br>The Team</p>
 		`
 		},
-		schema: t.object({
-			email: t.string({ format: "email" }),
-			resetUrl: t.string(),
-			expiresInMinutes: t.number()
+		schema: z.object({
+			email: z.string().meta({ format: "email" }),
+			resetUrl: z.string(),
+			expiresInMinutes: z.number()
 		})
 	});
 	accountLockout = $notification({
@@ -902,9 +904,19 @@ var UserNotifications = class {
 				<p>Best regards,<br>The Team</p>
 			`
 		},
-		schema: t.object({
-			email: t.string({ format: "email" }),
-			lockoutMinutes: t.number()
+		translations: { fr: { email: {
+			subject: "Compte temporairement verrouillé",
+			body: (it) => `
+					<h1>Compte temporairement verrouillé</h1>
+					<p>Bonjour,</p>
+					<p>Votre compte a été temporairement verrouillé suite à un trop grand nombre de tentatives de connexion échouées.</p>
+					<p>Si c'était bien vous, patientez ${it.lockoutMinutes} minutes avant de réessayer. Mot de passe oublié ? Utilisez la réinitialisation de mot de passe.</p>
+					<p>Si ce n'était pas vous, quelqu'un essaie peut-être d'accéder à votre compte. Nous vous recommandons de changer votre mot de passe au plus vite.</p>
+				`
+		} } },
+		schema: z.object({
+			email: z.string().meta({ format: "email" }),
+			lockoutMinutes: z.number()
 		})
 	});
 	emailVerificationLink = $notification({
@@ -930,10 +942,10 @@ var UserNotifications = class {
 			<p>Best regards,<br>The Team</p>
 		`
 		},
-		schema: t.object({
-			email: t.string({ format: "email" }),
-			verifyUrl: t.string(),
-			expiresInMinutes: t.number()
+		schema: z.object({
+			email: z.string().meta({ format: "email" }),
+			verifyUrl: z.string(),
+			expiresInMinutes: z.number()
 		})
 	});
 };
@@ -943,6 +955,7 @@ var UserService = class {
 	alepha = $inject(Alepha);
 	log = $logger();
 	verificationController = $client();
+	verificationService = $inject(VerificationService);
 	realmProvider = $inject(RealmProvider);
 	cryptoProvider = $inject(CryptoProvider);
 	userAudits(realmName) {
@@ -980,9 +993,9 @@ var UserService = class {
 			return true;
 		}
 		try {
-			const verification = await this.verificationController.requestVerificationCode({
-				params: { type: method },
-				body: { target: email }
+			const verification = await this.verificationService.createVerification({
+				type: method,
+				target: email
 			});
 			if (method === "link") {
 				const realmSettings = await this.realmProvider.getRealm(userRealmName).getSettings();
@@ -1310,15 +1323,15 @@ var AdminUserController = class {
 		use: [$secure({ permissions: ["admin:user:read"] })],
 		description: "List roles available in a realm",
 		schema: {
-			query: t.object({ userRealmName: t.optional(t.string()) }),
-			response: t.array(t.object({
-				name: t.string(),
-				default: t.optional(t.boolean()),
-				description: t.optional(t.string())
+			query: z.object({ userRealmName: z.string().optional() }),
+			response: z.array(z.object({
+				name: z.string(),
+				default: z.boolean().optional(),
+				description: z.string().optional()
 			}))
 		},
-		handler: ({ query }) => {
-			return this.securityProvider.getRoles(query.userRealmName).map((r) => ({
+		handler: ({ query, user }) => {
+			return this.securityProvider.getRoles(this.securityProvider.assertRealmScope(user, query.userRealmName)).map((r) => ({
 				name: r.name,
 				default: r.default,
 				description: r.description
@@ -1334,12 +1347,12 @@ var AdminUserController = class {
 		use: [$secure({ permissions: ["admin:user:read"] })],
 		description: "Find users with pagination and filtering",
 		schema: {
-			query: t.extend(userQuerySchema, { userRealmName: t.optional(t.string()) }),
-			response: t.page(userResourceSchema)
+			query: userQuerySchema.extend({ userRealmName: z.string().optional() }),
+			response: z.page(userResourceSchema)
 		},
-		handler: ({ query }) => {
+		handler: ({ query, user }) => {
 			const { userRealmName, ...q } = query;
-			return this.userService.findUsers(q, userRealmName);
+			return this.userService.findUsers(q, this.securityProvider.assertRealmScope(user, userRealmName));
 		}
 	});
 	/**
@@ -1351,11 +1364,11 @@ var AdminUserController = class {
 		use: [$secure({ permissions: ["admin:user:read"] })],
 		description: "Get a user by ID",
 		schema: {
-			params: t.object({ id: t.uuid() }),
-			query: t.object({ userRealmName: t.optional(t.string()) }),
+			params: z.object({ id: z.uuid() }),
+			query: z.object({ userRealmName: z.string().optional() }),
 			response: userResourceSchema
 		},
-		handler: ({ params, query }) => this.userService.getUserById(params.id, query.userRealmName)
+		handler: ({ params, query, user }) => this.userService.getUserById(params.id, this.securityProvider.assertRealmScope(user, query.userRealmName))
 	});
 	/**
 	* Create a new user.
@@ -1367,11 +1380,11 @@ var AdminUserController = class {
 		use: [$secure({ permissions: ["admin:user:create"] })],
 		description: "Create a new user",
 		schema: {
-			query: t.object({ userRealmName: t.optional(t.string()) }),
+			query: z.object({ userRealmName: z.string().optional() }),
 			body: createUserSchema,
 			response: userResourceSchema
 		},
-		handler: ({ body, query }) => this.userService.createUser(body, query.userRealmName)
+		handler: ({ body, query, user }) => this.userService.createUser(body, this.securityProvider.assertRealmScope(user, query.userRealmName))
 	});
 	/**
 	* Update a user.
@@ -1383,12 +1396,12 @@ var AdminUserController = class {
 		use: [$secure({ permissions: ["admin:user:update"] })],
 		description: "Update a user",
 		schema: {
-			params: t.object({ id: t.uuid() }),
-			query: t.object({ userRealmName: t.optional(t.string()) }),
+			params: z.object({ id: z.uuid() }),
+			query: z.object({ userRealmName: z.string().optional() }),
 			body: updateUserSchema,
 			response: userResourceSchema
 		},
-		handler: ({ params, body, query }) => this.userService.updateUser(params.id, body, query.userRealmName)
+		handler: ({ params, body, query, user }) => this.userService.updateUser(params.id, body, this.securityProvider.assertRealmScope(user, query.userRealmName))
 	});
 	/**
 	* Set (or reset) a user's password. Admin-only flow — does NOT
@@ -1402,13 +1415,13 @@ var AdminUserController = class {
 		use: [$secure({ permissions: ["admin:user:update"] })],
 		description: "Set a user's password",
 		schema: {
-			params: t.object({ id: t.uuid() }),
-			query: t.object({ userRealmName: t.optional(t.string()) }),
-			body: t.object({ password: t.string({ minLength: 1 }) }),
+			params: z.object({ id: z.uuid() }),
+			query: z.object({ userRealmName: z.string().optional() }),
+			body: z.object({ password: z.string().min(1) }),
 			response: okSchema
 		},
-		handler: async ({ params, body, query }) => {
-			await this.userService.setPassword(params.id, body.password, query.userRealmName);
+		handler: async ({ params, body, query, user }) => {
+			await this.userService.setPassword(params.id, body.password, this.securityProvider.assertRealmScope(user, query.userRealmName));
 			return {
 				ok: true,
 				id: params.id
@@ -1425,12 +1438,12 @@ var AdminUserController = class {
 		use: [$secure({ permissions: ["admin:user:delete"] })],
 		description: "Delete a user",
 		schema: {
-			params: t.object({ id: t.uuid() }),
-			query: t.object({ userRealmName: t.optional(t.string()) }),
+			params: z.object({ id: z.uuid() }),
+			query: z.object({ userRealmName: z.string().optional() }),
 			response: okSchema
 		},
-		handler: async ({ params, query }) => {
-			await this.userService.deleteUser(params.id, query.userRealmName);
+		handler: async ({ params, query, user }) => {
+			await this.userService.deleteUser(params.id, this.securityProvider.assertRealmScope(user, query.userRealmName));
 			return {
 				ok: true,
 				id: params.id
@@ -1449,17 +1462,15 @@ var AdminUserController = class {
 		use: [$secure({ permissions: ["admin:user:delete"] })],
 		description: "Delete many users",
 		schema: {
-			query: t.object({ userRealmName: t.optional(t.string()) }),
-			body: t.object({ ids: t.array(t.uuid(), {
-				minItems: 1,
-				maxItems: 1e3
-			}) }),
-			response: t.object({ deleted: t.array(t.uuid()) })
+			query: z.object({ userRealmName: z.string().optional() }),
+			body: z.object({ ids: z.array(z.uuid()).min(1).max(1e3) }),
+			response: z.object({ deleted: z.array(z.uuid()) })
 		},
-		handler: async ({ body, query }) => {
+		handler: async ({ body, query, user }) => {
+			const realm = this.securityProvider.assertRealmScope(user, query.userRealmName);
 			const deleted = [];
 			for (const id of body.ids) {
-				await this.userService.deleteUser(id, query.userRealmName);
+				await this.userService.deleteUser(id, realm);
 				deleted.push(id);
 			}
 			return { deleted };
@@ -1467,20 +1478,110 @@ var AdminUserController = class {
 	});
 };
 //#endregion
+//#region ../../src/api/users/controllers/MySessionController.ts
+/**
+* A session as exposed to ITS OWNER — `refreshToken` is deliberately
+* omitted (returning it would let any XSS exfiltrate a long-lived
+* credential); `current` flags the session backing the calling request.
+*/
+const mySessionSchema = z.object({
+	id: z.uuid(),
+	createdAt: z.datetime(),
+	expiresAt: z.datetime(),
+	lastUsedAt: z.datetime().optional(),
+	ip: z.string().optional(),
+	country: z.string().optional(),
+	userAgent: z.object({
+		os: z.string(),
+		browser: z.string(),
+		device: z.enum([
+			"MOBILE",
+			"DESKTOP",
+			"TABLET"
+		])
+	}).optional(),
+	current: z.boolean()
+});
+/**
+* Self-service session management — the "where am I signed in?" page of an
+* account area. Counterpart of {@link AdminSessionController}, scoped to the
+* CALLER's own sessions: list them, revoke one (a stolen laptop), or revoke
+* everything except the current one.
+*/
+var MySessionController = class {
+	realmProvider = $inject(RealmProvider);
+	sessions(realm) {
+		return this.realmProvider.sessionRepository(realm);
+	}
+	toMySession(session, currentSessionId) {
+		return {
+			id: session.id,
+			createdAt: session.createdAt,
+			expiresAt: session.expiresAt,
+			lastUsedAt: session.lastUsedAt,
+			ip: session.ip,
+			country: session.country,
+			userAgent: session.userAgent,
+			current: session.id === currentSessionId
+		};
+	}
+	listMySessions = $action({
+		method: "GET",
+		path: "/users/me/sessions",
+		use: [$secure()],
+		description: "List the caller's active sessions",
+		schema: { response: z.array(mySessionSchema) },
+		handler: async ({ user }) => {
+			return (await this.sessions(user.realm).findMany({
+				where: { userId: { eq: user.id } },
+				orderBy: [{
+					column: "createdAt",
+					direction: "desc"
+				}]
+			})).map((s) => this.toMySession(s, user.sessionId));
+		}
+	});
+	deleteMySession = $action({
+		method: "DELETE",
+		path: "/users/me/sessions/:id",
+		use: [$secure()],
+		description: "Revoke one of the caller's sessions",
+		schema: {
+			params: z.object({ id: z.uuid() }),
+			response: z.object({ ok: z.boolean() })
+		},
+		handler: async ({ params, user }) => {
+			const repo = this.sessions(user.realm);
+			const session = await repo.findOne({ where: {
+				id: { eq: params.id },
+				userId: { eq: user.id }
+			} });
+			if (!session) throw new NotFoundError("Session not found");
+			await repo.deleteById(session.id);
+			return { ok: true };
+		}
+	});
+	deleteMyOtherSessions = $action({
+		method: "POST",
+		path: "/users/me/sessions/revoke-others",
+		use: [$secure()],
+		description: "Revoke every caller session except the current one",
+		schema: { response: z.object({ revoked: z.integer() }) },
+		handler: async ({ user }) => {
+			const repo = this.sessions(user.realm);
+			const others = (await repo.findMany({ where: { userId: { eq: user.id } } })).filter((s) => s.id !== user.sessionId);
+			for (const s of others) await repo.deleteById(s.id);
+			return { revoked: others.length };
+		}
+	});
+};
+//#endregion
 //#region ../../src/api/users/schemas/realmConfigSchema.ts
-const realmConfigSchema = t.object({
+const realmConfigSchema = z.object({
 	settings: realmAuthSettingsAtom.schema,
-	realmName: t.string(),
-	authenticationMethods: t.array(authenticationProviderSchema),
-	captchaSiteKey: t.optional(t.string({ description: "Public site key for the captcha widget (when settings.captchaRequired is true)" })),
-	/**
-	* Federated (broker) social login. When present, the login UI renders one
-	* button per provider linking to `{brokerUrl}/auth/federated/start`.
-	*/
-	federated: t.optional(t.object({
-		brokerUrl: t.string({ description: "Broker origin that performs the OIDC dance." }),
-		providers: t.array(t.union([t.const("google"), t.const("apple")]), { description: "Federated providers to surface as login buttons." })
-	}))
+	realmName: z.string(),
+	authenticationMethods: z.array(authenticationProviderSchema),
+	captchaSiteKey: z.string().describe("Public site key for the captcha widget (when settings.captchaRequired is true)").optional()
 });
 //#endregion
 //#region ../../src/api/users/controllers/RealmController.ts
@@ -1504,7 +1605,7 @@ var RealmController = class {
 		path: `${this.url}/config`,
 		use: [$etag()],
 		schema: {
-			query: t.object({ realmName: t.optional(t.string()) }),
+			query: z.object({ realmName: z.string().optional() }),
 			response: realmConfigSchema
 		},
 		handler: async ({ query }) => {
@@ -1515,8 +1616,7 @@ var RealmController = class {
 				settings,
 				realmName,
 				authenticationMethods: this.serverAuthProvider.getAuthenticationProviders({ realmName }),
-				captchaSiteKey: settings.captchaRequired ? this.captchaProvider.getSiteKey() : void 0,
-				federated: realm.federated
+				captchaSiteKey: settings.captchaRequired ? this.captchaProvider.getSiteKey() : void 0
 			};
 		}
 	});
@@ -1524,9 +1624,9 @@ var RealmController = class {
 		group: this.group,
 		path: `${this.url}/check-username`,
 		schema: {
-			query: t.object({ realmName: t.optional(t.text()) }),
-			body: t.object({ username: t.text() }),
-			response: t.object({ available: t.boolean() })
+			query: z.object({ realmName: z.text().optional() }),
+			body: z.object({ username: z.text() }),
+			response: z.object({ available: z.boolean() })
 		},
 		handler: async ({ query, body }) => {
 			const realmName = query.realmName;
@@ -1542,21 +1642,18 @@ var RealmController = class {
 * Requires the intent ID from Phase 1, the verification code,
 * and the new password.
 */
-const completePasswordResetRequestSchema = t.object({
-	intentId: t.uuid({ description: "The intent ID from createPasswordResetIntent" }),
-	code: t.string({ description: "6-digit verification code sent via email" }),
-	newPassword: t.string({
-		minLength: 8,
-		description: "New password (minimum 8 characters)"
-	})
+const completePasswordResetRequestSchema = z.object({
+	intentId: z.uuid().describe("The intent ID from createPasswordResetIntent"),
+	code: z.string().describe("6-digit verification code sent via email"),
+	newPassword: z.string().min(8).describe("New password (minimum 8 characters)")
 });
 //#endregion
 //#region ../../src/api/users/schemas/completeRegistrationRequestSchema.ts
-const completeRegistrationRequestSchema = t.object({
-	intentId: t.uuid({ description: "The registration intent ID from the first phase" }),
-	emailCode: t.optional(t.string({ description: "Email verification code (if email verification required)" })),
-	phoneCode: t.optional(t.string({ description: "Phone verification code (if phone verification required)" })),
-	captchaToken: t.optional(t.string({ description: "Captcha token (if captcha required)" }))
+const completeRegistrationRequestSchema = z.object({
+	intentId: z.uuid().describe("The registration intent ID from the first phase"),
+	emailCode: z.string().describe("Email verification code (if email verification required)").optional(),
+	phoneCode: z.string().describe("Phone verification code (if phone verification required)").optional(),
+	captchaToken: z.string().describe("Captcha token (if captcha required)").optional()
 });
 //#endregion
 //#region ../../src/api/users/schemas/passwordResetIntentResponseSchema.ts
@@ -1566,9 +1663,9 @@ const completeRegistrationRequestSchema = t.object({
 * Contains the intent ID needed for Phase 2 completion,
 * along with expiration time.
 */
-const passwordResetIntentResponseSchema = t.object({
-	intentId: t.uuid({ description: "Unique identifier for this password reset intent" }),
-	expiresAt: t.datetime({ description: "ISO timestamp when this intent expires" })
+const passwordResetIntentResponseSchema = z.object({
+	intentId: z.uuid().describe("Unique identifier for this password reset intent"),
+	expiresAt: z.datetime().describe("ISO timestamp when this intent expires")
 });
 //#endregion
 //#region ../../src/api/users/schemas/registerQuerySchema.ts
@@ -1576,41 +1673,32 @@ const passwordResetIntentResponseSchema = t.object({
 * Schema for user registration query parameters.
 * Allows specifying a custom user realm.
 */
-const registerQuerySchema = t.object({ userRealmName: t.optional(t.text({ description: "The user realm to register the user in (defaults to 'default')" })) });
+const registerQuerySchema = z.object({ userRealmName: z.text({ description: "The user realm to register the user in (defaults to 'default')" }).optional() });
 //#endregion
 //#region ../../src/api/users/schemas/registerRequestSchema.ts
 /**
 * Schema for user registration request body.
 * Password is always required, other fields depend on realm settings.
 */
-const registerRequestSchema = t.object({
-	password: t.string({
-		minLength: 8,
-		description: "Password for the account"
-	}),
-	username: t.optional(t.string({
-		minLength: 3,
-		description: "Unique username for the account"
-	})),
-	email: t.optional(t.string({
-		format: "email",
-		description: "User's email address"
-	})),
-	phoneNumber: t.optional(t.string({ description: "User's phone number" })),
-	firstName: t.optional(t.string({ description: "User's first name" })),
-	lastName: t.optional(t.string({ description: "User's last name" })),
-	picture: t.optional(t.string({ description: "User's profile picture URL" })),
-	captchaToken: t.optional(t.string({ description: "Captcha response token (if captcha is required)" }))
+const registerRequestSchema = z.object({
+	password: z.string().min(8).describe("Password for the account"),
+	username: z.string().min(3).describe("Unique username for the account").optional(),
+	email: z.string().meta({ format: "email" }).describe("User's email address").optional(),
+	phoneNumber: z.string().describe("User's phone number").optional(),
+	firstName: z.string().describe("User's first name").optional(),
+	lastName: z.string().describe("User's last name").optional(),
+	picture: z.string().describe("User's profile picture URL").optional(),
+	captchaToken: z.string().describe("Captcha response token (if captcha is required)").optional()
 });
 //#endregion
 //#region ../../src/api/users/schemas/registrationIntentResponseSchema.ts
-const registrationIntentResponseSchema = t.object({
-	intentId: t.uuid({ description: "Unique identifier for the registration intent" }),
-	expectCaptcha: t.boolean({ description: "Whether captcha verification is required" }),
-	captchaSiteKey: t.optional(t.string({ description: "Public site key the client should render (when expectCaptcha is true)" })),
-	expectEmailVerification: t.boolean({ description: "Whether email verification is required" }),
-	expectPhoneVerification: t.boolean({ description: "Whether phone verification is required" }),
-	expiresAt: t.datetime({ description: "When the registration intent expires" })
+const registrationIntentResponseSchema = z.object({
+	intentId: z.uuid().describe("Unique identifier for the registration intent"),
+	expectCaptcha: z.boolean().describe("Whether captcha verification is required"),
+	captchaSiteKey: z.string().describe("Public site key the client should render (when expectCaptcha is true)").optional(),
+	expectEmailVerification: z.boolean().describe("Whether email verification is required"),
+	expectPhoneVerification: z.boolean().describe("Whether phone verification is required"),
+	expiresAt: z.datetime().describe("When the registration intent expires")
 });
 //#endregion
 //#region ../../src/api/users/services/CredentialService.ts
@@ -2005,6 +2093,7 @@ var RegistrationService = class {
 	dateTimeProvider = $inject(DateTimeProvider);
 	cryptoProvider = $inject(CryptoProvider);
 	verificationController = $client();
+	verificationService = $inject(VerificationService);
 	realmProvider = $inject(RealmProvider);
 	credentialService = $inject(CredentialService);
 	captchaProvider = $inject(CaptchaProvider);
@@ -2085,6 +2174,10 @@ var RegistrationService = class {
 			this.log.debug("Registration rejected: phone required", { userRealmName });
 			throw new BadRequestError("Phone number is required");
 		}
+		if (realmSettings?.firstNameLastName === "required" && (!body.firstName?.trim() || !body.lastName?.trim())) {
+			this.log.debug("Registration rejected: first/last name required", { userRealmName });
+			throw new BadRequestError("First name and last name are required");
+		}
 		if (realmSettings?.username === "email") {
 			if (!body.email) throw new BadRequestError("Email is required to derive a username from email");
 			const base = this.usernameSlugger.slug(body.email);
@@ -2257,9 +2350,9 @@ var RegistrationService = class {
 	*/
 	async sendEmailVerification(email, realmName) {
 		this.log.debug("Sending email verification code", { email });
-		const verification = await this.verificationController.requestVerificationCode({
-			params: { type: "code" },
-			body: { target: email }
+		const verification = await this.verificationService.createVerification({
+			type: "code",
+			target: email
 		});
 		await this.userNotifications(realmName).emailVerification.push({
 			contact: email,
@@ -2277,9 +2370,9 @@ var RegistrationService = class {
 	async sendPhoneVerification(phoneNumber, realmName) {
 		this.log.debug("Sending phone verification code", { phoneNumber });
 		try {
-			const verification = await this.verificationController.requestVerificationCode({
-				params: { type: "code" },
-				body: { target: phoneNumber }
+			const verification = await this.verificationService.createVerification({
+				type: "code",
+				target: phoneNumber
 			});
 			await this.userNotifications(realmName).phoneVerification.push({
 				contact: phoneNumber,
@@ -2380,8 +2473,8 @@ var UserController = class {
 		method: "POST",
 		path: `${this.url}/password-reset`,
 		schema: {
-			query: t.object({ userRealmName: t.optional(t.string()) }),
-			body: t.object({ email: t.email() }),
+			query: z.object({ userRealmName: z.string().optional() }),
+			body: z.object({ email: z.email() }),
 			response: passwordResetIntentResponseSchema
 		},
 		handler: ({ body, query }) => this.credentialService.createPasswordResetIntent(body.email, query.userRealmName)
@@ -2410,11 +2503,11 @@ var UserController = class {
 		path: "/users/password-reset/request",
 		group: this.group,
 		schema: {
-			query: t.object({ userRealmName: t.optional(t.string()) }),
-			body: t.object({ email: t.email() }),
-			response: t.object({
-				success: t.boolean(),
-				message: t.string()
+			query: z.object({ userRealmName: z.string().optional() }),
+			body: z.object({ email: z.email() }),
+			response: z.object({
+				success: z.boolean(),
+				message: z.string()
 			})
 		},
 		handler: async ({ body, query }) => {
@@ -2432,14 +2525,14 @@ var UserController = class {
 		path: "/users/password-reset/validate",
 		group: this.group,
 		schema: {
-			query: t.object({
-				email: t.email(),
-				token: t.string(),
-				userRealmName: t.optional(t.string())
+			query: z.object({
+				email: z.email(),
+				token: z.string(),
+				userRealmName: z.string().optional()
 			}),
-			response: t.object({
-				valid: t.boolean(),
-				email: t.optional(t.email())
+			response: z.object({
+				valid: z.boolean(),
+				email: z.email().optional()
 			})
 		},
 		handler: async ({ query }) => {
@@ -2460,15 +2553,15 @@ var UserController = class {
 		path: "/users/password-reset/reset",
 		group: this.group,
 		schema: {
-			query: t.object({ userRealmName: t.optional(t.string()) }),
-			body: t.object({
-				email: t.email(),
-				token: t.string(),
-				newPassword: t.string({ minLength: 8 })
+			query: z.object({ userRealmName: z.string().optional() }),
+			body: z.object({
+				email: z.email(),
+				token: z.string(),
+				newPassword: z.string().min(8)
 			}),
-			response: t.object({
-				success: t.boolean(),
-				message: t.string()
+			response: z.object({
+				success: z.boolean(),
+				message: z.string()
 			})
 		},
 		handler: async ({ body, query }) => {
@@ -2489,17 +2582,14 @@ var UserController = class {
 		path: "/users/email-verification/request",
 		group: this.group,
 		schema: {
-			query: t.object({
-				userRealmName: t.optional(t.string()),
-				method: t.optional(t.enum(["code", "link"], {
-					default: "code",
-					description: "Verification method: \"code\" sends a 6-digit code, \"link\" sends a clickable verification link. When using \"link\", configure verifyEmailUrl in realm settings."
-				}))
+			query: z.object({
+				userRealmName: z.string().optional(),
+				method: z.enum(["code", "link"]).describe("Verification method: \"code\" sends a 6-digit code, \"link\" sends a clickable verification link. When using \"link\", configure verifyEmailUrl in realm settings.").default("code").optional()
 			}),
-			body: t.object({ email: t.email() }),
-			response: t.object({
-				success: t.boolean(),
-				message: t.string()
+			body: z.object({ email: z.email() }),
+			response: z.object({
+				success: z.boolean(),
+				message: z.string()
 			})
 		},
 		handler: async ({ body, query }) => {
@@ -2519,14 +2609,14 @@ var UserController = class {
 		path: "/users/email-verification/verify",
 		group: this.group,
 		schema: {
-			query: t.object({ userRealmName: t.optional(t.string()) }),
-			body: t.object({
-				email: t.email(),
-				token: t.string()
+			query: z.object({ userRealmName: z.string().optional() }),
+			body: z.object({
+				email: z.email(),
+				token: z.string()
 			}),
-			response: t.object({
-				success: t.boolean(),
-				message: t.string()
+			response: z.object({
+				success: z.boolean(),
+				message: z.string()
 			})
 		},
 		handler: async ({ body, query }) => {
@@ -2545,11 +2635,11 @@ var UserController = class {
 		group: this.group,
 		use: [$secure()],
 		schema: {
-			query: t.object({
-				email: t.email(),
-				userRealmName: t.optional(t.string())
+			query: z.object({
+				email: z.email(),
+				userRealmName: z.string().optional()
 			}),
-			response: t.object({ verified: t.boolean() })
+			response: z.object({ verified: z.boolean() })
 		},
 		handler: async ({ query }) => {
 			return { verified: await this.userService.isEmailVerified(query.email, query.userRealmName) };
@@ -3235,6 +3325,7 @@ const $realm = (options = {}) => {
 		...options.issuer,
 		name,
 		secret: options.secret ?? securityProvider.secretKey,
+		signing: options.signing,
 		resolvers: customResolvers,
 		roles: options.issuer?.roles ?? [{
 			name: "admin",
@@ -3283,7 +3374,10 @@ const $realm = (options = {}) => {
 				id: user.id,
 				roles: user.roles,
 				name: composedName,
+				firstName: user.firstName,
+				lastName: user.lastName,
 				email: user.email,
+				emailVerified: user.emailVerified,
 				username: user.username,
 				picture: user.picture,
 				organization: user.organizationId ?? void 0,
@@ -3322,14 +3416,6 @@ const $realm = (options = {}) => {
 		if (identities.microsoft) auth.microsoft = $authMicrosoft(realm);
 		if (identities.franceconnect) auth.franceconnect = $authFranceConnect(realm);
 		alepha.with(() => auth);
-		if (identities.federated) {
-			const fed = $authFederationClient({
-				realm,
-				brokerUrl: identities.federated.brokerUrl,
-				publicKeyPem: identities.federated.publicKey
-			});
-			alepha.with(() => ({ federationCallback: fed.callback }));
-		}
 	}
 	if (features.parameters) {
 		alepha.with(AlephaApiParameters);
@@ -3346,57 +3432,34 @@ const $realm = (options = {}) => {
 };
 //#endregion
 //#region ../../src/api/users/schemas/loginSchema.ts
-const loginSchema = t.object({
-	username: t.text({
+const loginSchema = z.object({
+	username: z.text({
 		minLength: 3,
 		maxLength: 100,
 		description: "Username or email address for login"
 	}),
-	password: t.text({
+	password: z.text({
 		minLength: 8,
 		description: "User password"
 	})
 });
 //#endregion
 //#region ../../src/api/users/schemas/registerSchema.ts
-const registerSchema = t.object({
-	username: t.string({
-		minLength: 3,
-		maxLength: 20,
-		pattern: /^[a-zA-Z0-9_]+$/,
-		description: "Username for the new account"
-	}),
-	email: t.email({ description: "Email address for the new account" }),
-	password: t.string({
-		minLength: 8,
-		description: "Password for the new account"
-	}),
-	confirmPassword: t.string({
-		minLength: 8,
-		description: "Confirmation of the password"
-	}),
-	firstName: t.optional(t.string({
-		maxLength: 100,
-		description: "User's first name"
-	})),
-	lastName: t.optional(t.string({
-		maxLength: 100,
-		description: "User's last name"
-	}))
+const registerSchema = z.object({
+	username: z.string().min(3).max(20).regex(/^[a-zA-Z0-9_]+$/).describe("Username for the new account"),
+	email: z.email().describe("Email address for the new account"),
+	password: z.string().min(8).describe("Password for the new account"),
+	confirmPassword: z.string().min(8).describe("Confirmation of the password"),
+	firstName: z.string().max(100).describe("User's first name").optional(),
+	lastName: z.string().max(100).describe("User's last name").optional()
 });
 //#endregion
 //#region ../../src/api/users/schemas/resetPasswordSchema.ts
-const resetPasswordRequestSchema = t.object({ email: t.email({ description: "Email address to send password reset link" }) });
-const resetPasswordSchema = t.object({
-	token: t.string({ description: "Password reset token from email" }),
-	password: t.string({
-		minLength: 8,
-		description: "New password"
-	}),
-	confirmPassword: t.string({
-		minLength: 8,
-		description: "Confirmation of the new password"
-	})
+const resetPasswordRequestSchema = z.object({ email: z.email().describe("Email address to send password reset link") });
+const resetPasswordSchema = z.object({
+	token: z.string().describe("Password reset token from email"),
+	password: z.string().min(8).describe("New password"),
+	confirmPassword: z.string().min(8).describe("Confirmation of the new password")
 });
 //#endregion
 //#region ../../src/api/users/index.ts
@@ -3429,6 +3492,7 @@ const AlephaApiUsers = $module({
 		UserController,
 		AdminUserController,
 		AdminSessionController,
+		MySessionController,
 		AdminIdentityController,
 		RealmController
 	],
@@ -3441,6 +3505,6 @@ const AlephaApiUsers = $module({
 	]
 });
 //#endregion
-export { $realm, AdminIdentityController, AdminSessionController, AdminUserController, AlephaApiUsers, CredentialService, DEFAULT_USER_REALM_NAME, IdentityService, RealmController, RealmProvider, RegistrationService, SessionAudits, SessionCrudService, SessionService, UserAudits, UserBuckets, UserController, UserJobs, UserNotifications, UserService, UsernameSlugger, completePasswordResetRequestSchema, completeRegistrationRequestSchema, createUserSchema, identities, identityQuerySchema, identityResourceSchema, loginSchema, passwordResetIntentResponseSchema, realmAuthSettingsAtom, realmConfigSchema, registerSchema, registrationIntentResponseSchema, resetPasswordRequestSchema, resetPasswordSchema, sessionQuerySchema, sessionResourceSchema, sessionUserSummarySchema, sessions, updateUserSchema, userQuerySchema, userResourceSchema, users };
+export { $realm, AdminIdentityController, AdminSessionController, AdminUserController, AlephaApiUsers, CredentialService, DEFAULT_USER_REALM_NAME, IdentityService, MySessionController, RealmController, RealmProvider, RegistrationService, SessionAudits, SessionCrudService, SessionService, UserAudits, UserBuckets, UserController, UserJobs, UserNotifications, UserService, UsernameSlugger, completePasswordResetRequestSchema, completeRegistrationRequestSchema, createUserSchema, identities, identityQuerySchema, identityResourceSchema, loginSchema, mySessionSchema, passwordResetIntentResponseSchema, realmAuthSettingsAtom, realmConfigSchema, registerSchema, registrationIntentResponseSchema, resetPasswordRequestSchema, resetPasswordSchema, sessionQuerySchema, sessionResourceSchema, sessionUserSummarySchema, sessions, updateUserSchema, userQuerySchema, userResourceSchema, users };
 
 //# sourceMappingURL=index.js.map