@appxdigital/appx-core 0.1.124 → 0.1.125-beta.0

package/CHANGELOG.md

@@ -14,6 +14,31 @@ This project follows the `MAJOR.MINOR.PATCH` scheme in `package.json`.
 
 ---
 
+## [0.1.125] — 2026-07-29
+
+A string (uuid/cuid) `User.id` is now supported end-to-end, and the CLI's `create` gains a non-interactive mode plus far better failure diagnostics.
+
+### String `User.id` support (library)
+
+The framework was already id-type-agnostic in generic CRUD (it reads the PK type from the schema before coercing), but the auth module hardcoded `Int` in a few places — most importantly `SessionSerializer.deserializeUser`, which did `Number(userId)`: `NaN` for a uuid, so **session auth failed on every request** for string-id projects. All of it is fixed via one shared `coerceId(delegate, id)` helper (a `String` PK passes through, anything else is number-coerced):
+
+- `SessionSerializer.deserializeUser` — was `Number(userId)`.
+- `GET /auth/sessions/:userId` — was `parseInt(userId, 10)`, which silently truncates a uuid starting with digits (`'3f2a…'` → `3`, the **wrong user's sessions**).
+- `getSessionsByUserId` / `revokeRefreshTokensForUser` accept `UserId` (`string | number`, exported); the `express-session` `SessionData.userId` augmentation is widened the same way.
+- `coerceId` and `UserId` are exported from the package root for consumer overrides.
+
+**Using a string id is a schema-only change** — set `User.id String @default(uuid())` and switch `Session.userId` / `UserRefreshToken.userId` to `String` with it. No code overrides needed. See the new section in [`docs/authentication.md`](./docs/authentication.md#using-a-string-uuid--cuid-userid). Int-keyed projects are unaffected (drop-in).
+
+### CLI (`@appxdigital/appx-core-cli`)
+
+- **Non-interactive `create`.** `appx-core create --yes` (or any value flag) skips the wizard — for CI, scripts, and non-TTY contexts. Unset values take the wizard's defaults; the database check fails fast with the reason instead of re-prompting. Flags: `--name`, `--db-provider`, `--db-host`, `--db-port`, `--db-user`, `--db-password`, `--db-name`, `--show-output`.
+- **`create` failures now show the real error.** Hidden commands piped their output to nowhere, so an init failure surfaced as an opaque stack trace with `stdout/stderr: null`; the tail of the failing command's output is now printed.
+- **Prisma is preflighted and invoked from the project.** After `npm install`, `create` verifies the project's own `node_modules/.bin/prisma` exists (an `~/.npmrc` with `legacy-peer-deps`/`omit=peer` silently skips the peer deps that carry it) and runs every migrate step via that explicit path — never a `PATH` lookup.
+
+Drop-in: no changes required in existing projects.
+
+---
+
 ## [0.1.124] — 2026-07-23
 
 ### Fixed

package/PRERELEASES.md

@@ -31,6 +31,26 @@ Prereleases are excluded from normal semver range resolution, so a project on
 
 ---
 
+## [0.1.125-beta.0] — library
+
+Prerelease of the string-`User.id` support that ships in `[0.1.125]` — see
+[`CHANGELOG.md`](./CHANGELOG.md#01125--2026-07-29) for the full notes. Same
+content as the production cut; published to `beta` so a uuid-keyed project can
+validate before promoting.
+
+- Session auth, `GET /auth/sessions/:userId`, and refresh-token revocation now
+  coerce ids to the `User.id` type from your schema (`coerceId`, exported).
+- `UserId` (`string | number`) exported; `SessionData.userId` widened.
+- Int-keyed projects: drop-in, no changes.
+
+## [cli-1.0.25-beta.0] — CLI
+
+Prerelease of the CLI changes in `[0.1.125]`'s CLI section: non-interactive
+`create --yes` (+ per-answer flags), failure output no longer swallowed, prisma
+preflighted and run from the project's own `node_modules/.bin`. Also includes
+the self-update mechanism and channel-matched library pinning shipped in
+cli-1.0.23.
+
 ## [0.1.121-beta.16] — unreleased
 
 **Fix — `AuthModule.forRoot({ controller: false })` now actually omits the

package/README.md

@@ -147,6 +147,17 @@ appx-core create
 cd <your-project>
 ```
 
+**Non-interactive (CI / scripts).** Passing `--yes` — or any value flag — skips the wizard entirely; anything not given uses the wizard's default. No prompt is ever opened, so it's safe without a TTY. The database check still runs and fails fast with the reason instead of re-prompting.
+
+```bash
+appx-core create --yes \
+  --name my-app \
+  --db-provider mysql --db-host 127.0.0.1 --db-port 3306 \
+  --db-user root --db-password secret --db-name my_app_db
+```
+
+Flags: `--name`, `--db-provider mysql|postgresql`, `--db-host`, `--db-port`, `--db-user`, `--db-password`, `--db-name`, `--show-output`. File upload isn't configured on this path — run `appx-core setup:fileupload` inside the project afterwards.
+
 ### 3) Configure Environment
 
 `appx-core create` **already writes a `.env`** at the project root, with secure

package/dist/common/interfaces/user.interface.d.ts

@@ -3,6 +3,18 @@ export interface UserCreateInput {
     password: string;
     name?: string;
 }
+/**
+ * The type of a user's primary key as accepted at API boundaries. `User.id` is a
+ * `String` (uuid/cuid) or an `Int` (autoincrement) depending on the consumer's
+ * schema, so anything that *accepts* a user id (route params, service methods,
+ * session data) should accept both. Framework code coerces to the concrete type
+ * at the data-access boundary via `coerceId`.
+ *
+ * Note `User.id` below stays `string`: the authenticated principal is treated as
+ * an opaque string id throughout auth/session, and widening it here would force
+ * casts in consumer override code. Use `UserId` for *inputs*, not the principal.
+ */
+export type UserId = string | number;
 export interface User {
     id: string;
     email: string;

package/dist/common/interfaces/user.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.interface.d.ts","sourceRoot":"","sources":["../../../src/common/interfaces/user.interface.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,eAAe;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,IAAI;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B"}
+{"version":3,"file":"user.interface.d.ts","sourceRoot":"","sources":["../../../src/common/interfaces/user.interface.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,eAAe;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAErC,MAAM,WAAW,IAAI;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B"}

package/dist/common/types.d.ts

@@ -15,7 +15,7 @@ declare global {
 }
 declare module 'express-session' {
     interface SessionData {
-        userId: number;
+        userId: string | number;
     }
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/common/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/common/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAC5C,OAAO,iBAAiB,CAAC;AAEzB,MAAM,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;AAEhD,OAAO,CAAC,MAAM,CAAC;IACX,UAAU,OAAO,CAAC;QACd,UAAU,OAAO;YACb,MAAM,CAAC,EAAE,YAAY,CAAC;YAEtB,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,IAAI,CAAC;YAEjD,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,IAAI,CAAC;YAE3C,IAAI,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;SAC3B;QAED,UAAU,IAAK,SAAQ,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;SACzC;KACJ;CACJ;AAED,OAAO,QAAQ,iBAAiB,CAAC;IAC7B,UAAU,WAAW;QACjB,MAAM,EAAE,MAAM,CAAC;KAClB;CACJ"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/common/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAC5C,OAAO,iBAAiB,CAAC;AAEzB,MAAM,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;AAEhD,OAAO,CAAC,MAAM,CAAC;IACX,UAAU,OAAO,CAAC;QACd,UAAU,OAAO;YACb,MAAM,CAAC,EAAE,YAAY,CAAC;YAEtB,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,IAAI,CAAC;YAEjD,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,GAAG,IAAI,CAAC;YAE3C,IAAI,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;SAC3B;QAED,UAAU,IAAK,SAAQ,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;SACzC;KACJ;CACJ;AAED,OAAO,QAAQ,iBAAiB,CAAC;IAC7B,UAAU,WAAW;QAIjB,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;KAC3B;CACJ"}

package/dist/common/utils/coerce-id.util.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The shape we need off a Prisma model delegate: its runtime field metadata.
+ * A delegate (e.g. `prisma.user`) exposes `fields.id.typeName` — the scalar
+ * type name of the primary key ('String', 'Int', 'BigInt', …). This passes
+ * through the PrismaService proxy unchanged (the proxy only wraps method calls).
+ */
+export interface IdBearingDelegate {
+    fields?: {
+        id?: {
+            typeName?: string;
+        };
+    };
+}
+/**
+ * Coerce an id — as it arrives over HTTP (route params) or from a session
+ * (always a string) — to the runtime type the model's primary key expects.
+ *
+ * String primary keys (uuid/cuid) pass through unchanged; every other PK type
+ * is converted with `Number()`, matching Prisma's expectation for `Int` ids.
+ * The type is read from the delegate's own field metadata, so this is correct
+ * whether `User.id` is `Int @default(autoincrement())` or `String @default(uuid())`.
+ *
+ * This is the single source of truth for id coercion — generic CRUD
+ * (`CoreService`) and the auth module both call it, so a string-keyed model
+ * behaves consistently everywhere. Do NOT reintroduce `Number(id)` / `parseInt`
+ * at call sites: `Number('3f2a…')` is `NaN` and `parseInt('3f2a…', 10)` is `3`,
+ * i.e. a silent wrong-row lookup for UUID ids.
+ */
+export declare function coerceId(delegate: IdBearingDelegate, id: string | number): string | number;
+//# sourceMappingURL=coerce-id.util.d.ts.map

package/dist/common/utils/coerce-id.util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coerce-id.util.d.ts","sourceRoot":"","sources":["../../../src/common/utils/coerce-id.util.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAC9B,MAAM,CAAC,EAAE;QAAC,EAAE,CAAC,EAAE;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAC,CAAA;KAAC,CAAC;CACvC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAM1F"}

package/dist/common/utils/coerce-id.util.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.coerceId = void 0;
+const common_1 = require("@nestjs/common");
+/**
+ * Coerce an id — as it arrives over HTTP (route params) or from a session
+ * (always a string) — to the runtime type the model's primary key expects.
+ *
+ * String primary keys (uuid/cuid) pass through unchanged; every other PK type
+ * is converted with `Number()`, matching Prisma's expectation for `Int` ids.
+ * The type is read from the delegate's own field metadata, so this is correct
+ * whether `User.id` is `Int @default(autoincrement())` or `String @default(uuid())`.
+ *
+ * This is the single source of truth for id coercion — generic CRUD
+ * (`CoreService`) and the auth module both call it, so a string-keyed model
+ * behaves consistently everywhere. Do NOT reintroduce `Number(id)` / `parseInt`
+ * at call sites: `Number('3f2a…')` is `NaN` and `parseInt('3f2a…', 10)` is `3`,
+ * i.e. a silent wrong-row lookup for UUID ids.
+ */
+function coerceId(delegate, id) {
+    const idField = delegate?.fields?.id;
+    if (!idField) {
+        throw new common_1.BadRequestException(`Model does not have an 'id' field`);
+    }
+    return idField.typeName === 'String' ? String(id) : Number(id);
+}
+exports.coerceId = coerceId;

package/dist/config/generate-session-schema.js

@@ -39,6 +39,22 @@ const doesSessionModelExist = () => {
     }
     return false;
 };
+/**
+ * Read the type of `User.id` from schema.prisma so the generated `Session.userId`
+ * foreign key matches it. A consumer who changes `User.id` to `String` (uuid/cuid)
+ * must not have an `Int` FK written back by tooling. Defaults to `Int` when the
+ * User model or its id can't be found.
+ */
+const getUserIdType = () => {
+    if (!fs.existsSync(schemaPath))
+        return 'Int';
+    const schemaContent = fs.readFileSync(schemaPath, 'utf-8');
+    const userModel = schemaContent.match(/model\s+User\s*{[\s\S]*?}/i);
+    if (!userModel)
+        return 'Int';
+    const idField = userModel[0].match(/^\s*id\s+(\w+)/m);
+    return idField ? idField[1] : 'Int';
+};
 /**
  * Ensure that the session schema exists if it is not already defined in schema.prisma
  */
@@ -49,13 +65,14 @@ const ensureSessionSchemaExists = () => {
     }
     if (!fs.existsSync(sessionSchemaPath)) {
         console.log('Session schema not found in session.prisma. Creating it...');
+        const userIdType = getUserIdType();
         const sessionSchemaContent = `
       model Session {
         id        String   @id
         sid       String   @unique
         data      String
         expiresAt DateTime
-        userId    Int?
+        userId    ${userIdType}?
       }
     `;
         fs.writeFileSync(sessionSchemaPath, sessionSchemaContent);

package/dist/index.d.ts

@@ -24,6 +24,8 @@ export * from './common/guards/user-population.guard';
 export * from './modules/common.module';
 export * from './common/interceptors/prisma.interceptor';
 export * from './common/decorators/scalar-field.decorator';
+export * from './common/utils/coerce-id.util';
+export * from './common/interfaces/user.interface';
 export * from './common/config/permissionsConfigTypes';
 export * from './common/config/adminConfigType';
 export * from './common/config/permissions.config.provider';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAI3C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qCAAqC,CAAC;AACpD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AACnD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,sCAAsC,CAAC;AACrD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uCAAuC,CAAC;AACtD,cAAc,yBAAyB,CAAC;AACxC,cAAc,0CAA0C,CAAC;AACzD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,wCAAwC,CAAC;AACvD,cAAc,iCAAiC,CAAC;AAChD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,oBAAoB,CAAC;AACnC,cAAc,mCAAmC,CAAC;AAClD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,wCAAwC,CAAC;AACvD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,oCAAoC,CAAC;AACnD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qCAAqC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAI3C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qCAAqC,CAAC;AACpD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AACnD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,sCAAsC,CAAC;AACrD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uCAAuC,CAAC;AACtD,cAAc,yBAAyB,CAAC;AACxC,cAAc,0CAA0C,CAAC;AACzD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,+BAA+B,CAAC;AAC9C,cAAc,oCAAoC,CAAC;AACnD,cAAc,wCAAwC,CAAC;AACvD,cAAc,iCAAiC,CAAC;AAChD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,oBAAoB,CAAC;AACnC,cAAc,mCAAmC,CAAC;AAClD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,wCAAwC,CAAC;AACvD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,oCAAoC,CAAC;AACnD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qCAAqC,CAAC"}

package/dist/index.js

@@ -43,6 +43,8 @@ __exportStar(require("./common/guards/user-population.guard"), exports);
 __exportStar(require("./modules/common.module"), exports);
 __exportStar(require("./common/interceptors/prisma.interceptor"), exports);
 __exportStar(require("./common/decorators/scalar-field.decorator"), exports);
+__exportStar(require("./common/utils/coerce-id.util"), exports);
+__exportStar(require("./common/interfaces/user.interface"), exports);
 __exportStar(require("./common/config/permissionsConfigTypes"), exports);
 __exportStar(require("./common/config/adminConfigType"), exports);
 __exportStar(require("./common/config/permissions.config.provider"), exports);

package/dist/modules/auth/auth.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.controller.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.controller.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,WAAW,EAAC,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAC,WAAW,EAAC,MAAM,oBAAoB,CAAC;AAG/C,OAAO,EAAC,OAAO,EAAE,QAAQ,EAAC,MAAM,SAAS,CAAC;AAI1C,qBACa,cAAc;IACX,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW;gBAAxB,WAAW,EAAE,WAAW;IAGjD,QAAQ,CAAS,WAAW,EAAE,WAAW;;;;IAMzC,KAAK,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ;IAW/C,MAAM,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBhE,EAAE,CAAQ,GAAG,EAAE,OAAO;;;IAQtB,iBAAiB,CAAQ,GAAG,EAAE,OAAO;;;IAOrC,gBAAgB,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ;IAM1D,cAAc,CAAkB,MAAM,EAAE,MAAM,EAAS,GAAG,EAAE,OAAO;;;IAanE,oBAAoB,CACF,SAAS,EAAE,MAAM,EAC9B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ;IAgBlB,QAAQ,CAAQ,GAAG,EAAE,OAAO;;;;;IAM5B,aAAa,CAAQ,GAAG,EAAE,OAAO;;;;IAOjC,SAAS,CAAQ,GAAG,EAAE,OAAO;;;CAQtC"}
+{"version":3,"file":"auth.controller.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.controller.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,WAAW,EAAC,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAC,WAAW,EAAC,MAAM,oBAAoB,CAAC;AAG/C,OAAO,EAAC,OAAO,EAAE,QAAQ,EAAC,MAAM,SAAS,CAAC;AAI1C,qBACa,cAAc;IACX,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW;gBAAxB,WAAW,EAAE,WAAW;IAGjD,QAAQ,CAAS,WAAW,EAAE,WAAW;;;;IAMzC,KAAK,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ;IAW/C,MAAM,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBhE,EAAE,CAAQ,GAAG,EAAE,OAAO;;;IAQtB,iBAAiB,CAAQ,GAAG,EAAE,OAAO;;;IAOrC,gBAAgB,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ;IAM1D,cAAc,CAAkB,MAAM,EAAE,MAAM,EAAS,GAAG,EAAE,OAAO;;;IAgBnE,oBAAoB,CACF,SAAS,EAAE,MAAM,EAC9B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ;IAgBlB,QAAQ,CAAQ,GAAG,EAAE,OAAO;;;;;IAM5B,aAAa,CAAQ,GAAG,EAAE,OAAO;;;;IAOjC,SAAS,CAAQ,GAAG,EAAE,OAAO;;;CAQtC"}

package/dist/modules/auth/auth.controller.js

@@ -70,7 +70,10 @@ let AuthController = exports.AuthController = class AuthController {
         if (req.user?.role !== 'ADMIN') {
             throw new common_1.ForbiddenException('Access denied.');
         }
-        const sessions = await this.authService.getSessionsByUserId(parseInt(userId, 10));
+        // Pass the raw param through; the service coerces it to the User PK's
+        // actual type. `parseInt('3f2a…', 10)` was `3` — a silent wrong-user
+        // lookup for uuid ids — while `parseInt('f3a2…')` was `NaN`.
+        const sessions = await this.authService.getSessionsByUserId(userId);
         return { sessions };
     }
     async closeSpecificSession(sessionId, req, res) {

package/dist/modules/auth/auth.service.d.ts

@@ -4,6 +4,7 @@ import { PrismaService } from '../../prisma/prisma.service';
 import { ConfigService } from '@nestjs/config';
 import { Request, Response } from 'express';
 import { JwtService } from "@nestjs/jwt";
+import { UserId } from '../../common/interfaces/user.interface';
 export declare class AuthService {
     protected readonly userService: UserService;
     protected readonly prisma: PrismaService;
@@ -24,7 +25,7 @@ export declare class AuthService {
     getCurrentUser(req: Request): Promise<any>;
     getActiveSessions(req: Request): Promise<any>;
     closeAllUserSessions(req: Request, res: Response): Promise<void>;
-    getSessionsByUserId(userId: number): Promise<any>;
+    getSessionsByUserId(userId: UserId): Promise<any>;
     closeSpecificSession(sessionId: string): Promise<boolean>;
     validateJwtPayload(payload: any): Promise<any>;
     private generateTokens;
@@ -38,6 +39,6 @@ export declare class AuthService {
         refresh_token: string;
         user: any;
     }>;
-    revokeRefreshTokensForUser(userId: number): Promise<void>;
+    revokeRefreshTokensForUser(userId: UserId): Promise<void>;
 }
 //# sourceMappingURL=auth.service.d.ts.map

package/dist/modules/auth/auth.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,WAAW,EAAC,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAC,WAAW,EAAC,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAC,aAAa,EAAC,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAC,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAC,OAAO,EAAE,QAAQ,EAAC,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAC,UAAU,EAAiB,MAAM,aAAa,CAAC;AAKvD,qBACa,WAAW;IAIhB,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW;IAC3C,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,aAAa;IACxC,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU;IACzC,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,aAAa;IANnD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;gBAGpB,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,aAAa,EACrB,UAAU,EAAE,UAAU,EACtB,aAAa,EAAE,aAAa;IAK7C,QAAQ,CAAC,WAAW,EAAE,WAAW;;;;IA2BjC,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,GAAG,CAAA;KAAC,CAAC;IA8B1D,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBlD,YAAY,CACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GACtB,OAAO,CAAC,GAAG,CAAC;IAuBT,cAAc,CAAC,GAAG,EAAE,OAAO;IAW3B,iBAAiB,CAAC,GAAG,EAAE,OAAO;IAW9B,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ;IA0BhD,mBAAmB,CAAC,MAAM,EAAE,MAAM;IAMlC,oBAAoB,CAAC,SAAS,EAAE,MAAM;IAOtC,kBAAkB,CAAC,OAAO,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;YActC,cAAc;IAkCtB,aAAa,CAAC,yBAAyB,EAAE,GAAG,GAAG,OAAO,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAC,CAAC;IA4B3G,OAAO,CAAC,WAAW;IAUb,QAAQ,CAAC,iBAAiB,EAAE,GAAG,GAAG,OAAO,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,GAAG,CAAA;KAAC,CAAC;IAcnG,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAUlE"}
+{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,WAAW,EAAC,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAC,WAAW,EAAC,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAC,aAAa,EAAC,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAC,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAC,OAAO,EAAE,QAAQ,EAAC,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAC,UAAU,EAAiB,MAAM,aAAa,CAAC;AAGvD,OAAO,EAAC,MAAM,EAAC,MAAM,wCAAwC,CAAC;AAI9D,qBACa,WAAW;IAIhB,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW;IAC3C,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,aAAa;IACxC,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU;IACzC,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,aAAa;IANnD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;gBAGpB,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,aAAa,EACrB,UAAU,EAAE,UAAU,EACtB,aAAa,EAAE,aAAa;IAK7C,QAAQ,CAAC,WAAW,EAAE,WAAW;;;;IA2BjC,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,GAAG,CAAA;KAAC,CAAC;IA8B1D,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBlD,YAAY,CACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GACtB,OAAO,CAAC,GAAG,CAAC;IAuBT,cAAc,CAAC,GAAG,EAAE,OAAO;IAW3B,iBAAiB,CAAC,GAAG,EAAE,OAAO;IAW9B,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ;IA0BhD,mBAAmB,CAAC,MAAM,EAAE,MAAM;IAMlC,oBAAoB,CAAC,SAAS,EAAE,MAAM;IAOtC,kBAAkB,CAAC,OAAO,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;YActC,cAAc;IAkCtB,aAAa,CAAC,yBAAyB,EAAE,GAAG,GAAG,OAAO,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAC,CAAC;IA4B3G,OAAO,CAAC,WAAW;IAUb,QAAQ,CAAC,iBAAiB,EAAE,GAAG,GAAG,OAAO,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,GAAG,CAAA;KAAC,CAAC;IAcnG,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAUlE"}

package/dist/modules/auth/auth.service.js

@@ -40,6 +40,7 @@ const prisma_service_1 = require("../../prisma/prisma.service");
 const config_1 = require("@nestjs/config");
 const jwt_1 = require("@nestjs/jwt");
 const cuid2_1 = require("@paralleldrive/cuid2");
+const coerce_id_util_1 = require("../../common/utils/coerce-id.util");
 let AuthService = exports.AuthService = class AuthService {
     constructor(userService, prisma, jwtService, configService) {
         this.userService = userService;
@@ -172,7 +173,7 @@ let AuthService = exports.AuthService = class AuthService {
     }
     async getSessionsByUserId(userId) {
         return this.prisma.session.findMany({
-            where: { userId, expiresAt: { gte: new Date() } },
+            where: { userId: (0, coerce_id_util_1.coerceId)(this.prisma.user, userId), expiresAt: { gte: new Date() } },
         });
     }
     async closeSpecificSession(sessionId) {
@@ -272,7 +273,7 @@ let AuthService = exports.AuthService = class AuthService {
     }
     async revokeRefreshTokensForUser(userId) {
         await this.prisma.userRefreshToken.updateMany({
-            where: { userId: userId, revokedAt: null },
+            where: { userId: (0, coerce_id_util_1.coerceId)(this.prisma.user, userId), revokedAt: null },
             data: { revokedAt: new Date() },
         }, 
         // @ts-ignore

package/dist/modules/auth/session/session-serializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-serializer.d.ts","sourceRoot":"","sources":["../../../../src/modules/auth/session/session-serializer.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,kBAAkB,EAAC,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAC,aAAa,EAAC,MAAM,gCAAgC,CAAC;AAE7D,qBACa,iBAAkB,SAAQ,kBAAkB;IACzC,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,aAAa;IAIzC,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ;IAIjC,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ;CAqBvD"}
+{"version":3,"file":"session-serializer.d.ts","sourceRoot":"","sources":["../../../../src/modules/auth/session/session-serializer.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,kBAAkB,EAAC,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAC,aAAa,EAAC,MAAM,gCAAgC,CAAC;AAG7D,qBACa,iBAAkB,SAAQ,kBAAkB;IACzC,OAAO,CAAC,MAAM;gBAAN,MAAM,EAAE,aAAa;IAIzC,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ;IAIjC,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ;CAwBvD"}

package/dist/modules/auth/session/session-serializer.js

@@ -13,6 +13,7 @@ exports.SessionSerializer = void 0;
 const common_1 = require("@nestjs/common");
 const passport_1 = require("@nestjs/passport");
 const prisma_service_1 = require("../../../prisma/prisma.service");
+const coerce_id_util_1 = require("../../../common/utils/coerce-id.util");
 let SessionSerializer = exports.SessionSerializer = class SessionSerializer extends passport_1.PassportSerializer {
     constructor(prisma) {
         super();
@@ -27,7 +28,10 @@ let SessionSerializer = exports.SessionSerializer = class SessionSerializer exte
         }
         try {
             const user = await this.prisma.user.findFirstOrThrow({
-                where: { id: Number(userId) },
+                // Coerce to the User PK's actual type. `Number(userId)` here made
+                // session auth fail closed for string (uuid/cuid) ids — Number of
+                // a uuid is NaN, so findFirstOrThrow threw on every request.
+                where: { id: (0, coerce_id_util_1.coerceId)(this.prisma.user, userId) },
                 select: {
                     id: true,
                     role: true,

package/dist/modules/core/core.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core.service.d.ts","sourceRoot":"","sources":["../../../src/modules/core/core.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAEjD,qBACa,WAAW,CAAC,CAAC;IAElB,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC;gBAA9B,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC;IAIrD;;;;OAIG;IACG,OAAO,CAAC,MAAM,GAAE,GAAQ,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAQ7C;;;;;OAKG;IACG,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,GAAE,GAAQ,GAAG,OAAO,CAAC,CAAC,CAAC;IAYxD;;;;OAIG;IACG,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAUtC;;;;OAIG;IACG,MAAM,CAAC,IAAI,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC;IAQnC;;;;;OAKG;IACG,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC;IAW5D;;;;OAIG;IACG,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAajD,OAAO,CAAC,yBAAyB;CAUpC"}
+{"version":3,"file":"core.service.d.ts","sourceRoot":"","sources":["../../../src/modules/core/core.service.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAEjD,qBACa,WAAW,CAAC,CAAC;IAElB,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC;gBAA9B,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC;IAIrD;;;;OAIG;IACG,OAAO,CAAC,MAAM,GAAE,GAAQ,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAQ7C;;;;;OAKG;IACG,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,GAAE,GAAQ,GAAG,OAAO,CAAC,CAAC,CAAC;IAYxD;;;;OAIG;IACG,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAUtC;;;;OAIG;IACG,MAAM,CAAC,IAAI,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC;IAQnC;;;;;OAKG;IACG,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC;IAW5D;;;;OAIG;IACG,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAejD,OAAO,CAAC,yBAAyB;CAGpC"}

package/dist/modules/core/core.service.js

@@ -12,6 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CoreService = void 0;
 const common_1 = require("@nestjs/common");
 const error_handler_1 = require("../../common/utils/error-handler");
+const coerce_id_util_1 = require("../../common/utils/coerce-id.util");
 let CoreService = exports.CoreService = class CoreService {
     constructor(modelDelegate) {
         this.modelDelegate = modelDelegate;
@@ -105,17 +106,12 @@ let CoreService = exports.CoreService = class CoreService {
         }
     }
     /*
-      * Generates a 'where' clause based on the model's ID field. Depending on the type of the ID field, it may convert the ID to a number.
+      * Generates a 'where' clause based on the model's ID field. Coercion to the
+      * PK's concrete type (String passes through, otherwise Number) is centralised
+      * in `coerceId` and shared with the auth module.
      */
     _generateWhereFromIdField(id) {
-        let idField = this.modelDelegate.fields.id;
-        if (!idField) {
-            throw new common_1.BadRequestException(`Model does not have an 'id' field`);
-        }
-        if (idField.typeName != "String") {
-            id = Number(id);
-        }
-        return { id: id };
+        return { id: (0, coerce_id_util_1.coerceId)(this.modelDelegate, id) };
     }
 };
 exports.CoreService = CoreService = __decorate([

package/docs/authentication.md

@@ -218,3 +218,43 @@ exported from `@appxdigital/appx-core`. To override inner functionality:
 
 If a class you need to extend isn't exported, that's a framework gap — open it
 rather than deep-importing from `dist/`.
+
+## Using a string (UUID / cuid) `User.id`
+
+The scaffold defaults to `User.id Int @default(autoincrement())`, but a **string
+primary key is fully supported** — teams migrating in from Supabase, Firebase,
+Hasura, etc. usually keep their existing UUIDs. The framework reads the id's
+type from your schema and coerces ids to it at the data-access boundary
+(`coerceId`), so generic CRUD, sessions, and the auth module all handle a string
+`User.id` without any override.
+
+To use it, change the primary key **and the two foreign keys that reference it**
+together — they must match:
+
+```prisma
+model User {
+  id String @id @default(uuid())   // or @default(cuid())
+  // …
+}
+
+model Session {
+  // …
+  userId String?                    // was Int?
+}
+
+model UserRefreshToken {
+  // …
+  userId String                     // was Int
+  user   User @relation(fields: [userId], references: [id], onDelete: Cascade)
+}
+```
+
+That's the whole change — no code overrides are required. A `prisma db pull`
+against an existing UUID-keyed database already emits `String @id`, so the pulled
+schema and the framework agree.
+
+> **Why it's just the schema:** ids arrive over HTTP and in sessions as strings.
+> The framework never hardcodes `Number(id)` — it converts based on the PK type,
+> so a `String` id passes through untouched while an `Int` id is still parsed.
+> Accept a user id as `UserId` (`string | number`) in your own signatures if you
+> extend the auth service; it's exported from the package root.

package/docs/limitations.md

@@ -52,6 +52,7 @@ Generated CRUD accepts nested `create`/`connect` **one level deep only** — a `
 - **No audit logging of denials.** A refused request returns `403` but emits no structured audit event; per-request diagnostics are opt-in via `prismaService.debugQueries(true)`.
 - **Exposed models are a full bypass.** `@ExposeModels` / `@Permission(a, [models])` / `withExposedModels` disable row *and* field filtering for the listed models within that scope. Keep the scope as narrow as possible.
 - **`connect` defaults to one rule per target model; override per relation when needed.** By default every foreign key that points at model `T` is authorized by the single `T.connect` rule for the role. When a specific relation needs a different (stricter) rule — "a class's teacher must be a teacher" — declare a **relation-scoped** `connect` on the source model (`Source[role].relations[field].connect`); it is ANDed with `T.connect`, or stands alone if `T` has none. See [permissions.md](./permissions.md#two-places-to-declare-a-connect-rule). A relation rule can only strengthen, never loosen, the target rule.
+- **A string `User.id` needs its two foreign keys changed with it.** `User.id` may be `String` (uuid/cuid) instead of the scaffold's `Int` — the framework is id-type-agnostic and coerces accordingly (see [authentication.md](./authentication.md#using-a-string-uuid--cuid-userid)). But `Session.userId` and `UserRefreshToken.userId` must be switched to `String` in the same edit; leaving one as `Int` is a schema/relation mismatch Prisma will reject at migrate time. Change all three together.
 - **The config is validated at boot; a bad config stops the app.** A create condition that references a relation, or a required foreign key whose target lacks a `connect` rule for a role that can create, is a startup error (not a runtime one). This is deliberate — the alternative is a silent runtime `403`. The error message names exactly what to fix.
 
 ---

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@appxdigital/appx-core",
-    "version": "0.1.124",
+    "version": "0.1.125-beta.0",
     "description": "Appx Core is a library that provides a set of tools to help you build your application faster.",
     "main": "dist/index.js",
     "types": "dist/index.d.ts",