@apso/cli 0.44.0 → 0.45.1

package/dist/commands/generate.js

@@ -2,9 +2,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const tslib_1 = require("tslib");
 const core_1 = require("@oclif/core");
+const fs = tslib_1.__importStar(require("fs"));
 const path = tslib_1.__importStar(require("path"));
 const inquirer_1 = tslib_1.__importDefault(require("inquirer"));
 const lib_1 = require("../lib");
+const types_1 = require("../lib/types");
 const base_command_1 = tslib_1.__importDefault(require("../lib/base-command"));
 const interactive_1 = require("../lib/utils/interactive");
 const perf_hooks_1 = require("perf_hooks");
@@ -173,6 +175,7 @@ class Generate extends base_command_1.default {
                     allEntities: entities,
                     apiType: lowerCaseApiType,
                     relationshipMap,
+                    auth,
                 }));
             }
             // eslint-disable-next-line no-await-in-loop
@@ -202,7 +205,7 @@ class Generate extends base_command_1.default {
             await writeGenerated(file.path, file.content);
         }
         // Generate index module
-        const indexFiles = await generator.generateIndexModule(entities, lowerCaseApiType, { emitEvents, http });
+        const indexFiles = await generator.generateIndexModule(entities, lowerCaseApiType, { emitEvents, http, auth });
         for (const file of indexFiles) {
             // eslint-disable-next-line no-await-in-loop
             await writeGenerated(file.path, file.content);
@@ -265,6 +268,23 @@ class Generate extends base_command_1.default {
                 console.log("[apso] Updated src/orm.config.ts so `apso migrate verify` and `apso test smoke` can run on a local PGlite database. Run npm install before building.");
             }
         }
+        // The generated auth code imports a JWT library; declare it.
+        if (auth && (0, types_1.isJwtAuth)(auth)) {
+            if (language === "typescript" &&
+                (0, crud_deps_1.addMissingDeps)(process.cwd(), crud_deps_1.JOSE_DEP).length > 0)
+                console.log("[apso] Added jose to package.json (the generated auth guard imports it). Run npm install before building.");
+            if (language === "python" &&
+                (0, crud_deps_1.addMissingPythonDep)(process.cwd(), crud_deps_1.PYJWT_DEP))
+                console.log(`[apso] Added ${crud_deps_1.PYJWT_DEP} to pyproject.toml (the generated auth module imports it). Reinstall the project's dependencies.`);
+            if (language === "go")
+                console.log("[apso] The generated auth middleware imports github.com/golang-jwt/jwt/v5 and github.com/MicahParks/keyfunc/v3. Run go mod tidy before building.");
+        }
+        if (language === "python") {
+            const main = path.join(process.cwd(), "app", "main.py");
+            if (fs.existsSync(main) &&
+                !fs.readFileSync(main, "utf8").includes("autogen_router"))
+                console.warn("[apso] app/main.py does not include autogen_router, so the generated routes are not served. Add: from app.autogen import autogen_router; app.include_router(autogen_router)");
+        }
         const totalBuildTime = perf_hooks_1.performance.now() - totalBuildStart;
         console.log(`[apso] Finished building all entities in ${totalBuildTime.toFixed(2)} ms`);
         // Best-effort: install the commit co-author hook so commits that include

package/dist/commands/mcp/serve.js

@@ -382,6 +382,7 @@ class McpServe extends base_command_1.default {
                             allEntities: entities,
                             apiType: lowerCaseApiType,
                             relationshipMap,
+                            auth,
                         }),
                         generator.generateModule({
                             entity,
@@ -408,7 +409,7 @@ class McpServe extends base_command_1.default {
                     filesGenerated.push(file.path);
                 }
                 // Generate index module
-                const indexFiles = await generator.generateIndexModule(entities, lowerCaseApiType);
+                const indexFiles = await generator.generateIndexModule(entities, lowerCaseApiType, { auth });
                 for (const file of indexFiles) {
                     const fullPath = path.join(autogenPath, file.path);
                     // eslint-disable-next-line no-await-in-loop
@@ -450,6 +451,7 @@ class McpServe extends base_command_1.default {
                 "auth0",
                 "clerk",
                 "cognito",
+                "jwt",
                 "api-key",
                 "custom-db-session",
             ])
@@ -518,11 +520,12 @@ class McpServe extends base_command_1.default {
                             issuer: "https://YOUR_TENANT.auth0.com/",
                             audience: "https://api.yourapp.com",
                         },
+                        // Auth0 custom claims must be namespaced URLs, added by a post-login Action.
                         claims: {
                             userId: "sub",
                             email: "email",
-                            roles: "roles",
-                            organizationId: "org_id",
+                            roles: "https://yourapp.com/roles",
+                            workspaceId: "https://yourapp.com/org_id",
                         },
                     },
                     entities: [],
@@ -531,15 +534,14 @@ class McpServe extends base_command_1.default {
                 clerk: {
                     auth: {
                         provider: "clerk",
+                        // Clerk session tokens carry no aud; the active organization is o.id / o.rol.
                         jwt: {
                             issuer: "https://YOUR_CLERK_FRONTEND_API",
-                            audience: "",
                         },
                         claims: {
                             userId: "sub",
-                            email: "email",
-                            roles: "roles",
-                            organizationId: "org_id",
+                            workspaceId: "o.id",
+                            roles: "o.rol",
                         },
                     },
                     entities: [],
@@ -556,7 +558,26 @@ class McpServe extends base_command_1.default {
                             userId: "sub",
                             email: "email",
                             roles: "cognito:groups",
-                            organizationId: "custom:org_id",
+                            workspaceId: "custom:org_id",
+                        },
+                    },
+                    entities: [],
+                    relationships: [],
+                },
+                jwt: {
+                    // Any issuer that publishes a JWKS (Supabase Auth, Firebase, WorkOS, Okta, Better Auth's JWT plugin).
+                    auth: {
+                        provider: "jwt",
+                        jwt: {
+                            issuer: "https://YOUR_ISSUER",
+                            audience: "YOUR_AUDIENCE",
+                            jwksUri: "https://YOUR_ISSUER/.well-known/jwks.json",
+                        },
+                        claims: {
+                            userId: "sub",
+                            email: "email",
+                            workspaceId: "org_id",
+                            roles: "roles",
                         },
                     },
                     entities: [],
@@ -601,7 +622,7 @@ class McpServe extends base_command_1.default {
                 content: [
                     {
                         type: "text",
-                        text: `# Auth Setup: ${authProvider}\n\nMerge the following into your .apsorc file:\n\n\`\`\`json\n${JSON.stringify(config, null, 2)}\n\`\`\`\n\nAfter updating .apsorc:\n1. Run \`apso generate\` (or use the scaffold_api tool) to regenerate code\n2. Run \`npm install\` if new dependencies are needed\n3. Run \`apso dev\` to start the server and create auth tables\n\n${authProvider === "better-auth" ? "**Important:** BetterAuth stores passwords in the `account` table (not User). The `providerId` field must be set to \"credential\" for email/password login to work. Use `@apso/better-auth-adapter@latest` in your frontend." : "Configure the JWT issuer and audience values for your " + authProvider + " tenant."}`,
+                        text: `# Auth Setup: ${authProvider}\n\nMerge the following into your .apsorc file:\n\n\`\`\`json\n${JSON.stringify(config, null, 2)}\n\`\`\`\n\nAfter updating .apsorc:\n1. Run \`apso generate\` (or use the scaffold_api tool) to regenerate code\n2. Run \`npm install\` if new dependencies are needed\n3. Run \`apso dev\` to start the server and create auth tables\n\n${authProvider === "better-auth" ? "**Important:** BetterAuth stores passwords in the `account` table (not User). The `providerId` field must be set to \"credential\" for email/password login to work. Use `@apso/better-auth-adapter@latest` in your frontend." : authProvider === "api-key" ? "Store each key's hex SHA-256 in ApiKey.keyHash, never the key itself; callers send the key in the x-api-key header." : "Replace the issuer, audience and claim names with your " + authProvider + " tenant's values. The service checks each token's signature against the issuer's JWKS. See https://docs.apso.ai/develop/auth/byoa."}`,
                     },
                 ],
             };

package/dist/lib/generators/base.d.ts

@@ -55,6 +55,7 @@ export declare abstract class BaseGenerator implements LanguageGenerator {
     abstract generateIndexModule(entities: Entity[], apiType: string, opts?: {
         emitEvents?: boolean;
         http?: boolean;
+        auth?: AuthConfig;
     }): Promise<GeneratedFile[]>;
     /**
      * Generate guard files (auth, scope, etc.)

package/dist/lib/generators/go.d.ts

@@ -35,6 +35,7 @@ export declare class GoGenerator extends BaseGenerator {
     generateIndexModule(entities: Entity[], _apiType: string, opts?: {
         emitEvents?: boolean;
         http?: boolean;
+        auth?: AuthConfig;
     }): Promise<GeneratedFile[]>;
     /**
      * Emits a schema-derived manifest of the entities that opted in to
@@ -54,6 +55,6 @@ export declare class GoGenerator extends BaseGenerator {
     generateDomainEvents(entities: Entity[], _apiType?: string, opts?: {
         emitEvents?: boolean;
     }): Promise<GeneratedFile[]>;
-    generateGuards(_entities: Entity[], auth?: AuthConfig): Promise<GeneratedFile[]>;
+    generateGuards(entities: Entity[], auth?: AuthConfig): Promise<GeneratedFile[]>;
     generateQueryUtils(_entities: Entity[], _apiType: string): Promise<GeneratedFile[]>;
 }

package/dist/lib/generators/go.js

@@ -5,6 +5,8 @@ const tslib_1 = require("tslib");
 const path = tslib_1.__importStar(require("path"));
 const Eta = tslib_1.__importStar(require("eta"));
 const base_1 = require("./base");
+const types_1 = require("../types");
+const guards_1 = require("../guards");
 const field_1 = require("../utils/field");
 const relationships_1 = require("../utils/relationships");
 const casing_1 = require("../utils/casing");
@@ -128,6 +130,8 @@ class GoGenerator extends base_1.BaseGenerator {
             goType: this.mapFieldToGoType(field),
             pascalName: (0, casing_1.pascalCase)(field.name),
             snakeName: (0, casing_1.snakeCase)(field.name),
+            // The enum type the enums package declares (EntityFieldEnum).
+            enumType: field.type === "enum" ? field.dataType : undefined,
         }));
     }
     async generateEntity(options) {
@@ -357,6 +361,7 @@ ${downStatements}
         });
         const content = await this.renderTemplate("./index-module", {
             entities: entitiesData,
+            hasAuth: Boolean(opts === null || opts === void 0 ? void 0 : opts.auth),
         });
         // Generate model registry for AutoMigrate support
         const modelRefs = entities
@@ -415,10 +420,35 @@ ${modelRefs}
             },
         ];
     }
-    async generateGuards(_entities, auth) {
-        const content = await this.renderTemplate("./middleware/auth", {
-            auth,
-        });
+    async generateGuards(entities, auth) {
+        if (!auth)
+            return [];
+        if ((0, guards_1.hasScopedEntities)(entities))
+            console.warn("[apso] scopeBy is enforced in TypeScript services only; this Go service authenticates requests but does not filter rows by tenant");
+        let data;
+        if ((0, types_1.isJwtAuth)(auth)) {
+            data = { jwt: (0, types_1.resolveJwtAuth)(auth) };
+        }
+        else if ((0, types_1.isApiKeyAuth)(auth)) {
+            const apiKey = (0, guards_1.apiKeyTemplateData)((0, types_1.resolveApiKeyAuth)(auth), entities);
+            const entity = entities.find((e) => e.name === apiKey.apiKeyEntity);
+            // gorm's default naming: snake_case of the Go field name.
+            const column = (name) => (0, casing_1.snakeCase)(name);
+            data = {
+                apiKey: {
+                    ...apiKey,
+                    goModel: (0, casing_1.pascalCase)(entity.name),
+                    keyColumn: column(apiKey.keyField),
+                    expiresColumn: column("expiresAt"),
+                    workspaceColumn: column(apiKey.workspaceField),
+                    roleColumn: apiKey.roleField ? column(apiKey.roleField) : undefined,
+                },
+            };
+        }
+        else {
+            throw new Error(`auth.provider "${auth.provider}" is generated for TypeScript services only. For Go, use "jwt" (Better Auth issues JWTs with its JWT plugin) or "api-key".`);
+        }
+        const content = await this.renderTemplate("./middleware/auth", data);
         return [
             {
                 path: "middleware/auth.go",

package/dist/lib/generators/python.d.ts

@@ -16,7 +16,9 @@ export declare class PythonGenerator extends BaseGenerator {
     generateModule(_options: EntityGenerationOptions): Promise<GeneratedFile[]>;
     generateMigration(options: MigrationGenerationOptions): Promise<GeneratedFile[]>;
     generateEnums(entities: Entity[], _apiType: string): Promise<GeneratedFile[]>;
-    generateIndexModule(entities: Entity[], _apiType: string): Promise<GeneratedFile[]>;
+    generateIndexModule(entities: Entity[], _apiType: string, opts?: {
+        auth?: AuthConfig;
+    }): Promise<GeneratedFile[]>;
     /**
      * Emits a schema-derived manifest of the entities that opted in to
      * domain-event emission (`.apsorc` `emitEvents`), mirroring the TypeScript
@@ -35,6 +37,6 @@ export declare class PythonGenerator extends BaseGenerator {
     generateDomainEvents(entities: Entity[], _apiType?: string, opts?: {
         emitEvents?: boolean;
     }): Promise<GeneratedFile[]>;
-    generateGuards(_entities: Entity[], _auth?: AuthConfig): Promise<GeneratedFile[]>;
+    generateGuards(entities: Entity[], auth?: AuthConfig): Promise<GeneratedFile[]>;
     generateQueryUtils(_entities: Entity[], _apiType: string): Promise<GeneratedFile[]>;
 }

package/dist/lib/generators/python.js

@@ -5,10 +5,12 @@ const tslib_1 = require("tslib");
 const path = tslib_1.__importStar(require("path"));
 const Eta = tslib_1.__importStar(require("eta"));
 const base_1 = require("./base");
+const types_1 = require("../types");
 const field_1 = require("../utils/field");
 const relationships_1 = require("../utils/relationships");
 const casing_1 = require("../utils/casing");
 const events_1 = require("../events");
+const guards_1 = require("../guards");
 const migration_file_1 = require("../ddl/migration-file");
 const pluralize_1 = tslib_1.__importDefault(require("pluralize"));
 /**
@@ -279,8 +281,11 @@ ${downStatements || "    pass"}
             },
         ];
     }
-    async generateIndexModule(entities, _apiType) {
-        const content = await this.renderTemplate("./index-module", { entities });
+    async generateIndexModule(entities, _apiType, opts) {
+        const content = await this.renderTemplate("./index-module", {
+            entities,
+            hasAuth: Boolean(opts === null || opts === void 0 ? void 0 : opts.auth),
+        });
         return [
             {
                 path: "__init__.py",
@@ -320,10 +325,27 @@ ${downStatements || "    pass"}
             },
         ];
     }
-    async generateGuards(_entities, _auth) {
-        // Python auth/guards would be implemented differently (e.g., FastAPI dependencies)
-        // This is a placeholder for future implementation
-        return [];
+    async generateGuards(entities, auth) {
+        if (!auth)
+            return [];
+        if ((0, guards_1.hasScopedEntities)(entities))
+            console.warn("[apso] scopeBy is enforced in TypeScript services only; this Python service authenticates requests but does not filter rows by tenant");
+        let data;
+        if ((0, types_1.isJwtAuth)(auth)) {
+            data = { jwt: (0, types_1.resolveJwtAuth)(auth) };
+        }
+        else if ((0, types_1.isApiKeyAuth)(auth)) {
+            const apiKey = (0, guards_1.apiKeyTemplateData)((0, types_1.resolveApiKeyAuth)(auth), entities);
+            data = {
+                apiKey: { ...apiKey, pyModule: apiKey.apiKeyEntity.toLowerCase() },
+            };
+        }
+        else {
+            throw new Error(`auth.provider "${auth.provider}" is generated for TypeScript services only. For Python, use "jwt" (Better Auth issues JWTs with its JWT plugin) or "api-key".`);
+        }
+        return [
+            { path: "auth.py", content: await this.renderTemplate("./auth", data) },
+        ];
     }
     async generateQueryUtils(_entities, _apiType) {
         const queryContent = await this.renderTemplate("./utils/query", {});

package/dist/lib/generators/typescript.d.ts

@@ -16,8 +16,9 @@ export declare class TypeScriptGenerator extends BaseGenerator {
     generateModule(options: EntityGenerationOptions): Promise<GeneratedFile[]>;
     generateMigration(_options: MigrationGenerationOptions): Promise<GeneratedFile[]>;
     generateEnums(entities: Entity[], apiType: string): Promise<GeneratedFile[]>;
-    generateIndexModule(entities: Entity[], apiType: string, _opts?: {
+    generateIndexModule(entities: Entity[], apiType: string, opts?: {
         emitEvents?: boolean;
+        auth?: AuthConfig;
     }): Promise<GeneratedFile[]>;
     generateGuards(entities: Entity[], auth?: AuthConfig): Promise<GeneratedFile[]>;
     /**

package/dist/lib/generators/typescript.js

@@ -109,7 +109,8 @@ class TypeScriptGenerator extends base_1.BaseGenerator {
         ];
     }
     async generateController(options) {
-        const { entity, relationships, relationshipMap } = options;
+        var _a, _b;
+        const { entity, relationships, relationshipMap, auth } = options;
         const { name: entityName } = entity;
         const relationshipsForTemplate = (0, relationships_1.getRelationshipForTemplate)(entityName, relationships);
         // Handle nested relationships for joins
@@ -135,6 +136,12 @@ class TypeScriptGenerator extends base_1.BaseGenerator {
             primaryKeyType,
             associations: [...new Set(relationshipsForTemplate)],
             nestedJoinsFile,
+            // Direct scopeBy fields @CrudAuth adds to every query once a caller is
+            // authenticated. Nested scopes (task.workspaceId) are checked per row by
+            // ScopeGuard only.
+            crudAuth: auth
+                ? ((_b = (_a = (0, guards_1.getScopedEntities)([entity])[0]) === null || _a === void 0 ? void 0 : _a.scopes) !== null && _b !== void 0 ? _b : []).filter((s) => s.direct)
+                : [],
         };
         const controllerContent = await this.renderTemplate("./rest/controller-rest", data);
         const specContent = await this.renderTemplate("./rest/controller-rest-spec", data);
@@ -307,8 +314,13 @@ class TypeScriptGenerator extends base_1.BaseGenerator {
             },
         ];
     }
-    async generateIndexModule(entities, apiType, _opts) {
-        const content = await this.renderTemplate(`./${apiType}/index-module-${apiType}`, { entities });
+    async generateIndexModule(entities, apiType, opts) {
+        // generateGuards emits GuardsModule whenever auth or scopeBy is configured;
+        // listing it here is what turns its global guards on.
+        const content = await this.renderTemplate(`./${apiType}/index-module-${apiType}`, {
+            entities,
+            hasGuards: Boolean(opts === null || opts === void 0 ? void 0 : opts.auth) || (0, guards_1.hasScopedEntities)(entities),
+        });
         return [
             {
                 path: "index.ts",
@@ -319,20 +331,45 @@ class TypeScriptGenerator extends base_1.BaseGenerator {
     async generateGuards(entities, auth) {
         const hasScopes = (0, guards_1.hasScopedEntities)(entities);
         const normalizedAuth = this.normalizeAuthConfig(auth);
-        if (!hasScopes && !normalizedAuth) {
+        const jwt = auth && (0, auth_1.isJwtAuth)(auth) ? (0, auth_1.resolveJwtAuth)(auth) : undefined;
+        const apiKey = auth && (0, auth_1.isApiKeyAuth)(auth)
+            ? (0, guards_1.apiKeyTemplateData)((0, auth_1.resolveApiKeyAuth)(auth), entities)
+            : undefined;
+        const hasAuth = Boolean(normalizedAuth || jwt || apiKey);
+        if (!hasScopes && !hasAuth) {
             return [];
         }
         const scopedEntities = (0, guards_1.getScopedEntities)(entities);
         const files = [];
+        const authEntities = normalizedAuth
+            ? [
+                normalizedAuth.sessionEntity,
+                normalizedAuth.userEntity,
+                ...(normalizedAuth.accountUserEntity
+                    ? [normalizedAuth.accountUserEntity]
+                    : []),
+            ]
+            : apiKey
+                ? [apiKey.apiKeyEntity]
+                : [];
         const templateData = {
             scopedEntities,
             authConfig: normalizedAuth,
+            hasAuth,
+            authProvider: auth === null || auth === void 0 ? void 0 : auth.provider,
+            authEntities,
+            jwt,
+            apiKey,
             generatedAt: new Date().toISOString(),
             generatedBy: "Apso CLI",
         };
         // Generate auth.guard.ts if auth is configured
-        if (normalizedAuth) {
-            const authGuardContent = await this.renderTemplate("./guards/auth.guard.eta", templateData);
+        if (hasAuth) {
+            const authGuardContent = await this.renderTemplate(jwt
+                ? "./guards/jwt-auth.guard.eta"
+                : apiKey
+                    ? "./guards/api-key-auth.guard.eta"
+                    : "./guards/auth.guard.eta", templateData);
             files.push({
                 path: "guards/auth.guard.ts",
                 content: authGuardContent,

package/dist/lib/guards.d.ts

@@ -1,4 +1,4 @@
-import { Entity } from "./types";
+import { Entity, ResolvedApiKeyAuth } from "./types";
 /**
  * Represents a scope field configuration for template rendering
  */
@@ -28,3 +28,13 @@ export declare function getScopedEntities(entities: Entity[]): ScopedEntityConfi
  * Checks if any entities have scopeBy configured.
  */
 export declare function hasScopedEntities(entities: Entity[]): boolean;
+/** API key settings plus what the key entity offers, as the guard templates use them. */
+export interface ApiKeyTemplateData extends ResolvedApiKeyAuth {
+    hasStatus: boolean;
+    hasExpiresAt: boolean;
+}
+/**
+ * Check the API key entity exists and has the hash field, and note whether it
+ * has `status` and `expiresAt`, which the guard then enforces.
+ */
+export declare function apiKeyTemplateData(apiKey: ResolvedApiKeyAuth, entities: Entity[]): ApiKeyTemplateData;

package/dist/lib/guards.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.hasScopedEntities = exports.getScopedEntities = void 0;
+exports.apiKeyTemplateData = exports.hasScopedEntities = exports.getScopedEntities = void 0;
 const tslib_1 = require("tslib");
 const pluralize_1 = tslib_1.__importDefault(require("pluralize"));
 /**
@@ -62,3 +62,22 @@ function hasScopedEntities(entities) {
     return entities.some((entity) => entity.scopeBy);
 }
 exports.hasScopedEntities = hasScopedEntities;
+/**
+ * Check the API key entity exists and has the hash field, and note whether it
+ * has `status` and `expiresAt`, which the guard then enforces.
+ */
+function apiKeyTemplateData(apiKey, entities) {
+    var _a;
+    const entity = entities.find((e) => e.name === apiKey.apiKeyEntity);
+    if (!entity)
+        throw new Error(`auth.apiKeyEntity "${apiKey.apiKeyEntity}" is not an entity in .apsorc; add it with a "${apiKey.keyField}" text field`);
+    const fields = new Set(((_a = entity.fields) !== null && _a !== void 0 ? _a : []).map((f) => f.name));
+    if (!fields.has(apiKey.keyField))
+        throw new Error(`Entity ${apiKey.apiKeyEntity} needs a "${apiKey.keyField}" text field holding each key's hex SHA-256 (auth.keyField)`);
+    return {
+        ...apiKey,
+        hasStatus: fields.has("status"),
+        hasExpiresAt: fields.has("expiresAt"),
+    };
+}
+exports.apiKeyTemplateData = apiKeyTemplateData;

package/dist/lib/templates/go/index-module.eta

@@ -4,6 +4,7 @@ package routes
 
 import (
 <% if (httpEntities.length > 0) { %>	"app/autogen/handlers"
+<% } %><% if (it.hasAuth) { %>	"app/autogen/middleware"
 <% } %>	"app/autogen/services"
 	"github.com/gin-gonic/gin"
 	"gorm.io/gorm"
@@ -11,6 +12,11 @@ import (
 
 // RegisterAllRoutes registers all entity routes
 func RegisterAllRoutes(r *gin.RouterGroup, db *gorm.DB) {
+<% if (it.hasAuth) { %>
+	// Every route in this group requires authentication (.apsorc auth).
+	r.Use(middleware.AuthMiddleware(db))
+
+<% } %>
 <% httpEntities.forEach((entity) => { %>
 	// <%= entity.name %> routes
 	<%= entity.camelName %>Service := services.New<%= entity.name %>Service(db)