@ftisindia/create-app 0.1.0

package/template/docs/api.http

@@ -0,0 +1,269 @@
+@baseUrl = http://localhost:3000
+@email = owner@example.com
+@password = replace-with-printed-setup-password
+@newUserEmail = new.owner@example.com
+@newUserPassword = new-owner-password-123
+@refreshToken = replace-with-refresh-token
+@oauthCode = replace-with-oauth-exchange-code
+@orgId = replace-with-org-id
+@membershipId = replace-with-membership-id
+@targetMembershipId = replace-with-target-membership-id
+@roleId = replace-with-role-id
+@newRoleId = replace-with-new-role-id
+@invitationId = replace-with-invitation-id
+@invitationToken = replace-with-invitation-token
+
+### Health
+GET {{baseUrl}}/health
+
+### Auth: signup
+# @name signup
+POST {{baseUrl}}/auth/signup
+Content-Type: application/json
+
+{
+  "email": "{{newUserEmail}}",
+  "password": "{{newUserPassword}}",
+  "displayName": "New Owner"
+}
+
+### Auth: login
+# @name login
+POST {{baseUrl}}/auth/login
+Content-Type: application/json
+
+{
+  "email": "{{email}}",
+  "password": "{{password}}"
+}
+
+### Auth: refresh token
+# @name refresh
+POST {{baseUrl}}/auth/refresh
+Content-Type: application/json
+
+{
+  "refreshToken": "{{refreshToken}}"
+}
+
+### Auth: Google OAuth start
+GET {{baseUrl}}/auth/google
+
+### Auth: Google OAuth callback
+GET {{baseUrl}}/auth/google/callback
+
+### Auth: exchange Google OAuth one-time code
+POST {{baseUrl}}/auth/oauth/exchange
+Content-Type: application/json
+
+{
+  "code": "{{oauthCode}}"
+}
+
+### Auth: current user
+GET {{baseUrl}}/auth/me
+Authorization: Bearer {{login.response.body.accessToken}}
+
+### Organisations: create organisation
+# @name createOrg
+POST {{baseUrl}}/organisations
+Authorization: Bearer {{login.response.body.accessToken}}
+Content-Type: application/json
+
+{
+  "name": "Demo REST Client Org",
+  "slug": "demo-rest-client-org"
+}
+
+### Memberships: current membership
+GET {{baseUrl}}/organisations/{{orgId}}/memberships/me
+Authorization: Bearer {{login.response.body.accessToken}}
+
+### Memberships: list
+GET {{baseUrl}}/organisations/{{orgId}}/memberships
+Authorization: Bearer {{login.response.body.accessToken}}
+
+### Memberships: update status
+PATCH {{baseUrl}}/organisations/{{orgId}}/memberships/{{membershipId}}/status
+Authorization: Bearer {{login.response.body.accessToken}}
+Content-Type: application/json
+
+{
+  "status": "SUSPENDED"
+}
+
+### Memberships: assign role
+PATCH {{baseUrl}}/organisations/{{orgId}}/memberships/{{membershipId}}/role
+Authorization: Bearer {{login.response.body.accessToken}}
+Content-Type: application/json
+
+{
+  "roleId": "{{roleId}}"
+}
+
+### Memberships: update owner flag
+PATCH {{baseUrl}}/organisations/{{orgId}}/memberships/{{membershipId}}/owner
+Authorization: Bearer {{login.response.body.accessToken}}
+Content-Type: application/json
+
+{
+  "isOwner": true
+}
+
+### Memberships: update billing contact flag
+PATCH {{baseUrl}}/organisations/{{orgId}}/memberships/{{membershipId}}/billing-contact
+Authorization: Bearer {{login.response.body.accessToken}}
+Content-Type: application/json
+
+{
+  "isBillingContact": true
+}
+
+### Memberships: transfer owner
+POST {{baseUrl}}/organisations/{{orgId}}/memberships/transfer-owner
+Authorization: Bearer {{login.response.body.accessToken}}
+Content-Type: application/json
+
+{
+  "toMembershipId": "{{targetMembershipId}}"
+}
+
+### Invitations: create
+# @name invite
+POST {{baseUrl}}/organisations/{{orgId}}/invitations
+Authorization: Bearer {{login.response.body.accessToken}}
+Content-Type: application/json
+
+{
+  "targetType": "EMAIL",
+  "targetValue": "teammate@example.com",
+  "roleId": "{{roleId}}"
+}
+
+### Invitations: list
+GET {{baseUrl}}/organisations/{{orgId}}/invitations
+Authorization: Bearer {{login.response.body.accessToken}}
+
+### Invitations: revoke
+POST {{baseUrl}}/organisations/{{orgId}}/invitations/{{invitationId}}/revoke
+Authorization: Bearer {{login.response.body.accessToken}}
+
+### Invitations: resend
+# @name resendInvitation
+POST {{baseUrl}}/organisations/{{orgId}}/invitations/{{invitationId}}/resend
+Authorization: Bearer {{login.response.body.accessToken}}
+
+### Invitations: accept
+POST {{baseUrl}}/invitations/accept
+Content-Type: application/json
+
+{
+  "token": "{{invitationToken}}",
+  "password": "teammate-password-123",
+  "displayName": "Teammate"
+}
+
+### Invitations: decline
+POST {{baseUrl}}/invitations/decline
+Content-Type: application/json
+
+{
+  "token": "{{invitationToken}}"
+}
+
+### Access control: list permissions
+GET {{baseUrl}}/organisations/{{orgId}}/access-control/permissions
+Authorization: Bearer {{login.response.body.accessToken}}
+
+### Access control: list route permissions
+GET {{baseUrl}}/organisations/{{orgId}}/access-control/route-permissions
+Authorization: Bearer {{login.response.body.accessToken}}
+
+### Access control: list roles
+GET {{baseUrl}}/organisations/{{orgId}}/access-control/roles
+Authorization: Bearer {{login.response.body.accessToken}}
+
+### Access control: create role
+# @name createRole
+POST {{baseUrl}}/organisations/{{orgId}}/access-control/roles
+Authorization: Bearer {{login.response.body.accessToken}}
+Content-Type: application/json
+
+{
+  "name": "Support",
+  "description": "Can review support-facing records."
+}
+
+### Access control: update role
+PATCH {{baseUrl}}/organisations/{{orgId}}/access-control/roles/{{newRoleId}}
+Authorization: Bearer {{login.response.body.accessToken}}
+Content-Type: application/json
+
+{
+  "name": "Support Lead",
+  "description": "Can manage support-facing records."
+}
+
+### Access control: delete role
+DELETE {{baseUrl}}/organisations/{{orgId}}/access-control/roles/{{newRoleId}}
+Authorization: Bearer {{login.response.body.accessToken}}
+
+### Access control: list role permissions
+GET {{baseUrl}}/organisations/{{orgId}}/access-control/roles/{{roleId}}/permissions
+Authorization: Bearer {{login.response.body.accessToken}}
+
+### Access control: replace role permissions
+PUT {{baseUrl}}/organisations/{{orgId}}/access-control/roles/{{roleId}}/permissions
+Authorization: Bearer {{login.response.body.accessToken}}
+Content-Type: application/json
+
+{
+  "permissionKeys": ["memberships.read", "settings.read", "audit.read"]
+}
+
+### Settings: list
+GET {{baseUrl}}/organisations/{{orgId}}/settings
+Authorization: Bearer {{login.response.body.accessToken}}
+
+### Settings: get one
+GET {{baseUrl}}/organisations/{{orgId}}/settings/timezone
+Authorization: Bearer {{login.response.body.accessToken}}
+
+### Settings: update one
+PATCH {{baseUrl}}/organisations/{{orgId}}/settings
+Authorization: Bearer {{login.response.body.accessToken}}
+Content-Type: application/json
+
+{
+  "key": "timezone",
+  "value": "UTC"
+}
+
+### Audit: list
+GET {{baseUrl}}/organisations/{{orgId}}/audit?limit=25
+Authorization: Bearer {{login.response.body.accessToken}}
+
+### Audit: filtered list
+GET {{baseUrl}}/organisations/{{orgId}}/audit?action=organisation.setting.update&targetType=OrganisationSetting&limit=10
+Authorization: Bearer {{login.response.body.accessToken}}
+
+### Sample: status
+GET {{baseUrl}}/organisations/{{orgId}}/sample/status
+Authorization: Bearer {{login.response.body.accessToken}}
+
+### Sample: echo
+POST {{baseUrl}}/organisations/{{orgId}}/sample/echo
+Authorization: Bearer {{login.response.body.accessToken}}
+Content-Type: application/json
+
+{
+  "message": "Hello from REST Client"
+}
+
+### Auth: logout
+POST {{baseUrl}}/auth/logout
+Content-Type: application/json
+
+{
+  "refreshToken": "{{refreshToken}}"
+}

package/template/eslint.config.mjs

@@ -0,0 +1,51 @@
+import js from '@eslint/js';
+import prettier from 'eslint-config-prettier';
+import globals from 'globals';
+import { dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import tseslint from 'typescript-eslint';
+
+const tsconfigRootDir = dirname(fileURLToPath(import.meta.url));
+
+export default tseslint.config(
+  js.configs.recommended,
+  ...tseslint.configs.recommendedTypeChecked,
+  prettier,
+  {
+    languageOptions: {
+      ecmaVersion: 2023,
+      globals: {
+        ...globals.node,
+        ...globals.jest,
+      },
+      parserOptions: {
+        projectService: {
+          allowDefaultProject: ['*.mjs', 'scripts/*.mjs'],
+        },
+        tsconfigRootDir,
+      },
+    },
+    rules: {
+      '@typescript-eslint/no-floating-promises': 'error',
+      '@typescript-eslint/no-misused-promises': 'error',
+      '@typescript-eslint/no-require-imports': 'off',
+      '@typescript-eslint/no-unnecessary-type-assertion': 'off',
+      '@typescript-eslint/no-unsafe-argument': 'off',
+      '@typescript-eslint/no-unsafe-assignment': 'off',
+      '@typescript-eslint/no-unsafe-call': 'off',
+      '@typescript-eslint/no-unsafe-member-access': 'off',
+      '@typescript-eslint/no-unsafe-return': 'off',
+      '@typescript-eslint/no-unused-vars': [
+        'error',
+        {
+          argsIgnorePattern: '^_',
+          caughtErrorsIgnorePattern: '^_',
+          varsIgnorePattern: '^_',
+        },
+      ],
+    },
+  },
+  {
+    ignores: ['coverage/**', 'dist/**', 'node_modules/**'],
+  },
+);

package/template/nest-cli.json

@@ -0,0 +1,8 @@
+{
+  "$schema": "https://json.schemastore.org/nest-cli",
+  "collection": "@nestjs/schematics",
+  "sourceRoot": "src",
+  "compilerOptions": {
+    "deleteOutDir": true
+  }
+}

package/template/prisma/migrations/20260530000000_init/migration.sql

@@ -0,0 +1,248 @@
+-- CreateEnum
+CREATE TYPE "OrganisationStatus" AS ENUM ('ACTIVE', 'SUSPENDED', 'DELETED');
+
+-- CreateEnum
+CREATE TYPE "MembershipStatus" AS ENUM ('ACTIVE', 'SUSPENDED', 'REVOKED');
+
+-- CreateEnum
+CREATE TYPE "AuthProvider" AS ENUM ('EMAIL_PASSWORD', 'GOOGLE', 'FACEBOOK', 'MOBILE_OTP', 'MAGIC_LINK');
+
+-- CreateEnum
+CREATE TYPE "InvitationTargetType" AS ENUM ('EMAIL', 'MOBILE');
+
+-- CreateEnum
+CREATE TYPE "InvitationStatus" AS ENUM ('PENDING', 'ACCEPTED', 'DECLINED', 'EXPIRED', 'REVOKED');
+
+-- CreateTable
+CREATE TABLE "User" (
+    "id" TEXT NOT NULL,
+    "email" TEXT,
+    "mobile" TEXT,
+    "passwordHash" TEXT,
+    "displayName" TEXT,
+    "isActive" BOOLEAN NOT NULL DEFAULT true,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "User_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "AuthIdentity" (
+    "id" TEXT NOT NULL,
+    "userId" TEXT NOT NULL,
+    "provider" "AuthProvider" NOT NULL,
+    "providerUserId" TEXT NOT NULL,
+    "email" TEXT,
+    "mobile" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "AuthIdentity_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "RefreshToken" (
+    "id" TEXT NOT NULL,
+    "userId" TEXT NOT NULL,
+    "tokenHash" TEXT NOT NULL,
+    "expiresAt" TIMESTAMP(3) NOT NULL,
+    "revokedAt" TIMESTAMP(3),
+    "replacedByTokenId" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "RefreshToken_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "AuthExchangeCode" (
+    "id" TEXT NOT NULL,
+    "userId" TEXT NOT NULL,
+    "tokenHash" TEXT NOT NULL,
+    "expiresAt" TIMESTAMP(3) NOT NULL,
+    "usedAt" TIMESTAMP(3),
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "AuthExchangeCode_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "PasswordResetToken" (
+    "id" TEXT NOT NULL,
+    "userId" TEXT NOT NULL,
+    "tokenHash" TEXT NOT NULL,
+    "expiresAt" TIMESTAMP(3) NOT NULL,
+    "usedAt" TIMESTAMP(3),
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "PasswordResetToken_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "Organisation" (
+    "id" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "slug" TEXT NOT NULL,
+    "status" "OrganisationStatus" NOT NULL DEFAULT 'ACTIVE',
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "Organisation_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "OrganisationSetting" (
+    "id" TEXT NOT NULL,
+    "orgId" TEXT NOT NULL,
+    "key" TEXT NOT NULL,
+    "value" JSONB NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "OrganisationSetting_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "Membership" (
+    "id" TEXT NOT NULL,
+    "userId" TEXT NOT NULL,
+    "orgId" TEXT NOT NULL,
+    "roleId" TEXT NOT NULL,
+    "status" "MembershipStatus" NOT NULL DEFAULT 'ACTIVE',
+    "isOwner" BOOLEAN NOT NULL DEFAULT false,
+    "isBillingContact" BOOLEAN NOT NULL DEFAULT false,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "Membership_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "Role" (
+    "id" TEXT NOT NULL,
+    "orgId" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "description" TEXT,
+    "isSystemSeeded" BOOLEAN NOT NULL DEFAULT false,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "Role_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "Invitation" (
+    "id" TEXT NOT NULL,
+    "orgId" TEXT NOT NULL,
+    "targetType" "InvitationTargetType" NOT NULL,
+    "targetValue" TEXT NOT NULL,
+    "normalizedTargetValue" TEXT NOT NULL,
+    "roleId" TEXT NOT NULL,
+    "tokenHash" TEXT NOT NULL,
+    "status" "InvitationStatus" NOT NULL DEFAULT 'PENDING',
+    "expiresAt" TIMESTAMP(3) NOT NULL,
+    "invitedByUserId" TEXT NOT NULL,
+    "acceptedByUserId" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "acceptedAt" TIMESTAMP(3),
+    "revokedAt" TIMESTAMP(3),
+
+    CONSTRAINT "Invitation_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "Permission" (
+    "id" TEXT NOT NULL,
+    "key" TEXT NOT NULL,
+    "module" TEXT NOT NULL,
+    "action" TEXT NOT NULL,
+    "subject" TEXT NOT NULL,
+    "description" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "Permission_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "RolePermission" (
+    "roleId" TEXT NOT NULL,
+    "permissionId" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "RolePermission_pkey" PRIMARY KEY ("roleId","permissionId")
+);
+
+-- CreateTable
+CREATE TABLE "AuditLog" (
+    "id" TEXT NOT NULL,
+    "orgId" TEXT,
+    "actorUserId" TEXT,
+    "action" TEXT NOT NULL,
+    "targetType" TEXT NOT NULL,
+    "targetId" TEXT,
+    "metadata" JSONB,
+    "ipAddress" TEXT,
+    "userAgent" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "AuditLog_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "User_email_key" ON "User"("email");
+CREATE UNIQUE INDEX "User_mobile_key" ON "User"("mobile");
+CREATE INDEX "AuthIdentity_userId_idx" ON "AuthIdentity"("userId");
+CREATE INDEX "AuthIdentity_provider_idx" ON "AuthIdentity"("provider");
+CREATE UNIQUE INDEX "AuthIdentity_provider_providerUserId_key" ON "AuthIdentity"("provider", "providerUserId");
+CREATE UNIQUE INDEX "RefreshToken_tokenHash_key" ON "RefreshToken"("tokenHash");
+CREATE INDEX "RefreshToken_userId_idx" ON "RefreshToken"("userId");
+CREATE INDEX "RefreshToken_expiresAt_idx" ON "RefreshToken"("expiresAt");
+CREATE INDEX "RefreshToken_revokedAt_idx" ON "RefreshToken"("revokedAt");
+CREATE UNIQUE INDEX "AuthExchangeCode_tokenHash_key" ON "AuthExchangeCode"("tokenHash");
+CREATE INDEX "AuthExchangeCode_userId_idx" ON "AuthExchangeCode"("userId");
+CREATE INDEX "AuthExchangeCode_expiresAt_idx" ON "AuthExchangeCode"("expiresAt");
+CREATE INDEX "AuthExchangeCode_usedAt_idx" ON "AuthExchangeCode"("usedAt");
+CREATE UNIQUE INDEX "PasswordResetToken_tokenHash_key" ON "PasswordResetToken"("tokenHash");
+CREATE INDEX "PasswordResetToken_userId_idx" ON "PasswordResetToken"("userId");
+CREATE INDEX "PasswordResetToken_expiresAt_idx" ON "PasswordResetToken"("expiresAt");
+CREATE INDEX "PasswordResetToken_usedAt_idx" ON "PasswordResetToken"("usedAt");
+CREATE UNIQUE INDEX "Organisation_slug_key" ON "Organisation"("slug");
+CREATE INDEX "OrganisationSetting_orgId_idx" ON "OrganisationSetting"("orgId");
+CREATE UNIQUE INDEX "OrganisationSetting_orgId_key_key" ON "OrganisationSetting"("orgId", "key");
+CREATE INDEX "Membership_orgId_idx" ON "Membership"("orgId");
+CREATE INDEX "Membership_userId_idx" ON "Membership"("userId");
+CREATE INDEX "Membership_status_idx" ON "Membership"("status");
+CREATE UNIQUE INDEX "Membership_userId_orgId_key" ON "Membership"("userId", "orgId");
+CREATE INDEX "Role_orgId_idx" ON "Role"("orgId");
+CREATE UNIQUE INDEX "Role_orgId_name_key" ON "Role"("orgId", "name");
+CREATE UNIQUE INDEX "Role_id_orgId_key" ON "Role"("id", "orgId");
+CREATE UNIQUE INDEX "Invitation_tokenHash_key" ON "Invitation"("tokenHash");
+CREATE INDEX "Invitation_orgId_idx" ON "Invitation"("orgId");
+CREATE INDEX "Invitation_targetType_normalizedTargetValue_idx" ON "Invitation"("targetType", "normalizedTargetValue");
+CREATE INDEX "Invitation_status_idx" ON "Invitation"("status");
+CREATE UNIQUE INDEX "Invitation_pending_target_unique" ON "Invitation"("orgId", "targetType", "normalizedTargetValue") WHERE "status" = 'PENDING';
+CREATE UNIQUE INDEX "Permission_key_key" ON "Permission"("key");
+CREATE INDEX "AuditLog_orgId_idx" ON "AuditLog"("orgId");
+CREATE INDEX "AuditLog_orgId_createdAt_idx" ON "AuditLog"("orgId", "createdAt");
+CREATE INDEX "AuditLog_actorUserId_idx" ON "AuditLog"("actorUserId");
+CREATE INDEX "AuditLog_action_idx" ON "AuditLog"("action");
+CREATE INDEX "AuditLog_targetType_targetId_idx" ON "AuditLog"("targetType", "targetId");
+CREATE INDEX "AuditLog_createdAt_idx" ON "AuditLog"("createdAt");
+
+-- AddForeignKey
+ALTER TABLE "AuthIdentity" ADD CONSTRAINT "AuthIdentity_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "RefreshToken" ADD CONSTRAINT "RefreshToken_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "AuthExchangeCode" ADD CONSTRAINT "AuthExchangeCode_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "PasswordResetToken" ADD CONSTRAINT "PasswordResetToken_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "OrganisationSetting" ADD CONSTRAINT "OrganisationSetting_orgId_fkey" FOREIGN KEY ("orgId") REFERENCES "Organisation"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "Membership" ADD CONSTRAINT "Membership_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "Membership" ADD CONSTRAINT "Membership_orgId_fkey" FOREIGN KEY ("orgId") REFERENCES "Organisation"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "Membership" ADD CONSTRAINT "Membership_roleId_orgId_fkey" FOREIGN KEY ("roleId", "orgId") REFERENCES "Role"("id", "orgId") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "Role" ADD CONSTRAINT "Role_orgId_fkey" FOREIGN KEY ("orgId") REFERENCES "Organisation"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "Invitation" ADD CONSTRAINT "Invitation_orgId_fkey" FOREIGN KEY ("orgId") REFERENCES "Organisation"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "Invitation" ADD CONSTRAINT "Invitation_roleId_orgId_fkey" FOREIGN KEY ("roleId", "orgId") REFERENCES "Role"("id", "orgId") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "Invitation" ADD CONSTRAINT "Invitation_invitedByUserId_fkey" FOREIGN KEY ("invitedByUserId") REFERENCES "User"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "Invitation" ADD CONSTRAINT "Invitation_acceptedByUserId_fkey" FOREIGN KEY ("acceptedByUserId") REFERENCES "User"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+ALTER TABLE "RolePermission" ADD CONSTRAINT "RolePermission_roleId_fkey" FOREIGN KEY ("roleId") REFERENCES "Role"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+ALTER TABLE "RolePermission" ADD CONSTRAINT "RolePermission_permissionId_fkey" FOREIGN KEY ("permissionId") REFERENCES "Permission"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+ALTER TABLE "AuditLog" ADD CONSTRAINT "AuditLog_actorUserId_fkey" FOREIGN KEY ("actorUserId") REFERENCES "User"("id") ON DELETE SET NULL ON UPDATE CASCADE;