@ftisindia/create-app 0.1.3 → 0.1.5

package/template/src/config/env.validation.ts

@@ -1,17 +1,17 @@
-import { z } from "zod";
+import { z } from 'zod';
 
 const booleanFromEnv = z.preprocess((value) => {
-  if (typeof value === "boolean") {
+  if (typeof value === 'boolean') {
     return value;
   }
 
-  if (typeof value === "string") {
+  if (typeof value === 'string') {
     const normalized = value.trim().toLowerCase();
-    if (normalized === "true") {
+    if (normalized === 'true') {
       return true;
     }
 
-    if (normalized === "false") {
+    if (normalized === 'false') {
       return false;
     }
   }
@@ -22,84 +22,103 @@ const booleanFromEnv = z.preprocess((value) => {
 const durationSchema = z
   .string()
   .trim()
-  .regex(/^\d+[smhdw]$/, "duration must use s, m, h, d, or w units");
+  .regex(/^\d+[smhdw]$/, 'duration must use s, m, h, d, or w units');
 
 export const envSchema = z
   .object({
-    NODE_ENV: z
-      .enum(["development", "test", "production"])
-      .default("development"),
+    NODE_ENV: z.enum(['development', 'test', 'production']).default('development'),
     PORT: z.coerce.number().int().positive().default(3000),
     DATABASE_URL: z
       .string()
       .trim()
-      .min(1, "DATABASE_URL is required")
-      .url("DATABASE_URL must be a valid URL"),
-    JWT_SECRET: z
-      .string()
-      .trim()
-      .min(16, "JWT_SECRET must be at least 16 characters"),
-    JWT_ACCESS_EXPIRES_IN: durationSchema.default("15m"),
-    JWT_REFRESH_EXPIRES_IN: durationSchema.default("7d"),
-    JWT_ISSUER: z.string().trim().min(1).default("foundation-starter"),
-    JWT_AUDIENCE: z.string().trim().min(1).default("foundation-api"),
+      .min(1, 'DATABASE_URL is required')
+      .url('DATABASE_URL must be a valid URL'),
+    JWT_SECRET: z.string().trim().min(32, 'JWT_SECRET must be at least 32 characters'),
+    JWT_ACCESS_EXPIRES_IN: durationSchema.default('15m'),
+    JWT_REFRESH_EXPIRES_IN: durationSchema.default('7d'),
+    JWT_ISSUER: z.string().trim().min(1).default('foundation-starter'),
+    JWT_AUDIENCE: z.string().trim().min(1).default('foundation-api'),
     AUTH_EMAIL_PASSWORD_ENABLED: booleanFromEnv.default(true),
     AUTH_GOOGLE_ENABLED: booleanFromEnv.default(false),
-    AUTH_GOOGLE_CLIENT_ID: z.string().trim().optional().default(""),
-    AUTH_GOOGLE_CLIENT_SECRET: z.string().trim().optional().default(""),
+    AUTH_GOOGLE_CLIENT_ID: z.string().trim().optional().default(''),
+    AUTH_GOOGLE_CLIENT_SECRET: z.string().trim().optional().default(''),
     AUTH_GOOGLE_CALLBACK_URL: z
       .string()
       .trim()
       .url()
-      .default("http://localhost:3000/auth/google/callback"),
+      .default('http://localhost:3000/auth/google/callback'),
     AUTH_GOOGLE_SUCCESS_REDIRECT_URL: z
       .string()
       .trim()
       .url()
-      .default("http://localhost:3000/auth/google/success"),
+      .default('http://localhost:3000/auth/google/success'),
     AUTH_GOOGLE_ERROR_REDIRECT_URL: z
       .string()
       .trim()
       .url()
-      .default("http://localhost:3000/auth/google/error"),
-    SESSION_SECRET: z.string().trim().optional().default(""),
+      .default('http://localhost:3000/auth/google/error'),
+    SESSION_SECRET: z.string().trim().optional().default(''),
     AUTH_FACEBOOK_ENABLED: booleanFromEnv.default(false),
     AUTH_MOBILE_OTP_ENABLED: booleanFromEnv.default(false),
     AUTH_MAGIC_LINK_ENABLED: booleanFromEnv.default(false),
+    CORS_ENABLED: booleanFromEnv.default(false),
+    CORS_ORIGINS: z.string().trim().optional().default(''),
+    CORS_CREDENTIALS: booleanFromEnv.default(false),
     RBAC_CACHE_TTL_SECONDS: z.coerce.number().int().positive().default(60),
-    ORG_CONTEXT_MODE: z.literal("path").default("path"),
+    ORG_CONTEXT_MODE: z.literal('path').default('path'),
   })
   .superRefine((env, ctx) => {
+    const corsOrigins = parseCorsOrigins(env.CORS_ORIGINS);
+
+    if (env.CORS_CREDENTIALS && corsOrigins.includes('*')) {
+      ctx.addIssue({
+        code: 'custom',
+        path: ['CORS_ORIGINS'],
+        message: 'CORS_ORIGINS cannot include * when CORS_CREDENTIALS=true',
+      });
+    }
+
     if (!env.AUTH_GOOGLE_ENABLED) {
       return;
     }
 
     if (!env.AUTH_GOOGLE_CLIENT_ID) {
       ctx.addIssue({
-        code: "custom",
-        path: ["AUTH_GOOGLE_CLIENT_ID"],
-        message:
-          "AUTH_GOOGLE_CLIENT_ID is required when AUTH_GOOGLE_ENABLED=true",
+        code: 'custom',
+        path: ['AUTH_GOOGLE_CLIENT_ID'],
+        message: 'AUTH_GOOGLE_CLIENT_ID is required when AUTH_GOOGLE_ENABLED=true',
       });
     }
 
     if (!env.AUTH_GOOGLE_CLIENT_SECRET) {
       ctx.addIssue({
-        code: "custom",
-        path: ["AUTH_GOOGLE_CLIENT_SECRET"],
-        message:
-          "AUTH_GOOGLE_CLIENT_SECRET is required when AUTH_GOOGLE_ENABLED=true",
+        code: 'custom',
+        path: ['AUTH_GOOGLE_CLIENT_SECRET'],
+        message: 'AUTH_GOOGLE_CLIENT_SECRET is required when AUTH_GOOGLE_ENABLED=true',
       });
     }
 
     if (env.SESSION_SECRET.length < 32) {
       ctx.addIssue({
-        code: "custom",
-        path: ["SESSION_SECRET"],
-        message:
-          "SESSION_SECRET must be at least 32 characters when AUTH_GOOGLE_ENABLED=true",
+        code: 'custom',
+        path: ['SESSION_SECRET'],
+        message: 'SESSION_SECRET must be at least 32 characters when AUTH_GOOGLE_ENABLED=true',
       });
     }
+
+    if (env.NODE_ENV === 'production') {
+      requireHttpsInProduction(ctx, 'AUTH_GOOGLE_CALLBACK_URL', env.AUTH_GOOGLE_CALLBACK_URL);
+      requireHttpsInProduction(
+        ctx,
+        'AUTH_GOOGLE_SUCCESS_REDIRECT_URL',
+        env.AUTH_GOOGLE_SUCCESS_REDIRECT_URL,
+      );
+      requireHttpsInProduction(
+        ctx,
+        'AUTH_GOOGLE_ERROR_REDIRECT_URL',
+        env.AUTH_GOOGLE_ERROR_REDIRECT_URL,
+      );
+    }
   });
 
 export type Env = z.infer<typeof envSchema>;
@@ -114,8 +133,8 @@ function parseEnv(config: Record<string, unknown>): Env {
   }
 
   const details = parsed.error.issues
-    .map((issue) => `- ${issue.path.join(".") || "env"}: ${issue.message}`)
-    .join("\n");
+    .map((issue) => `- ${issue.path.join('.') || 'env'}: ${issue.message}`)
+    .join('\n');
 
   throw new Error(`Environment validation failed:\n${details}`);
 }
@@ -129,3 +148,22 @@ export function getEnv(): Env {
   validatedEnv ??= parseEnv(process.env);
   return validatedEnv;
 }
+
+export function parseCorsOrigins(value: string) {
+  return value
+    .split(',')
+    .map((origin) => origin.trim())
+    .filter(Boolean);
+}
+
+function requireHttpsInProduction(ctx: z.RefinementCtx, key: string, value: string) {
+  if (new URL(value).protocol === 'https:') {
+    return;
+  }
+
+  ctx.addIssue({
+    code: 'custom',
+    path: [key],
+    message: `${key} must use https when Google OAuth is enabled in production.`,
+  });
+}

package/template/src/config/index.ts

@@ -1,5 +1,5 @@
-export { default as appConfig } from "./app.config";
-export { default as authConfig } from "./auth.config";
-export { default as databaseConfig } from "./database.config";
-export { default as rbacConfig } from "./rbac.config";
-export { validate } from "./env.validation";
+export { default as appConfig } from './app.config';
+export { default as authConfig } from './auth.config';
+export { default as databaseConfig } from './database.config';
+export { default as rbacConfig } from './rbac.config';
+export { validate } from './env.validation';

package/template/src/config/rbac.config.ts

@@ -1,6 +1,6 @@
-import { registerAs } from "@nestjs/config";
-import { getEnv } from "./env.validation";
+import { registerAs } from '@nestjs/config';
+import { getEnv } from './env.validation';
 
-export default registerAs("rbac", () => ({
+export default registerAs('rbac', () => ({
   cacheTtlSeconds: getEnv().RBAC_CACHE_TTL_SECONDS,
 }));

package/template/src/database/prisma/prisma-transaction.ts

@@ -1,4 +1,4 @@
-import { Prisma } from "@prisma/client";
+import { Prisma } from '@prisma/client';
 
 type TransactionOptions = {
   maxWait?: number;

package/template/src/database/prisma/prisma.module.ts

@@ -1,5 +1,5 @@
-import { Global, Module } from "@nestjs/common";
-import { PrismaService } from "./prisma.service";
+import { Global, Module } from '@nestjs/common';
+import { PrismaService } from './prisma.service';
 
 @Global()
 @Module({

package/template/src/database/prisma/prisma.service.ts

@@ -1,11 +1,8 @@
-import { Injectable, OnModuleDestroy, OnModuleInit } from "@nestjs/common";
-import { PrismaClient } from "@prisma/client";
+import { Injectable, OnModuleDestroy, OnModuleInit } from '@nestjs/common';
+import { PrismaClient } from '@prisma/client';
 
 @Injectable()
-export class PrismaService
-  extends PrismaClient
-  implements OnModuleInit, OnModuleDestroy
-{
+export class PrismaService extends PrismaClient implements OnModuleInit, OnModuleDestroy {
   async onModuleInit() {
     await this.$connect();
   }

package/template/src/main.ts

@@ -1,13 +1,26 @@
-import { ValidationPipe } from "@nestjs/common";
-import { ConfigService } from "@nestjs/config";
-import { NestFactory } from "@nestjs/core";
-import { DocumentBuilder, SwaggerModule } from "@nestjs/swagger";
-import { AppModule } from "./app.module";
-import { HttpExceptionFilter } from "./common/filters/http-exception.filter";
+import { ValidationPipe } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { NestFactory } from '@nestjs/core';
+import { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';
+import { AppModule } from './app.module';
+import { HttpExceptionFilter } from './common/filters/http-exception.filter';
 
 async function bootstrap() {
   const app = await NestFactory.create(AppModule);
   const config = app.get(ConfigService);
+  const cors = config.get<{
+    enabled: boolean;
+    origins: string[];
+    credentials: boolean;
+  }>('app.cors');
+
+  if (cors?.enabled) {
+    app.enableCors({
+      origin: cors.origins,
+      credentials: cors.credentials,
+    });
+  }
+
   app.enableShutdownHooks();
   app.useGlobalFilters(new HttpExceptionFilter());
 
@@ -22,21 +35,21 @@ async function bootstrap() {
   const document = SwaggerModule.createDocument(
     app,
     new DocumentBuilder()
-      .setTitle("Foundation Starter API")
+      .setTitle('Foundation Starter API')
       .setDescription(
-        "Modular-monolith starter API with auth, organisations, RBAC, audit, and settings.",
+        'Modular-monolith starter API with auth, organisations, RBAC, audit, and settings.',
       )
-      .setVersion("0.1.0")
+      .setVersion('0.1.0')
       .addBearerAuth()
       .build(),
   );
-  SwaggerModule.setup("docs", app, document, {
+  SwaggerModule.setup('docs', app, document, {
     swaggerOptions: {
       persistAuthorization: true,
     },
   });
 
-  await app.listen(config.get<number>("app.port") ?? 3000);
+  await app.listen(config.get<number>('app.port') ?? 3000);
 }
 
 void bootstrap();

package/template/src/modules/access-control/access-control.module.ts

@@ -1,17 +1,18 @@
-import { Global, Module } from "@nestjs/common";
-import { DiscoveryModule } from "@nestjs/core";
-import { AuthModule } from "../auth/auth.module";
-import { RouteRegistryValidator } from "./application/route-registry.validator";
-import { AbilityFactory } from "./application/services/ability.factory";
-import { AccessControlService } from "./application/services/access-control.service";
-import { PermissionGuard } from "./application/services/permission.guard";
-import { RbacCacheService } from "./application/services/rbac-cache.service";
-import { AccessControlController } from "./presentation/access-control.controller";
+import { Global, Module } from '@nestjs/common';
+import { DiscoveryModule } from '@nestjs/core';
+import { AuthModule } from '../auth/auth.module';
+import { RouteRegistryValidator } from './application/route-registry.validator';
+import { AbilityFactory } from './application/services/ability.factory';
+import { AccessControlService } from './application/services/access-control.service';
+import { PermissionGuard } from './application/services/permission.guard';
+import { RbacCacheService } from './application/services/rbac-cache.service';
+import { AccessControlController } from './presentation/access-control.controller';
+import { CurrentAccessControlController } from './presentation/current-access-control.controller';
 
 @Global()
 @Module({
   imports: [AuthModule, DiscoveryModule],
-  controllers: [AccessControlController],
+  controllers: [AccessControlController, CurrentAccessControlController],
   providers: [
     AbilityFactory,
     AccessControlService,

package/template/src/modules/access-control/application/role-permission-policy.ts

@@ -0,0 +1,71 @@
+import { ForbiddenException } from '@nestjs/common';
+
+/**
+ * Prevents privilege self-elevation: an actor may only assign or invite to a
+ * role whose permission set is a subset of the actor's own effective
+ * permissions. Organisation owners bypass the check.
+ *
+ * Both MembershipsService.assignRole and InvitationsService (create/resend)
+ * call this with the candidate role's permission keys and the actor's RBAC
+ * context, so a member holding only e.g. `roles.manage` / `memberships.invite`
+ * cannot grant a role carrying permissions they do not themselves hold.
+ */
+export function assertRoleWithinActorPermissions(args: {
+  actorIsOwner: boolean;
+  actorPermissionKeys: readonly string[];
+  rolePermissionKeys: readonly string[];
+}) {
+  if (args.actorIsOwner) {
+    return;
+  }
+
+  const heldKeys = new Set(args.actorPermissionKeys);
+  const exceeded = args.rolePermissionKeys.filter((key) => !heldKeys.has(key)).sort();
+
+  if (exceeded.length > 0) {
+    throw new ForbiddenException(
+      `You cannot grant a role with permissions you do not hold: ${exceeded.join(', ')}.`,
+    );
+  }
+}
+
+/**
+ * Prevents privilege escalation when a role's permission set is rewritten: a
+ * non-owner actor may only add or remove permission keys they themselves hold.
+ * Permission keys outside the actor's own set must stay unchanged — they can be
+ * neither granted nor revoked by someone who does not hold them. Owners bypass.
+ */
+export function assertPermissionChangeWithinActor(args: {
+  actorIsOwner: boolean;
+  actorPermissionKeys: readonly string[];
+  previousPermissionKeys: readonly string[];
+  nextPermissionKeys: readonly string[];
+}) {
+  if (args.actorIsOwner) {
+    return;
+  }
+
+  const previous = new Set(args.previousPermissionKeys);
+  const next = new Set(args.nextPermissionKeys);
+  const changed = new Set<string>();
+
+  for (const key of args.nextPermissionKeys) {
+    if (!previous.has(key)) {
+      changed.add(key);
+    }
+  }
+  for (const key of args.previousPermissionKeys) {
+    if (!next.has(key)) {
+      changed.add(key);
+    }
+  }
+
+  const heldKeys = new Set(args.actorPermissionKeys);
+  const exceeded = [...changed].filter((key) => !heldKeys.has(key)).sort();
+
+  if (exceeded.length > 0) {
+    throw new ForbiddenException(
+      `You cannot grant or revoke permissions you do not hold: ${exceeded.join(', ')}.`,
+    );
+  }
+}

package/template/src/modules/access-control/application/route-registry.validator.ts

@@ -1,17 +1,9 @@
-import {
-  Injectable,
-  OnApplicationBootstrap,
-  RequestMethod,
-} from "@nestjs/common";
-import { METHOD_METADATA, PATH_METADATA } from "@nestjs/common/constants";
-import { DiscoveryService, MetadataScanner, Reflector } from "@nestjs/core";
-import { REQUIRED_PERMISSIONS_KEY } from "../presentation/permissions.decorator";
-import {
-  PermissionKey,
-  permissionKeys,
-  RoutePermissionEntry,
-} from "../types/permission-key";
-import { routePermissionRegistry } from "../types/route-permission-registry";
+import { Injectable, OnApplicationBootstrap, RequestMethod } from '@nestjs/common';
+import { METHOD_METADATA, PATH_METADATA } from '@nestjs/common/constants';
+import { DiscoveryService, MetadataScanner, Reflector } from '@nestjs/core';
+import { REQUIRED_PERMISSIONS_KEY } from '../presentation/permissions.decorator';
+import { PermissionKey, permissionKeys, RoutePermissionEntry } from '../types/permission-key';
+import { routePermissionRegistry } from '../types/route-permission-registry';
 
 type ControllerInstance = Record<string, unknown>;
 type RouteHandler = (...args: unknown[]) => unknown;
@@ -33,28 +25,16 @@ export class RouteRegistryValidator implements OnApplicationBootstrap {
     const enforcedRoutes = this.discoverPermissionRoutes();
     const registryRoutes = routePermissionRegistry.map(normalizeEntry);
 
-    const enforcedByRoute = mapByRoute(
-      enforcedRoutes,
-      "enforced route metadata",
-    );
-    const registryByRoute = mapByRoute(
-      registryRoutes,
-      "routePermissionRegistry",
-    );
+    const enforcedByRoute = mapByRoute(enforcedRoutes, 'enforced route metadata');
+    const registryByRoute = mapByRoute(registryRoutes, 'routePermissionRegistry');
     const missingFromRegistry = enforcedRoutes.filter(
       (entry) => !registryByRoute.has(routeKey(entry)),
     );
     const staleRegistryEntries = registryRoutes.filter(
       (entry) => !enforcedByRoute.has(routeKey(entry)),
     );
-    const permissionMismatches = collectPermissionMismatches(
-      registryByRoute,
-      enforcedByRoute,
-    );
-    const unknownPermissions = collectUnknownPermissions([
-      ...registryRoutes,
-      ...enforcedRoutes,
-    ]);
+    const permissionMismatches = collectPermissionMismatches(registryByRoute, enforcedByRoute);
+    const unknownPermissions = collectUnknownPermissions([...registryRoutes, ...enforcedRoutes]);
 
     if (
       missingFromRegistry.length > 0 ||
@@ -83,16 +63,12 @@ export class RouteRegistryValidator implements OnApplicationBootstrap {
         continue;
       }
 
-      const controllerPaths = toPathParts(
-        this.reflector.get(PATH_METADATA, metatype),
-      );
+      const controllerPaths = toPathParts(this.reflector.get(PATH_METADATA, metatype));
       const prototype = Object.getPrototypeOf(instance) as object | null;
 
-      for (const methodName of this.metadataScanner.getAllMethodNames(
-        prototype,
-      )) {
+      for (const methodName of this.metadataScanner.getAllMethodNames(prototype)) {
         const handler = instance[methodName];
-        if (typeof handler !== "function") {
+        if (typeof handler !== 'function') {
           continue;
         }
 
@@ -112,9 +88,7 @@ export class RouteRegistryValidator implements OnApplicationBootstrap {
           continue;
         }
 
-        const methodPaths = toPathParts(
-          this.reflector.get(PATH_METADATA, handler),
-        );
+        const methodPaths = toPathParts(this.reflector.get(PATH_METADATA, handler));
         for (const path of combinePaths(controllerPaths, methodPaths)) {
           entries.push(
             normalizeEntry({
@@ -143,10 +117,7 @@ function collectPermissionMismatches(
       continue;
     }
 
-    if (
-      permissionListKey(registered.permissions) !==
-      permissionListKey(enforced.permissions)
-    ) {
+    if (permissionListKey(registered.permissions) !== permissionListKey(enforced.permissions)) {
       mismatches.push({
         key,
         registryPermissions: registered.permissions,
@@ -176,48 +147,48 @@ function formatRegistryDriftError({
   permissionMismatches: RoutePermissionDiff[];
   unknownPermissions: string[];
 }) {
-  const sections = ["Route permission registry drift detected."];
+  const sections = ['Route permission registry drift detected.'];
 
   if (missingFromRegistry.length > 0) {
     sections.push(
       [
-        "Permission-gated routes missing from routePermissionRegistry:",
+        'Permission-gated routes missing from routePermissionRegistry:',
         ...missingFromRegistry.map(formatEntry),
-      ].join("\n"),
+      ].join('\n'),
     );
   }
 
   if (staleRegistryEntries.length > 0) {
     sections.push(
       [
-        "routePermissionRegistry entries without matching permission-gated routes:",
+        'routePermissionRegistry entries without matching permission-gated routes:',
         ...staleRegistryEntries.map(formatEntry),
-      ].join("\n"),
+      ].join('\n'),
     );
   }
 
   if (permissionMismatches.length > 0) {
     sections.push(
       [
-        "routePermissionRegistry permission mismatches:",
+        'routePermissionRegistry permission mismatches:',
         ...permissionMismatches.map(
           (diff) =>
-            `- ${diff.key}: registry [${diff.registryPermissions.join(", ")}], enforced [${diff.enforcedPermissions.join(", ")}]`,
+            `- ${diff.key}: registry [${diff.registryPermissions.join(', ')}], enforced [${diff.enforcedPermissions.join(', ')}]`,
         ),
-      ].join("\n"),
+      ].join('\n'),
     );
   }
 
   if (unknownPermissions.length > 0) {
     sections.push(
       [
-        "Unknown permission keys referenced by guarded routes or routePermissionRegistry:",
+        'Unknown permission keys referenced by guarded routes or routePermissionRegistry:',
         ...unknownPermissions.map((permission) => `- ${permission}`),
-      ].join("\n"),
+      ].join('\n'),
     );
   }
 
-  return sections.join("\n\n");
+  return sections.join('\n\n');
 }
 
 function mapByRoute(entries: RoutePermissionEntry[], source: string) {
@@ -248,7 +219,7 @@ function combinePaths(controllerPaths: string[], methodPaths: string[]) {
 
   for (const controllerPath of controllerPaths) {
     for (const methodPath of methodPaths) {
-      paths.push(normalizePath([controllerPath, methodPath].join("/")));
+      paths.push(normalizePath([controllerPath, methodPath].join('/')));
     }
   }
 
@@ -257,19 +228,19 @@ function combinePaths(controllerPaths: string[], methodPaths: string[]) {
 
 function toPathParts(metadata: string | string[] | undefined) {
   if (Array.isArray(metadata)) {
-    return metadata.length > 0 ? metadata : [""];
+    return metadata.length > 0 ? metadata : [''];
   }
 
-  return [metadata ?? ""];
+  return [metadata ?? ''];
 }
 
 function normalizePath(path: string) {
   const trimmed = path
-    .split("/")
+    .split('/')
     .filter((part) => part.length > 0)
-    .join("/");
+    .join('/');
 
-  return trimmed ? `/${trimmed}` : "/";
+  return trimmed ? `/${trimmed}` : '/';
 }
 
 function requestMethodToString(method: RequestMethod) {
@@ -281,9 +252,9 @@ function routeKey(entry: RoutePermissionEntry) {
 }
 
 function permissionListKey(permissions: PermissionKey[]) {
-  return permissions.join("\0");
+  return permissions.join('\0');
 }
 
 function formatEntry(entry: RoutePermissionEntry) {
-  return `- ${routeKey(entry)} -> [${entry.permissions.join(", ")}]`;
+  return `- ${routeKey(entry)} -> [${entry.permissions.join(', ')}]`;
 }

package/template/src/modules/access-control/application/services/ability.factory.ts

@@ -1,11 +1,7 @@
-import {
-  AbilityBuilder,
-  createMongoAbility,
-  MongoAbility,
-} from "@casl/ability";
-import { Injectable } from "@nestjs/common";
-import { permissionKeyToRule } from "../../types/permission-key";
-import { RbacContext } from "../../types/rbac-context";
+import { AbilityBuilder, createMongoAbility, MongoAbility } from '@casl/ability';
+import { Injectable } from '@nestjs/common';
+import { permissionKeyToRule } from '../../types/permission-key';
+import { RbacContext } from '../../types/rbac-context';
 
 export type AppAbility = MongoAbility<[string, string]>;
 
@@ -15,7 +11,7 @@ export class AbilityFactory {
     const { can, build } = new AbilityBuilder<AppAbility>(createMongoAbility);
 
     if (context.isOwner) {
-      can("manage", "all");
+      can('manage', 'all');
     }
 
     for (const key of context.permissionKeys) {