@scryan7371/sdr-security 0.1.3 → 0.1.4

package/dist/api/migrations/1700000000001-add-refresh-tokens.js

@@ -7,12 +7,14 @@ class AddRefreshTokens1700000000001 {
         const userTableRef = getUserTableReference();
         await queryRunner.query(`
       CREATE TABLE "refresh_token" (
-        "id" varchar PRIMARY KEY NOT NULL,
+        "id" uuid PRIMARY KEY NOT NULL DEFAULT uuidv7(),
         "token_hash" varchar NOT NULL,
         "expires_at" timestamptz NOT NULL,
         "revoked_at" timestamptz,
-        "userId" varchar,
+        "userId" uuid,
         "created_at" timestamptz NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+        CONSTRAINT "CHK_refresh_token_id_uuidv7" CHECK ("id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
+        CONSTRAINT "CHK_refresh_token_userId_uuidv7" CHECK ("userId" IS NULL OR "userId"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
         CONSTRAINT "FK_refresh_token_user" FOREIGN KEY ("userId") REFERENCES ${userTableRef} ("id") ON DELETE CASCADE ON UPDATE NO ACTION
       )
     `);

package/dist/api/migrations/1739500000000-create-security-identity.js

@@ -8,11 +8,13 @@ class CreateSecurityIdentity1739500000000 {
         await queryRunner.query(`
       CREATE TABLE IF NOT EXISTS "security_identity" (
         "id" uuid PRIMARY KEY NOT NULL DEFAULT uuidv7(),
-        "user_id" varchar NOT NULL,
+        "user_id" uuid NOT NULL,
         "provider" varchar NOT NULL,
         "provider_subject" varchar NOT NULL,
         "created_at" timestamptz NOT NULL DEFAULT now(),
         "updated_at" timestamptz NOT NULL DEFAULT now(),
+        CONSTRAINT "CHK_security_identity_id_uuidv7" CHECK ("id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
+        CONSTRAINT "CHK_security_identity_user_id_uuidv7" CHECK ("user_id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
         CONSTRAINT "FK_security_identity_user_id" FOREIGN KEY ("user_id") REFERENCES ${userTableRef} ("id") ON DELETE CASCADE
       )
     `);

package/dist/api/migrations/1739510000000-create-security-roles.js

@@ -11,7 +11,8 @@ class CreateSecurityRoles1739510000000 {
         "description" text,
         "is_system" boolean NOT NULL DEFAULT false,
         "created_at" timestamptz NOT NULL DEFAULT now(),
-        "updated_at" timestamptz NOT NULL DEFAULT now()
+        "updated_at" timestamptz NOT NULL DEFAULT now(),
+        CONSTRAINT "CHK_security_role_id_uuidv7" CHECK ("id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$')
       )
     `);
         await queryRunner.query(`CREATE UNIQUE INDEX IF NOT EXISTS "IDX_security_role_key" ON "security_role" ("role_key")`);

package/dist/api/migrations/1739515000000-create-security-user-roles.js

@@ -8,9 +8,12 @@ class CreateSecurityUserRoles1739515000000 {
         await queryRunner.query(`
       CREATE TABLE IF NOT EXISTS "security_user_role" (
         "id" uuid PRIMARY KEY NOT NULL DEFAULT uuidv7(),
-        "user_id" varchar NOT NULL,
+        "user_id" uuid NOT NULL,
         "role_id" uuid NOT NULL,
         "created_at" timestamptz NOT NULL DEFAULT now(),
+        CONSTRAINT "CHK_security_user_role_id_uuidv7" CHECK ("id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
+        CONSTRAINT "CHK_security_user_role_user_id_uuidv7" CHECK ("user_id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
+        CONSTRAINT "CHK_security_user_role_role_id_uuidv7" CHECK ("role_id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
         CONSTRAINT "FK_security_user_role_user_id" FOREIGN KEY ("user_id") REFERENCES ${userTableRef} ("id") ON DELETE CASCADE,
         CONSTRAINT "FK_security_user_role_role_id" FOREIGN KEY ("role_id") REFERENCES "security_role" ("id") ON DELETE CASCADE
       )

package/dist/api/migrations/1739520000000-create-password-reset-tokens.js

@@ -8,11 +8,13 @@ class CreatePasswordResetTokens1739520000000 {
         await queryRunner.query(`
       CREATE TABLE IF NOT EXISTS "security_password_reset_token" (
         "id" uuid PRIMARY KEY NOT NULL DEFAULT uuidv7(),
-        "user_id" varchar NOT NULL,
+        "user_id" uuid NOT NULL,
         "token" varchar NOT NULL,
         "expires_at" timestamptz NOT NULL,
         "used_at" timestamptz,
         "created_at" timestamptz NOT NULL DEFAULT now(),
+        CONSTRAINT "CHK_security_password_reset_token_id_uuidv7" CHECK ("id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
+        CONSTRAINT "CHK_security_password_reset_token_user_id_uuidv7" CHECK ("user_id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
         CONSTRAINT "FK_security_password_reset_token_user_id" FOREIGN KEY ("user_id") REFERENCES ${userTableRef} ("id") ON DELETE CASCADE
       )
     `);

package/dist/api/migrations/1739530000000-create-security-user.js

@@ -7,13 +7,14 @@ class CreateSecurityUser1739530000000 {
         const userTableRef = getUserTableReference();
         await queryRunner.query(`
       CREATE TABLE IF NOT EXISTS "security_user" (
-        "user_id" varchar PRIMARY KEY NOT NULL,
+        "user_id" uuid PRIMARY KEY NOT NULL,
         "password_hash" varchar NOT NULL,
         "email_verified_at" timestamptz,
         "email_verification_token" varchar,
         "admin_approved_at" timestamptz,
         "is_active" boolean NOT NULL DEFAULT true,
         "created_at" timestamptz NOT NULL DEFAULT now(),
+        CONSTRAINT "CHK_security_user_user_id_uuidv7" CHECK ("user_id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
         CONSTRAINT "FK_security_user_user_id" FOREIGN KEY ("user_id") REFERENCES ${userTableRef} ("id") ON DELETE CASCADE
       )
     `);

package/dist/integration/database.integration.test.js

@@ -97,7 +97,7 @@ const resetSchemaBeforeRun = process.env.SECURITY_TEST_RESET_SCHEMA !== "false";
         await client.query(`SET search_path TO "${schema}", public`);
         await client.query(`
       CREATE TABLE IF NOT EXISTS "${schema}"."app_user" (
-        "id" varchar PRIMARY KEY NOT NULL,
+        "id" uuid PRIMARY KEY NOT NULL,
         "email" varchar NOT NULL
       )
     `);

package/dist/nest/entities/app-user.entity.js

@@ -17,7 +17,7 @@ let AppUserEntity = class AppUserEntity {
 };
 exports.AppUserEntity = AppUserEntity;
 __decorate([
-    (0, typeorm_1.PrimaryGeneratedColumn)("uuid"),
+    (0, typeorm_1.PrimaryColumn)({ type: "uuid" }),
     __metadata("design:type", String)
 ], AppUserEntity.prototype, "id", void 0);
 __decorate([

package/dist/nest/entities/password-reset-token.entity.d.ts

@@ -5,4 +5,5 @@ export declare class PasswordResetTokenEntity {
     expiresAt: Date;
     usedAt: Date | null;
     createdAt: Date;
+    ensureId(): void;
 }

package/dist/nest/entities/password-reset-token.entity.js

@@ -11,6 +11,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PasswordResetTokenEntity = void 0;
 const typeorm_1 = require("typeorm");
+const uuid_1 = require("uuid");
 let PasswordResetTokenEntity = class PasswordResetTokenEntity {
     id;
     userId;
@@ -18,14 +19,19 @@ let PasswordResetTokenEntity = class PasswordResetTokenEntity {
     expiresAt;
     usedAt;
     createdAt;
+    ensureId() {
+        if (!this.id) {
+            this.id = (0, uuid_1.v7)();
+        }
+    }
 };
 exports.PasswordResetTokenEntity = PasswordResetTokenEntity;
 __decorate([
-    (0, typeorm_1.PrimaryGeneratedColumn)("uuid"),
+    (0, typeorm_1.PrimaryColumn)({ type: "uuid" }),
     __metadata("design:type", String)
 ], PasswordResetTokenEntity.prototype, "id", void 0);
 __decorate([
-    (0, typeorm_1.Column)({ type: "varchar", name: "user_id" }),
+    (0, typeorm_1.Column)({ type: "uuid", name: "user_id" }),
     __metadata("design:type", String)
 ], PasswordResetTokenEntity.prototype, "userId", void 0);
 __decorate([
@@ -44,6 +50,12 @@ __decorate([
     (0, typeorm_1.CreateDateColumn)({ name: "created_at" }),
     __metadata("design:type", Date)
 ], PasswordResetTokenEntity.prototype, "createdAt", void 0);
+__decorate([
+    (0, typeorm_1.BeforeInsert)(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", void 0)
+], PasswordResetTokenEntity.prototype, "ensureId", null);
 exports.PasswordResetTokenEntity = PasswordResetTokenEntity = __decorate([
     (0, typeorm_1.Entity)({ name: "security_password_reset_token" })
 ], PasswordResetTokenEntity);

package/dist/nest/entities/refresh-token.entity.js

@@ -21,7 +21,7 @@ let RefreshTokenEntity = class RefreshTokenEntity {
 };
 exports.RefreshTokenEntity = RefreshTokenEntity;
 __decorate([
-    (0, typeorm_1.PrimaryColumn)({ type: "varchar" }),
+    (0, typeorm_1.PrimaryColumn)({ type: "uuid" }),
     __metadata("design:type", String)
 ], RefreshTokenEntity.prototype, "id", void 0);
 __decorate([
@@ -37,7 +37,7 @@ __decorate([
     __metadata("design:type", Object)
 ], RefreshTokenEntity.prototype, "revokedAt", void 0);
 __decorate([
-    (0, typeorm_1.Column)({ type: "varchar", name: "userId", nullable: true }),
+    (0, typeorm_1.Column)({ type: "uuid", name: "userId", nullable: true }),
     __metadata("design:type", Object)
 ], RefreshTokenEntity.prototype, "userId", void 0);
 __decorate([

package/dist/nest/entities/security-role.entity.d.ts

@@ -3,4 +3,5 @@ export declare class SecurityRoleEntity {
     roleKey: string;
     description: string | null;
     isSystem: boolean;
+    ensureId(): void;
 }

package/dist/nest/entities/security-role.entity.js

@@ -10,16 +10,22 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SecurityRoleEntity = void 0;
+const uuid_1 = require("uuid");
 const typeorm_1 = require("typeorm");
 let SecurityRoleEntity = class SecurityRoleEntity {
     id;
     roleKey;
     description;
     isSystem;
+    ensureId() {
+        if (!this.id) {
+            this.id = (0, uuid_1.v7)();
+        }
+    }
 };
 exports.SecurityRoleEntity = SecurityRoleEntity;
 __decorate([
-    (0, typeorm_1.PrimaryGeneratedColumn)("uuid"),
+    (0, typeorm_1.PrimaryColumn)({ type: "uuid" }),
     __metadata("design:type", String)
 ], SecurityRoleEntity.prototype, "id", void 0);
 __decorate([
@@ -34,6 +40,12 @@ __decorate([
     (0, typeorm_1.Column)({ type: "boolean", name: "is_system", default: false }),
     __metadata("design:type", Boolean)
 ], SecurityRoleEntity.prototype, "isSystem", void 0);
+__decorate([
+    (0, typeorm_1.BeforeInsert)(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", void 0)
+], SecurityRoleEntity.prototype, "ensureId", null);
 exports.SecurityRoleEntity = SecurityRoleEntity = __decorate([
     (0, typeorm_1.Entity)({ name: "security_role" })
 ], SecurityRoleEntity);

package/dist/nest/entities/security-user-role.entity.d.ts

@@ -2,4 +2,5 @@ export declare class SecurityUserRoleEntity {
     id: string;
     userId: string;
     roleId: string;
+    ensureId(): void;
 }

package/dist/nest/entities/security-user-role.entity.js

@@ -10,25 +10,37 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SecurityUserRoleEntity = void 0;
+const uuid_1 = require("uuid");
 const typeorm_1 = require("typeorm");
 let SecurityUserRoleEntity = class SecurityUserRoleEntity {
     id;
     userId;
     roleId;
+    ensureId() {
+        if (!this.id) {
+            this.id = (0, uuid_1.v7)();
+        }
+    }
 };
 exports.SecurityUserRoleEntity = SecurityUserRoleEntity;
 __decorate([
-    (0, typeorm_1.PrimaryGeneratedColumn)("uuid"),
+    (0, typeorm_1.PrimaryColumn)({ type: "uuid" }),
     __metadata("design:type", String)
 ], SecurityUserRoleEntity.prototype, "id", void 0);
 __decorate([
-    (0, typeorm_1.Column)({ type: "varchar", name: "user_id" }),
+    (0, typeorm_1.Column)({ type: "uuid", name: "user_id" }),
     __metadata("design:type", String)
 ], SecurityUserRoleEntity.prototype, "userId", void 0);
 __decorate([
     (0, typeorm_1.Column)({ type: "uuid", name: "role_id" }),
     __metadata("design:type", String)
 ], SecurityUserRoleEntity.prototype, "roleId", void 0);
+__decorate([
+    (0, typeorm_1.BeforeInsert)(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", void 0)
+], SecurityUserRoleEntity.prototype, "ensureId", null);
 exports.SecurityUserRoleEntity = SecurityUserRoleEntity = __decorate([
     (0, typeorm_1.Entity)({ name: "security_user_role" })
 ], SecurityUserRoleEntity);

package/dist/nest/entities/security-user.entity.js

@@ -22,7 +22,7 @@ let SecurityUserEntity = class SecurityUserEntity {
 };
 exports.SecurityUserEntity = SecurityUserEntity;
 __decorate([
-    (0, typeorm_1.PrimaryColumn)({ type: "varchar", name: "user_id" }),
+    (0, typeorm_1.PrimaryColumn)({ type: "uuid", name: "user_id" }),
     __metadata("design:type", String)
 ], SecurityUserEntity.prototype, "userId", void 0);
 __decorate([

package/dist/nest/security-auth.service.js

@@ -17,6 +17,7 @@ const common_1 = require("@nestjs/common");
 const crypto_1 = require("crypto");
 const bcryptjs_1 = require("bcryptjs");
 const jsonwebtoken_1 = require("jsonwebtoken");
+const uuid_1 = require("uuid");
 const typeorm_1 = require("@nestjs/typeorm");
 const typeorm_2 = require("typeorm");
 const roles_1 = require("../api/roles");
@@ -58,6 +59,7 @@ let SecurityAuthService = class SecurityAuthService {
             throw new common_1.BadRequestException("Email already in use");
         }
         const appUser = await this.appUsersRepo.save(this.appUsersRepo.create({
+            id: (0, uuid_1.v7)(),
             email,
         }));
         const securityUser = await this.securityUsersRepo.save(this.securityUsersRepo.create({
@@ -161,6 +163,7 @@ let SecurityAuthService = class SecurityAuthService {
         const expiresAt = new Date(Date.now() +
             (this.options.passwordResetTokenExpiresInMinutes ?? 30) * 60_000);
         await this.passwordResetRepo.save(this.passwordResetRepo.create({
+            id: (0, uuid_1.v7)(),
             userId: appUser.id,
             token,
             expiresAt,
@@ -220,7 +223,7 @@ let SecurityAuthService = class SecurityAuthService {
         const refreshTokenExpiresAt = new Date(Date.now() +
             (this.options.refreshTokenExpiresInDays ?? 30) * 24 * 60 * 60 * 1000);
         await this.refreshTokenRepo.save(this.refreshTokenRepo.create({
-            id: (0, crypto_1.randomUUID)(),
+            id: (0, uuid_1.v7)(),
             userId: appUser.id,
             tokenHash: refreshTokenHash,
             expiresAt: refreshTokenExpiresAt,

package/dist/nest/security-auth.service.test.js

@@ -8,11 +8,13 @@ vitest_1.vi.mock("bcryptjs", () => ({
 }));
 vitest_1.vi.mock("crypto", () => ({
     randomBytes: vitest_1.vi.fn(() => ({ toString: () => "token-bytes" })),
-    randomUUID: vitest_1.vi.fn(() => "uuid-1"),
 }));
 vitest_1.vi.mock("jsonwebtoken", () => ({
     sign: vitest_1.vi.fn(() => "signed-access-token"),
 }));
+vitest_1.vi.mock("uuid", () => ({
+    v7: vitest_1.vi.fn(() => "uuid-1"),
+}));
 const bcryptjs_1 = require("bcryptjs");
 const jsonwebtoken_1 = require("jsonwebtoken");
 const security_auth_service_1 = require("./security-auth.service");

package/dist/nest/security-workflows.service.js

@@ -16,6 +16,7 @@ exports.SecurityWorkflowsService = void 0;
 const common_1 = require("@nestjs/common");
 const typeorm_1 = require("@nestjs/typeorm");
 const typeorm_2 = require("typeorm");
+const uuid_1 = require("uuid");
 const contracts_1 = require("../api/contracts");
 const roles_1 = require("../api/roles");
 const app_user_entity_1 = require("./entities/app-user.entity");
@@ -94,6 +95,7 @@ let SecurityWorkflowsService = class SecurityWorkflowsService {
         let role = await this.rolesRepo.findOne({ where: { roleKey } });
         if (!role) {
             role = this.rolesRepo.create({
+                id: (0, uuid_1.v7)(),
                 roleKey,
                 description: description?.trim() || null,
                 isSystem: roleKey === contracts_1.ADMIN_ROLE,
@@ -139,6 +141,7 @@ let SecurityWorkflowsService = class SecurityWorkflowsService {
         await this.userRolesRepo.delete({ userId });
         if (roles.length > 0) {
             await this.userRolesRepo.save(roles.map((role) => this.userRolesRepo.create({
+                id: (0, uuid_1.v7)(),
                 userId,
                 roleId: role.id,
             })));
@@ -182,6 +185,7 @@ let SecurityWorkflowsService = class SecurityWorkflowsService {
             return;
         }
         await this.rolesRepo.save(missing.map((roleKey) => this.rolesRepo.create({
+            id: (0, uuid_1.v7)(),
             roleKey,
             description: null,
             isSystem: roleKey === contracts_1.ADMIN_ROLE,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scryan7371/sdr-security",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Reusable auth/security capability for API and app clients.",
   "main": "dist/index.js",
   "exports": {
@@ -34,7 +34,8 @@
   "dependencies": {
     "@babel/runtime": "7.28.6",
     "bcryptjs": "3.0.3",
-    "jsonwebtoken": "9.0.3"
+    "jsonwebtoken": "9.0.3",
+    "uuid": "11.1.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^11.0.0",

package/src/api/migrations/1700000000001-add-refresh-tokens.ts

@@ -8,12 +8,14 @@ export class AddRefreshTokens1700000000001 {
 
     await queryRunner.query(`
       CREATE TABLE "refresh_token" (
-        "id" varchar PRIMARY KEY NOT NULL,
+        "id" uuid PRIMARY KEY NOT NULL DEFAULT uuidv7(),
         "token_hash" varchar NOT NULL,
         "expires_at" timestamptz NOT NULL,
         "revoked_at" timestamptz,
-        "userId" varchar,
+        "userId" uuid,
         "created_at" timestamptz NOT NULL DEFAULT (CURRENT_TIMESTAMP),
+        CONSTRAINT "CHK_refresh_token_id_uuidv7" CHECK ("id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
+        CONSTRAINT "CHK_refresh_token_userId_uuidv7" CHECK ("userId" IS NULL OR "userId"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
         CONSTRAINT "FK_refresh_token_user" FOREIGN KEY ("userId") REFERENCES ${userTableRef} ("id") ON DELETE CASCADE ON UPDATE NO ACTION
       )
     `);

package/src/api/migrations/1739500000000-create-security-identity.ts

@@ -9,11 +9,13 @@ export class CreateSecurityIdentity1739500000000 {
     await queryRunner.query(`
       CREATE TABLE IF NOT EXISTS "security_identity" (
         "id" uuid PRIMARY KEY NOT NULL DEFAULT uuidv7(),
-        "user_id" varchar NOT NULL,
+        "user_id" uuid NOT NULL,
         "provider" varchar NOT NULL,
         "provider_subject" varchar NOT NULL,
         "created_at" timestamptz NOT NULL DEFAULT now(),
         "updated_at" timestamptz NOT NULL DEFAULT now(),
+        CONSTRAINT "CHK_security_identity_id_uuidv7" CHECK ("id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
+        CONSTRAINT "CHK_security_identity_user_id_uuidv7" CHECK ("user_id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
         CONSTRAINT "FK_security_identity_user_id" FOREIGN KEY ("user_id") REFERENCES ${userTableRef} ("id") ON DELETE CASCADE
       )
     `);

package/src/api/migrations/1739510000000-create-security-roles.ts

@@ -11,7 +11,8 @@ export class CreateSecurityRoles1739510000000 {
         "description" text,
         "is_system" boolean NOT NULL DEFAULT false,
         "created_at" timestamptz NOT NULL DEFAULT now(),
-        "updated_at" timestamptz NOT NULL DEFAULT now()
+        "updated_at" timestamptz NOT NULL DEFAULT now(),
+        CONSTRAINT "CHK_security_role_id_uuidv7" CHECK ("id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$')
       )
     `);
 

package/src/api/migrations/1739515000000-create-security-user-roles.ts

@@ -9,9 +9,12 @@ export class CreateSecurityUserRoles1739515000000 {
     await queryRunner.query(`
       CREATE TABLE IF NOT EXISTS "security_user_role" (
         "id" uuid PRIMARY KEY NOT NULL DEFAULT uuidv7(),
-        "user_id" varchar NOT NULL,
+        "user_id" uuid NOT NULL,
         "role_id" uuid NOT NULL,
         "created_at" timestamptz NOT NULL DEFAULT now(),
+        CONSTRAINT "CHK_security_user_role_id_uuidv7" CHECK ("id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
+        CONSTRAINT "CHK_security_user_role_user_id_uuidv7" CHECK ("user_id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
+        CONSTRAINT "CHK_security_user_role_role_id_uuidv7" CHECK ("role_id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
         CONSTRAINT "FK_security_user_role_user_id" FOREIGN KEY ("user_id") REFERENCES ${userTableRef} ("id") ON DELETE CASCADE,
         CONSTRAINT "FK_security_user_role_role_id" FOREIGN KEY ("role_id") REFERENCES "security_role" ("id") ON DELETE CASCADE
       )

package/src/api/migrations/1739520000000-create-password-reset-tokens.ts

@@ -9,11 +9,13 @@ export class CreatePasswordResetTokens1739520000000 {
     await queryRunner.query(`
       CREATE TABLE IF NOT EXISTS "security_password_reset_token" (
         "id" uuid PRIMARY KEY NOT NULL DEFAULT uuidv7(),
-        "user_id" varchar NOT NULL,
+        "user_id" uuid NOT NULL,
         "token" varchar NOT NULL,
         "expires_at" timestamptz NOT NULL,
         "used_at" timestamptz,
         "created_at" timestamptz NOT NULL DEFAULT now(),
+        CONSTRAINT "CHK_security_password_reset_token_id_uuidv7" CHECK ("id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
+        CONSTRAINT "CHK_security_password_reset_token_user_id_uuidv7" CHECK ("user_id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
         CONSTRAINT "FK_security_password_reset_token_user_id" FOREIGN KEY ("user_id") REFERENCES ${userTableRef} ("id") ON DELETE CASCADE
       )
     `);

package/src/api/migrations/1739530000000-create-security-user.ts

@@ -8,13 +8,14 @@ export class CreateSecurityUser1739530000000 {
 
     await queryRunner.query(`
       CREATE TABLE IF NOT EXISTS "security_user" (
-        "user_id" varchar PRIMARY KEY NOT NULL,
+        "user_id" uuid PRIMARY KEY NOT NULL,
         "password_hash" varchar NOT NULL,
         "email_verified_at" timestamptz,
         "email_verification_token" varchar,
         "admin_approved_at" timestamptz,
         "is_active" boolean NOT NULL DEFAULT true,
         "created_at" timestamptz NOT NULL DEFAULT now(),
+        CONSTRAINT "CHK_security_user_user_id_uuidv7" CHECK ("user_id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
         CONSTRAINT "FK_security_user_user_id" FOREIGN KEY ("user_id") REFERENCES ${userTableRef} ("id") ON DELETE CASCADE
       )
     `);

package/src/integration/database.integration.test.ts

@@ -121,7 +121,7 @@ describe("database integration", () => {
     await client.query(`SET search_path TO "${schema}", public`);
     await client.query(`
       CREATE TABLE IF NOT EXISTS "${schema}"."app_user" (
-        "id" varchar PRIMARY KEY NOT NULL,
+        "id" uuid PRIMARY KEY NOT NULL,
         "email" varchar NOT NULL
       )
     `);

package/src/nest/entities/app-user.entity.ts

@@ -1,8 +1,8 @@
-import { Column, Entity, PrimaryGeneratedColumn } from "typeorm";
+import { Column, Entity, PrimaryColumn } from "typeorm";
 
 @Entity({ name: "app_user" })
 export class AppUserEntity {
-  @PrimaryGeneratedColumn("uuid")
+  @PrimaryColumn({ type: "uuid" })
   id!: string;
 
   @Column({ type: "varchar" })

package/src/nest/entities/password-reset-token.entity.ts

@@ -1,16 +1,18 @@
 import {
+  BeforeInsert,
   Column,
   CreateDateColumn,
   Entity,
-  PrimaryGeneratedColumn,
+  PrimaryColumn,
 } from "typeorm";
+import { v7 as uuidv7 } from "uuid";
 
 @Entity({ name: "security_password_reset_token" })
 export class PasswordResetTokenEntity {
-  @PrimaryGeneratedColumn("uuid")
+  @PrimaryColumn({ type: "uuid" })
   id!: string;
 
-  @Column({ type: "varchar", name: "user_id" })
+  @Column({ type: "uuid", name: "user_id" })
   userId!: string;
 
   @Column({ type: "varchar", unique: true })
@@ -24,4 +26,11 @@ export class PasswordResetTokenEntity {
 
   @CreateDateColumn({ name: "created_at" })
   createdAt!: Date;
+
+  @BeforeInsert()
+  ensureId() {
+    if (!this.id) {
+      this.id = uuidv7();
+    }
+  }
 }

package/src/nest/entities/refresh-token.entity.ts

@@ -2,7 +2,7 @@ import { Column, CreateDateColumn, Entity, PrimaryColumn } from "typeorm";
 
 @Entity({ name: "refresh_token" })
 export class RefreshTokenEntity {
-  @PrimaryColumn({ type: "varchar" })
+  @PrimaryColumn({ type: "uuid" })
   id!: string;
 
   @Column({ type: "varchar", name: "token_hash" })
@@ -14,7 +14,7 @@ export class RefreshTokenEntity {
   @Column({ type: "timestamptz", name: "revoked_at", nullable: true })
   revokedAt!: Date | null;
 
-  @Column({ type: "varchar", name: "userId", nullable: true })
+  @Column({ type: "uuid", name: "userId", nullable: true })
   userId!: string | null;
 
   @CreateDateColumn({ name: "created_at" })

package/src/nest/entities/security-role.entity.ts

@@ -1,8 +1,9 @@
-import { Column, Entity, PrimaryGeneratedColumn } from "typeorm";
+import { v7 as uuidv7 } from "uuid";
+import { BeforeInsert, Column, Entity, PrimaryColumn } from "typeorm";
 
 @Entity({ name: "security_role" })
 export class SecurityRoleEntity {
-  @PrimaryGeneratedColumn("uuid")
+  @PrimaryColumn({ type: "uuid" })
   id!: string;
 
   @Column({ type: "varchar", name: "role_key", unique: true })
@@ -13,4 +14,11 @@ export class SecurityRoleEntity {
 
   @Column({ type: "boolean", name: "is_system", default: false })
   isSystem!: boolean;
+
+  @BeforeInsert()
+  ensureId() {
+    if (!this.id) {
+      this.id = uuidv7();
+    }
+  }
 }

package/src/nest/entities/security-user-role.entity.ts

@@ -1,13 +1,21 @@
-import { Column, Entity, PrimaryGeneratedColumn } from "typeorm";
+import { v7 as uuidv7 } from "uuid";
+import { BeforeInsert, Column, Entity, PrimaryColumn } from "typeorm";
 
 @Entity({ name: "security_user_role" })
 export class SecurityUserRoleEntity {
-  @PrimaryGeneratedColumn("uuid")
+  @PrimaryColumn({ type: "uuid" })
   id!: string;
 
-  @Column({ type: "varchar", name: "user_id" })
+  @Column({ type: "uuid", name: "user_id" })
   userId!: string;
 
   @Column({ type: "uuid", name: "role_id" })
   roleId!: string;
+
+  @BeforeInsert()
+  ensureId() {
+    if (!this.id) {
+      this.id = uuidv7();
+    }
+  }
 }

package/src/nest/entities/security-user.entity.ts

@@ -2,7 +2,7 @@ import { Column, CreateDateColumn, Entity, PrimaryColumn } from "typeorm";
 
 @Entity({ name: "security_user" })
 export class SecurityUserEntity {
-  @PrimaryColumn({ type: "varchar", name: "user_id" })
+  @PrimaryColumn({ type: "uuid", name: "user_id" })
   userId!: string;
 
   @Column({ type: "varchar", name: "password_hash" })

package/src/nest/security-auth.service.test.ts

@@ -10,13 +10,16 @@ vi.mock("bcryptjs", () => ({
 
 vi.mock("crypto", () => ({
   randomBytes: vi.fn(() => ({ toString: () => "token-bytes" })),
-  randomUUID: vi.fn(() => "uuid-1"),
 }));
 
 vi.mock("jsonwebtoken", () => ({
   sign: vi.fn(() => "signed-access-token"),
 }));
 
+vi.mock("uuid", () => ({
+  v7: vi.fn(() => "uuid-1"),
+}));
+
 import { compare } from "bcryptjs";
 import { sign } from "jsonwebtoken";
 import { SecurityAuthService } from "./security-auth.service";

package/src/nest/security-auth.service.ts

@@ -4,9 +4,10 @@ import {
   Injectable,
   UnauthorizedException,
 } from "@nestjs/common";
-import { randomBytes, randomUUID } from "crypto";
+import { randomBytes } from "crypto";
 import { compare, hash } from "bcryptjs";
 import { sign, type SignOptions } from "jsonwebtoken";
+import { v7 as uuidv7 } from "uuid";
 import { InjectRepository } from "@nestjs/typeorm";
 import { In, IsNull, Repository } from "typeorm";
 import { AuthResponse, RegisterResponse } from "../api/contracts";
@@ -60,6 +61,7 @@ export class SecurityAuthService {
 
     const appUser = await this.appUsersRepo.save(
       this.appUsersRepo.create({
+        id: uuidv7(),
         email,
       }),
     );
@@ -195,6 +197,7 @@ export class SecurityAuthService {
     );
     await this.passwordResetRepo.save(
       this.passwordResetRepo.create({
+        id: uuidv7(),
         userId: appUser.id,
         token,
         expiresAt,
@@ -283,7 +286,7 @@ export class SecurityAuthService {
 
     await this.refreshTokenRepo.save(
       this.refreshTokenRepo.create({
-        id: randomUUID(),
+        id: uuidv7(),
         userId: appUser.id,
         tokenHash: refreshTokenHash,
         expiresAt: refreshTokenExpiresAt,

package/src/nest/security-workflows.service.ts

@@ -1,6 +1,7 @@
 import { Inject, Injectable, NotFoundException } from "@nestjs/common";
 import { InjectRepository } from "@nestjs/typeorm";
 import { In, Repository } from "typeorm";
+import { v7 as uuidv7 } from "uuid";
 import { ADMIN_ROLE } from "../api/contracts";
 import { normalizeRoleName } from "../api/roles";
 import { AppUserEntity } from "./entities/app-user.entity";
@@ -106,6 +107,7 @@ export class SecurityWorkflowsService {
     let role = await this.rolesRepo.findOne({ where: { roleKey } });
     if (!role) {
       role = this.rolesRepo.create({
+        id: uuidv7(),
         roleKey,
         description: description?.trim() || null,
         isSystem: roleKey === ADMIN_ROLE,
@@ -158,6 +160,7 @@ export class SecurityWorkflowsService {
       await this.userRolesRepo.save(
         roles.map((role) =>
           this.userRolesRepo.create({
+            id: uuidv7(),
             userId,
             roleId: role.id,
           }),
@@ -210,6 +213,7 @@ export class SecurityWorkflowsService {
     await this.rolesRepo.save(
       missing.map((roleKey) =>
         this.rolesRepo.create({
+          id: uuidv7(),
           roleKey,
           description: null,
           isSystem: roleKey === ADMIN_ROLE,