@scryan7371/sdr-security 0.1.4 → 0.1.5

package/dist/api/migrations/1700000000001-add-refresh-tokens.js

@@ -13,8 +13,6 @@ class AddRefreshTokens1700000000001 {
         "revoked_at" timestamptz,
         "userId" uuid,
         "created_at" timestamptz NOT NULL DEFAULT (CURRENT_TIMESTAMP),
-        CONSTRAINT "CHK_refresh_token_id_uuidv7" CHECK ("id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
-        CONSTRAINT "CHK_refresh_token_userId_uuidv7" CHECK ("userId" IS NULL OR "userId"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
         CONSTRAINT "FK_refresh_token_user" FOREIGN KEY ("userId") REFERENCES ${userTableRef} ("id") ON DELETE CASCADE ON UPDATE NO ACTION
       )
     `);

package/dist/api/migrations/1739490000000-create-app-user.d.ts

@@ -0,0 +1,9 @@
+export declare class CreateAppUser1739490000000 {
+    name: string;
+    up(queryRunner: {
+        query: (sql: string) => Promise<unknown>;
+    }): Promise<void>;
+    down(queryRunner: {
+        query: (sql: string) => Promise<unknown>;
+    }): Promise<void>;
+}

package/dist/api/migrations/1739490000000-create-app-user.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreateAppUser1739490000000 = void 0;
+class CreateAppUser1739490000000 {
+    name = "CreateAppUser1739490000000";
+    async up(queryRunner) {
+        const userTableRef = getUserTableReference();
+        await queryRunner.query(`
+      CREATE TABLE IF NOT EXISTS ${userTableRef} (
+        "id" uuid PRIMARY KEY NOT NULL,
+        "email" varchar NOT NULL
+      )
+    `);
+    }
+    async down(queryRunner) {
+        const userTableRef = getUserTableReference();
+        await queryRunner.query(`DROP TABLE IF EXISTS ${userTableRef}`);
+    }
+}
+exports.CreateAppUser1739490000000 = CreateAppUser1739490000000;
+const getSafeIdentifier = (value, fallback) => {
+    const resolved = value?.trim() || fallback;
+    if (!resolved || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(resolved)) {
+        throw new Error(`Invalid SQL identifier: ${resolved}`);
+    }
+    return resolved;
+};
+const getUserTableReference = () => {
+    const table = getSafeIdentifier(process.env.USER_TABLE, "app_user");
+    const schema = process.env.USER_TABLE_SCHEMA
+        ? getSafeIdentifier(process.env.USER_TABLE_SCHEMA, "public")
+        : "public";
+    return `"${schema}"."${table}"`;
+};

package/dist/api/migrations/1739500000000-create-security-identity.js

@@ -13,8 +13,6 @@ class CreateSecurityIdentity1739500000000 {
         "provider_subject" varchar NOT NULL,
         "created_at" timestamptz NOT NULL DEFAULT now(),
         "updated_at" timestamptz NOT NULL DEFAULT now(),
-        CONSTRAINT "CHK_security_identity_id_uuidv7" CHECK ("id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
-        CONSTRAINT "CHK_security_identity_user_id_uuidv7" CHECK ("user_id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
         CONSTRAINT "FK_security_identity_user_id" FOREIGN KEY ("user_id") REFERENCES ${userTableRef} ("id") ON DELETE CASCADE
       )
     `);

package/dist/api/migrations/1739510000000-create-security-roles.js

@@ -11,8 +11,7 @@ class CreateSecurityRoles1739510000000 {
         "description" text,
         "is_system" boolean NOT NULL DEFAULT false,
         "created_at" timestamptz NOT NULL DEFAULT now(),
-        "updated_at" timestamptz NOT NULL DEFAULT now(),
-        CONSTRAINT "CHK_security_role_id_uuidv7" CHECK ("id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$')
+        "updated_at" timestamptz NOT NULL DEFAULT now()
       )
     `);
         await queryRunner.query(`CREATE UNIQUE INDEX IF NOT EXISTS "IDX_security_role_key" ON "security_role" ("role_key")`);

package/dist/api/migrations/1739515000000-create-security-user-roles.js

@@ -11,9 +11,6 @@ class CreateSecurityUserRoles1739515000000 {
         "user_id" uuid NOT NULL,
         "role_id" uuid NOT NULL,
         "created_at" timestamptz NOT NULL DEFAULT now(),
-        CONSTRAINT "CHK_security_user_role_id_uuidv7" CHECK ("id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
-        CONSTRAINT "CHK_security_user_role_user_id_uuidv7" CHECK ("user_id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
-        CONSTRAINT "CHK_security_user_role_role_id_uuidv7" CHECK ("role_id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
         CONSTRAINT "FK_security_user_role_user_id" FOREIGN KEY ("user_id") REFERENCES ${userTableRef} ("id") ON DELETE CASCADE,
         CONSTRAINT "FK_security_user_role_role_id" FOREIGN KEY ("role_id") REFERENCES "security_role" ("id") ON DELETE CASCADE
       )

package/dist/api/migrations/1739520000000-create-password-reset-tokens.js

@@ -13,8 +13,6 @@ class CreatePasswordResetTokens1739520000000 {
         "expires_at" timestamptz NOT NULL,
         "used_at" timestamptz,
         "created_at" timestamptz NOT NULL DEFAULT now(),
-        CONSTRAINT "CHK_security_password_reset_token_id_uuidv7" CHECK ("id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
-        CONSTRAINT "CHK_security_password_reset_token_user_id_uuidv7" CHECK ("user_id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
         CONSTRAINT "FK_security_password_reset_token_user_id" FOREIGN KEY ("user_id") REFERENCES ${userTableRef} ("id") ON DELETE CASCADE
       )
     `);

package/dist/api/migrations/1739530000000-create-security-user.js

@@ -14,7 +14,6 @@ class CreateSecurityUser1739530000000 {
         "admin_approved_at" timestamptz,
         "is_active" boolean NOT NULL DEFAULT true,
         "created_at" timestamptz NOT NULL DEFAULT now(),
-        CONSTRAINT "CHK_security_user_user_id_uuidv7" CHECK ("user_id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
         CONSTRAINT "FK_security_user_user_id" FOREIGN KEY ("user_id") REFERENCES ${userTableRef} ("id") ON DELETE CASCADE
       )
     `);

package/dist/api/migrations/index.d.ts

@@ -1,8 +1,10 @@
+import { CreateAppUser1739490000000 } from "./1739490000000-create-app-user";
 import { AddRefreshTokens1700000000001 } from "./1700000000001-add-refresh-tokens";
 import { CreateSecurityIdentity1739500000000 } from "./1739500000000-create-security-identity";
 import { CreateSecurityRoles1739510000000 } from "./1739510000000-create-security-roles";
 import { CreateSecurityUserRoles1739515000000 } from "./1739515000000-create-security-user-roles";
 import { CreatePasswordResetTokens1739520000000 } from "./1739520000000-create-password-reset-tokens";
 import { CreateSecurityUser1739530000000 } from "./1739530000000-create-security-user";
-export declare const securityMigrations: (typeof AddRefreshTokens1700000000001)[];
-export { AddRefreshTokens1700000000001, CreateSecurityIdentity1739500000000, CreateSecurityRoles1739510000000, CreateSecurityUserRoles1739515000000, CreatePasswordResetTokens1739520000000, CreateSecurityUser1739530000000, };
+export declare const allMigrations: (typeof CreateAppUser1739490000000)[];
+export declare const securityMigrations: (typeof CreateAppUser1739490000000)[];
+export { CreateAppUser1739490000000, AddRefreshTokens1700000000001, CreateSecurityIdentity1739500000000, CreateSecurityRoles1739510000000, CreateSecurityUserRoles1739515000000, CreatePasswordResetTokens1739520000000, CreateSecurityUser1739530000000, };

package/dist/api/migrations/index.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CreateSecurityUser1739530000000 = exports.CreatePasswordResetTokens1739520000000 = exports.CreateSecurityUserRoles1739515000000 = exports.CreateSecurityRoles1739510000000 = exports.CreateSecurityIdentity1739500000000 = exports.AddRefreshTokens1700000000001 = exports.securityMigrations = void 0;
+exports.CreateSecurityUser1739530000000 = exports.CreatePasswordResetTokens1739520000000 = exports.CreateSecurityUserRoles1739515000000 = exports.CreateSecurityRoles1739510000000 = exports.CreateSecurityIdentity1739500000000 = exports.AddRefreshTokens1700000000001 = exports.CreateAppUser1739490000000 = exports.securityMigrations = exports.allMigrations = void 0;
+const _1739490000000_create_app_user_1 = require("./1739490000000-create-app-user");
+Object.defineProperty(exports, "CreateAppUser1739490000000", { enumerable: true, get: function () { return _1739490000000_create_app_user_1.CreateAppUser1739490000000; } });
 const _1700000000001_add_refresh_tokens_1 = require("./1700000000001-add-refresh-tokens");
 Object.defineProperty(exports, "AddRefreshTokens1700000000001", { enumerable: true, get: function () { return _1700000000001_add_refresh_tokens_1.AddRefreshTokens1700000000001; } });
 const _1739500000000_create_security_identity_1 = require("./1739500000000-create-security-identity");
@@ -13,7 +15,8 @@ const _1739520000000_create_password_reset_tokens_1 = require("./1739520000000-c
 Object.defineProperty(exports, "CreatePasswordResetTokens1739520000000", { enumerable: true, get: function () { return _1739520000000_create_password_reset_tokens_1.CreatePasswordResetTokens1739520000000; } });
 const _1739530000000_create_security_user_1 = require("./1739530000000-create-security-user");
 Object.defineProperty(exports, "CreateSecurityUser1739530000000", { enumerable: true, get: function () { return _1739530000000_create_security_user_1.CreateSecurityUser1739530000000; } });
-exports.securityMigrations = [
+exports.allMigrations = [
+    _1739490000000_create_app_user_1.CreateAppUser1739490000000,
     _1700000000001_add_refresh_tokens_1.AddRefreshTokens1700000000001,
     _1739500000000_create_security_identity_1.CreateSecurityIdentity1739500000000,
     _1739510000000_create_security_roles_1.CreateSecurityRoles1739510000000,
@@ -21,3 +24,4 @@ exports.securityMigrations = [
     _1739520000000_create_password_reset_tokens_1.CreatePasswordResetTokens1739520000000,
     _1739530000000_create_security_user_1.CreateSecurityUser1739530000000,
 ];
+exports.securityMigrations = exports.allMigrations.filter((migration) => migration !== _1739490000000_create_app_user_1.CreateAppUser1739490000000);

package/dist/api/migrations/migrations.test.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const vitest_1 = require("vitest");
+const _1739490000000_create_app_user_1 = require("./1739490000000-create-app-user");
 const _1700000000001_add_refresh_tokens_1 = require("./1700000000001-add-refresh-tokens");
 const _1739500000000_create_security_identity_1 = require("./1739500000000-create-security-identity");
 const _1739510000000_create_security_roles_1 = require("./1739510000000-create-security-roles");
@@ -14,6 +15,18 @@ const originalEnv = { ...process.env };
     vitest_1.vi.restoreAllMocks();
 });
 (0, vitest_1.describe)("security migrations", () => {
+    (0, vitest_1.it)("exports all migration list for test/dev", () => {
+        (0, vitest_1.expect)(index_1.allMigrations.length).toBe(7);
+        (0, vitest_1.expect)(index_1.allMigrations).toEqual([
+            _1739490000000_create_app_user_1.CreateAppUser1739490000000,
+            _1700000000001_add_refresh_tokens_1.AddRefreshTokens1700000000001,
+            _1739500000000_create_security_identity_1.CreateSecurityIdentity1739500000000,
+            _1739510000000_create_security_roles_1.CreateSecurityRoles1739510000000,
+            _1739515000000_create_security_user_roles_1.CreateSecurityUserRoles1739515000000,
+            _1739520000000_create_password_reset_tokens_1.CreatePasswordResetTokens1739520000000,
+            _1739530000000_create_security_user_1.CreateSecurityUser1739530000000,
+        ]);
+    });
     (0, vitest_1.it)("exports migration list", () => {
         (0, vitest_1.expect)(index_1.securityMigrations.length).toBe(6);
         (0, vitest_1.expect)(index_1.securityMigrations).toEqual([
@@ -25,6 +38,14 @@ const originalEnv = { ...process.env };
             _1739530000000_create_security_user_1.CreateSecurityUser1739530000000,
         ]);
     });
+    (0, vitest_1.it)("runs app user migration up/down", async () => {
+        const query = vitest_1.vi.fn().mockResolvedValue(undefined);
+        const migration = new _1739490000000_create_app_user_1.CreateAppUser1739490000000();
+        await migration.up({ query });
+        await migration.down({ query });
+        (0, vitest_1.expect)(query).toHaveBeenCalledWith(vitest_1.expect.stringContaining('CREATE TABLE IF NOT EXISTS "public"."app_user"'));
+        (0, vitest_1.expect)(query).toHaveBeenCalledWith(vitest_1.expect.stringContaining('DROP TABLE IF EXISTS "public"."app_user"'));
+    });
     (0, vitest_1.it)("runs refresh token migration up/down", async () => {
         const query = vitest_1.vi.fn().mockResolvedValue(undefined);
         const migration = new _1700000000001_add_refresh_tokens_1.AddRefreshTokens1700000000001();

package/dist/integration/database.integration.test.js

@@ -95,15 +95,9 @@ const resetSchemaBeforeRun = process.env.SECURITY_TEST_RESET_SCHEMA !== "false";
         }
         await client.query(`CREATE SCHEMA IF NOT EXISTS "${schema}"`);
         await client.query(`SET search_path TO "${schema}", public`);
-        await client.query(`
-      CREATE TABLE IF NOT EXISTS "${schema}"."app_user" (
-        "id" uuid PRIMARY KEY NOT NULL,
-        "email" varchar NOT NULL
-      )
-    `);
         process.env.USER_TABLE = "app_user";
         process.env.USER_TABLE_SCHEMA = schema;
-        for (const Migration of migrations_1.securityMigrations) {
+        for (const Migration of migrations_1.allMigrations) {
             await new Migration().up(runner);
         }
     });
@@ -112,10 +106,9 @@ const resetSchemaBeforeRun = process.env.SECURITY_TEST_RESET_SCHEMA !== "false";
             return;
         }
         if (!keepSchemaForDebug) {
-            for (const Migration of [...migrations_1.securityMigrations].reverse()) {
+            for (const Migration of [...migrations_1.allMigrations].reverse()) {
                 await new Migration().down(runner);
             }
-            await client.query(`DROP TABLE IF EXISTS "${schema}"."app_user"`);
             await client.query(`DROP SCHEMA IF EXISTS "${schema}" CASCADE`);
         }
         await client.end();

package/dist/nest/security-workflows.controller.d.ts

@@ -49,23 +49,23 @@ export declare class SecurityWorkflowsController {
     } | {
         success: true;
     }>;
-    getUserRoles(id: string): Promise<{
+    getUserRoles(userId: string): Promise<{
         userId: string;
         roles: string[];
     }>;
-    setUserRoles(id: string, body: {
+    setUserRoles(userId: string, body: {
         roles?: string[];
     }): Promise<{
         userId: string;
         roles: string[];
     }>;
-    assignUserRole(id: string, body: {
+    assignUserRole(userId: string, body: {
         role?: string;
     }): Promise<{
         userId: string;
         roles: string[];
     }>;
-    removeUserRole(id: string, role: string): Promise<{
+    removeUserRole(userId: string, role: string): Promise<{
         userId: string;
         roles: string[];
     }>;

package/dist/nest/security-workflows.controller.js

@@ -53,23 +53,23 @@ let SecurityWorkflowsController = class SecurityWorkflowsController {
     async removeRole(role) {
         return this.workflowsService.removeRole(role);
     }
-    async getUserRoles(id) {
-        return this.workflowsService.getUserRoles(id);
+    async getUserRoles(userId) {
+        return this.workflowsService.getUserRoles(userId);
     }
-    async setUserRoles(id, body) {
+    async setUserRoles(userId, body) {
         if (!Array.isArray(body.roles)) {
             throw new common_1.BadRequestException("roles must be an array");
         }
-        return this.workflowsService.setUserRoles(id, body.roles);
+        return this.workflowsService.setUserRoles(userId, body.roles);
     }
-    async assignUserRole(id, body) {
+    async assignUserRole(userId, body) {
         if (!body.role || !body.role.trim()) {
             throw new common_1.BadRequestException("role is required");
         }
-        return this.workflowsService.assignRoleToUser(id, body.role);
+        return this.workflowsService.assignRoleToUser(userId, body.role);
     }
-    async removeUserRole(id, role) {
-        return this.workflowsService.removeRoleFromUser(id, role);
+    async removeUserRole(userId, role) {
+        return this.workflowsService.removeRoleFromUser(userId, role);
     }
 };
 exports.SecurityWorkflowsController = SecurityWorkflowsController;
@@ -136,45 +136,65 @@ __decorate([
     __metadata("design:returntype", Promise)
 ], SecurityWorkflowsController.prototype, "removeRole", null);
 __decorate([
-    (0, common_1.Get)("users/:id/roles"),
+    (0, common_1.Get)("users/:userId/roles"),
     (0, common_1.UseGuards)(security_jwt_guard_1.SecurityJwtGuard, security_admin_guard_1.SecurityAdminGuard),
     (0, swagger_1.ApiOperation)({ summary: "Get assigned roles for a user" }),
+    (0, swagger_1.ApiParam)({
+        name: "userId",
+        description: "User id from app_user.id",
+        type: String,
+    }),
     (0, swagger_1.ApiBearerAuth)(),
-    __param(0, (0, common_1.Param)("id")),
+    __param(0, (0, common_1.Param)("userId")),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [String]),
     __metadata("design:returntype", Promise)
 ], SecurityWorkflowsController.prototype, "getUserRoles", null);
 __decorate([
-    (0, common_1.Put)("users/:id/roles"),
+    (0, common_1.Put)("users/:userId/roles"),
     (0, common_1.UseGuards)(security_jwt_guard_1.SecurityJwtGuard, security_admin_guard_1.SecurityAdminGuard),
     (0, swagger_1.ApiOperation)({ summary: "Replace user roles" }),
+    (0, swagger_1.ApiParam)({
+        name: "userId",
+        description: "User id from app_user.id",
+        type: String,
+    }),
     (0, swagger_1.ApiBearerAuth)(),
     (0, swagger_1.ApiBody)({ type: workflows_dto_1.SetUserRolesDto }),
-    __param(0, (0, common_1.Param)("id")),
+    __param(0, (0, common_1.Param)("userId")),
     __param(1, (0, common_1.Body)()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [String, Object]),
     __metadata("design:returntype", Promise)
 ], SecurityWorkflowsController.prototype, "setUserRoles", null);
 __decorate([
-    (0, common_1.Post)("users/:id/roles"),
+    (0, common_1.Post)("users/:userId/roles"),
     (0, common_1.UseGuards)(security_jwt_guard_1.SecurityJwtGuard, security_admin_guard_1.SecurityAdminGuard),
     (0, swagger_1.ApiOperation)({ summary: "Assign one role to a user" }),
+    (0, swagger_1.ApiParam)({
+        name: "userId",
+        description: "User id from app_user.id",
+        type: String,
+    }),
     (0, swagger_1.ApiBearerAuth)(),
     (0, swagger_1.ApiBody)({ type: workflows_dto_1.AssignRoleDto }),
-    __param(0, (0, common_1.Param)("id")),
+    __param(0, (0, common_1.Param)("userId")),
     __param(1, (0, common_1.Body)()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [String, Object]),
     __metadata("design:returntype", Promise)
 ], SecurityWorkflowsController.prototype, "assignUserRole", null);
 __decorate([
-    (0, common_1.Delete)("users/:id/roles/:role"),
+    (0, common_1.Delete)("users/:userId/roles/:role"),
     (0, common_1.UseGuards)(security_jwt_guard_1.SecurityJwtGuard, security_admin_guard_1.SecurityAdminGuard),
     (0, swagger_1.ApiOperation)({ summary: "Remove one role from a user" }),
+    (0, swagger_1.ApiParam)({
+        name: "userId",
+        description: "User id from app_user.id",
+        type: String,
+    }),
     (0, swagger_1.ApiBearerAuth)(),
-    __param(0, (0, common_1.Param)("id")),
+    __param(0, (0, common_1.Param)("userId")),
     __param(1, (0, common_1.Param)("role")),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [String, String]),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scryan7371/sdr-security",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Reusable auth/security capability for API and app clients.",
   "main": "dist/index.js",
   "exports": {

package/src/api/migrations/1700000000001-add-refresh-tokens.ts

@@ -14,8 +14,6 @@ export class AddRefreshTokens1700000000001 {
         "revoked_at" timestamptz,
         "userId" uuid,
         "created_at" timestamptz NOT NULL DEFAULT (CURRENT_TIMESTAMP),
-        CONSTRAINT "CHK_refresh_token_id_uuidv7" CHECK ("id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
-        CONSTRAINT "CHK_refresh_token_userId_uuidv7" CHECK ("userId" IS NULL OR "userId"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
         CONSTRAINT "FK_refresh_token_user" FOREIGN KEY ("userId") REFERENCES ${userTableRef} ("id") ON DELETE CASCADE ON UPDATE NO ACTION
       )
     `);

package/src/api/migrations/1739490000000-create-app-user.ts

@@ -0,0 +1,39 @@
+export class CreateAppUser1739490000000 {
+  name = "CreateAppUser1739490000000";
+
+  async up(queryRunner: {
+    query: (sql: string) => Promise<unknown>;
+  }): Promise<void> {
+    const userTableRef = getUserTableReference();
+
+    await queryRunner.query(`
+      CREATE TABLE IF NOT EXISTS ${userTableRef} (
+        "id" uuid PRIMARY KEY NOT NULL,
+        "email" varchar NOT NULL
+      )
+    `);
+  }
+
+  async down(queryRunner: {
+    query: (sql: string) => Promise<unknown>;
+  }): Promise<void> {
+    const userTableRef = getUserTableReference();
+    await queryRunner.query(`DROP TABLE IF EXISTS ${userTableRef}`);
+  }
+}
+
+const getSafeIdentifier = (value: string | undefined, fallback: string) => {
+  const resolved = value?.trim() || fallback;
+  if (!resolved || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(resolved)) {
+    throw new Error(`Invalid SQL identifier: ${resolved}`);
+  }
+  return resolved;
+};
+
+const getUserTableReference = () => {
+  const table = getSafeIdentifier(process.env.USER_TABLE, "app_user");
+  const schema = process.env.USER_TABLE_SCHEMA
+    ? getSafeIdentifier(process.env.USER_TABLE_SCHEMA, "public")
+    : "public";
+  return `"${schema}"."${table}"`;
+};

package/src/api/migrations/1739500000000-create-security-identity.ts

@@ -14,8 +14,6 @@ export class CreateSecurityIdentity1739500000000 {
         "provider_subject" varchar NOT NULL,
         "created_at" timestamptz NOT NULL DEFAULT now(),
         "updated_at" timestamptz NOT NULL DEFAULT now(),
-        CONSTRAINT "CHK_security_identity_id_uuidv7" CHECK ("id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
-        CONSTRAINT "CHK_security_identity_user_id_uuidv7" CHECK ("user_id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
         CONSTRAINT "FK_security_identity_user_id" FOREIGN KEY ("user_id") REFERENCES ${userTableRef} ("id") ON DELETE CASCADE
       )
     `);

package/src/api/migrations/1739510000000-create-security-roles.ts

@@ -11,8 +11,7 @@ export class CreateSecurityRoles1739510000000 {
         "description" text,
         "is_system" boolean NOT NULL DEFAULT false,
         "created_at" timestamptz NOT NULL DEFAULT now(),
-        "updated_at" timestamptz NOT NULL DEFAULT now(),
-        CONSTRAINT "CHK_security_role_id_uuidv7" CHECK ("id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$')
+        "updated_at" timestamptz NOT NULL DEFAULT now()
       )
     `);
 

package/src/api/migrations/1739515000000-create-security-user-roles.ts

@@ -12,9 +12,6 @@ export class CreateSecurityUserRoles1739515000000 {
         "user_id" uuid NOT NULL,
         "role_id" uuid NOT NULL,
         "created_at" timestamptz NOT NULL DEFAULT now(),
-        CONSTRAINT "CHK_security_user_role_id_uuidv7" CHECK ("id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
-        CONSTRAINT "CHK_security_user_role_user_id_uuidv7" CHECK ("user_id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
-        CONSTRAINT "CHK_security_user_role_role_id_uuidv7" CHECK ("role_id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
         CONSTRAINT "FK_security_user_role_user_id" FOREIGN KEY ("user_id") REFERENCES ${userTableRef} ("id") ON DELETE CASCADE,
         CONSTRAINT "FK_security_user_role_role_id" FOREIGN KEY ("role_id") REFERENCES "security_role" ("id") ON DELETE CASCADE
       )

package/src/api/migrations/1739520000000-create-password-reset-tokens.ts

@@ -14,8 +14,6 @@ export class CreatePasswordResetTokens1739520000000 {
         "expires_at" timestamptz NOT NULL,
         "used_at" timestamptz,
         "created_at" timestamptz NOT NULL DEFAULT now(),
-        CONSTRAINT "CHK_security_password_reset_token_id_uuidv7" CHECK ("id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
-        CONSTRAINT "CHK_security_password_reset_token_user_id_uuidv7" CHECK ("user_id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
         CONSTRAINT "FK_security_password_reset_token_user_id" FOREIGN KEY ("user_id") REFERENCES ${userTableRef} ("id") ON DELETE CASCADE
       )
     `);

package/src/api/migrations/1739530000000-create-security-user.ts

@@ -15,7 +15,6 @@ export class CreateSecurityUser1739530000000 {
         "admin_approved_at" timestamptz,
         "is_active" boolean NOT NULL DEFAULT true,
         "created_at" timestamptz NOT NULL DEFAULT now(),
-        CONSTRAINT "CHK_security_user_user_id_uuidv7" CHECK ("user_id"::text ~* '^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'),
         CONSTRAINT "FK_security_user_user_id" FOREIGN KEY ("user_id") REFERENCES ${userTableRef} ("id") ON DELETE CASCADE
       )
     `);

package/src/api/migrations/index.ts

@@ -1,3 +1,4 @@
+import { CreateAppUser1739490000000 } from "./1739490000000-create-app-user";
 import { AddRefreshTokens1700000000001 } from "./1700000000001-add-refresh-tokens";
 import { CreateSecurityIdentity1739500000000 } from "./1739500000000-create-security-identity";
 import { CreateSecurityRoles1739510000000 } from "./1739510000000-create-security-roles";
@@ -5,7 +6,8 @@ import { CreateSecurityUserRoles1739515000000 } from "./1739515000000-create-sec
 import { CreatePasswordResetTokens1739520000000 } from "./1739520000000-create-password-reset-tokens";
 import { CreateSecurityUser1739530000000 } from "./1739530000000-create-security-user";
 
-export const securityMigrations = [
+export const allMigrations = [
+  CreateAppUser1739490000000,
   AddRefreshTokens1700000000001,
   CreateSecurityIdentity1739500000000,
   CreateSecurityRoles1739510000000,
@@ -14,7 +16,12 @@ export const securityMigrations = [
   CreateSecurityUser1739530000000,
 ];
 
+export const securityMigrations = allMigrations.filter(
+  (migration) => migration !== CreateAppUser1739490000000,
+);
+
 export {
+  CreateAppUser1739490000000,
   AddRefreshTokens1700000000001,
   CreateSecurityIdentity1739500000000,
   CreateSecurityRoles1739510000000,

package/src/api/migrations/migrations.test.ts

@@ -1,11 +1,12 @@
 import { afterEach, describe, expect, it, vi } from "vitest";
+import { CreateAppUser1739490000000 } from "./1739490000000-create-app-user";
 import { AddRefreshTokens1700000000001 } from "./1700000000001-add-refresh-tokens";
 import { CreateSecurityIdentity1739500000000 } from "./1739500000000-create-security-identity";
 import { CreateSecurityRoles1739510000000 } from "./1739510000000-create-security-roles";
 import { CreateSecurityUserRoles1739515000000 } from "./1739515000000-create-security-user-roles";
 import { CreatePasswordResetTokens1739520000000 } from "./1739520000000-create-password-reset-tokens";
 import { CreateSecurityUser1739530000000 } from "./1739530000000-create-security-user";
-import { securityMigrations } from "./index";
+import { allMigrations, securityMigrations } from "./index";
 
 const originalEnv = { ...process.env };
 
@@ -15,6 +16,19 @@ afterEach(() => {
 });
 
 describe("security migrations", () => {
+  it("exports all migration list for test/dev", () => {
+    expect(allMigrations.length).toBe(7);
+    expect(allMigrations).toEqual([
+      CreateAppUser1739490000000,
+      AddRefreshTokens1700000000001,
+      CreateSecurityIdentity1739500000000,
+      CreateSecurityRoles1739510000000,
+      CreateSecurityUserRoles1739515000000,
+      CreatePasswordResetTokens1739520000000,
+      CreateSecurityUser1739530000000,
+    ]);
+  });
+
   it("exports migration list", () => {
     expect(securityMigrations.length).toBe(6);
     expect(securityMigrations).toEqual([
@@ -27,6 +41,21 @@ describe("security migrations", () => {
     ]);
   });
 
+  it("runs app user migration up/down", async () => {
+    const query = vi.fn().mockResolvedValue(undefined);
+    const migration = new CreateAppUser1739490000000();
+
+    await migration.up({ query });
+    await migration.down({ query });
+
+    expect(query).toHaveBeenCalledWith(
+      expect.stringContaining('CREATE TABLE IF NOT EXISTS "public"."app_user"'),
+    );
+    expect(query).toHaveBeenCalledWith(
+      expect.stringContaining('DROP TABLE IF EXISTS "public"."app_user"'),
+    );
+  });
+
   it("runs refresh token migration up/down", async () => {
     const query = vi.fn().mockResolvedValue(undefined);
     const migration = new AddRefreshTokens1700000000001();

package/src/integration/database.integration.test.ts

@@ -2,7 +2,7 @@ import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 import { Client, ClientConfig } from "pg";
-import { securityMigrations } from "../api/migrations";
+import { allMigrations } from "../api/migrations";
 
 type QueryRunnerLike = {
   query: (sql: string, params?: unknown[]) => Promise<unknown>;
@@ -119,17 +119,10 @@ describe("database integration", () => {
     }
     await client.query(`CREATE SCHEMA IF NOT EXISTS "${schema}"`);
     await client.query(`SET search_path TO "${schema}", public`);
-    await client.query(`
-      CREATE TABLE IF NOT EXISTS "${schema}"."app_user" (
-        "id" uuid PRIMARY KEY NOT NULL,
-        "email" varchar NOT NULL
-      )
-    `);
-
     process.env.USER_TABLE = "app_user";
     process.env.USER_TABLE_SCHEMA = schema;
 
-    for (const Migration of securityMigrations) {
+    for (const Migration of allMigrations) {
       await new Migration().up(runner as never);
     }
   });
@@ -140,10 +133,9 @@ describe("database integration", () => {
     }
 
     if (!keepSchemaForDebug) {
-      for (const Migration of [...securityMigrations].reverse()) {
+      for (const Migration of [...allMigrations].reverse()) {
         await new Migration().down(runner as never);
       }
-      await client.query(`DROP TABLE IF EXISTS "${schema}"."app_user"`);
       await client.query(`DROP SCHEMA IF EXISTS "${schema}" CASCADE`);
     }
     await client.end();

package/src/nest/security-workflows.controller.ts

@@ -10,7 +10,13 @@ import {
   Put,
   UseGuards,
 } from "@nestjs/common";
-import { ApiBearerAuth, ApiBody, ApiOperation, ApiTags } from "@nestjs/swagger";
+import {
+  ApiBearerAuth,
+  ApiBody,
+  ApiOperation,
+  ApiParam,
+  ApiTags,
+} from "@nestjs/swagger";
 import { SecurityAdminGuard } from "./security-admin.guard";
 import { SecurityJwtGuard } from "./security-jwt.guard";
 import { SecurityWorkflowsService } from "./security-workflows.service";
@@ -101,49 +107,72 @@ export class SecurityWorkflowsController {
     return this.workflowsService.removeRole(role);
   }
 
-  @Get("users/:id/roles")
+  @Get("users/:userId/roles")
   @UseGuards(SecurityJwtGuard, SecurityAdminGuard)
   @ApiOperation({ summary: "Get assigned roles for a user" })
+  @ApiParam({
+    name: "userId",
+    description: "User id from app_user.id",
+    type: String,
+  })
   @ApiBearerAuth()
-  async getUserRoles(@Param("id") id: string) {
-    return this.workflowsService.getUserRoles(id);
+  async getUserRoles(@Param("userId") userId: string) {
+    return this.workflowsService.getUserRoles(userId);
   }
 
-  @Put("users/:id/roles")
+  @Put("users/:userId/roles")
   @UseGuards(SecurityJwtGuard, SecurityAdminGuard)
   @ApiOperation({ summary: "Replace user roles" })
+  @ApiParam({
+    name: "userId",
+    description: "User id from app_user.id",
+    type: String,
+  })
   @ApiBearerAuth()
   @ApiBody({ type: SetUserRolesDto })
   async setUserRoles(
-    @Param("id") id: string,
+    @Param("userId") userId: string,
     @Body() body: { roles?: string[] },
   ) {
     if (!Array.isArray(body.roles)) {
       throw new BadRequestException("roles must be an array");
     }
-    return this.workflowsService.setUserRoles(id, body.roles);
+    return this.workflowsService.setUserRoles(userId, body.roles);
   }
 
-  @Post("users/:id/roles")
+  @Post("users/:userId/roles")
   @UseGuards(SecurityJwtGuard, SecurityAdminGuard)
   @ApiOperation({ summary: "Assign one role to a user" })
+  @ApiParam({
+    name: "userId",
+    description: "User id from app_user.id",
+    type: String,
+  })
   @ApiBearerAuth()
   @ApiBody({ type: AssignRoleDto })
   async assignUserRole(
-    @Param("id") id: string,
+    @Param("userId") userId: string,
     @Body() body: { role?: string },
   ) {
     if (!body.role || !body.role.trim()) {
       throw new BadRequestException("role is required");
     }
-    return this.workflowsService.assignRoleToUser(id, body.role);
+    return this.workflowsService.assignRoleToUser(userId, body.role);
   }
 
-  @Delete("users/:id/roles/:role")
+  @Delete("users/:userId/roles/:role")
   @UseGuards(SecurityJwtGuard, SecurityAdminGuard)
   @ApiOperation({ summary: "Remove one role from a user" })
+  @ApiParam({
+    name: "userId",
+    description: "User id from app_user.id",
+    type: String,
+  })
   @ApiBearerAuth()
-  async removeUserRole(@Param("id") id: string, @Param("role") role: string) {
-    return this.workflowsService.removeRoleFromUser(id, role);
+  async removeUserRole(
+    @Param("userId") userId: string,
+    @Param("role") role: string,
+  ) {
+    return this.workflowsService.removeRoleFromUser(userId, role);
   }
 }