@simple-auth-kit/cli 1.0.0

package/registry/combos/express-drizzle/variants/base/test/variant-hooks.ts

@@ -0,0 +1,179 @@
+// Variant hooks for the no-workspaces variant. See test/harness.ts for the contract.
+//
+// Admin authority here is global: it is the `admin` role, and the role's permissions are what
+// confer it. There is no scope to admit a user into — every user is already in range of the admin
+// endpoints.
+import "dotenv/config";
+import { eq, inArray } from "drizzle-orm";
+import { drizzle } from "drizzle-orm/node-postgres";
+import { Pool } from "pg";
+import type { Database } from "../src/db.js";
+import { toId } from "../src/id.helper.js";
+import { POLICY_VERSION_KEY } from "../src/permission-cache.js";
+import { provisionDefaultRoles, SEED_ADMIN_ROLES } from "../src/rbac.defaults.js";
+import * as schema from "../src/schema.js";
+import { permissions, roleUser, roles } from "../src/schema.js";
+import { permissionCacheStore } from "./bootstrap.js";
+import { renewingToken, type AdminSession, type AuthTokens, type Principal, type ProofContext, type VariantHooks } from "./harness.js";
+
+/** One short-lived pool per call, closed on the way out, so the proof process has no lingering handle to wait on. */
+async function withDb<T>(fn: (db: Database) => Promise<T>): Promise<T> {
+  const pool = new Pool({ connectionString: process.env["DATABASE_URL"] });
+  try {
+    return await fn(drizzle(pool, { schema }));
+  } finally {
+    await pool.end();
+  }
+}
+
+/** Remembered by `makeAdmin` so `freshToken()` can mint a new one whenever a section needs it. */
+let adminCredentials: { identifier: string; password: string } | undefined;
+
+export const hooks: VariantHooks = {
+  variant: "base",
+
+  async makeAdmin(ctx: ProofContext, principal: Principal): Promise<AdminSession> {
+    // The role slug on its own confers nothing — no guard checks for the string "admin". Authority
+    // comes from the permission_role rows behind it, and in this variant the seeder is the only
+    // thing that writes them, so the hook does what `npm run seed` does: calls the same
+    // provisioning function, from the same definition the routes are typed against. Idempotent,
+    // so it is safe against a database that has already been seeded.
+    await withDb(async (db) => {
+      await provisionDefaultRoles(db);
+      const adminRoles = await db
+        .select({ id: roles.id })
+        .from(roles)
+        .where(inArray(roles.slug, SEED_ADMIN_ROLES));
+      await db
+        .insert(roleUser)
+        .values(adminRoles.map((role) => ({ userId: toId(principal.userId), roleId: role.id })))
+        .onConflictDoNothing({ target: [roleUser.userId, roleUser.roleId] });
+    });
+
+    adminCredentials = { identifier: principal.email, password: principal.password };
+    // Those writes went straight to the database, behind the running app's back, so nothing
+    // bumped a version counter and the caller's already-cached (empty) permissions would still be
+    // served. Bumping the policy counter is exactly what an out-of-band writer is supposed to do —
+    // see permission-cache.ts. Logging in would not have helped: nothing about authorization is
+    // in the token.
+    await permissionCacheStore.bump(POLICY_VERSION_KEY);
+    const login = await ctx.call("POST", "/auth/login", { body: { identifier: principal.email, password: principal.password } });
+    const token = (login.body as AuthTokens).accessToken;
+    ctx.assert(!!token, `the seeded admin can log in (got ${login.status})`);
+    return {
+      token,
+      freshToken: renewingToken(async () => {
+        const res = await ctx.call("POST", "/auth/login", { body: adminCredentials! });
+        return (res.body as AuthTokens).accessToken;
+      }),
+    };
+  },
+
+  async admitUser(): Promise<void> {
+    // Nothing to do: admin endpoints operate on the whole deployment.
+  },
+
+  async proveVariantProperties(ctx: ProofContext, admin: AdminSession): Promise<void> {
+    const listed = await ctx.call("GET", "/auth/admin/users", { token: await admin.freshToken() });
+    ctx.assert(listed.status === 200, `admin can list every user in the deployment (got ${listed.status})`);
+    ctx.assert(Array.isArray(listed.body?.items) && listed.body.items.length > 0, "the user list is non-empty");
+
+    const workspaces = await ctx.call("GET", "/workspaces", { token: await admin.freshToken() });
+    ctx.assert(workspaces.status === 404, `no workspace endpoints exist in this variant (got ${workspaces.status})`);
+
+    const me = await ctx.call("GET", "/auth/me", { token: await admin.freshToken() });
+    ctx.assert(me.body?.roles?.includes("admin"), "roles are global: they apply to every request this user makes");
+
+    // --- authorization is not in the token, so a change lands on the next *request* ---
+    //
+    // This section used to assert the opposite, and the change is deliberate. Permissions were
+    // baked into the access token at issue time, which made the check free but meant a revocation
+    // did not apply until the caller's next token — a window bounded only by the access-token TTL,
+    // documented as a sharp edge and asserted in both directions right here. Authorization is now
+    // resolved from the database (through a version-keyed cache) on the request that uses it, so
+    // the window is gone and the assertions that described it have been replaced by the ones that
+    // describe what actually happens.
+    const email = ctx.uniqueEmail("immediate");
+    const password = "immediate-pw-12345";
+    const tokens = await ctx.signup(email, password);
+    const userId = (await ctx.call("GET", "/auth/me", { token: tokens.accessToken })).body.sub as string;
+
+    const beforeGrant = await ctx.call("GET", "/auth/admin/users", { token: tokens.accessToken });
+    ctx.assert(beforeGrant.status === 403, `a user with no grant is refused (got ${beforeGrant.status})`);
+
+    const granted = await ctx.call("POST", `/auth/admin/users/${userId}/permissions`, { token: await admin.freshToken(), body: { permission: "users:read" } });
+    ctx.assert(granted.status === 200 || granted.status === 201, `admin can grant a permission directly (got ${granted.status})`);
+
+    const afterGrant = await ctx.call("GET", "/auth/admin/users", { token: tokens.accessToken });
+    ctx.assert(afterGrant.status === 200, `…and the grant is in effect on the very next request, on the token they already held (got ${afterGrant.status})`);
+
+    const revoked = await ctx.call("POST", `/auth/admin/users/${userId}/permissions/${encodeURIComponent("users:read")}/revoke`, {
+      token: await admin.freshToken(),
+    });
+    ctx.assert(revoked.status === 200 || revoked.status === 201, `admin can revoke the direct grant (got ${revoked.status})`);
+
+    const afterRevoke = await ctx.call("GET", "/auth/admin/users", { token: tokens.accessToken });
+    ctx.assert(afterRevoke.status === 403, `and the revocation lands on the very next request too, on the same token (got ${afterRevoke.status})`);
+
+    await proveTheCacheIsReal(ctx, admin, tokens.accessToken);
+    await proveARawDatabaseEditChangesEnforcement(ctx, admin);
+  },
+};
+
+/**
+ * A cache nobody can prove is working is a bug surface. These assertions read the very store the
+ * app resolves through (`test/bootstrap.ts` hands it to `AuthModule.forRoot`), so "the second
+ * request did not touch the database" is a measurement rather than a claim.
+ */
+async function proveTheCacheIsReal(ctx: ProofContext, admin: AdminSession, token: string): Promise<void> {
+  const N = 8;
+  await ctx.call("GET", "/auth/me", { token }); // warm, so the measurement is of the steady state
+  const before = { ...permissionCacheStore.stats };
+  for (let i = 0; i < N; i += 1) await ctx.call("GET", "/auth/me", { token });
+  const after = permissionCacheStore.stats;
+
+  ctx.assert(
+    after.misses === before.misses && after.hits === before.hits + N,
+    `${N} identical authorized requests resolve permissions 0 further times — all ${N} were cache hits (misses +${after.misses - before.misses}, hits +${after.hits - before.hits})`,
+  );
+
+  const userId = (await ctx.call("GET", "/auth/me", { token })).body.sub as string;
+  const beforeGrant = { ...permissionCacheStore.stats };
+  await ctx.call("POST", `/auth/admin/users/${userId}/permissions`, { token: await admin.freshToken(), body: { permission: "probe:cache" } });
+  const afterGrantCall = await ctx.call("GET", "/auth/me", { token });
+  ctx.assert(
+    permissionCacheStore.stats.misses > beforeGrant.misses,
+    "a grant bumps this user's version counter, so the next request misses the cache and re-resolves rather than serving a stale entry",
+  );
+  ctx.assert((afterGrantCall.body?.permissions ?? []).includes("probe:cache"), "…and the freshly resolved answer contains the new permission");
+  await ctx.call("POST", `/auth/admin/users/${userId}/permissions/${encodeURIComponent("probe:cache")}/revoke`, { token: await admin.freshToken() });
+}
+
+/**
+ * The admin API already proves that editing the catalog changes enforcement, but it is the API
+ * doing the writing — this rules out any possibility that it is also doing something in memory.
+ * A `psql` session would look exactly like this.
+ */
+async function proveARawDatabaseEditChangesEnforcement(ctx: ProofContext, admin: AdminSession): Promise<void> {
+  const email = ctx.uniqueEmail("rawedit");
+  const tokens = await ctx.signup(email, "rawedit-pw-12345");
+  const userId = (await ctx.call("GET", "/auth/me", { token: tokens.accessToken })).body.sub as string;
+  await ctx.call("POST", `/auth/admin/users/${userId}/permissions`, { token: await admin.freshToken(), body: { permission: "audit-log:read" } });
+  ctx.assert((await ctx.call("GET", "/auth/admin/audit-log", { token: tokens.accessToken })).status === 200, "a direct grant opens the audit log");
+
+  const setActive = async (isActive: boolean) => {
+    // Written straight to the table, with no code change and no redeploy. The bump that follows is
+    // the out-of-band writer's half of the cache contract (permission-cache.ts) — without it the
+    // edit would still land, but only once the cached entry expired.
+    await withDb((db) => db.update(permissions).set({ isActive }).where(eq(permissions.slug, "audit-log:read")));
+    await permissionCacheStore.bump(POLICY_VERSION_KEY);
+  };
+
+  await setActive(false);
+  const denied = await ctx.call("GET", "/auth/admin/audit-log", { token: tokens.accessToken });
+  ctx.assert(denied.status === 403, `a permission deactivated by a raw database write stops opening its route (got ${denied.status})`);
+
+  await setActive(true);
+  const restored = await ctx.call("GET", "/auth/admin/audit-log", { token: tokens.accessToken });
+  ctx.assert(restored.status === 200, `…and reactivating it in the database opens the route again (got ${restored.status})`);
+}

package/registry/combos/express-drizzle/variants/workspaces/.env.example

@@ -0,0 +1,30 @@
+DATABASE_URL="postgresql://postgres:postgres@localhost:5432/auth_reference?schema=public"
+
+# OAuth (optional — only needed if you pass oauthProviders into createAuthApp())
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+APPLE_CLIENT_ID=
+APPLE_TEAM_ID=
+APPLE_KEY_ID=
+APPLE_PRIVATE_KEY=
+
+# Seeder (`npm run seed`, src/seed.ts). The permission catalog, the first workspace and that
+# workspace's default roles are always seeded; the initial admin user and their membership of it
+# are created only when BOTH admin variables are set. There is no default password — with either
+# one missing the seeder says so and skips the admin rather than putting a known credential on
+# the deployment. Setting them again later is a no-op for an admin that already exists: their
+# current password is left alone.
+SEED_ADMIN_EMAIL=
+SEED_ADMIN_PASSWORD=
+
+# Optional second seeded account and workspace membership, held by the "superadmin" role (same
+# full-catalog permissions as "admin", distinct account). Same no-default-password rule as
+# SEED_ADMIN_* above; leaving any of these unset skips it. SEED_SUPERADMIN_USERNAME is
+# optional — without it the account has no username and only its email logs in.
+SEED_SUPERADMIN_EMAIL=
+SEED_SUPERADMIN_USERNAME=
+SEED_SUPERADMIN_PASSWORD=
+
+# Name of the workspace the seeder creates (and adopts on later runs). Defaults to
+# "Default workspace" when unset.
+SEED_WORKSPACE_NAME=

package/registry/combos/express-drizzle/variants/workspaces/drizzle/0000_init.sql

@@ -0,0 +1,251 @@
+CREATE TABLE "audit_logs" (
+	"id" bigserial PRIMARY KEY NOT NULL,
+	"uuid" text NOT NULL,
+	"workspace_id" bigint,
+	"user_id" bigint,
+	"name" text NOT NULL,
+	"action" text NOT NULL,
+	"info" jsonb NOT NULL,
+	"remarks" text,
+	"created_at" timestamp (6) with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp (6) with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "denylisted_access_tokens" (
+	"jti" text PRIMARY KEY NOT NULL,
+	"expires_at" timestamp (6) with time zone NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "oauth_accounts" (
+	"id" bigserial PRIMARY KEY NOT NULL,
+	"uuid" text NOT NULL,
+	"user_id" bigint NOT NULL,
+	"provider" varchar(100) NOT NULL,
+	"provider_account_id" text NOT NULL,
+	"email" text,
+	"created_at" timestamp (6) with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "password_reset_tokens" (
+	"id" bigserial PRIMARY KEY NOT NULL,
+	"uuid" text NOT NULL,
+	"user_id" bigint NOT NULL,
+	"token_hash" text NOT NULL,
+	"expires_at" timestamp (6) with time zone NOT NULL,
+	"consumed_at" timestamp (6) with time zone,
+	"created_at" timestamp (6) with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "permission_member" (
+	"member_id" bigint NOT NULL,
+	"permission_id" bigint NOT NULL,
+	"created_at" timestamp (6) with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "permission_member_pkey" PRIMARY KEY("member_id","permission_id")
+);
+--> statement-breakpoint
+CREATE TABLE "permission_role" (
+	"permission_id" bigint NOT NULL,
+	"role_id" bigint NOT NULL,
+	"created_at" timestamp (6) with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "permission_role_pkey" PRIMARY KEY("permission_id","role_id")
+);
+--> statement-breakpoint
+CREATE TABLE "permissions" (
+	"id" bigserial PRIMARY KEY NOT NULL,
+	"uuid" text NOT NULL,
+	"slug" varchar(255) NOT NULL,
+	"name" varchar(255) NOT NULL,
+	"display_name" varchar(255) NOT NULL,
+	"description" text,
+	"group" varchar(255) DEFAULT 'General' NOT NULL,
+	"group_order" integer DEFAULT 0 NOT NULL,
+	"order" integer DEFAULT 0 NOT NULL,
+	"is_active" boolean DEFAULT true NOT NULL,
+	"created_by" bigint,
+	"updated_by" bigint,
+	"is_deleted" boolean DEFAULT false NOT NULL,
+	"deleted_at" timestamp (6) with time zone,
+	"deleted_by" bigint,
+	"deleted_reason" varchar(255),
+	"created_at" timestamp (6) with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp (6) with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "role_member" (
+	"member_id" bigint NOT NULL,
+	"role_id" bigint NOT NULL,
+	"created_at" timestamp (6) with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "role_member_pkey" PRIMARY KEY("member_id","role_id")
+);
+--> statement-breakpoint
+CREATE TABLE "roles" (
+	"id" bigserial PRIMARY KEY NOT NULL,
+	"uuid" text NOT NULL,
+	"workspace_id" bigint NOT NULL,
+	"slug" varchar(255) NOT NULL,
+	"name" varchar(255) NOT NULL,
+	"display_name" varchar(255) NOT NULL,
+	"description" text,
+	"is_default" boolean DEFAULT false NOT NULL,
+	"order" integer DEFAULT 0 NOT NULL,
+	"is_active" boolean DEFAULT true NOT NULL,
+	"created_by" bigint,
+	"updated_by" bigint,
+	"is_deleted" boolean DEFAULT false NOT NULL,
+	"deleted_at" timestamp (6) with time zone,
+	"deleted_by" bigint,
+	"deleted_reason" varchar(255),
+	"created_at" timestamp (6) with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp (6) with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "sessions" (
+	"id" bigserial PRIMARY KEY NOT NULL,
+	"uuid" text NOT NULL,
+	"user_id" bigint NOT NULL,
+	"session_version" integer DEFAULT 0 NOT NULL,
+	"current_refresh_jti" text NOT NULL,
+	"provider" varchar(100),
+	"user_agent" text,
+	"ip" varchar(100),
+	"expires_at" timestamp (6) with time zone NOT NULL,
+	"is_revoked" boolean DEFAULT false NOT NULL,
+	"revoked_at" timestamp (6) with time zone,
+	"revoked_by" bigint,
+	"revoked_ip" varchar(100),
+	"is_active" boolean DEFAULT true NOT NULL,
+	"created_by" bigint,
+	"updated_by" bigint,
+	"is_deleted" boolean DEFAULT false NOT NULL,
+	"deleted_at" timestamp (6) with time zone,
+	"deleted_by" bigint,
+	"deleted_reason" varchar(255),
+	"created_at" timestamp (6) with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp (6) with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "two_factor_backup_codes" (
+	"id" bigserial PRIMARY KEY NOT NULL,
+	"uuid" text NOT NULL,
+	"user_id" bigint NOT NULL,
+	"code_hash" text NOT NULL,
+	"used_at" timestamp (6) with time zone
+);
+--> statement-breakpoint
+CREATE TABLE "users" (
+	"id" bigserial PRIMARY KEY NOT NULL,
+	"uuid" text NOT NULL,
+	"email" text NOT NULL,
+	"first_name" text,
+	"last_name" text,
+	"display_name" text,
+	"phone" text,
+	"username" text,
+	"photo" text,
+	"last_login" timestamp (6) with time zone,
+	"password_hash" text,
+	"blocked" boolean DEFAULT false NOT NULL,
+	"two_factor_enabled" boolean DEFAULT false NOT NULL,
+	"two_factor_secret" text,
+	"created_by" bigint,
+	"updated_by" bigint,
+	"is_deleted" boolean DEFAULT false NOT NULL,
+	"deleted_at" timestamp (6) with time zone,
+	"deleted_by" bigint,
+	"deleted_reason" varchar(255),
+	"created_at" timestamp (6) with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp (6) with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "workspace_members" (
+	"id" bigserial PRIMARY KEY NOT NULL,
+	"uuid" text NOT NULL,
+	"user_id" bigint NOT NULL,
+	"workspace_id" bigint NOT NULL,
+	"created_at" timestamp (6) with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "workspaces" (
+	"id" bigserial PRIMARY KEY NOT NULL,
+	"uuid" text NOT NULL,
+	"name" text NOT NULL,
+	"is_active" boolean DEFAULT true NOT NULL,
+	"created_by" bigint,
+	"updated_by" bigint,
+	"is_deleted" boolean DEFAULT false NOT NULL,
+	"deleted_at" timestamp (6) with time zone,
+	"deleted_by" bigint,
+	"deleted_reason" varchar(255),
+	"created_at" timestamp (6) with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp (6) with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "audit_logs" ADD CONSTRAINT "audit_logs_workspace_id_workspaces_id_fk" FOREIGN KEY ("workspace_id") REFERENCES "public"."workspaces"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_accounts" ADD CONSTRAINT "oauth_accounts_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "password_reset_tokens" ADD CONSTRAINT "password_reset_tokens_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "permission_member" ADD CONSTRAINT "permission_member_member_id_workspace_members_id_fk" FOREIGN KEY ("member_id") REFERENCES "public"."workspace_members"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "permission_member" ADD CONSTRAINT "permission_member_permission_id_permissions_id_fk" FOREIGN KEY ("permission_id") REFERENCES "public"."permissions"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "permission_role" ADD CONSTRAINT "permission_role_permission_id_permissions_id_fk" FOREIGN KEY ("permission_id") REFERENCES "public"."permissions"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "permission_role" ADD CONSTRAINT "permission_role_role_id_roles_id_fk" FOREIGN KEY ("role_id") REFERENCES "public"."roles"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "permissions" ADD CONSTRAINT "permissions_created_by_users_id_fk" FOREIGN KEY ("created_by") REFERENCES "public"."users"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "permissions" ADD CONSTRAINT "permissions_updated_by_users_id_fk" FOREIGN KEY ("updated_by") REFERENCES "public"."users"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "permissions" ADD CONSTRAINT "permissions_deleted_by_users_id_fk" FOREIGN KEY ("deleted_by") REFERENCES "public"."users"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "role_member" ADD CONSTRAINT "role_member_member_id_workspace_members_id_fk" FOREIGN KEY ("member_id") REFERENCES "public"."workspace_members"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "role_member" ADD CONSTRAINT "role_member_role_id_roles_id_fk" FOREIGN KEY ("role_id") REFERENCES "public"."roles"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "roles" ADD CONSTRAINT "roles_workspace_id_workspaces_id_fk" FOREIGN KEY ("workspace_id") REFERENCES "public"."workspaces"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "roles" ADD CONSTRAINT "roles_created_by_users_id_fk" FOREIGN KEY ("created_by") REFERENCES "public"."users"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "roles" ADD CONSTRAINT "roles_updated_by_users_id_fk" FOREIGN KEY ("updated_by") REFERENCES "public"."users"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "roles" ADD CONSTRAINT "roles_deleted_by_users_id_fk" FOREIGN KEY ("deleted_by") REFERENCES "public"."users"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "sessions" ADD CONSTRAINT "sessions_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "sessions" ADD CONSTRAINT "sessions_revoked_by_users_id_fk" FOREIGN KEY ("revoked_by") REFERENCES "public"."users"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "sessions" ADD CONSTRAINT "sessions_created_by_users_id_fk" FOREIGN KEY ("created_by") REFERENCES "public"."users"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "sessions" ADD CONSTRAINT "sessions_updated_by_users_id_fk" FOREIGN KEY ("updated_by") REFERENCES "public"."users"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "sessions" ADD CONSTRAINT "sessions_deleted_by_users_id_fk" FOREIGN KEY ("deleted_by") REFERENCES "public"."users"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "two_factor_backup_codes" ADD CONSTRAINT "two_factor_backup_codes_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "users" ADD CONSTRAINT "users_created_by_users_id_fk" FOREIGN KEY ("created_by") REFERENCES "public"."users"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "users" ADD CONSTRAINT "users_updated_by_users_id_fk" FOREIGN KEY ("updated_by") REFERENCES "public"."users"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "users" ADD CONSTRAINT "users_deleted_by_users_id_fk" FOREIGN KEY ("deleted_by") REFERENCES "public"."users"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "workspace_members" ADD CONSTRAINT "workspace_members_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "workspace_members" ADD CONSTRAINT "workspace_members_workspace_id_workspaces_id_fk" FOREIGN KEY ("workspace_id") REFERENCES "public"."workspaces"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "audit_logs_uuid_key" ON "audit_logs" USING btree ("uuid");--> statement-breakpoint
+CREATE INDEX "audit_logs_workspace_created_idx" ON "audit_logs" USING btree ("workspace_id","created_at");--> statement-breakpoint
+CREATE INDEX "audit_logs_user_created_idx" ON "audit_logs" USING btree ("user_id","created_at");--> statement-breakpoint
+CREATE INDEX "audit_logs_created_idx" ON "audit_logs" USING btree ("created_at");--> statement-breakpoint
+CREATE UNIQUE INDEX "oauth_accounts_uuid_key" ON "oauth_accounts" USING btree ("uuid");--> statement-breakpoint
+CREATE UNIQUE INDEX "oauth_accounts_provider_provider_account_id_key" ON "oauth_accounts" USING btree ("provider","provider_account_id");--> statement-breakpoint
+CREATE INDEX "oauth_accounts_user_id_idx" ON "oauth_accounts" USING btree ("user_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "password_reset_tokens_uuid_key" ON "password_reset_tokens" USING btree ("uuid");--> statement-breakpoint
+CREATE UNIQUE INDEX "password_reset_tokens_token_hash_key" ON "password_reset_tokens" USING btree ("token_hash");--> statement-breakpoint
+CREATE INDEX "permission_member_permission_id_idx" ON "permission_member" USING btree ("permission_id");--> statement-breakpoint
+CREATE INDEX "permission_role_role_id_idx" ON "permission_role" USING btree ("role_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "permissions_uuid_key" ON "permissions" USING btree ("uuid");--> statement-breakpoint
+CREATE UNIQUE INDEX "permissions_slug_key" ON "permissions" USING btree ("slug");--> statement-breakpoint
+CREATE INDEX "permissions_is_active_idx" ON "permissions" USING btree ("is_active");--> statement-breakpoint
+CREATE INDEX "permissions_group_order_idx" ON "permissions" USING btree ("group","group_order","order");--> statement-breakpoint
+CREATE INDEX "permissions_is_deleted_idx" ON "permissions" USING btree ("is_deleted");--> statement-breakpoint
+CREATE INDEX "role_member_role_id_idx" ON "role_member" USING btree ("role_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "roles_uuid_key" ON "roles" USING btree ("uuid");--> statement-breakpoint
+CREATE UNIQUE INDEX "roles_workspace_id_slug_key" ON "roles" USING btree ("workspace_id","slug");--> statement-breakpoint
+CREATE INDEX "roles_workspace_default_idx" ON "roles" USING btree ("workspace_id","is_default");--> statement-breakpoint
+CREATE INDEX "roles_active_order_idx" ON "roles" USING btree ("is_active","order");--> statement-breakpoint
+CREATE INDEX "roles_is_deleted_idx" ON "roles" USING btree ("is_deleted");--> statement-breakpoint
+CREATE UNIQUE INDEX "sessions_uuid_key" ON "sessions" USING btree ("uuid");--> statement-breakpoint
+CREATE INDEX "sessions_user_id_idx" ON "sessions" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "sessions_is_revoked_idx" ON "sessions" USING btree ("is_revoked");--> statement-breakpoint
+CREATE INDEX "sessions_expires_at_idx" ON "sessions" USING btree ("expires_at");--> statement-breakpoint
+CREATE INDEX "sessions_user_active_idx" ON "sessions" USING btree ("user_id","is_revoked","expires_at");--> statement-breakpoint
+CREATE INDEX "sessions_revoked_by_idx" ON "sessions" USING btree ("revoked_by");--> statement-breakpoint
+CREATE UNIQUE INDEX "two_factor_backup_codes_uuid_key" ON "two_factor_backup_codes" USING btree ("uuid");--> statement-breakpoint
+CREATE INDEX "two_factor_backup_codes_user_id_idx" ON "two_factor_backup_codes" USING btree ("user_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "users_uuid_key" ON "users" USING btree ("uuid");--> statement-breakpoint
+CREATE UNIQUE INDEX "users_email_key" ON "users" USING btree ("email");--> statement-breakpoint
+CREATE UNIQUE INDEX "users_first_name_key" ON "users" USING btree ("first_name");--> statement-breakpoint
+CREATE UNIQUE INDEX "users_last_name_key" ON "users" USING btree ("last_name");--> statement-breakpoint
+CREATE UNIQUE INDEX "users_phone_key" ON "users" USING btree ("phone");--> statement-breakpoint
+CREATE UNIQUE INDEX "users_username_key" ON "users" USING btree ("username");--> statement-breakpoint
+CREATE INDEX "users_is_deleted_idx" ON "users" USING btree ("is_deleted");--> statement-breakpoint
+CREATE UNIQUE INDEX "workspace_members_uuid_key" ON "workspace_members" USING btree ("uuid");--> statement-breakpoint
+CREATE UNIQUE INDEX "workspace_members_user_id_workspace_id_key" ON "workspace_members" USING btree ("user_id","workspace_id");--> statement-breakpoint
+CREATE INDEX "workspace_members_workspace_id_idx" ON "workspace_members" USING btree ("workspace_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "workspaces_uuid_key" ON "workspaces" USING btree ("uuid");--> statement-breakpoint
+CREATE INDEX "workspaces_is_deleted_idx" ON "workspaces" USING btree ("is_deleted");

package/registry/combos/express-drizzle/variants/workspaces/drizzle/0001_add_is_active_field.sql

@@ -0,0 +1 @@
+ALTER TABLE "users" ADD COLUMN "is_active" boolean DEFAULT true NOT NULL;