@simple-auth-kit/cli 1.0.0

package/registry/combos/nestjs-prisma/shared/src/permission-cache.ts

@@ -0,0 +1,140 @@
+// Authorization is resolved from the database on every authorized request — a grant or
+// revocation takes effect on the caller's next request, not their next token — which puts one
+// multi-join read on the hot path. This module caches that read without changing the semantics.
+//
+//   1. Version-key invalidation, never eviction: a cache key embeds two generation counters, and
+//      bumping one makes every key built from the old value unreachable in a single write.
+//   2. Two counters: a *subject* counter per principal, bumped by that user's own role/grant
+//      changes; a global *policy* counter, bumped by role-composition or permission-activation
+//      changes. A single global counter would flush everyone on any one user's grant change.
+//   3. The store is an injected interface with an in-memory default — swap in Redis via
+//      `AuthModule.forRoot` without touching this file. Keys are namespaced `simpleauthkit:authz:*`.
+//
+// Authentication is deliberately not cached here: token validity/denylist/blocked-user checks
+// happen on `AuthGuard`, which never reads this cache. Negative results aren't cached either —
+// "not a member of this workspace" is re-read every time.
+import { Inject, Injectable } from "@nestjs/common";
+import { AUTH_CONFIG, AuthConfig } from "./auth.config.js";
+
+/** DI token for the store. Provide your own to `AuthModule.forRoot({ permissionCacheStore })`. */
+export const PERMISSION_CACHE_STORE = Symbol("PERMISSION_CACHE_STORE");
+
+export const CACHE_NAMESPACE = "simpleauthkit:authz";
+
+// Small and string-valued: each op maps onto one Redis command (GET, MGET, SET EX, INCR).
+export interface PermissionCacheStore {
+  get(key: string): Promise<string | undefined>;
+  getMany(keys: readonly string[]): Promise<Array<string | undefined>>;
+  set(key: string, value: string, ttlSeconds: number): Promise<void>;
+  bump(key: string): Promise<number>;
+}
+
+// Default store: a Map with expiry, scoped to one process. Correct for single-instance
+// deployments; a multi-instance deployment should pass a shared store instead, since a version
+// bumped on one instance isn't seen by the others.
+//
+// `stats` isn't decoration — `prove-cycle` asserts N identical authorized requests cause one
+// database resolution, not N.
+export class InMemoryPermissionCacheStore implements PermissionCacheStore {
+  readonly stats = { hits: 0, misses: 0, writes: 0 };
+  private readonly entries = new Map<string, { value: string; expiresAt: number }>();
+
+  async get(key: string): Promise<string | undefined> {
+    const entry = this.entries.get(key);
+    if (!entry) {
+      this.stats.misses += 1;
+      return undefined;
+    }
+    if (entry.expiresAt <= Date.now()) {
+      this.entries.delete(key);
+      this.stats.misses += 1;
+      return undefined;
+    }
+    this.stats.hits += 1;
+    return entry.value;
+  }
+
+  async getMany(keys: readonly string[]): Promise<Array<string | undefined>> {
+    // Version reads are bookkeeping, not cache traffic — counting them in hits/misses would make
+    // the hit rate meaningless, and `prove-cycle` asserts on that number.
+    return keys.map((key) => {
+      const entry = this.entries.get(key);
+      return entry && entry.expiresAt > Date.now() ? entry.value : undefined;
+    });
+  }
+
+  async set(key: string, value: string, ttlSeconds: number): Promise<void> {
+    this.stats.writes += 1;
+    this.entries.set(key, { value, expiresAt: Date.now() + ttlSeconds * 1000 });
+  }
+
+  async bump(key: string): Promise<number> {
+    const entry = this.entries.get(key);
+    const next = Number(entry && entry.expiresAt > Date.now() ? entry.value : 0) + 1;
+    // Version counters outlive entries on purpose: a counter that expired back to 0 would make
+    // every superseded entry reachable again.
+    this.entries.set(key, { value: String(next), expiresAt: Number.MAX_SAFE_INTEGER });
+    return next;
+  }
+}
+
+// Exported so anything writing RBAC rows outside this application (a second service, a
+// migration, a psql session) can bump the counter itself — otherwise an out-of-band write is
+// only picked up once the cache entry expires.
+export const POLICY_VERSION_KEY = `${CACHE_NAMESPACE}:policy-version`;
+export const subjectVersionKey = (subject: string) => `${CACHE_NAMESPACE}:subject-version:${subject}`;
+const entryKey = (subject: string, policy: string, subjectVersion: string) => `${CACHE_NAMESPACE}:entry:${subject}:p${policy}:s${subjectVersion}`;
+
+// Reads through to the database once per (principal, policy version, subject version). Used by
+// each variant's `AuthzGuard` — the variants differ only in what a "subject" is (a user id in
+// `base`, a `userId:workspaceId` pair in `workspaces`), so this file is shared while the guards
+// aren't.
+@Injectable()
+export class PermissionCache {
+  constructor(
+    @Inject(PERMISSION_CACHE_STORE) private readonly store: PermissionCacheStore,
+    @Inject(AUTH_CONFIG) private readonly config: AuthConfig,
+  ) {}
+
+  // Concurrent misses on the same key collapse into one `load()` — in-process, so a cold key
+  // under load costs one database read per instance rather than one per request.
+  private readonly inFlight = new Map<string, Promise<unknown>>();
+
+  async resolve<T>(subject: string, load: () => Promise<T | null>): Promise<T | null> {
+    const ttl = this.config.permissionCacheTtlSeconds;
+    if (ttl <= 0) return load(); // caching off; the semantics are identical, only the cost differs
+
+    const [policy = "0", version = "0"] = await this.store.getMany([POLICY_VERSION_KEY, subjectVersionKey(subject)]);
+    const key = entryKey(subject, policy, version);
+
+    const cached = await this.store.get(key);
+    if (cached !== undefined) return JSON.parse(cached) as T;
+
+    const existing = this.inFlight.get(key);
+    if (existing) return (await existing) as T | null;
+
+    const pending = (async () => {
+      const resolved = await load();
+      // A negative result is not written: see the module comment. Only a real answer is cached.
+      if (resolved !== null) await this.store.set(key, JSON.stringify(resolved), ttl);
+      return resolved;
+    })();
+
+    this.inFlight.set(key, pending);
+    try {
+      return await pending;
+    } finally {
+      this.inFlight.delete(key);
+    }
+  }
+
+  // One principal's role assignments or direct grants changed.
+  async invalidateSubject(subject: string): Promise<void> {
+    await this.store.bump(subjectVersionKey(subject));
+  }
+
+  // What a role carries changed, or a permission was activated/deactivated — affects everyone.
+  async invalidatePolicy(): Promise<void> {
+    await this.store.bump(POLICY_VERSION_KEY);
+  }
+}

package/registry/combos/nestjs-prisma/shared/src/rate-limit.store.ts

@@ -0,0 +1,26 @@
+import { Injectable } from "@nestjs/common";
+import type { RateLimitDeps } from "@/lib/auth/core/rate-limit.js";
+
+/**
+ * In-memory window counter — fine for a single instance / the reference combo's proof.
+ * Swap for Redis (INCR + PEXPIRE) behind this same `increment` signature once you run
+ * more than one instance; nothing above this layer needs to change.
+ */
+@Injectable()
+export class InMemoryRateLimitStore implements RateLimitDeps {
+  private readonly windows = new Map<string, { count: number; resetAt: number }>();
+
+  async increment(key: string, windowMs: number): Promise<number> {
+    const now = Date.now();
+    const existing = this.windows.get(key);
+    if (!existing || existing.resetAt <= now) {
+      this.windows.set(key, { count: 1, resetAt: now + windowMs });
+      return 1;
+    }
+    existing.count += 1;
+    return existing.count;
+  }
+}
+
+/** DI token for the store. Provide your own to `AuthModule.forRoot({ rateLimitStore })` — mirrors `PERMISSION_CACHE_STORE`. */
+export const RATE_LIMIT_STORE = Symbol("RATE_LIMIT_STORE");

package/registry/combos/nestjs-prisma/shared/src/request-context.ts

@@ -0,0 +1,19 @@
+// The three request-scoped objects every guard and controller in this combo reads.
+//
+//   req.auth    — verified access-token claims: which user, which session.
+//   req.authz   — the roles/permissions resolved for this request.
+//   req.ability — the same authorization as a CASL ability, derived from req.authz.permissions
+//                 in the same guard that resolves them.
+//
+// Importing this module for its side effect installs the Express `Request` augmentation.
+import type { AccessTokenClaims } from "@/lib/auth/core/types.js";
+import type { AppAbility } from "./ability.js";
+import type { AuthzContext } from "./authz.guard.js";
+
+declare module "express" {
+  interface Request {
+    auth?: AccessTokenClaims;
+    authz?: AuthzContext;
+    ability?: AppAbility;
+  }
+}

package/registry/combos/nestjs-prisma/shared/src/response.interceptor.ts

@@ -0,0 +1,48 @@
+import { CallHandler, ExecutionContext, Injectable, NestInterceptor } from "@nestjs/common";
+import { Observable, map } from "rxjs";
+import type { Request, Response } from "express";
+
+/**
+ * Every successful response is wrapped the same way: the real HTTP status alongside the payload,
+ * so a client never has to special-case "was this a 200 or a 201" by inspecting the body — the
+ * envelope's `statusCode` and the transport's own status line always agree.
+ */
+export interface Envelope<T> {
+  success: true;
+  statusCode: number;
+  message: string;
+  data: T;
+}
+
+function deriveMessage(method: string): string {
+  switch (method) {
+    case "GET":
+      return "Fetched successfully";
+    case "POST":
+      return "Created successfully";
+    case "PATCH":
+    case "PUT":
+      return "Updated successfully";
+    case "DELETE":
+      return "Deleted successfully";
+    default:
+      return "Request successful";
+  }
+}
+
+@Injectable()
+export class ResponseInterceptor<T> implements NestInterceptor<T, Envelope<T>> {
+  intercept(context: ExecutionContext, next: CallHandler<T>): Observable<Envelope<T>> {
+    const http = context.switchToHttp();
+    const req = http.getRequest<Request>();
+    const res = http.getResponse<Response>();
+    return next.handle().pipe(
+      map((data) => ({
+        success: true,
+        statusCode: res.statusCode,
+        message: deriveMessage(req.method),
+        data,
+      })),
+    );
+  }
+}

package/registry/combos/nestjs-prisma/shared/src/route-tiers.ts

@@ -0,0 +1,102 @@
+// Every route in this combo belongs to exactly one of three tiers, and says so on itself:
+// @Public() (no auth), @Authenticated() (any logged-in user), @CheckAbility(...slugs) (every
+// named slug required). `assertEveryRouteDeclaresATier` below fails startup, by name, for any
+// route declaring none of the three — so an ungated admin route can't ship silently. The check
+// also verifies the guards actually attached match the declared tier, so a route marked
+// @Authenticated() with no AuthGuard can't masquerade as gated.
+import { RequestMethod, SetMetadata } from "@nestjs/common";
+import { GUARDS_METADATA, METHOD_METADATA, PATH_METADATA } from "@nestjs/common/constants.js";
+import type { PermissionSlug } from "./rbac.defaults.js";
+
+export const ROUTE_TIER_KEY = "routeTier";
+export const CHECK_ABILITY_KEY = "checkAbility";
+
+export type RouteTier = "public" | "authenticated" | "ability";
+
+export const Public = () => SetMetadata(ROUTE_TIER_KEY, "public" satisfies RouteTier);
+
+// Pair with @UseGuards(AuthGuard) — the startup check refuses a route that claims this tier
+// without an authentication guard behind it.
+export const Authenticated = () => SetMetadata(ROUTE_TIER_KEY, "authenticated" satisfies RouteTier);
+
+// Requires AuthGuard, then the variant's authorization guard, then AbilityGuard. All named
+// slugs must be held — the guard ANDs them. The argument is typed as `PermissionSlug` (the
+// catalog in rbac.defaults.ts) so a route can't be gated on a slug nothing will ever grant.
+export const CheckAbility = (...abilities: PermissionSlug[]) =>
+  applyBoth(SetMetadata(ROUTE_TIER_KEY, "ability" satisfies RouteTier), SetMetadata(CHECK_ABILITY_KEY, abilities as string[]));
+
+/** `applyDecorators` from @nestjs/common, minus its class-decorator branch — these two are method decorators. */
+function applyBoth(...decorators: MethodDecorator[]): MethodDecorator {
+  return (target, key, descriptor) => {
+    for (const decorate of decorators) decorate(target, key, descriptor);
+    return descriptor;
+  };
+}
+
+/** A guard entry in `@UseGuards` may be a class or an already-constructed instance; both reduce to a class. */
+type GuardEntry = Function | { constructor: Function };
+
+const guardClassesOn = (target: object): Function[] =>
+  ((Reflect.getMetadata(GUARDS_METADATA, target) as GuardEntry[] | undefined) ?? []).map((g) => (typeof g === "function" ? g : g.constructor));
+
+const joinPath = (...parts: unknown[]) =>
+  "/" +
+  parts
+    .filter((p): p is string => typeof p === "string")
+    .flatMap((p) => p.split("/"))
+    .filter((segment) => segment.length > 0)
+    .join("/");
+
+/** Own methods carrying Nest's route metadata. Controllers here are flat classes; inherited routes are not a shape this combo uses. */
+function routeHandlersOf(controller: Function): Array<{ name: string; handler: Function }> {
+  const prototype = controller.prototype as Record<string, unknown>;
+  return Object.getOwnPropertyNames(prototype)
+    .filter((name) => name !== "constructor")
+    .map((name) => ({ name, handler: prototype[name] }))
+    .filter((entry): entry is { name: string; handler: Function } => typeof entry.handler === "function")
+    .filter((entry) => Reflect.getMetadata(PATH_METADATA, entry.handler) !== undefined);
+}
+
+// Fail-closed at startup over the whole route table this library owns. Called from
+// `AuthModule.forRoot` with the same array that populates `controllers:`, so nothing can be
+// added to the module and left out of the check. Covers only this combo's own controllers, not
+// the consuming application's.
+export function assertEveryRouteDeclaresATier(controllers: readonly Function[], guards: { authentication: Function; ability: Function }): void {
+  const offenders: string[] = [];
+
+  for (const controller of controllers) {
+    const controllerPath = Reflect.getMetadata(PATH_METADATA, controller);
+    const controllerGuards = guardClassesOn(controller);
+
+    for (const { name, handler } of routeHandlersOf(controller)) {
+      const method = RequestMethod[Reflect.getMetadata(METHOD_METADATA, handler) as RequestMethod] ?? "?";
+      const route = `${method} ${joinPath(controllerPath, Reflect.getMetadata(PATH_METADATA, handler))} (${controller.name}.${name})`;
+
+      const tier: RouteTier | undefined = Reflect.getMetadata(ROUTE_TIER_KEY, handler) ?? Reflect.getMetadata(ROUTE_TIER_KEY, controller);
+      if (!tier) {
+        offenders.push(`${route} — declares no tier: add @Public(), @Authenticated(), or @CheckAbility(slug)`);
+        continue;
+      }
+
+      // A tier is a claim about what protects the route. Check the claim against the guards that
+      // are actually attached, so "marked but not wired" cannot masquerade as "gated".
+      const attached = [...controllerGuards, ...guardClassesOn(handler)];
+      const authenticated = attached.includes(guards.authentication);
+      const ability = attached.includes(guards.ability);
+
+      if (tier === "public" && (authenticated || ability)) offenders.push(`${route} — declares @Public() but is behind ${attached.map((g) => g.name).join(", ")}`);
+      if (tier === "authenticated" && !authenticated) offenders.push(`${route} — declares @Authenticated() but has no ${guards.authentication.name}`);
+      if (tier === "authenticated" && ability) offenders.push(`${route} — declares @Authenticated() but is behind ${guards.ability.name}; use @CheckAbility instead`);
+      if (tier === "ability" && !(authenticated && ability))
+        offenders.push(`${route} — declares @CheckAbility but is not behind ${guards.authentication.name} + ${guards.ability.name}`);
+    }
+  }
+
+  if (offenders.length) {
+    throw new Error(
+      `${offenders.length} route(s) are not correctly tiered — refusing to start:\n  ` +
+        offenders.join("\n  ") +
+        `\n\nEvery route must be exactly one of: @Public() (no auth), @Authenticated() (any logged-in user), @CheckAbility(slug) (a permission).`,
+    );
+  }
+}

package/registry/combos/nestjs-prisma/shared/src/session.repository.ts

@@ -0,0 +1,129 @@
+import { randomUUID } from "node:crypto";
+import { Inject, Injectable } from "@nestjs/common";
+import type { SessionStoreDeps } from "@/lib/auth/core/session-policy.js";
+import type { AuditEvent, Revoker, SessionRecord } from "@/lib/auth/core/types.js";
+import { PrismaClient } from "../generated/prisma/client.js";
+import { AUTH_CONFIG, AuthConfig } from "./auth.config.js";
+import { AuditLogRepository } from "./audit-log.repository.js";
+import { toId, toIdOrNull } from "./id.helper.js";
+
+function toSessionRecord(row: {
+  id: bigint;
+  userId: bigint;
+  sessionVersion: number;
+  currentRefreshJti: string;
+  provider: string | null;
+  expiresAt: Date;
+  revokedAt: Date | null;
+  revokedBy: bigint | null;
+  revokedByIp: string | null;
+  createdAt: Date;
+  userAgent: string | null;
+  ip: string | null;
+}): SessionRecord {
+  return {
+    id: row.id.toString(),
+    userId: row.userId.toString(),
+    sessionVersion: row.sessionVersion,
+    currentRefreshJti: row.currentRefreshJti,
+    provider: row.provider ?? undefined,
+    expiresAt: row.expiresAt.toISOString(),
+    revokedAt: row.revokedAt?.toISOString() ?? null,
+    revokedBy: row.revokedBy?.toString() ?? undefined,
+    revokedByIp: row.revokedByIp ?? undefined,
+    createdAt: row.createdAt.toISOString(),
+    userAgent: row.userAgent ?? undefined,
+    ip: row.ip ?? undefined,
+  };
+}
+
+// `isRevoked` is derived from `revokedAt` here, not stored as its own fact — one place computing
+// it keeps the two columns honest.
+const revocationFields = (revoker?: Revoker) => ({
+  revokedAt: new Date(),
+  isRevoked: true,
+  isActive: false,
+  revokedBy: toIdOrNull(revoker?.userId),
+  revokedByIp: revoker?.ip ?? null,
+});
+
+@Injectable()
+export class SessionRepository implements SessionStoreDeps {
+  constructor(
+    @Inject(PrismaClient) private readonly prisma: PrismaClient,
+    @Inject(AuditLogRepository) private readonly auditLog: AuditLogRepository,
+    @Inject(AUTH_CONFIG) private readonly config: AuthConfig,
+  ) {}
+
+  async appendAuditEvent(event: AuditEvent): Promise<void> {
+    await this.auditLog.append(event);
+  }
+
+  async findSession(id: string): Promise<SessionRecord | null> {
+    const row = await this.prisma.session.findUnique({ where: { id: toId(id) } });
+    return row ? toSessionRecord(row) : null;
+  }
+
+  async saveSession(session: SessionRecord): Promise<void> {
+    const revoked = session.revokedAt !== null;
+    await this.prisma.session.update({
+      where: { id: toId(session.id) },
+      data: {
+        sessionVersion: session.sessionVersion,
+        currentRefreshJti: session.currentRefreshJti,
+        revokedAt: session.revokedAt ? new Date(session.revokedAt) : null,
+        isRevoked: revoked,
+        isActive: !revoked,
+        revokedBy: toIdOrNull(session.revokedBy),
+        revokedByIp: session.revokedByIp ?? null,
+      },
+    });
+  }
+
+  // expiresAt is set once here and never rewritten — an absolute cap, not a sliding window.
+  // `id` is no longer client-supplied — the bigint PK auto-increments.
+  async createSession(input: { userId: string; userAgent?: string; ip?: string; provider?: string }): Promise<SessionRecord> {
+    const userIdBig = toId(input.userId);
+    const row = await this.prisma.session.create({
+      data: {
+        userId: userIdBig,
+        currentRefreshJti: randomUUID(),
+        provider: input.provider,
+        userAgent: input.userAgent,
+        ip: input.ip,
+        expiresAt: new Date(Date.now() + this.config.sessionTtlSeconds * 1000),
+        createdBy: userIdBig,
+      },
+    });
+    return toSessionRecord(row);
+  }
+
+  async revokeAllByUser(userId: string, revoker?: Revoker): Promise<void> {
+    await this.prisma.session.updateMany({
+      where: { userId: toId(userId), revokedAt: null },
+      data: { ...revocationFields(revoker), sessionVersion: { increment: 1 } },
+    });
+  }
+
+  async revokeAllByUserExcept(userId: string, keepSessionId: string, revoker?: Revoker): Promise<void> {
+    await this.prisma.session.updateMany({
+      where: { userId: toId(userId), id: { not: toId(keepSessionId) }, revokedAt: null },
+      data: { ...revocationFields(revoker), sessionVersion: { increment: 1 } },
+    });
+  }
+
+  async denylistJti(jti: string, ttlSeconds: number): Promise<void> {
+    await this.prisma.denylistedAccessToken.upsert({
+      where: { jti },
+      create: { jti, expiresAt: new Date(Date.now() + ttlSeconds * 1000) },
+      update: { expiresAt: new Date(Date.now() + ttlSeconds * 1000) },
+    });
+  }
+
+  async isDenylisted(jti: string): Promise<boolean> {
+    const row = await this.prisma.denylistedAccessToken.findUnique({ where: { jti } });
+    if (!row) return false;
+    if (row.expiresAt.getTime() < Date.now()) return false; // expired; a cleanup job reaps these, see Phase 6
+    return true;
+  }
+}

package/registry/combos/nestjs-prisma/shared/src/two-factor.repository.ts

@@ -0,0 +1,29 @@
+import { Inject, Injectable } from "@nestjs/common";
+import { verifyBackupCode } from "@/lib/auth/core/two-factor.js";
+import { PrismaClient } from "../generated/prisma/client.js";
+
+// Takes bigint directly, not string: every caller already has the user row's id in hand from
+// its own Prisma lookup, so there's nothing to parse here.
+@Injectable()
+export class TwoFactorRepository {
+  constructor(@Inject(PrismaClient) private readonly prisma: PrismaClient) {}
+
+  /** Replaces any prior set — re-confirming enrollment invalidates old backup codes. */
+  async saveBackupCodes(userId: bigint, hashes: string[]): Promise<void> {
+    await this.prisma.twoFactorBackupCode.deleteMany({ where: { userId } });
+    await this.prisma.twoFactorBackupCode.createMany({ data: hashes.map((codeHash) => ({ userId, codeHash })) });
+  }
+
+  async consumeBackupCode(userId: bigint, code: string): Promise<boolean> {
+    const unused = await this.prisma.twoFactorBackupCode.findMany({ where: { userId, usedAt: null } });
+    const match = unused.find((row) => verifyBackupCode(code, row.codeHash));
+    if (!match) return false;
+
+    await this.prisma.twoFactorBackupCode.update({ where: { id: match.id }, data: { usedAt: new Date() } });
+    return true;
+  }
+
+  async clearBackupCodes(userId: bigint): Promise<void> {
+    await this.prisma.twoFactorBackupCode.deleteMany({ where: { userId } });
+  }
+}

package/registry/combos/nestjs-prisma/test/bootstrap.ts

@@ -0,0 +1,54 @@
+import "reflect-metadata";
+import { Module } from "@nestjs/common";
+import { NestFactory } from "@nestjs/core";
+import { AuthModule } from "../src/auth.module.js";
+import { InMemoryPermissionCacheStore } from "../src/permission-cache.js";
+
+// No mailer is wired up for the proof, so this stands in for one — prove-cycle.ts reads the
+// raw token back out of here the same way a test inbox would, to exercise the reset flow.
+export const capturedResetTokens = new Map<string, string>();
+
+/**
+ * The very store the app resolves permissions through. Exposed so `prove-cycle.ts` can assert
+ * that N identical authorized requests cause one database resolution rather than N — a cache
+ * nobody can prove is working is a bug surface, not an optimisation.
+ */
+export const permissionCacheStore = new InMemoryPermissionCacheStore();
+
+/**
+ * The app module is built *inside* `bootstrap()`, not at import time.
+ *
+ * `AuthModule.forRoot` is where the startup route-tier check runs, and the proof needs to call
+ * bootstrap twice: once with a deliberately untiered route present, expecting the boot to fail,
+ * and once without. A module built at import time would have run the check before the proof could
+ * arrange either case.
+ */
+export async function bootstrap(port: number) {
+  @Module({
+    imports: [
+      AuthModule.forRoot({
+        // Was 2 seconds, "so the proof can exercise expiry-adjacent paths quickly" — except no
+        // assertion in the proof waits for an access token to expire, so it bought nothing and
+        // cost a real 1-in-10 flake: the admin's token could die mid-section and surface as a
+        // confusing failure two assertions later. Long enough that expiry is never a variable,
+        // short enough to stay realistic. See `renewingToken` in test/harness.ts for the other
+        // half of the fix.
+        accessTokenTtlSeconds: 300,
+        // The proof fires hundreds of requests in well under a minute — the production buckets
+        // (100/1s, 200/10s, 400/60s) would 429 it partway through. One generous bucket keeps the
+        // throttler guard on every request without ever tripping, so its wiring is exercised
+        // rather than switched off.
+        throttle: [{ name: "proof", ttl: 1_000, limit: 100_000 }],
+        permissionCacheStore,
+        sendPasswordResetEmail: async (email, token) => {
+          capturedResetTokens.set(email, token);
+        },
+      }),
+    ],
+  })
+  class AppModule {}
+
+  const app = await NestFactory.create(AppModule, { logger: false });
+  await app.listen(port);
+  return app;
+}