@simple-auth-kit/cli 1.0.0

package/registry/combos/nestjs-prisma/variants/base/prisma/schema/simple-auth-kit.prisma

@@ -0,0 +1,437 @@
+// Roles and permissions are global to this deployment. Authorization is resolved from the
+// database on every request (user → roles → role permissions, unioned with direct grants), and
+// the access token carries no authorization — a grant or revocation takes effect on the next
+// request, not the next token.
+// This is one file among possibly several under prisma/schema/ — Prisma's multi-file schema
+// support (stable since well before the version this repo pins) merges every .prisma file in
+// that folder into one logical schema automatically. Named simple-auth-kit.prisma specifically
+// so a consumer's own models, added as a sibling file in this same folder, are picked up by
+// `prisma generate`/`migrate` too, without the CLI ever touching that sibling file — it only
+// ever manages this one, by its exact name.
+//
+// `output` stays relative to *this file's own location*, which differs by context: the
+// registry's own dev/typecheck loop (scripts/materialize.mjs) keeps prisma/ as a sibling of
+// src/, so "../../generated/prisma" (two levels up from prisma/schema/) lands next to src/,
+// matching every "../generated/prisma/client.js" import there. A real CLI install moves
+// prisma.config.ts + prisma/ to the project root while src/ stays nested inside the merged
+// auth-lib directory — the CLI rewrites those same import strings in the copied files to match
+// (see installMerge's extraRewrites in cli/simple-auth-kit.ts), rather than this field trying to
+// be two things at once.
+generator client {
+  provider = "prisma-client"
+  output   = "../../generated/prisma"
+}
+
+datasource db {
+  provider = "postgresql"
+}
+
+model User {
+  id               BigInt    @id @default(autoincrement())
+  uuid             String    @unique @default(uuid())
+  email            String    @unique
+  firstName        String?   @unique @map("first_name")
+  lastName         String?   @unique @map("last_name")
+  displayName      String?   @map("display_name")
+  phone            String?   @unique
+  username         String?   @unique
+  photo            String?
+  dob              DateTime? @db.Date
+  gender           String?   @db.VarChar(10)
+  joinedDate       DateTime  @default(now()) @map("joined_date") @db.Date
+  lastLogin        DateTime? @map("last_login") @db.Timestamptz(6)
+  passwordHash     String?   @map("password_hash") // nullable: OAuth-only signup has no password
+  // Two independent reasons an account can't authenticate, tracked separately so an admin can see
+  // *why*: `blocked` is a security/moderation action (see `block()`/`unblock()`); `isActive` is a
+  // routine administrative on/off toggle (see `activate()`/`deactivate()`) — e.g. paused while an
+  // employee is on leave, with no implication of wrongdoing. Both deny login on their own; neither
+  // implies the other, and unblocking a blocked-but-inactive account still leaves it inactive.
+  blocked          Boolean   @default(false)
+  isActive         Boolean   @default(true) @map("is_active")
+  twoFactorEnabled Boolean   @default(false) @map("two_factor_enabled")
+  twoFactorSecret  String?   @map("two_factor_secret") // base32 TOTP secret; plaintext-at-rest
+  createdBy        BigInt?   @map("created_by")
+  updatedBy        BigInt?   @map("updated_by")
+  isDeleted        Boolean   @default(false) @map("is_deleted")
+  deletedAt        DateTime? @map("deleted_at") @db.Timestamptz(6)
+  deletedBy        BigInt?   @map("deleted_by")
+  deletedReason    String?   @map("deleted_reason") @db.VarChar(255)
+  createdAt        DateTime  @default(now()) @map("created_at") @db.Timestamptz(6)
+  updatedAt        DateTime  @updatedAt @map("updated_at") @db.Timestamptz(6)
+
+  roles                RoleUser[]
+  permissions          PermissionUser[]
+  sessions             Session[]             @relation("UserSessions")
+  oauthAccounts        OAuthAccount[]
+  passwordResetTokens  PasswordResetToken[]
+  twoFactorBackupCodes TwoFactorBackupCode[]
+
+  // Named relations: Session/Role/Permission each point at User multiple times, so Prisma needs
+  // an explicit name per back-reference.
+  revokedSessions Session[] @relation("UserRevokedSessions")
+  createdSessions Session[] @relation("SessionCreatedBy")
+  updatedSessions Session[] @relation("SessionUpdatedBy")
+  deletedSessions Session[] @relation("SessionDeletedBy")
+
+  createdByUser User?  @relation("UserCreatedBy", fields: [createdBy], references: [id], onDelete: SetNull)
+  usersCreated  User[] @relation("UserCreatedBy")
+  updatedByUser User?  @relation("UserUpdatedBy", fields: [updatedBy], references: [id], onDelete: SetNull)
+  usersUpdated  User[] @relation("UserUpdatedBy")
+  deletedByUser User?  @relation("UserDeletedBy", fields: [deletedBy], references: [id], onDelete: SetNull)
+  usersDeleted  User[] @relation("UserDeletedBy")
+
+  rolesCreated       Role[]       @relation("RoleCreatedBy")
+  rolesUpdated       Role[]       @relation("RoleUpdatedBy")
+  rolesDeleted       Role[]       @relation("RoleDeletedBy")
+  permissionsCreated Permission[] @relation("PermissionCreatedBy")
+  permissionsUpdated Permission[] @relation("PermissionUpdatedBy")
+  permissionsDeleted Permission[] @relation("PermissionDeletedBy")
+
+  countriesCreated Country[] @relation("CountryCreatedBy")
+  countriesUpdated Country[] @relation("CountryUpdatedBy")
+  countriesDeleted Country[] @relation("CountryDeletedBy")
+
+  languagesCreated Language[] @relation("LanguageCreatedBy")
+  languagesUpdated Language[] @relation("LanguageUpdatedBy")
+  languagesDeleted Language[] @relation("LanguageDeletedBy")
+
+  customersCreated Customer[] @relation("CustomerCreatedBy")
+  customersUpdated Customer[] @relation("CustomerUpdatedBy")
+  customersDeleted Customer[] @relation("CustomerDeletedBy")
+
+  @@index([isDeleted], map: "users_is_deleted_idx")
+  @@map("users")
+}
+
+/// `slug` is the identifier grants/revocations key off, so renaming `name`/`displayName` never
+/// breaks one. `isDefault` is what a newly signed-up user is given. `isActive: false` suspends a
+/// role without deleting it; `isDeleted` removes it from every listing outright.
+model Role {
+  id            BigInt    @id @default(autoincrement())
+  uuid          String    @unique @default(uuid())
+  slug          String    @unique @db.VarChar(255)
+  name          String    @db.VarChar(255)
+  displayName   String    @map("display_name") @db.VarChar(255)
+  description   String?
+  isDefault     Boolean   @default(false) @map("is_default")
+  order         Int       @default(0)
+  isActive      Boolean   @default(true) @map("is_active")
+  createdBy     BigInt?   @map("created_by")
+  updatedBy     BigInt?   @map("updated_by")
+  isDeleted     Boolean   @default(false) @map("is_deleted")
+  deletedAt     DateTime? @map("deleted_at") @db.Timestamptz(6)
+  deletedBy     BigInt?   @map("deleted_by")
+  deletedReason String?   @map("deleted_reason") @db.VarChar(255)
+  createdAt     DateTime  @default(now()) @map("created_at") @db.Timestamptz(6)
+  updatedAt     DateTime  @updatedAt @map("updated_at") @db.Timestamptz(6)
+
+  users       RoleUser[]
+  permissions PermissionRole[]
+
+  createdByUser User? @relation("RoleCreatedBy", fields: [createdBy], references: [id], onDelete: SetNull)
+  updatedByUser User? @relation("RoleUpdatedBy", fields: [updatedBy], references: [id], onDelete: SetNull)
+  deletedByUser User? @relation("RoleDeletedBy", fields: [deletedBy], references: [id], onDelete: SetNull)
+
+  @@index([isDefault], map: "roles_is_default_idx")
+  @@index([isActive, order], map: "roles_active_order_idx")
+  @@index([isDeleted], map: "roles_is_deleted_idx")
+  @@map("roles")
+}
+
+/// One capability, identified by its `slug` (`users:read`, `roles:assign`) — the same string
+/// used in `@CheckAbility` and `ability.can`. `group`/`groupOrder`/`order` back the admin
+/// console's permission matrix. `isActive: false` switches a capability off deployment-wide
+/// without unpicking every role that grants it; `isDeleted` removes it from every listing.
+model Permission {
+  id            BigInt    @id @default(autoincrement())
+  uuid          String    @unique @default(uuid())
+  slug          String    @unique @db.VarChar(255)
+  name          String    @db.VarChar(255)
+  displayName   String    @map("display_name") @db.VarChar(255)
+  description   String?
+  group         String    @default("General") @db.VarChar(255)
+  groupOrder    Int       @default(0) @map("group_order")
+  order         Int       @default(0)
+  isActive      Boolean   @default(true) @map("is_active")
+  createdBy     BigInt?   @map("created_by")
+  updatedBy     BigInt?   @map("updated_by")
+  isDeleted     Boolean   @default(false) @map("is_deleted")
+  deletedAt     DateTime? @map("deleted_at") @db.Timestamptz(6)
+  deletedBy     BigInt?   @map("deleted_by")
+  deletedReason String?   @map("deleted_reason") @db.VarChar(255)
+  createdAt     DateTime  @default(now()) @map("created_at") @db.Timestamptz(6)
+  updatedAt     DateTime  @updatedAt @map("updated_at") @db.Timestamptz(6)
+
+  roles PermissionRole[]
+  users PermissionUser[]
+
+  createdByUser User? @relation("PermissionCreatedBy", fields: [createdBy], references: [id], onDelete: SetNull)
+  updatedByUser User? @relation("PermissionUpdatedBy", fields: [updatedBy], references: [id], onDelete: SetNull)
+  deletedByUser User? @relation("PermissionDeletedBy", fields: [deletedBy], references: [id], onDelete: SetNull)
+
+  @@index([isActive], map: "permissions_is_active_idx")
+  @@index([group, groupOrder, order], map: "permissions_group_order_idx")
+  @@index([isDeleted], map: "permissions_is_deleted_idx")
+  @@map("permissions")
+}
+
+/// Which roles a user holds.
+model RoleUser {
+  userId    BigInt   @map("user_id")
+  roleId    BigInt   @map("role_id")
+  createdAt DateTime @default(now()) @map("created_at") @db.Timestamptz(6)
+  updatedAt DateTime @updatedAt @map("updated_at") @db.Timestamptz(6)
+
+  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
+  role Role @relation(fields: [roleId], references: [id], onDelete: Cascade)
+
+  @@id([userId, roleId])
+  @@index([roleId], map: "role_user_role_id_idx")
+  @@map("role_user")
+}
+
+/// What each role carries.
+model PermissionRole {
+  permissionId BigInt   @map("permission_id")
+  roleId       BigInt   @map("role_id")
+  createdAt    DateTime @default(now()) @map("created_at") @db.Timestamptz(6)
+  updatedAt    DateTime @updatedAt @map("updated_at") @db.Timestamptz(6)
+
+  permission Permission @relation(fields: [permissionId], references: [id], onDelete: Cascade)
+  role       Role       @relation(fields: [roleId], references: [id], onDelete: Cascade)
+
+  @@id([permissionId, roleId])
+  @@index([roleId], map: "permission_role_role_id_idx")
+  @@map("permission_role")
+}
+
+/// Direct per-user permission grants, additive to whatever the user's roles already carry.
+model PermissionUser {
+  userId       BigInt   @map("user_id")
+  permissionId BigInt   @map("permission_id")
+  createdAt    DateTime @default(now()) @map("created_at") @db.Timestamptz(6)
+  updatedAt    DateTime @updatedAt @map("updated_at") @db.Timestamptz(6)
+
+  user       User       @relation(fields: [userId], references: [id], onDelete: Cascade)
+  permission Permission @relation(fields: [permissionId], references: [id], onDelete: Cascade)
+
+  @@id([userId, permissionId])
+  @@index([permissionId], map: "permission_user_permission_id_idx")
+  @@map("permission_user")
+}
+
+/// Links a social-login identity to a User. `[provider, providerAccountId]` is the OIDC `sub`
+/// claim; one User can have several, one per provider.
+model OAuthAccount {
+  id                BigInt   @id @default(autoincrement())
+  uuid              String   @unique @default(uuid())
+  userId            BigInt   @map("user_id")
+  provider          String   @db.VarChar(100)
+  providerAccountId String   @map("provider_account_id")
+  email             String?
+  createdAt         DateTime @default(now()) @map("created_at") @db.Timestamptz(6)
+
+  user User @relation(fields: [userId], references: [id])
+
+  @@unique([provider, providerAccountId])
+  @@index([userId], map: "oauth_accounts_user_id_idx")
+  @@map("oauth_accounts")
+}
+
+/// Single-use forgot-password tokens. Only `tokenHash` is stored, never the raw token.
+model PasswordResetToken {
+  id         BigInt    @id @default(autoincrement())
+  uuid       String    @unique @default(uuid())
+  userId     BigInt    @map("user_id")
+  tokenHash  String    @unique @map("token_hash")
+  expiresAt  DateTime  @map("expires_at") @db.Timestamptz(6)
+  consumedAt DateTime? @map("consumed_at") @db.Timestamptz(6)
+  createdAt  DateTime  @default(now()) @map("created_at") @db.Timestamptz(6)
+
+  user User @relation(fields: [userId], references: [id])
+
+  @@map("password_reset_tokens")
+}
+
+/// One-time 2FA recovery codes, issued when the user confirms TOTP enrollment.
+model TwoFactorBackupCode {
+  id       BigInt    @id @default(autoincrement())
+  uuid     String    @unique @default(uuid())
+  userId   BigInt    @map("user_id")
+  codeHash String    @map("code_hash")
+  usedAt   DateTime? @map("used_at") @db.Timestamptz(6)
+
+  user User @relation(fields: [userId], references: [id])
+
+  @@index([userId], map: "two_factor_backup_codes_user_id_idx")
+  @@map("two_factor_backup_codes")
+}
+
+/// Append-only event sink for `SessionStoreDeps.appendAuditEvent` (registry/core/session-policy.ts)
+/// plus the RBAC/2FA/OAuth/password-reset flows. `action` is the AuditEvent's discriminant and
+/// `info` the rest of its fields, so no schema change is needed when core adds event variants.
+/// The RBAC/User/Session tables also carry their own `createdBy`/`updatedBy`/`deletedBy` — a
+/// denormalized copy of the same fact, kept so a row-level "who touched this" read needs no join.
+model AuditLog {
+  id        BigInt   @id @default(autoincrement())
+  uuid      String   @unique @default(uuid())
+  userId    BigInt?  @map("user_id") // who the event is about; null if not attributable to one user
+  name      String // human-readable label for `action`, e.g. "Role assigned"
+  action    String // AuditEvent discriminant, e.g. "role_assigned"
+  info      Json // the rest of the AuditEvent's fields
+  remarks   String? // free-text note
+  createdAt DateTime @default(now()) @map("created_at") @db.Timestamptz(6)
+  updatedAt DateTime @updatedAt @map("updated_at") @db.Timestamptz(6)
+
+  @@index([userId, createdAt], map: "audit_logs_user_created_idx")
+  @@index([createdAt], map: "audit_logs_created_idx")
+  @@map("audit_logs")
+}
+
+/// One row per logged-in device. Stores no usable credential: `currentRefreshJti` is the id of
+/// the currently-valid refresh token, not the token itself. `expiresAt` is an absolute cap set
+/// once at creation, never extended — `rotateRefreshToken` in core enforces it. `isRevoked` is
+/// derived from `revokedAt` by the repository, never set independently.
+model Session {
+  id                BigInt    @id @default(autoincrement())
+  uuid              String    @unique @default(uuid())
+  userId            BigInt    @map("user_id")
+  sessionVersion    Int       @default(0) @map("session_version")
+  currentRefreshJti String    @map("current_refresh_jti")
+  provider          String?   @db.VarChar(100) // OAuth provider this login came through; null for a password login
+  userAgent         String?   @map("user_agent")
+  ip                String?   @db.VarChar(100)
+  expiresAt         DateTime  @map("expires_at") @db.Timestamptz(6)
+  isRevoked         Boolean   @default(false) @map("is_revoked")
+  revokedAt         DateTime? @map("revoked_at") @db.Timestamptz(6)
+  revokedBy         BigInt?   @map("revoked_by")
+  revokedByIp       String?   @map("revoked_ip") @db.VarChar(100)
+  isActive          Boolean   @default(true) @map("is_active")
+  createdBy         BigInt?   @map("created_by")
+  updatedBy         BigInt?   @map("updated_by")
+  isDeleted         Boolean   @default(false) @map("is_deleted")
+  deletedAt         DateTime? @map("deleted_at") @db.Timestamptz(6)
+  deletedBy         BigInt?   @map("deleted_by")
+  deletedReason     String?   @map("deleted_reason") @db.VarChar(255)
+  createdAt         DateTime  @default(now()) @map("created_at") @db.Timestamptz(6)
+  updatedAt         DateTime  @updatedAt @map("updated_at") @db.Timestamptz(6)
+
+  user          User  @relation("UserSessions", fields: [userId], references: [id], onDelete: Cascade)
+  revokedByUser User? @relation("UserRevokedSessions", fields: [revokedBy], references: [id], onDelete: SetNull)
+  createdByUser User? @relation("SessionCreatedBy", fields: [createdBy], references: [id], onDelete: SetNull)
+  updatedByUser User? @relation("SessionUpdatedBy", fields: [updatedBy], references: [id], onDelete: SetNull)
+  deletedByUser User? @relation("SessionDeletedBy", fields: [deletedBy], references: [id], onDelete: SetNull)
+
+  @@index([userId], map: "sessions_user_id_idx")
+  @@index([isRevoked], map: "sessions_is_revoked_idx")
+  @@index([expiresAt], map: "sessions_expires_at_idx")
+  @@index([userId, isRevoked, expiresAt], map: "sessions_user_active_idx")
+  @@index([revokedBy], map: "sessions_revoked_by_idx")
+  @@map("sessions")
+}
+
+/// Instant access-token revocation. Rows are only ever as old as the access-token TTL (~15 min)
+/// — safe to move to Redis with a matching TTL without changing callers.
+model DenylistedAccessToken {
+  jti       String   @id
+  expiresAt DateTime @map("expires_at") @db.Timestamptz(6)
+
+  @@map("denylisted_access_tokens")
+}
+
+/// Admin-managed reference data — a deployment's country list. `flag` is a stored image path/URL,
+/// the same string-field convention `User.photo` already uses (no multipart upload in this combo).
+model Country {
+  id           BigInt    @id @default(autoincrement())
+  uuid         String    @unique @default(uuid())
+  code         String    @unique @db.VarChar(10)
+  name         String    @db.VarChar(100)
+  emoji        String    @db.VarChar(10)
+  phoneCode    String    @map("phone_code") @db.VarChar(10)
+  currency     String    @db.VarChar(10)
+  currencyName String    @map("currency_name") @db.VarChar(100)
+  isoCode      String    @unique @map("iso_code") @db.VarChar(10)
+  flag         String?
+  isActive     Boolean   @default(true) @map("is_active")
+  createdBy    BigInt?   @map("created_by")
+  updatedBy    BigInt?   @map("updated_by")
+  isDeleted    Boolean   @default(false) @map("is_deleted")
+  deletedAt    DateTime? @map("deleted_at") @db.Timestamptz(6)
+  deletedBy    BigInt?   @map("deleted_by")
+  deletedReason String?  @map("deleted_reason") @db.VarChar(255)
+  createdAt    DateTime  @default(now()) @map("created_at") @db.Timestamptz(6)
+  updatedAt    DateTime  @updatedAt @map("updated_at") @db.Timestamptz(6)
+
+  createdByUser User? @relation("CountryCreatedBy", fields: [createdBy], references: [id], onDelete: SetNull)
+  updatedByUser User? @relation("CountryUpdatedBy", fields: [updatedBy], references: [id], onDelete: SetNull)
+  deletedByUser User? @relation("CountryDeletedBy", fields: [deletedBy], references: [id], onDelete: SetNull)
+
+  @@index([isActive], map: "countries_is_active_idx")
+  @@index([isDeleted], map: "countries_is_deleted_idx")
+  @@map("countries")
+}
+
+/// Admin-managed reference data — a deployment's supported languages. Deliberately no `countryId`
+/// FK: the UI this backend mirrors has no country field on the language form.
+model Language {
+  id            BigInt    @id @default(autoincrement())
+  uuid          String    @unique @default(uuid())
+  code          String    @unique @db.VarChar(10)
+  name          String    @db.VarChar(100)
+  nativeName    String    @map("native_name") @db.VarChar(100)
+  direction     String    @default("ltr") @db.VarChar(3)
+  isDefault     Boolean   @default(false) @map("is_default")
+  isActive      Boolean   @default(true) @map("is_active")
+  createdBy     BigInt?   @map("created_by")
+  updatedBy     BigInt?   @map("updated_by")
+  isDeleted     Boolean   @default(false) @map("is_deleted")
+  deletedAt     DateTime? @map("deleted_at") @db.Timestamptz(6)
+  deletedBy     BigInt?   @map("deleted_by")
+  deletedReason String?   @map("deleted_reason") @db.VarChar(255)
+  createdAt     DateTime  @default(now()) @map("created_at") @db.Timestamptz(6)
+  updatedAt     DateTime  @updatedAt @map("updated_at") @db.Timestamptz(6)
+
+  createdByUser User? @relation("LanguageCreatedBy", fields: [createdBy], references: [id], onDelete: SetNull)
+  updatedByUser User? @relation("LanguageUpdatedBy", fields: [updatedBy], references: [id], onDelete: SetNull)
+  deletedByUser User? @relation("LanguageDeletedBy", fields: [deletedBy], references: [id], onDelete: SetNull)
+
+  @@index([isActive], map: "languages_is_active_idx")
+  @@index([isDeleted], map: "languages_is_deleted_idx")
+  @@map("languages")
+}
+
+/// End-users managed by admins — no login capability, and deliberately not related to the RBAC
+/// `User` model above (which plays this deployment's "admin"). A `Customer` never authenticates,
+/// so it carries no password/session/role relations at all.
+model Customer {
+  id               BigInt    @id @default(autoincrement())
+  uuid             String    @unique @default(uuid())
+  firstName        String?   @map("first_name") @db.VarChar(100)
+  lastName         String?   @map("last_name") @db.VarChar(100)
+  username         String?   @unique @db.VarChar(100)
+  email            String    @unique @db.VarChar(255)
+  phone            String?   @unique @db.VarChar(100)
+  dob              DateTime? @db.Date
+  gender           String?   @db.VarChar(10)
+  joinedDate       DateTime  @default(now()) @map("joined_date") @db.Date
+  photo            String?
+  isEmailVerified  Boolean   @default(false) @map("is_email_verified")
+  isPhoneVerified  Boolean   @default(false) @map("is_phone_verified")
+  isActive         Boolean   @default(true) @map("is_active")
+  createdBy        BigInt?   @map("created_by")
+  updatedBy        BigInt?   @map("updated_by")
+  isDeleted        Boolean   @default(false) @map("is_deleted")
+  deletedAt        DateTime? @map("deleted_at") @db.Timestamptz(6)
+  deletedBy        BigInt?   @map("deleted_by")
+  deletedReason    String?   @map("deleted_reason") @db.VarChar(255)
+  createdAt        DateTime  @default(now()) @map("created_at") @db.Timestamptz(6)
+  updatedAt        DateTime  @updatedAt @map("updated_at") @db.Timestamptz(6)
+
+  createdByUser User? @relation("CustomerCreatedBy", fields: [createdBy], references: [id], onDelete: SetNull)
+  updatedByUser User? @relation("CustomerUpdatedBy", fields: [updatedBy], references: [id], onDelete: SetNull)
+  deletedByUser User? @relation("CustomerDeletedBy", fields: [deletedBy], references: [id], onDelete: SetNull)
+
+  @@index([isActive], map: "customers_is_active_idx")
+  @@index([isDeleted], map: "customers_is_deleted_idx")
+  @@map("customers")
+}