@simple-auth-kit/cli 1.0.0

package/registry/combos/nestjs-prisma/variants/base/test/variant-hooks.ts

@@ -0,0 +1,135 @@
+// Variant hooks for the no-workspaces variant. See test/harness.ts for the contract. Admin
+// authority here is global (the `admin` role) — there's no scope to admit a user into.
+import "dotenv/config";
+import { PrismaPg } from "@prisma/adapter-pg";
+import { PrismaClient } from "../generated/prisma/client.js";
+import { toId } from "../src/id.helper.js";
+import { provisionDefaultRoles, SEED_ADMIN_ROLES } from "../src/rbac.defaults.js";
+import { POLICY_VERSION_KEY } from "../src/permission-cache.js";
+import { permissionCacheStore } from "./bootstrap.js";
+import { renewingToken, type AdminSession, type AuthTokens, type Principal, type ProofContext, type VariantHooks } from "./harness.js";
+
+const prisma = new PrismaClient({ adapter: new PrismaPg({ connectionString: process.env["DATABASE_URL"] }) });
+
+/** Remembered by `makeAdmin` so `freshToken()` can mint a new one whenever a section needs it. */
+let adminCredentials: { identifier: string; password: string } | undefined;
+
+export const hooks: VariantHooks = {
+  variant: "base",
+
+  async makeAdmin(ctx: ProofContext, principal: Principal): Promise<AdminSession> {
+    // Calls the same provisioning function `npm run seed` does — idempotent, safe against an
+    // already-seeded database.
+    await provisionDefaultRoles(prisma);
+    const roles = await prisma.role.findMany({ where: { slug: { in: SEED_ADMIN_ROLES } }, select: { id: true } });
+    await prisma.roleUser.createMany({ data: roles.map((role) => ({ userId: toId(principal.userId), roleId: role.id })), skipDuplicates: true });
+
+    adminCredentials = { identifier: principal.email, password: principal.password };
+    // These writes went straight to the database, behind the app's back — bump the policy
+    // counter ourselves so the cache doesn't keep serving a stale (empty) permission set.
+    await permissionCacheStore.bump(POLICY_VERSION_KEY);
+    const login = await ctx.call("POST", "/auth/login", { body: { identifier: principal.email, password: principal.password } });
+    const token = (login.body as AuthTokens).accessToken;
+    ctx.assert(!!token, `the seeded admin can log in (got ${login.status})`);
+    return {
+      token,
+      freshToken: renewingToken(async () => {
+        const res = await ctx.call("POST", "/auth/login", { body: adminCredentials! });
+        return (res.body as AuthTokens).accessToken;
+      }),
+    };
+  },
+
+  async admitUser(): Promise<void> {
+    // Nothing to do: admin endpoints operate on the whole deployment.
+  },
+
+  async proveVariantProperties(ctx: ProofContext, admin: AdminSession): Promise<void> {
+    const listed = await ctx.call("GET", "/auth/admin/users", { token: await admin.freshToken() });
+    ctx.assert(listed.status === 200, `admin can list every user in the deployment (got ${listed.status})`);
+    ctx.assert(Array.isArray(listed.body?.items) && listed.body.items.length > 0, "the user list is non-empty");
+
+    const workspaces = await ctx.call("GET", "/workspaces", { token: await admin.freshToken() });
+    ctx.assert(workspaces.status === 404, `no workspace endpoints exist in this variant (got ${workspaces.status})`);
+
+    const me = await ctx.call("GET", "/auth/me", { token: await admin.freshToken() });
+    ctx.assert(me.body?.roles?.includes("admin"), "roles are global: they apply to every request this user makes");
+
+    // Authorization is not in the token, so a grant/revoke lands on the caller's next request.
+    const email = ctx.uniqueEmail("immediate");
+    const password = "immediate-pw-12345";
+    const tokens = await ctx.signup(email, password);
+    const userId = (await ctx.call("GET", "/auth/me", { token: tokens.accessToken })).body.sub as string;
+
+    const beforeGrant = await ctx.call("GET", "/auth/admin/users", { token: tokens.accessToken });
+    ctx.assert(beforeGrant.status === 403, `a user with no grant is refused (got ${beforeGrant.status})`);
+
+    const granted = await ctx.call("POST", `/auth/admin/users/${userId}/permissions`, { token: await admin.freshToken(), body: { permission: "users:read" } });
+    ctx.assert(granted.status === 200 || granted.status === 201, `admin can grant a permission directly (got ${granted.status})`);
+
+    const afterGrant = await ctx.call("GET", "/auth/admin/users", { token: tokens.accessToken });
+    ctx.assert(afterGrant.status === 200, `…and the grant is in effect on the very next request, on the token they already held (got ${afterGrant.status})`);
+
+    const revoked = await ctx.call("POST", `/auth/admin/users/${userId}/permissions/${encodeURIComponent("users:read")}/revoke`, {
+      token: await admin.freshToken(),
+    });
+    ctx.assert(revoked.status === 200 || revoked.status === 201, `admin can revoke the direct grant (got ${revoked.status})`);
+
+    const afterRevoke = await ctx.call("GET", "/auth/admin/users", { token: tokens.accessToken });
+    ctx.assert(afterRevoke.status === 403, `and the revocation lands on the very next request too, on the same token (got ${afterRevoke.status})`);
+
+    await proveTheCacheIsReal(ctx, admin, tokens.accessToken);
+    await proveARawDatabaseEditChangesEnforcement(ctx, admin);
+  },
+};
+
+// Reads the very store the app resolves through, so "the second request didn't touch the
+// database" is a measurement rather than a claim.
+async function proveTheCacheIsReal(ctx: ProofContext, admin: AdminSession, token: string): Promise<void> {
+  const N = 8;
+  await ctx.call("GET", "/auth/me", { token }); // warm, so the measurement is of the steady state
+  const before = { ...permissionCacheStore.stats };
+  for (let i = 0; i < N; i += 1) await ctx.call("GET", "/auth/me", { token });
+  const after = permissionCacheStore.stats;
+
+  ctx.assert(
+    after.misses === before.misses && after.hits === before.hits + N,
+    `${N} identical authorized requests resolve permissions 0 further times — all ${N} were cache hits (misses +${after.misses - before.misses}, hits +${after.hits - before.hits})`,
+  );
+
+  const userId = (await ctx.call("GET", "/auth/me", { token })).body.sub as string;
+  const beforeGrant = { ...permissionCacheStore.stats };
+  await ctx.call("POST", `/auth/admin/users/${userId}/permissions`, { token: await admin.freshToken(), body: { permission: "probe:cache" } });
+  const afterGrantCall = await ctx.call("GET", "/auth/me", { token });
+  ctx.assert(
+    permissionCacheStore.stats.misses > beforeGrant.misses,
+    "a grant bumps this user's version counter, so the next request misses the cache and re-resolves rather than serving a stale entry",
+  );
+  ctx.assert((afterGrantCall.body?.permissions ?? []).includes("probe:cache"), "…and the freshly resolved answer contains the new permission");
+  await ctx.call("POST", `/auth/admin/users/${userId}/permissions/${encodeURIComponent("probe:cache")}/revoke`, { token: await admin.freshToken() });
+}
+
+// Writes the row directly rather than through the admin API, ruling out any in-memory side
+// channel — a `psql` session would look exactly like this.
+async function proveARawDatabaseEditChangesEnforcement(ctx: ProofContext, admin: AdminSession): Promise<void> {
+  const email = ctx.uniqueEmail("rawedit");
+  const tokens = await ctx.signup(email, "rawedit-pw-12345");
+  const userId = (await ctx.call("GET", "/auth/me", { token: tokens.accessToken })).body.sub as string;
+  await ctx.call("POST", `/auth/admin/users/${userId}/permissions`, { token: await admin.freshToken(), body: { permission: "audit-log:read" } });
+  ctx.assert((await ctx.call("GET", "/auth/admin/audit-log", { token: tokens.accessToken })).status === 200, "a direct grant opens the audit log");
+
+  // Written straight to the table, with no code change and no redeploy. The bump that follows is
+  // the out-of-band writer's half of the cache contract (permission-cache.ts) — without it the
+  // edit would still land, but only once the cached entry expired.
+  // Written straight to the table; the bump is the out-of-band writer's half of the cache
+  // contract (permission-cache.ts) — without it the edit would still land, only later.
+  await prisma.permission.update({ where: { slug: "audit-log:read" }, data: { isActive: false } });
+  await permissionCacheStore.bump(POLICY_VERSION_KEY);
+  const denied = await ctx.call("GET", "/auth/admin/audit-log", { token: tokens.accessToken });
+  ctx.assert(denied.status === 403, `a permission deactivated by a raw database write stops opening its route (got ${denied.status})`);
+
+  await prisma.permission.update({ where: { slug: "audit-log:read" }, data: { isActive: true } });
+  await permissionCacheStore.bump(POLICY_VERSION_KEY);
+  const restored = await ctx.call("GET", "/auth/admin/audit-log", { token: tokens.accessToken });
+  ctx.assert(restored.status === 200, `…and reactivating it in the database opens the route again (got ${restored.status})`);
+}

package/registry/combos/nestjs-prisma/variants/workspaces/.env.example

@@ -0,0 +1,30 @@
+DATABASE_URL="postgresql://postgres:postgres@localhost:5432/auth_reference?schema=public"
+
+# OAuth (optional — only needed if you pass oauthProviders into AuthModule.forRoot())
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+APPLE_CLIENT_ID=
+APPLE_TEAM_ID=
+APPLE_KEY_ID=
+APPLE_PRIVATE_KEY=
+
+# Seeder (`npm run seed`, src/seed.ts). The permission catalog, the first workspace and that
+# workspace's default roles are always seeded; the initial admin user and their membership of it
+# are created only when BOTH admin variables are set. There is no default password — with either
+# one missing the seeder says so and skips the admin rather than putting a known credential on
+# the deployment. Setting them again later is a no-op for an admin that already exists: their
+# current password is left alone.
+SEED_ADMIN_EMAIL=
+SEED_ADMIN_PASSWORD=
+
+# Optional second seeded account and workspace membership, held by the "superadmin" role (same
+# full-catalog permissions as "admin", distinct account). Same no-default-password rule as
+# SEED_ADMIN_* above; leaving any of these unset skips it. SEED_SUPERADMIN_USERNAME is
+# optional — without it the account has no username and only its email logs in.
+SEED_SUPERADMIN_EMAIL=
+SEED_SUPERADMIN_USERNAME=
+SEED_SUPERADMIN_PASSWORD=
+
+# Name of the workspace the seeder creates (and adopts on later runs). Defaults to
+# "Default workspace" when unset.
+SEED_WORKSPACE_NAME=

package/registry/combos/nestjs-prisma/variants/workspaces/prisma/migrations/20260810084938_init/migration.sql

@@ -0,0 +1,308 @@
+-- CreateTable
+CREATE TABLE "workspaces" (
+    "id" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "created_at" TIMESTAMPTZ(6) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "workspaces_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "workspace_members" (
+    "id" TEXT NOT NULL,
+    "user_id" TEXT NOT NULL,
+    "workspace_id" TEXT NOT NULL,
+    "created_at" TIMESTAMPTZ(6) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "workspace_members_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "users" (
+    "id" TEXT NOT NULL,
+    "email" TEXT NOT NULL,
+    "password_hash" TEXT,
+    "blocked" BOOLEAN NOT NULL DEFAULT false,
+    "two_factor_enabled" BOOLEAN NOT NULL DEFAULT false,
+    "two_factor_secret" TEXT,
+    "created_at" TIMESTAMPTZ(6) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "users_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "roles" (
+    "id" TEXT NOT NULL,
+    "workspace_id" TEXT NOT NULL,
+    "slug" VARCHAR(255) NOT NULL,
+    "display_name" VARCHAR(255) NOT NULL,
+    "description" TEXT,
+    "is_default" BOOLEAN NOT NULL DEFAULT false,
+    "order" INTEGER NOT NULL DEFAULT 0,
+    "is_active" BOOLEAN NOT NULL DEFAULT true,
+    "created_at" TIMESTAMPTZ(6) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMPTZ(6) NOT NULL,
+
+    CONSTRAINT "roles_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "permissions" (
+    "id" TEXT NOT NULL,
+    "slug" VARCHAR(255) NOT NULL,
+    "display_name" VARCHAR(255) NOT NULL,
+    "description" TEXT,
+    "group" VARCHAR(255) NOT NULL DEFAULT 'General',
+    "group_order" INTEGER NOT NULL DEFAULT 0,
+    "order" INTEGER NOT NULL DEFAULT 0,
+    "is_active" BOOLEAN NOT NULL DEFAULT true,
+    "created_at" TIMESTAMPTZ(6) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMPTZ(6) NOT NULL,
+
+    CONSTRAINT "permissions_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "role_member" (
+    "member_id" TEXT NOT NULL,
+    "role_id" TEXT NOT NULL,
+    "created_at" TIMESTAMPTZ(6) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "role_member_pkey" PRIMARY KEY ("member_id","role_id")
+);
+
+-- CreateTable
+CREATE TABLE "permission_role" (
+    "permission_id" TEXT NOT NULL,
+    "role_id" TEXT NOT NULL,
+    "created_at" TIMESTAMPTZ(6) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "permission_role_pkey" PRIMARY KEY ("permission_id","role_id")
+);
+
+-- CreateTable
+CREATE TABLE "permission_member" (
+    "member_id" TEXT NOT NULL,
+    "permission_id" TEXT NOT NULL,
+    "created_at" TIMESTAMPTZ(6) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "permission_member_pkey" PRIMARY KEY ("member_id","permission_id")
+);
+
+-- CreateTable
+CREATE TABLE "oauth_accounts" (
+    "id" TEXT NOT NULL,
+    "user_id" TEXT NOT NULL,
+    "provider" VARCHAR(100) NOT NULL,
+    "provider_account_id" TEXT NOT NULL,
+    "email" TEXT,
+    "created_at" TIMESTAMPTZ(6) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "oauth_accounts_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "password_reset_tokens" (
+    "id" TEXT NOT NULL,
+    "user_id" TEXT NOT NULL,
+    "token_hash" TEXT NOT NULL,
+    "expires_at" TIMESTAMPTZ(6) NOT NULL,
+    "consumed_at" TIMESTAMPTZ(6),
+    "created_at" TIMESTAMPTZ(6) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "password_reset_tokens_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "two_factor_backup_codes" (
+    "id" TEXT NOT NULL,
+    "user_id" TEXT NOT NULL,
+    "code_hash" TEXT NOT NULL,
+    "used_at" TIMESTAMPTZ(6),
+
+    CONSTRAINT "two_factor_backup_codes_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "audit_logs" (
+    "id" TEXT NOT NULL,
+    "workspace_id" TEXT,
+    "user_id" TEXT,
+    "name" TEXT NOT NULL,
+    "action" TEXT NOT NULL,
+    "info" JSONB NOT NULL,
+    "remarks" TEXT,
+    "created_at" TIMESTAMPTZ(6) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMPTZ(6) NOT NULL,
+
+    CONSTRAINT "audit_logs_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "sessions" (
+    "id" TEXT NOT NULL,
+    "user_id" TEXT NOT NULL,
+    "session_version" INTEGER NOT NULL DEFAULT 0,
+    "current_refresh_jti" TEXT NOT NULL,
+    "provider" VARCHAR(100),
+    "user_agent" TEXT,
+    "ip" VARCHAR(100),
+    "expires_at" TIMESTAMPTZ(6) NOT NULL,
+    "is_revoked" BOOLEAN NOT NULL DEFAULT false,
+    "revoked_at" TIMESTAMPTZ(6),
+    "revoked_by" TEXT,
+    "revoked_ip" VARCHAR(100),
+    "is_active" BOOLEAN NOT NULL DEFAULT true,
+    "created_by" TEXT,
+    "updated_by" TEXT,
+    "is_deleted" BOOLEAN NOT NULL DEFAULT false,
+    "deleted_at" TIMESTAMPTZ(6),
+    "deleted_by" TEXT,
+    "deleted_reason" VARCHAR(255),
+    "created_at" TIMESTAMPTZ(6) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMPTZ(6) NOT NULL,
+
+    CONSTRAINT "sessions_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "signing_keys" (
+    "kid" TEXT NOT NULL,
+    "public_key_pem" TEXT NOT NULL,
+    "private_key_pem" TEXT NOT NULL,
+    "created_at" TIMESTAMPTZ(6) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "retired_at" TIMESTAMPTZ(6),
+
+    CONSTRAINT "signing_keys_pkey" PRIMARY KEY ("kid")
+);
+
+-- CreateTable
+CREATE TABLE "denylisted_access_tokens" (
+    "jti" TEXT NOT NULL,
+    "expires_at" TIMESTAMPTZ(6) NOT NULL,
+
+    CONSTRAINT "denylisted_access_tokens_pkey" PRIMARY KEY ("jti")
+);
+
+-- CreateIndex
+CREATE INDEX "workspace_members_workspace_id_idx" ON "workspace_members"("workspace_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "workspace_members_user_id_workspace_id_key" ON "workspace_members"("user_id", "workspace_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "users_email_key" ON "users"("email");
+
+-- CreateIndex
+CREATE INDEX "roles_workspace_default_idx" ON "roles"("workspace_id", "is_default");
+
+-- CreateIndex
+CREATE INDEX "roles_active_order_idx" ON "roles"("is_active", "order");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "roles_workspace_id_slug_key" ON "roles"("workspace_id", "slug");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "permissions_slug_key" ON "permissions"("slug");
+
+-- CreateIndex
+CREATE INDEX "permissions_is_active_idx" ON "permissions"("is_active");
+
+-- CreateIndex
+CREATE INDEX "permissions_group_order_idx" ON "permissions"("group", "group_order", "order");
+
+-- CreateIndex
+CREATE INDEX "role_member_role_id_idx" ON "role_member"("role_id");
+
+-- CreateIndex
+CREATE INDEX "permission_role_role_id_idx" ON "permission_role"("role_id");
+
+-- CreateIndex
+CREATE INDEX "permission_member_permission_id_idx" ON "permission_member"("permission_id");
+
+-- CreateIndex
+CREATE INDEX "oauth_accounts_user_id_idx" ON "oauth_accounts"("user_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "oauth_accounts_provider_provider_account_id_key" ON "oauth_accounts"("provider", "provider_account_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "password_reset_tokens_token_hash_key" ON "password_reset_tokens"("token_hash");
+
+-- CreateIndex
+CREATE INDEX "two_factor_backup_codes_user_id_idx" ON "two_factor_backup_codes"("user_id");
+
+-- CreateIndex
+CREATE INDEX "audit_logs_workspace_created_idx" ON "audit_logs"("workspace_id", "created_at");
+
+-- CreateIndex
+CREATE INDEX "audit_logs_user_created_idx" ON "audit_logs"("user_id", "created_at");
+
+-- CreateIndex
+CREATE INDEX "audit_logs_created_idx" ON "audit_logs"("created_at");
+
+-- CreateIndex
+CREATE INDEX "sessions_user_id_idx" ON "sessions"("user_id");
+
+-- CreateIndex
+CREATE INDEX "sessions_is_revoked_idx" ON "sessions"("is_revoked");
+
+-- CreateIndex
+CREATE INDEX "sessions_expires_at_idx" ON "sessions"("expires_at");
+
+-- CreateIndex
+CREATE INDEX "sessions_user_active_idx" ON "sessions"("user_id", "is_revoked", "expires_at");
+
+-- CreateIndex
+CREATE INDEX "sessions_revoked_by_idx" ON "sessions"("revoked_by");
+
+-- AddForeignKey
+ALTER TABLE "workspace_members" ADD CONSTRAINT "workspace_members_user_id_fkey" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "workspace_members" ADD CONSTRAINT "workspace_members_workspace_id_fkey" FOREIGN KEY ("workspace_id") REFERENCES "workspaces"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "roles" ADD CONSTRAINT "roles_workspace_id_fkey" FOREIGN KEY ("workspace_id") REFERENCES "workspaces"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "role_member" ADD CONSTRAINT "role_member_member_id_fkey" FOREIGN KEY ("member_id") REFERENCES "workspace_members"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "role_member" ADD CONSTRAINT "role_member_role_id_fkey" FOREIGN KEY ("role_id") REFERENCES "roles"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "permission_role" ADD CONSTRAINT "permission_role_permission_id_fkey" FOREIGN KEY ("permission_id") REFERENCES "permissions"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "permission_role" ADD CONSTRAINT "permission_role_role_id_fkey" FOREIGN KEY ("role_id") REFERENCES "roles"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "permission_member" ADD CONSTRAINT "permission_member_member_id_fkey" FOREIGN KEY ("member_id") REFERENCES "workspace_members"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "permission_member" ADD CONSTRAINT "permission_member_permission_id_fkey" FOREIGN KEY ("permission_id") REFERENCES "permissions"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "oauth_accounts" ADD CONSTRAINT "oauth_accounts_user_id_fkey" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "password_reset_tokens" ADD CONSTRAINT "password_reset_tokens_user_id_fkey" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "two_factor_backup_codes" ADD CONSTRAINT "two_factor_backup_codes_user_id_fkey" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "sessions" ADD CONSTRAINT "sessions_user_id_fkey" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "sessions" ADD CONSTRAINT "sessions_revoked_by_fkey" FOREIGN KEY ("revoked_by") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "sessions" ADD CONSTRAINT "sessions_created_by_fkey" FOREIGN KEY ("created_by") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "sessions" ADD CONSTRAINT "sessions_updated_by_fkey" FOREIGN KEY ("updated_by") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "sessions" ADD CONSTRAINT "sessions_deleted_by_fkey" FOREIGN KEY ("deleted_by") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;

package/registry/combos/nestjs-prisma/variants/workspaces/prisma/migrations/20260810123450_add_profile_audit_soft_delete/migration.sql

@@ -0,0 +1,96 @@
+-- AlterTable
+ALTER TABLE "permission_member" ADD COLUMN     "updated_at" TIMESTAMPTZ(6) NOT NULL;
+
+-- AlterTable
+ALTER TABLE "permission_role" ADD COLUMN     "updated_at" TIMESTAMPTZ(6) NOT NULL;
+
+-- AlterTable
+ALTER TABLE "permissions" ADD COLUMN     "created_by" TEXT,
+ADD COLUMN     "deleted_at" TIMESTAMPTZ(6),
+ADD COLUMN     "deleted_by" TEXT,
+ADD COLUMN     "deleted_reason" VARCHAR(255),
+ADD COLUMN     "is_deleted" BOOLEAN NOT NULL DEFAULT false,
+ADD COLUMN     "name" VARCHAR(255) NOT NULL,
+ADD COLUMN     "updated_by" TEXT;
+
+-- AlterTable
+ALTER TABLE "role_member" ADD COLUMN     "updated_at" TIMESTAMPTZ(6) NOT NULL;
+
+-- AlterTable
+ALTER TABLE "roles" ADD COLUMN     "created_by" TEXT,
+ADD COLUMN     "deleted_at" TIMESTAMPTZ(6),
+ADD COLUMN     "deleted_by" TEXT,
+ADD COLUMN     "deleted_reason" VARCHAR(255),
+ADD COLUMN     "is_deleted" BOOLEAN NOT NULL DEFAULT false,
+ADD COLUMN     "name" VARCHAR(255) NOT NULL,
+ADD COLUMN     "updated_by" TEXT;
+
+-- AlterTable
+ALTER TABLE "users" ADD COLUMN     "created_by" TEXT,
+ADD COLUMN     "deleted_at" TIMESTAMPTZ(6),
+ADD COLUMN     "deleted_by" TEXT,
+ADD COLUMN     "deleted_reason" VARCHAR(255),
+ADD COLUMN     "first_name" TEXT,
+ADD COLUMN     "is_deleted" BOOLEAN NOT NULL DEFAULT false,
+ADD COLUMN     "last_login" TIMESTAMPTZ(6),
+ADD COLUMN     "last_name" TEXT,
+ADD COLUMN     "phone" TEXT,
+ADD COLUMN     "photo" TEXT,
+ADD COLUMN     "updated_at" TIMESTAMPTZ(6) NOT NULL,
+ADD COLUMN     "updated_by" TEXT,
+ADD COLUMN     "username" TEXT;
+
+-- CreateIndex
+CREATE UNIQUE INDEX "permissions_name_key" ON "permissions"("name");
+
+-- CreateIndex
+CREATE INDEX "permissions_is_deleted_idx" ON "permissions"("is_deleted");
+
+-- CreateIndex
+CREATE INDEX "roles_is_deleted_idx" ON "roles"("is_deleted");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "roles_workspace_id_name_key" ON "roles"("workspace_id", "name");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "users_first_name_key" ON "users"("first_name");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "users_last_name_key" ON "users"("last_name");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "users_phone_key" ON "users"("phone");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "users_username_key" ON "users"("username");
+
+-- CreateIndex
+CREATE INDEX "users_is_deleted_idx" ON "users"("is_deleted");
+
+-- AddForeignKey
+ALTER TABLE "users" ADD CONSTRAINT "users_created_by_fkey" FOREIGN KEY ("created_by") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "users" ADD CONSTRAINT "users_updated_by_fkey" FOREIGN KEY ("updated_by") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "users" ADD CONSTRAINT "users_deleted_by_fkey" FOREIGN KEY ("deleted_by") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "roles" ADD CONSTRAINT "roles_created_by_fkey" FOREIGN KEY ("created_by") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "roles" ADD CONSTRAINT "roles_updated_by_fkey" FOREIGN KEY ("updated_by") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "roles" ADD CONSTRAINT "roles_deleted_by_fkey" FOREIGN KEY ("deleted_by") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "permissions" ADD CONSTRAINT "permissions_created_by_fkey" FOREIGN KEY ("created_by") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "permissions" ADD CONSTRAINT "permissions_updated_by_fkey" FOREIGN KEY ("updated_by") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "permissions" ADD CONSTRAINT "permissions_deleted_by_fkey" FOREIGN KEY ("deleted_by") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+

package/registry/combos/nestjs-prisma/variants/workspaces/prisma/migrations/20260810123632_add_display_name/migration.sql

@@ -0,0 +1,3 @@
+-- AlterTable
+ALTER TABLE "users" ADD COLUMN     "display_name" TEXT;
+

package/registry/combos/nestjs-prisma/variants/workspaces/prisma/migrations/20260810124243_workspace_audit_soft_delete/migration.sql

@@ -0,0 +1,25 @@
+-- AlterTable
+ALTER TABLE "workspaces" ADD COLUMN     "created_by" TEXT,
+ADD COLUMN     "deleted_at" TIMESTAMPTZ(6),
+ADD COLUMN     "deleted_by" TEXT,
+ADD COLUMN     "deleted_reason" VARCHAR(255),
+ADD COLUMN     "is_active" BOOLEAN NOT NULL DEFAULT true,
+ADD COLUMN     "is_deleted" BOOLEAN NOT NULL DEFAULT false,
+ADD COLUMN     "updated_at" TIMESTAMPTZ(6) NOT NULL,
+ADD COLUMN     "updated_by" TEXT;
+
+-- CreateIndex
+CREATE INDEX "workspaces_is_active_idx" ON "workspaces"("is_active");
+
+-- CreateIndex
+CREATE INDEX "workspaces_is_deleted_idx" ON "workspaces"("is_deleted");
+
+-- AddForeignKey
+ALTER TABLE "workspaces" ADD CONSTRAINT "workspaces_created_by_fkey" FOREIGN KEY ("created_by") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "workspaces" ADD CONSTRAINT "workspaces_updated_by_fkey" FOREIGN KEY ("updated_by") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "workspaces" ADD CONSTRAINT "workspaces_deleted_by_fkey" FOREIGN KEY ("deleted_by") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+

package/registry/combos/nestjs-prisma/variants/workspaces/prisma/migrations/20260810131432_drop_signing_keys/migration.sql

@@ -0,0 +1,3 @@
+-- DropTable
+DROP TABLE "signing_keys";
+