@simple-auth-kit/cli 1.4.2 → 1.5.0

package/registry/combos/express-prisma/variants/workspaces/src/create-auth-app.ts

@@ -2,27 +2,33 @@ import { PrismaPg } from "@prisma/adapter-pg";
 import express, { type Express } from "express";
 import swaggerUi from "swagger-ui-express";
 import type { RateLimitDeps } from "@/lib/auth/core/rate-limit.js";
-import { createAdminRouter } from "./admin.router.js";
-import { AuditLogRepository } from "./audit-log.repository.js";
-import { authCoreErrorMiddleware } from "./auth-core-error.middleware.js";
+import { createAdminRouter } from "./routers/admin.router.js";
+import { AuditLogRepository } from "./repositories/audit-log.repository.js";
+import { authCoreErrorMiddleware } from "./middleware/auth-core-error.middleware.js";
 import { AuthConfig, defaultAuthConfig } from "./auth.config.js";
-import { createAuthMiddleware } from "./auth.middleware.js";
-import { createAuthRouter } from "./auth.router.js";
-import { AuthService } from "./auth.service.js";
-import { createAuthzMiddleware, createWorkspaceMiddleware } from "./authz.middleware.js";
-import { PrismaClient } from "../generated/prisma/client.js";
+import { createAuthMiddleware } from "./middleware/auth.middleware.js";
+import { createAuthRouter } from "./routers/auth.router.js";
+import { AuthService } from "./services/auth.service.js";
+import {
+  createAuthzMiddleware,
+  createWorkspaceMiddleware,
+} from "./middleware/authz.middleware.js";
+import { PrismaClient } from "./../generated/prisma/client.js";
 import { KeyProviderService } from "./key-provider.js";
-import { OAuthRepository } from "./oauth.repository.js";
+import { OAuthRepository } from "./repositories/oauth.repository.js";
 import { openApiSpec } from "./openapi-spec.js";
-import { PasswordResetRepository } from "./password-reset.repository.js";
-import { InMemoryPermissionCacheStore, PermissionCache } from "./permission-cache.js";
+import { PasswordResetRepository } from "./repositories/password-reset.repository.js";
+import {
+  InMemoryPermissionCacheStore,
+  PermissionCache,
+} from "./permission-cache.js";
 import { InMemoryRateLimitStore } from "./rate-limit.store.js";
-import { RbacRepository } from "./rbac.repository.js";
-import { responseEnvelope } from "./response-envelope.middleware.js";
-import { SessionRepository } from "./session.repository.js";
-import { TwoFactorRepository } from "./two-factor.repository.js";
-import { createWorkspaceRouter } from "./workspace.router.js";
-import { WorkspaceRepository } from "./workspace.repository.js";
+import { RbacRepository } from "./repositories/rbac.repository.js";
+import { responseEnvelope } from "./middleware/response-envelope.middleware.js";
+import { SessionRepository } from "./repositories/session.repository.js";
+import { TwoFactorRepository } from "./repositories/two-factor.repository.js";
+import { createWorkspaceRouter } from "./routers/workspace.router.js";
+import { WorkspaceRepository } from "./repositories/workspace.repository.js";
 
 export interface CreateAuthAppOptions {
   /** Overrides merged on top of `defaultAuthConfig`, same shape as the reference combo's `AuthModule.forRoot(config)`. */
@@ -41,7 +47,9 @@ export interface CreateAuthAppOptions {
 export function createAuthApp(options: CreateAuthAppOptions = {}): Express {
   const config: AuthConfig = { ...defaultAuthConfig, ...options.config };
 
-  const adapter = new PrismaPg({ connectionString: process.env["DATABASE_URL"] });
+  const adapter = new PrismaPg({
+    connectionString: process.env["DATABASE_URL"],
+  });
   const prisma = new PrismaClient({ adapter });
 
   const auditLog = new AuditLogRepository(prisma);
@@ -49,23 +57,41 @@ export function createAuthApp(options: CreateAuthAppOptions = {}): Express {
   const keys = new KeyProviderService();
   // Swap the store for a Redis-backed one by passing `rateLimitStore` in `config` — nothing in
   // this library's source changes.
-  const rateLimit: RateLimitDeps = config.rateLimitStore ?? new InMemoryRateLimitStore();
+  const rateLimit: RateLimitDeps =
+    config.rateLimitStore ?? new InMemoryRateLimitStore();
   // The cache seam. Swap the store for a Redis-backed one by passing `permissionCacheStore` in
   // `config` — nothing in this library's source changes. Keys are namespaced simpleauthkit:authz:*.
-  const permissionCache = new PermissionCache(config.permissionCacheStore ?? new InMemoryPermissionCacheStore(), config);
+  const permissionCache = new PermissionCache(
+    config.permissionCacheStore ?? new InMemoryPermissionCacheStore(),
+    config,
+  );
   const rbac = new RbacRepository(prisma, permissionCache);
   const workspaces = new WorkspaceRepository(prisma, rbac);
   const twoFactor = new TwoFactorRepository(prisma);
   const oauth = new OAuthRepository(prisma);
   const passwordReset = new PasswordResetRepository(prisma);
-  const authService = new AuthService(prisma, sessions, keys, rateLimit, auditLog, rbac, twoFactor, oauth, passwordReset, config);
+  const authService = new AuthService(
+    prisma,
+    sessions,
+    keys,
+    rateLimit,
+    auditLog,
+    rbac,
+    twoFactor,
+    oauth,
+    passwordReset,
+    config,
+  );
 
   const authentication = createAuthMiddleware({ keys, sessions });
   // Roles belong to a workspace membership, resolved from the database on the request that names
   // the workspace. `authorization` tolerates a request that names none (GET /auth/me answers with
   // empty roles); `workspaceScope` does not. See authz.middleware.ts.
   const authorization = createAuthzMiddleware({ rbac, cache: permissionCache });
-  const workspaceScope = createWorkspaceMiddleware({ rbac, cache: permissionCache });
+  const workspaceScope = createWorkspaceMiddleware({
+    rbac,
+    cache: permissionCache,
+  });
 
   if (!config.permissionCacheStore || !config.rateLimitStore) {
     console.warn(
@@ -84,14 +110,43 @@ export function createAuthApp(options: CreateAuthAppOptions = {}): Express {
   // slash) a plain 200 instead of swagger-ui-express's default 301 to "/docs/" — the
   // underlying static asset middleware would otherwise treat the mount root as a directory
   // listing and redirect.
-  app.use("/docs", swaggerUi.serveWithOptions({ redirect: false }), swaggerUi.setup(openApiSpec));
+  app.use(
+    "/docs",
+    swaggerUi.serveWithOptions({ redirect: false }),
+    swaggerUi.setup(openApiSpec),
+  );
   app.get("/docs-json", (_req, res) => res.json(openApiSpec));
   app.use(responseEnvelope());
   // Mounted before /auth so `/auth/admin/*` reaches the admin router rather than falling
   // through to the identity router's 404.
-  app.use("/auth/admin", createAdminRouter({ auth: authService, workspaces, authentication, workspaceScope }));
-  app.use("/auth", createAuthRouter({ auth: authService, config, authentication, authorization }));
-  app.use("/workspaces", createWorkspaceRouter({ workspaces, rbac, authentication, authorization, workspaceScope }));
+  app.use(
+    "/auth/admin",
+    createAdminRouter({
+      auth: authService,
+      workspaces,
+      authentication,
+      workspaceScope,
+    }),
+  );
+  app.use(
+    "/auth",
+    createAuthRouter({
+      auth: authService,
+      config,
+      authentication,
+      authorization,
+    }),
+  );
+  app.use(
+    "/workspaces",
+    createWorkspaceRouter({
+      workspaces,
+      rbac,
+      authentication,
+      authorization,
+      workspaceScope,
+    }),
+  );
   // Mounted last so it catches errors forwarded via `next(err)` from every route above.
   app.use(authCoreErrorMiddleware);
 

package/registry/combos/express-prisma/variants/workspaces/src/{authz.middleware.ts → middleware/authz.middleware.ts}

@@ -1,9 +1,12 @@
 import type { NextFunction, Request, RequestHandler, Response } from "express";
-import { defineAbilitiesFor } from "./ability.js";
-import { HttpError } from "./http-error.js";
-import type { PermissionCache } from "./permission-cache.js";
-import { memberCacheKey, type RbacRepository } from "./rbac.repository.js";
-import "./request-context.js";
+import { defineAbilitiesFor } from "../ability.js";
+import { HttpError } from "../http-error.js";
+import type { PermissionCache } from "../permission-cache.js";
+import {
+  memberCacheKey,
+  type RbacRepository,
+} from "../repositories/rbac.repository.js";
+import "../request-context.js";
 
 export const WORKSPACE_HEADER = "x-workspace-id";
 
@@ -45,10 +48,14 @@ async function resolve(deps: AuthzMiddlewareDeps, req: Request): Promise<void> {
   if (req.authz) return;
 
   const workspaceId = req.headers[WORKSPACE_HEADER];
-  if (!req.auth || typeof workspaceId !== "string" || workspaceId.length === 0) return;
+  if (!req.auth || typeof workspaceId !== "string" || workspaceId.length === 0)
+    return;
 
   const userId = req.auth.sub;
-  const authz = await deps.cache.resolve<AuthzContext>(memberCacheKey(userId, workspaceId), () => deps.rbac.resolveAuthzContext(userId, workspaceId));
+  const authz = await deps.cache.resolve<AuthzContext>(
+    memberCacheKey(userId, workspaceId),
+    () => deps.rbac.resolveAuthzContext(userId, workspaceId),
+  );
   // Deliberately the same answer for "no such workspace" and "not your workspace": a caller
   // outside a workspace must not be able to probe whether it exists.
   if (!authz) throw new HttpError(403, "not a member of this workspace");
@@ -65,8 +72,14 @@ async function resolve(deps: AuthzMiddlewareDeps, req: Request): Promise<void> {
  *
  * Replaces the reference combo's `AuthzGuard`.
  */
-export function createAuthzMiddleware(deps: AuthzMiddlewareDeps): RequestHandler {
-  return async function authzMiddleware(req: Request, _res: Response, next: NextFunction): Promise<void> {
+export function createAuthzMiddleware(
+  deps: AuthzMiddlewareDeps,
+): RequestHandler {
+  return async function authzMiddleware(
+    req: Request,
+    _res: Response,
+    next: NextFunction,
+  ): Promise<void> {
     try {
       await resolve(deps, req);
       next();
@@ -81,11 +94,18 @@ export function createAuthzMiddleware(deps: AuthzMiddlewareDeps): RequestHandler
  *
  * Replaces the reference combo's `WorkspaceGuard`.
  */
-export function createWorkspaceMiddleware(deps: AuthzMiddlewareDeps): RequestHandler {
-  return async function workspaceMiddleware(req: Request, _res: Response, next: NextFunction): Promise<void> {
+export function createWorkspaceMiddleware(
+  deps: AuthzMiddlewareDeps,
+): RequestHandler {
+  return async function workspaceMiddleware(
+    req: Request,
+    _res: Response,
+    next: NextFunction,
+  ): Promise<void> {
     try {
       await resolve(deps, req);
-      if (!req.authz) throw new HttpError(403, `${WORKSPACE_HEADER} header is required`);
+      if (!req.authz)
+        throw new HttpError(403, `${WORKSPACE_HEADER} header is required`);
       next();
     } catch (err) {
       next(err);

package/registry/combos/express-prisma/variants/workspaces/src/openapi-workspace.ts

@@ -1,8 +1,13 @@
 // The workspace-membership half of the OpenAPI document. Mirrors the reference combo's
 // `dto/workspace.dto.ts`; merged into the administration fragment by openapi-admin.ts, which is
 // what openapi-spec.ts assembles into the document.
-import { errorResponse, missingPermission, requiresPermission, type OpenApiFragment } from "./openapi-fragment.js";
-import { WORKSPACE_HEADER } from "./authz.middleware.js";
+import {
+  errorResponse,
+  missingPermission,
+  requiresPermission,
+  type OpenApiFragment,
+} from "./openapi-fragment.js";
+import { WORKSPACE_HEADER } from "./middleware/authz.middleware.js";
 
 /** Every route that acts *inside* a workspace names it with this header, never a path segment. */
 export const workspaceHeaderParameter = {
@@ -10,7 +15,8 @@ export const workspaceHeaderParameter = {
   in: "header",
   required: true,
   schema: { type: "string" },
-  description: "The workspace this request acts in. The caller must be a member of it.",
+  description:
+    "The workspace this request acts in. The caller must be a member of it.",
 };
 
 export const workspaceSpec: OpenApiFragment = {
@@ -18,7 +24,14 @@ export const workspaceSpec: OpenApiFragment = {
 
   // `GET /auth/me` works with or without it: named, it answers with that workspace's roles;
   // omitted, with none.
-  scopeParameters: [{ ...workspaceHeaderParameter, required: false, description: "Answer for this workspace. Omitted, `roles` and `permissions` come back empty." }],
+  scopeParameters: [
+    {
+      ...workspaceHeaderParameter,
+      required: false,
+      description:
+        "Answer for this workspace. Omitted, `roles` and `permissions` come back empty.",
+    },
+  ],
 
   schemas: {
     CreateWorkspaceRequest: {
@@ -32,15 +45,27 @@ export const workspaceSpec: OpenApiFragment = {
       type: "object",
       required: ["email"],
       properties: {
-        email: { type: "string", description: "Must already be a registered user — this library has no invite flow" },
-        roles: { type: "array", items: { type: "string" }, description: 'Defaults to ["member"]' },
+        email: {
+          type: "string",
+          description:
+            "Must already be a registered user — this library has no invite flow",
+        },
+        roles: {
+          type: "array",
+          items: { type: "string" },
+          description: 'Defaults to ["member"]',
+        },
       },
     },
     SetMemberRolesRequest: {
       type: "object",
       required: ["roles"],
       properties: {
-        roles: { type: "array", items: { type: "string" }, description: "Replaces the member's whole role set" },
+        roles: {
+          type: "array",
+          items: { type: "string" },
+          description: "Replaces the member's whole role set",
+        },
       },
     },
     WorkspaceSummary: {
@@ -50,7 +75,11 @@ export const workspaceSpec: OpenApiFragment = {
         id: { type: "string" },
         name: { type: "string" },
         createdAt: { type: "string", format: "date-time" },
-        roles: { type: "array", items: { type: "string" }, description: "The calling user's roles in this workspace" },
+        roles: {
+          type: "array",
+          items: { type: "string" },
+          description: "The calling user's roles in this workspace",
+        },
       },
     },
     MembershipSummary: {
@@ -84,23 +113,43 @@ export const workspaceSpec: OpenApiFragment = {
         security: [{ bearerAuth: [] }],
         requestBody: {
           required: true,
-          content: { "application/json": { schema: { $ref: "#/components/schemas/CreateWorkspaceRequest" } } },
+          content: {
+            "application/json": {
+              schema: { $ref: "#/components/schemas/CreateWorkspaceRequest" },
+            },
+          },
         },
         responses: {
-          "201": { description: "Created", content: { "application/json": { schema: { $ref: "#/components/schemas/WorkspaceSummary" } } } },
+          "201": {
+            description: "Created",
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/WorkspaceSummary" },
+              },
+            },
+          },
           "400": errorResponse("Missing required field"),
           "401": errorResponse("Missing or invalid access token"),
         },
       },
       get: {
         tags: ["workspaces"],
-        summary: "List the workspaces the current user belongs to, with their roles in each",
-        description: "Deliberately not permission-gated: it acts outside every workspace and only ever answers with the caller's own memberships.",
+        summary:
+          "List the workspaces the current user belongs to, with their roles in each",
+        description:
+          "Deliberately not permission-gated: it acts outside every workspace and only ever answers with the caller's own memberships.",
         security: [{ bearerAuth: [] }],
         responses: {
           "200": {
             description: "OK",
-            content: { "application/json": { schema: { type: "array", items: { $ref: "#/components/schemas/WorkspaceSummary" } } } },
+            content: {
+              "application/json": {
+                schema: {
+                  type: "array",
+                  items: { $ref: "#/components/schemas/WorkspaceSummary" },
+                },
+              },
+            },
           },
           "401": errorResponse("Missing or invalid access token"),
         },
@@ -110,16 +159,26 @@ export const workspaceSpec: OpenApiFragment = {
       get: {
         tags: ["workspaces"],
         summary: "List the members of the named workspace",
-        description: "Gated on membership of the named workspace rather than on a permission — seeing who else is in a room you are in is not an administrative capability.",
+        description:
+          "Gated on membership of the named workspace rather than on a permission — seeing who else is in a room you are in is not an administrative capability.",
         security: [{ bearerAuth: [] }],
         parameters: [workspaceHeaderParameter],
         responses: {
           "200": {
             description: "OK",
-            content: { "application/json": { schema: { type: "array", items: { $ref: "#/components/schemas/MembershipSummary" } } } },
+            content: {
+              "application/json": {
+                schema: {
+                  type: "array",
+                  items: { $ref: "#/components/schemas/MembershipSummary" },
+                },
+              },
+            },
           },
           "401": errorResponse("Missing or invalid access token"),
-          "403": errorResponse("Not a member of this workspace, or no workspace named"),
+          "403": errorResponse(
+            "Not a member of this workspace, or no workspace named",
+          ),
         },
       },
       post: {
@@ -130,13 +189,27 @@ export const workspaceSpec: OpenApiFragment = {
         parameters: [workspaceHeaderParameter],
         requestBody: {
           required: true,
-          content: { "application/json": { schema: { $ref: "#/components/schemas/AddMemberRequest" } } },
+          content: {
+            "application/json": {
+              schema: { $ref: "#/components/schemas/AddMemberRequest" },
+            },
+          },
         },
         responses: {
-          "201": { description: "Created", content: { "application/json": { schema: { $ref: "#/components/schemas/MembershipSummary" } } } },
+          "201": {
+            description: "Created",
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/MembershipSummary" },
+              },
+            },
+          },
           "400": errorResponse("Missing required field"),
           "401": errorResponse("Missing or invalid access token"),
-          "403": missingPermission("members:manage", "the request named no workspace you belong to"),
+          "403": missingPermission(
+            "members:manage",
+            "the request named no workspace you belong to",
+          ),
           "404": errorResponse("No user with that email"),
           "409": errorResponse("Already a member of this workspace"),
         },
@@ -150,17 +223,42 @@ export const workspaceSpec: OpenApiFragment = {
           requiresPermission("roles:assign") +
           " It deliberately shares that key with `POST /auth/admin/users/{userId}/roles` rather than minting one of its own: it is the same capability reached by a different path.",
         security: [{ bearerAuth: [] }],
-        parameters: [workspaceHeaderParameter, { name: "memberId", in: "path", required: true, schema: { type: "string" } }],
+        parameters: [
+          workspaceHeaderParameter,
+          {
+            name: "memberId",
+            in: "path",
+            required: true,
+            schema: { type: "string" },
+          },
+        ],
         requestBody: {
           required: true,
-          content: { "application/json": { schema: { $ref: "#/components/schemas/SetMemberRolesRequest" } } },
+          content: {
+            "application/json": {
+              schema: { $ref: "#/components/schemas/SetMemberRolesRequest" },
+            },
+          },
         },
         responses: {
-          "200": { description: "OK", content: { "application/json": { schema: { $ref: "#/components/schemas/MemberRolesResponse" } } } },
+          "200": {
+            description: "OK",
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/MemberRolesResponse" },
+              },
+            },
+          },
           "400": errorResponse("Missing required field"),
           "401": errorResponse("Missing or invalid access token"),
-          "403": missingPermission("roles:assign", "cannot change your own roles", "the request named no workspace you belong to"),
-          "404": errorResponse("Member not found in this workspace, or a role is not defined in it"),
+          "403": missingPermission(
+            "roles:assign",
+            "cannot change your own roles",
+            "the request named no workspace you belong to",
+          ),
+          "404": errorResponse(
+            "Member not found in this workspace, or a role is not defined in it",
+          ),
         },
       },
     },
@@ -168,13 +266,34 @@ export const workspaceSpec: OpenApiFragment = {
       delete: {
         tags: ["workspaces"],
         summary: "[admin] Remove a member from the named workspace",
-        description: requiresPermission("members:manage") + " Their direct permission grants go with the membership.",
+        description:
+          requiresPermission("members:manage") +
+          " Their direct permission grants go with the membership.",
         security: [{ bearerAuth: [] }],
-        parameters: [workspaceHeaderParameter, { name: "memberId", in: "path", required: true, schema: { type: "string" } }],
+        parameters: [
+          workspaceHeaderParameter,
+          {
+            name: "memberId",
+            in: "path",
+            required: true,
+            schema: { type: "string" },
+          },
+        ],
         responses: {
-          "200": { description: "OK", content: { "application/json": { schema: { $ref: "#/components/schemas/OkResponse" } } } },
+          "200": {
+            description: "OK",
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/OkResponse" },
+              },
+            },
+          },
           "401": errorResponse("Missing or invalid access token"),
-          "403": missingPermission("members:manage", "cannot remove yourself from a workspace you administer", "the request named no workspace you belong to"),
+          "403": missingPermission(
+            "members:manage",
+            "cannot remove yourself from a workspace you administer",
+            "the request named no workspace you belong to",
+          ),
           "404": errorResponse("Member not found in this workspace"),
         },
       },