@simple-auth-kit/cli 1.4.2 → 1.5.0

package/registry/combos/express-prisma/variants/workspaces/src/rbac.defaults.ts

@@ -28,7 +28,7 @@
 // `src/workspace.repository.ts` (which provisions every workspace created afterwards, inside the
 // same transaction that creates it, so its creator is never locked out of a workspace they just
 // made).
-import type { PrismaClient } from "../generated/prisma/client.js";
+import type { PrismaClient } from "./../generated/prisma/client.js";
 
 /** The display metadata a seeded permission carries. `group`/`order` exist so an admin console can render a stable matrix. */
 export interface PermissionSeed {
@@ -53,11 +53,22 @@ export interface PermissionSeed {
  * evaluate.
  */
 export const PERMISSION_CATALOG = {
-  "users:read": { displayName: "List members", description: "GET /auth/admin/users, GET /auth/admin/users/:userId", group: "Users", order: 1 },
-  "users:block": { displayName: "Block and unblock members", description: "POST /auth/admin/users/:userId/block, .../unblock", group: "Users", order: 2 },
+  "users:read": {
+    displayName: "List members",
+    description: "GET /auth/admin/users, GET /auth/admin/users/:userId",
+    group: "Users",
+    order: 1,
+  },
+  "users:block": {
+    displayName: "Block and unblock members",
+    description: "POST /auth/admin/users/:userId/block, .../unblock",
+    group: "Users",
+    order: 2,
+  },
   "users:manage": {
     displayName: "Edit and delete members",
-    description: "Edit a member's profile or delete their account — PATCH /auth/admin/users/:userId, DELETE /auth/admin/users/:userId",
+    description:
+      "Edit a member's profile or delete their account — PATCH /auth/admin/users/:userId, DELETE /auth/admin/users/:userId",
     group: "Users",
     order: 3,
   },
@@ -70,30 +81,44 @@ export const PERMISSION_CATALOG = {
   },
   "roles:assign": {
     displayName: "Assign roles",
-    description: "Assign and revoke a member's roles — POST /auth/admin/users/:userId/roles, .../roles/:roleSlug/revoke, PUT /workspaces/members/:memberId/roles",
+    description:
+      "Assign and revoke a member's roles — POST /auth/admin/users/:userId/roles, .../roles/:roleSlug/revoke, PUT /workspaces/members/:memberId/roles",
     group: "Roles",
     order: 2,
   },
-  "permissions:read": { displayName: "Read the permission catalog", description: "GET /auth/admin/permissions", group: "Permissions", order: 1 },
+  "permissions:read": {
+    displayName: "Read the permission catalog",
+    description: "GET /auth/admin/permissions",
+    group: "Permissions",
+    order: 1,
+  },
   "permissions:define": {
     displayName: "Define permissions",
-    description: "Create a permission, rename it, or deactivate it — POST /auth/admin/permissions. The authority that defines all the others.",
+    description:
+      "Create a permission, rename it, or deactivate it — POST /auth/admin/permissions. The authority that defines all the others.",
     group: "Permissions",
     order: 2,
   },
   "permissions:grant": {
     displayName: "Grant permissions directly",
-    description: "Grant and revoke a permission straight to a member, bypassing roles — POST /auth/admin/users/:userId/permissions, .../permissions/:slug/revoke",
+    description:
+      "Grant and revoke a permission straight to a member, bypassing roles — POST /auth/admin/users/:userId/permissions, .../permissions/:slug/revoke",
     group: "Permissions",
     order: 3,
   },
   "members:manage": {
     displayName: "Add and remove members",
-    description: "POST /workspaces/members, DELETE /workspaces/members/:memberId",
+    description:
+      "POST /workspaces/members, DELETE /workspaces/members/:memberId",
     group: "Members",
     order: 1,
   },
-  "audit-log:read": { displayName: "Read the audit log", description: "GET /auth/admin/audit-log", group: "Audit", order: 1 },
+  "audit-log:read": {
+    displayName: "Read the audit log",
+    description: "GET /auth/admin/audit-log",
+    group: "Audit",
+    order: 1,
+  },
 } as const satisfies Record<string, PermissionSeed>;
 
 /**
@@ -105,10 +130,14 @@ export const PERMISSION_CATALOG = {
  */
 export type PermissionSlug = keyof typeof PERMISSION_CATALOG;
 
-export const PERMISSION_SLUGS = Object.keys(PERMISSION_CATALOG) as PermissionSlug[];
+export const PERMISSION_SLUGS = Object.keys(
+  PERMISSION_CATALOG,
+) as PermissionSlug[];
 
 /** Groups, in the order an admin console should render them. Derived from the catalog so it cannot drift from it. */
-export const PERMISSION_GROUP_ORDER: string[] = [...new Set(PERMISSION_SLUGS.map((slug) => PERMISSION_CATALOG[slug].group))];
+export const PERMISSION_GROUP_ORDER: string[] = [
+  ...new Set(PERMISSION_SLUGS.map((slug) => PERMISSION_CATALOG[slug].group)),
+];
 
 /** The display metadata a seeded role carries, plus what it starts out granting. */
 export interface RoleSeed {
@@ -144,7 +173,8 @@ export const DEFAULT_ROLES: readonly RoleSeed[] = [
   {
     slug: "superadmin",
     displayName: "Super Admin",
-    description: "Carries every permission in the catalog — same authority as admin, held by the seeded super_admin account's membership (see SEED_SUPERADMIN_* in seed.ts).",
+    description:
+      "Carries every permission in the catalog — same authority as admin, held by the seeded super_admin account's membership (see SEED_SUPERADMIN_* in seed.ts).",
     isDefault: false,
     order: 1,
     permissions: PERMISSION_SLUGS,
@@ -152,7 +182,8 @@ export const DEFAULT_ROLES: readonly RoleSeed[] = [
   {
     slug: "member",
     displayName: "Member",
-    description: "The default for a new membership. Carries no administrative permission.",
+    description:
+      "The default for a new membership. Carries no administrative permission.",
     isDefault: true,
     order: 2,
     permissions: [],
@@ -170,7 +201,10 @@ export const WORKSPACE_CREATOR_ROLES: string[] = ["admin", "member"];
 export const SEED_SUPERADMIN_ROLES: string[] = ["superadmin", "member"];
 
 /** Anything that can write the catalog tables: the PrismaClient, or a `$transaction` client. */
-export type RbacWriter = Pick<PrismaClient, "permission" | "role" | "permissionRole">;
+export type RbacWriter = Pick<
+  PrismaClient,
+  "permission" | "role" | "permissionRole"
+>;
 
 /**
  * Writes the starting catalog, and one workspace's roles, into `db` — which may be a transaction
@@ -184,7 +218,10 @@ export type RbacWriter = Pick<PrismaClient, "permission" | "role" | "permissionR
  */
 // Takes bigint directly: both callers (`WorkspaceRepository.create`, `seed.ts`) already have the
 // workspace row's id in hand from their own Prisma call.
-export async function provisionDefaultRoles(db: RbacWriter, workspaceId: bigint): Promise<void> {
+export async function provisionDefaultRoles(
+  db: RbacWriter,
+  workspaceId: bigint,
+): Promise<void> {
   await db.permission.createMany({
     data: PERMISSION_SLUGS.map((slug) => ({
       slug,
@@ -192,12 +229,17 @@ export async function provisionDefaultRoles(db: RbacWriter, workspaceId: bigint)
       displayName: PERMISSION_CATALOG[slug].displayName,
       description: PERMISSION_CATALOG[slug].description,
       group: PERMISSION_CATALOG[slug].group,
-      groupOrder: PERMISSION_GROUP_ORDER.indexOf(PERMISSION_CATALOG[slug].group),
+      groupOrder: PERMISSION_GROUP_ORDER.indexOf(
+        PERMISSION_CATALOG[slug].group,
+      ),
       order: PERMISSION_CATALOG[slug].order,
     })),
     skipDuplicates: true,
   });
-  const permissions = await db.permission.findMany({ where: { slug: { in: PERMISSION_SLUGS } }, select: { id: true, slug: true } });
+  const permissions = await db.permission.findMany({
+    where: { slug: { in: PERMISSION_SLUGS } },
+    select: { id: true, slug: true },
+  });
   const permissionId = new Map(permissions.map((p) => [p.slug, p.id]));
 
   await db.role.createMany({
@@ -212,11 +254,21 @@ export async function provisionDefaultRoles(db: RbacWriter, workspaceId: bigint)
     })),
     skipDuplicates: true,
   });
-  const roles = await db.role.findMany({ where: { workspaceId, slug: { in: DEFAULT_ROLES.map((r) => r.slug) } }, select: { id: true, slug: true } });
+  const roles = await db.role.findMany({
+    where: { workspaceId, slug: { in: DEFAULT_ROLES.map((r) => r.slug) } },
+    select: { id: true, slug: true },
+  });
   const seedBySlug = new Map(DEFAULT_ROLES.map((role) => [role.slug, role]));
 
   const rolePermissions = roles.flatMap((role) =>
-    (seedBySlug.get(role.slug)?.permissions ?? []).map((slug) => ({ roleId: role.id, permissionId: permissionId.get(slug)! })),
+    (seedBySlug.get(role.slug)?.permissions ?? []).map((slug) => ({
+      roleId: role.id,
+      permissionId: permissionId.get(slug)!,
+    })),
   );
-  if (rolePermissions.length) await db.permissionRole.createMany({ data: rolePermissions, skipDuplicates: true });
+  if (rolePermissions.length)
+    await db.permissionRole.createMany({
+      data: rolePermissions,
+      skipDuplicates: true,
+    });
 }

package/registry/combos/express-prisma/variants/workspaces/src/{audit-log.repository.ts → repositories/audit-log.repository.ts}

@@ -1,7 +1,12 @@
 import type { AuditEvent } from "@/lib/auth/core/types.js";
-import { Prisma, PrismaClient } from "../generated/prisma/client.js";
-import { buildPageMeta, normalizeLimit, normalizePage, type Paginated } from "./pagination.js";
-import { toIdOrNull, toIdOrUndefined } from "./id.helper.js";
+import { Prisma, PrismaClient } from "../../generated/prisma/client.js";
+import {
+  buildPageMeta,
+  normalizeLimit,
+  normalizePage,
+  type Paginated,
+} from "../pagination.js";
+import { toIdOrNull, toIdOrUndefined } from "../id.helper.js";
 
 export interface AuditLogEntry {
   id: string;
@@ -47,7 +52,10 @@ export function toAuditLogEntry(row: AuditLogRow): AuditLogEntry {
 /** "role_assigned" -> "Role assigned". Derived rather than passed in, so core never has to carry display text. */
 export function humanizeAction(action: string): string {
   const words = action.split("_");
-  return [words[0].charAt(0).toUpperCase() + words[0].slice(1), ...words.slice(1)].join(" ");
+  return [
+    words[0].charAt(0).toUpperCase() + words[0].slice(1),
+    ...words.slice(1),
+  ].join(" ");
 }
 
 // Plain class, no DI container — constructed directly with a PrismaClient in
@@ -60,7 +68,10 @@ export class AuditLogRepository {
    * those happen to a user, not inside a workspace. Callers that *are* acting in a workspace
    * pass it, which is what scopes the admin audit-log read below.
    */
-  async append(event: AuditEvent, opts: { workspaceId?: string; remarks?: string } = {}): Promise<void> {
+  async append(
+    event: AuditEvent,
+    opts: { workspaceId?: string; remarks?: string } = {},
+  ): Promise<void> {
     await this.prisma.auditLog.create({
       data: {
         action: event.type,