@simple-auth-kit/cli 1.4.2 → 1.5.0

package/registry/combos/express-prisma/variants/workspaces/src/{rbac.repository.ts → repositories/rbac.repository.ts}

@@ -1,10 +1,15 @@
 import { resolvePermissions } from "@/lib/auth/core/rbac.js";
-import { Prisma, PrismaClient } from "../generated/prisma/client.js";
-import type { AuthzContext } from "./authz.middleware.js";
-import { HttpError } from "./http-error.js";
-import { buildPageMeta, normalizeLimit, normalizePage, type Paginated } from "./pagination.js";
-import { PermissionCache } from "./permission-cache.js";
-import { toId, toIdOrNull } from "./id.helper.js";
+import { Prisma, PrismaClient } from "../../generated/prisma/client.js";
+import type { AuthzContext } from "../middleware/authz.middleware.js";
+import { HttpError } from "../http-error.js";
+import {
+  buildPageMeta,
+  normalizeLimit,
+  normalizePage,
+  type Paginated,
+} from "../pagination.js";
+import { PermissionCache } from "../permission-cache.js";
+import { toId, toIdOrNull } from "../id.helper.js";
 
 export interface MemberSummary {
   memberId: string;
@@ -36,10 +41,15 @@ export interface MemberListFilter {
 
 export type MemberListResult = Paginated<MemberSummary>;
 
-const MEMBER_INCLUDE = { user: true, roles: { select: { role: { select: { slug: true } } } } } as const;
+const MEMBER_INCLUDE = {
+  user: true,
+  roles: { select: { role: { select: { slug: true } } } },
+} as const;
 
 /** A `WorkspaceMember` row as `findUnique`/`findMany` return it, joined with its user and roles. */
-export type MemberRow = Prisma.WorkspaceMemberGetPayload<{ include: typeof MEMBER_INCLUDE }>;
+export type MemberRow = Prisma.WorkspaceMemberGetPayload<{
+  include: typeof MEMBER_INCLUDE;
+}>;
 
 /** Shapes a raw row into the wire DTO. Exported so `listMembers`'s collection can be shaped by the caller. */
 export function toMemberSummary(row: MemberRow): MemberSummary {
@@ -111,7 +121,14 @@ const PERMISSION_SELECT = {
   isActive: true,
 } as const;
 
-const ROLE_SELECT = { id: true, slug: true, name: true, displayName: true, isDefault: true, isActive: true } as const;
+const ROLE_SELECT = {
+  id: true,
+  slug: true,
+  name: true,
+  displayName: true,
+  isDefault: true,
+  isActive: true,
+} as const;
 
 /**
  * The cache subject in this variant: authorization belongs to a membership, so the key has to be
@@ -122,7 +139,8 @@ const ROLE_SELECT = { id: true, slug: true, name: true, displayName: true, isDef
  * between the two one-directional — the guard needs this repository at runtime, so the repository
  * must not need the guard.
  */
-export const memberCacheKey = (userId: string, workspaceId: string) => `${userId}:${workspaceId}`;
+export const memberCacheKey = (userId: string, workspaceId: string) =>
+  `${userId}:${workspaceId}`;
 
 export class RbacRepository {
   constructor(
@@ -145,8 +163,15 @@ export class RbacRepository {
   // Takes bigint directly: its one caller (setMemberRoles) already has the membership's id in
   // hand from its own Prisma lookup, so there's nothing to parse here.
   private async invalidateMemberById(memberId: bigint): Promise<void> {
-    const member = await this.prisma.workspaceMember.findUnique({ where: { id: memberId }, select: { userId: true, workspaceId: true } });
-    if (member) await this.invalidateMember(member.userId.toString(), member.workspaceId.toString());
+    const member = await this.prisma.workspaceMember.findUnique({
+      where: { id: memberId },
+      select: { userId: true, workspaceId: true },
+    });
+    if (member)
+      await this.invalidateMember(
+        member.userId.toString(),
+        member.workspaceId.toString(),
+      );
   }
 
   /**
@@ -164,7 +189,10 @@ export class RbacRepository {
    * `isActive: false` on a role or a permission takes it out of the answer, which is what makes
    * deactivating either one enforcement-changing without unpicking any grant.
    */
-  async resolveAuthzContext(userId: string, workspaceId: string): Promise<AuthzContext | null> {
+  async resolveAuthzContext(
+    userId: string,
+    workspaceId: string,
+  ): Promise<AuthzContext | null> {
     // workspaceId arrives straight from the untrusted `X-Workspace-Id` header — a value that
     // isn't a valid bigint is exactly as "not a member" as one that parses but names no
     // membership, so it must not throw and 500 the request.
@@ -178,7 +206,10 @@ export class RbacRepository {
     }
 
     const member = await this.prisma.workspaceMember.findUnique({
-      where: { userId_workspaceId: { userId: userIdBig, workspaceId: workspaceIdBig }, user: { isDeleted: false } },
+      where: {
+        userId_workspaceId: { userId: userIdBig, workspaceId: workspaceIdBig },
+        user: { isDeleted: false },
+      },
       select: {
         id: true,
         roles: {
@@ -187,18 +218,28 @@ export class RbacRepository {
             role: {
               select: {
                 slug: true,
-                permissions: { where: { permission: { isActive: true, isDeleted: false } }, select: { permission: { select: { slug: true } } } },
+                permissions: {
+                  where: { permission: { isActive: true, isDeleted: false } },
+                  select: { permission: { select: { slug: true } } },
+                },
               },
             },
           },
         },
-        permissions: { where: { permission: { isActive: true, isDeleted: false } }, select: { permission: { select: { slug: true } } } },
+        permissions: {
+          where: { permission: { isActive: true, isDeleted: false } },
+          select: { permission: { select: { slug: true } } },
+        },
       },
     });
     if (!member) return null;
 
-    const rolePermissions = member.roles.flatMap((roleMember) => roleMember.role.permissions.map((pr) => pr.permission.slug));
-    const directPermissions = member.permissions.map((pm) => pm.permission.slug);
+    const rolePermissions = member.roles.flatMap((roleMember) =>
+      roleMember.role.permissions.map((pr) => pr.permission.slug),
+    );
+    const directPermissions = member.permissions.map(
+      (pm) => pm.permission.slug,
+    );
 
     return {
       workspaceId,
@@ -214,12 +255,21 @@ export class RbacRepository {
    * caller feeds the id straight into another Prisma call, and the one external caller
    * (AuthService) discards the result.
    */
-  async requireMember(workspaceId: string, userId: string): Promise<{ id: bigint }> {
+  async requireMember(
+    workspaceId: string,
+    userId: string,
+  ): Promise<{ id: bigint }> {
     const member = await this.prisma.workspaceMember.findUnique({
-      where: { userId_workspaceId: { userId: toId(userId), workspaceId: toId(workspaceId) } },
+      where: {
+        userId_workspaceId: {
+          userId: toId(userId),
+          workspaceId: toId(workspaceId),
+        },
+      },
       select: { id: true },
     });
-    if (!member) throw new HttpError(404, "user is not a member of this workspace");
+    if (!member)
+      throw new HttpError(404, "user is not a member of this workspace");
     return member;
   }
 
@@ -227,13 +277,21 @@ export class RbacRepository {
    * Newest-first, page-paginated; `search` matches an email substring. Returns raw rows —
    * shaping the collection is the caller's job, see `toMemberSummary`.
    */
-  async listMembers(workspaceId: string, filter: MemberListFilter = {}): Promise<Paginated<MemberRow>> {
+  async listMembers(
+    workspaceId: string,
+    filter: MemberListFilter = {},
+  ): Promise<Paginated<MemberRow>> {
     const page = normalizePage(filter.page);
     const limit = normalizeLimit(filter.limit);
     const workspaceIdBig = toId(workspaceId);
     const where = {
       workspaceId: workspaceIdBig,
-      user: { isDeleted: false, email: filter.search ? { contains: filter.search, mode: "insensitive" as const } : undefined },
+      user: {
+        isDeleted: false,
+        email: filter.search
+          ? { contains: filter.search, mode: "insensitive" as const }
+          : undefined,
+      },
     };
 
     const [rows, total] = await this.prisma.$transaction([
@@ -268,11 +326,21 @@ export class RbacRepository {
   async updateMember(
     workspaceId: string,
     userId: string,
-    input: { firstName?: string | null; lastName?: string | null; displayName?: string | null; phone?: string | null; username?: string | null; photo?: string | null },
+    input: {
+      firstName?: string | null;
+      lastName?: string | null;
+      displayName?: string | null;
+      phone?: string | null;
+      username?: string | null;
+      photo?: string | null;
+    },
     actorUserId: string | null,
   ): Promise<MemberSummary> {
     await this.requireMember(workspaceId, userId);
-    await this.prisma.user.update({ where: { id: toId(userId) }, data: { ...input, updatedBy: toIdOrNull(actorUserId) } });
+    await this.prisma.user.update({
+      where: { id: toId(userId) },
+      data: { ...input, updatedBy: toIdOrNull(actorUserId) },
+    });
     return this.getMember(workspaceId, userId);
   }
 
@@ -280,11 +348,21 @@ export class RbacRepository {
   // pattern, and `block`'s existing precedent of a workspace admin taking a global action on a
   // member's account — this disables the account across every workspace it belongs to, not just
   // this one, which is why it's gated the same way `block` is.
-  async deleteMember(workspaceId: string, userId: string, actorUserId: string | null, reason?: string): Promise<void> {
+  async deleteMember(
+    workspaceId: string,
+    userId: string,
+    actorUserId: string | null,
+    reason?: string,
+  ): Promise<void> {
     await this.requireMember(workspaceId, userId);
     await this.prisma.user.update({
       where: { id: toId(userId) },
-      data: { isDeleted: true, deletedAt: new Date(), deletedBy: toIdOrNull(actorUserId), deletedReason: reason ?? null },
+      data: {
+        isDeleted: true,
+        deletedAt: new Date(),
+        deletedBy: toIdOrNull(actorUserId),
+        deletedReason: reason ?? null,
+      },
     });
     await this.invalidateMember(userId, workspaceId);
   }
@@ -292,13 +370,22 @@ export class RbacRepository {
   async updateRole(
     workspaceId: string,
     roleId: string,
-    input: { name?: string; displayName?: string; description?: string | null; isActive?: boolean },
+    input: {
+      name?: string;
+      displayName?: string;
+      description?: string | null;
+      isActive?: boolean;
+    },
     actorUserId: string | null,
   ): Promise<RoleSummary> {
     const workspaceIdBig = toId(workspaceId);
     const roleIdBig = toId(roleId);
-    const existing = await this.prisma.role.findUnique({ where: { id: roleIdBig, isDeleted: false }, select: { id: true, workspaceId: true } });
-    if (!existing || existing.workspaceId !== workspaceIdBig) throw new HttpError(404, "role not found in this workspace");
+    const existing = await this.prisma.role.findUnique({
+      where: { id: roleIdBig, isDeleted: false },
+      select: { id: true, workspaceId: true },
+    });
+    if (!existing || existing.workspaceId !== workspaceIdBig)
+      throw new HttpError(404, "role not found in this workspace");
     const role = await this.prisma.role.update({
       where: { id: roleIdBig },
       data: { ...input, updatedBy: toIdOrNull(actorUserId) },
@@ -310,14 +397,28 @@ export class RbacRepository {
 
   // Soft-delete. `role_member`/`permission_role` rows pointing at it are left in place — the
   // role simply stops being resolved by `resolveAuthzContext`/`listRoles`.
-  async deleteRole(workspaceId: string, roleId: string, actorUserId: string | null, reason?: string): Promise<void> {
+  async deleteRole(
+    workspaceId: string,
+    roleId: string,
+    actorUserId: string | null,
+    reason?: string,
+  ): Promise<void> {
     const workspaceIdBig = toId(workspaceId);
     const roleIdBig = toId(roleId);
-    const existing = await this.prisma.role.findUnique({ where: { id: roleIdBig, isDeleted: false }, select: { id: true, workspaceId: true } });
-    if (!existing || existing.workspaceId !== workspaceIdBig) throw new HttpError(404, "role not found in this workspace");
+    const existing = await this.prisma.role.findUnique({
+      where: { id: roleIdBig, isDeleted: false },
+      select: { id: true, workspaceId: true },
+    });
+    if (!existing || existing.workspaceId !== workspaceIdBig)
+      throw new HttpError(404, "role not found in this workspace");
     await this.prisma.role.update({
       where: { id: roleIdBig },
-      data: { isDeleted: true, deletedAt: new Date(), deletedBy: toIdOrNull(actorUserId), deletedReason: reason ?? null },
+      data: {
+        isDeleted: true,
+        deletedAt: new Date(),
+        deletedBy: toIdOrNull(actorUserId),
+        deletedReason: reason ?? null,
+      },
     });
     await this.cache.invalidatePolicy();
   }
@@ -333,7 +434,12 @@ export class RbacRepository {
     const rows = await this.prisma.permission.findMany({
       where: { isDeleted: false },
       select: PERMISSION_SELECT,
-      orderBy: [{ groupOrder: "asc" }, { group: "asc" }, { order: "asc" }, { slug: "asc" }],
+      orderBy: [
+        { groupOrder: "asc" },
+        { group: "asc" },
+        { order: "asc" },
+        { slug: "asc" },
+      ],
     });
     return rows.map((row) => ({ ...row, id: row.id.toString() }));
   }
@@ -347,7 +453,10 @@ export class RbacRepository {
    * Upserted on `slug`, which stays the stable identifier grants and revocations use, so renaming
    * `name`/`displayName` never breaks a grant.
    */
-  async upsertPermission(input: PermissionInput, actorUserId: string | null): Promise<PermissionSummary> {
+  async upsertPermission(
+    input: PermissionInput,
+    actorUserId: string | null,
+  ): Promise<PermissionSummary> {
     const shared = {
       name: input.name,
       displayName: input.displayName,
@@ -389,7 +498,12 @@ export class RbacRepository {
 
   async createRole(
     workspaceId: string,
-    input: { slug: string; name?: string; displayName?: string; description?: string | null },
+    input: {
+      slug: string;
+      name?: string;
+      displayName?: string;
+      description?: string | null;
+    },
     actorUserId: string | null,
   ): Promise<RoleSummary> {
     const role = await this.prisma.role.create({
@@ -413,22 +527,37 @@ export class RbacRepository {
    * be granted, and it opens nothing until a route names it — and no route shipped by this
    * library can name it, because `@CheckAbility` only accepts slugs from `rbac.defaults.ts`.
    */
-  async attachPermissionToRole(workspaceId: string, roleId: string, permissionSlug: string, actorUserId: string | null): Promise<void> {
+  async attachPermissionToRole(
+    workspaceId: string,
+    roleId: string,
+    permissionSlug: string,
+    actorUserId: string | null,
+  ): Promise<void> {
     const workspaceIdBig = toId(workspaceId);
     const roleIdBig = toId(roleId);
-    const role = await this.prisma.role.findUnique({ where: { id: roleIdBig, isDeleted: false }, select: { id: true, workspaceId: true } });
-    if (!role || role.workspaceId !== workspaceIdBig) throw new HttpError(404, "role not found in this workspace");
+    const role = await this.prisma.role.findUnique({
+      where: { id: roleIdBig, isDeleted: false },
+      select: { id: true, workspaceId: true },
+    });
+    if (!role || role.workspaceId !== workspaceIdBig)
+      throw new HttpError(404, "role not found in this workspace");
 
     const permission = await this.ensurePermission(permissionSlug, actorUserId);
     await this.prisma.permissionRole.upsert({
-      where: { permissionId_roleId: { permissionId: permission.id, roleId: roleIdBig } },
+      where: {
+        permissionId_roleId: { permissionId: permission.id, roleId: roleIdBig },
+      },
       create: { permissionId: permission.id, roleId: roleIdBig },
       update: {},
     });
     await this.cache.invalidatePolicy(); // every membership holding this role is affected
   }
 
-  async assignRoleToMember(workspaceId: string, userId: string, roleSlug: string): Promise<void> {
+  async assignRoleToMember(
+    workspaceId: string,
+    userId: string,
+    roleSlug: string,
+  ): Promise<void> {
     const role = await this.requireRole(workspaceId, roleSlug);
     const member = await this.requireMember(workspaceId, userId);
     await this.prisma.roleMember.upsert({
@@ -439,32 +568,64 @@ export class RbacRepository {
     await this.invalidateMember(userId, workspaceId);
   }
 
-  async revokeRoleFromMember(workspaceId: string, userId: string, roleSlug: string): Promise<void> {
+  async revokeRoleFromMember(
+    workspaceId: string,
+    userId: string,
+    roleSlug: string,
+  ): Promise<void> {
     const member = await this.requireMember(workspaceId, userId);
-    const role = await this.prisma.role.findUnique({ where: { workspaceId_slug: { workspaceId: toId(workspaceId), slug: roleSlug } }, select: { id: true } });
+    const role = await this.prisma.role.findUnique({
+      where: {
+        workspaceId_slug: { workspaceId: toId(workspaceId), slug: roleSlug },
+      },
+      select: { id: true },
+    });
     if (!role) return;
-    await this.prisma.roleMember.deleteMany({ where: { memberId: member.id, roleId: role.id } });
+    await this.prisma.roleMember.deleteMany({
+      where: { memberId: member.id, roleId: role.id },
+    });
     await this.invalidateMember(userId, workspaceId);
   }
 
   /** Replaces the whole set — the "set a member's roles" operation, as opposed to assign/revoke one at a time. */
-  async setMemberRoles(workspaceId: string, memberId: string, roleSlugs: string[]): Promise<{ memberId: string; roles: string[] }> {
+  async setMemberRoles(
+    workspaceId: string,
+    memberId: string,
+    roleSlugs: string[],
+  ): Promise<{ memberId: string; roles: string[] }> {
     const workspaceIdBig = toId(workspaceId);
     const memberIdBig = toId(memberId);
-    const member = await this.prisma.workspaceMember.findUnique({ where: { id: memberIdBig }, select: { id: true, workspaceId: true } });
-    if (!member || member.workspaceId !== workspaceIdBig) throw new HttpError(404, "member not found in this workspace");
+    const member = await this.prisma.workspaceMember.findUnique({
+      where: { id: memberIdBig },
+      select: { id: true, workspaceId: true },
+    });
+    if (!member || member.workspaceId !== workspaceIdBig)
+      throw new HttpError(404, "member not found in this workspace");
 
     const roles = await this.prisma.role.findMany({
-      where: { workspaceId: workspaceIdBig, slug: { in: roleSlugs }, isDeleted: false },
+      where: {
+        workspaceId: workspaceIdBig,
+        slug: { in: roleSlugs },
+        isDeleted: false,
+      },
       select: { id: true, slug: true },
     });
-    const unknown = roleSlugs.filter((slug) => !roles.some((role) => role.slug === slug));
-    if (unknown.length) throw new HttpError(404, `role(s) not defined in this workspace: ${unknown.join(", ")}`);
+    const unknown = roleSlugs.filter(
+      (slug) => !roles.some((role) => role.slug === slug),
+    );
+    if (unknown.length)
+      throw new HttpError(
+        404,
+        `role(s) not defined in this workspace: ${unknown.join(", ")}`,
+      );
 
     // Replace, in one transaction: a member must never be briefly role-less to a concurrent request.
     await this.prisma.$transaction([
       this.prisma.roleMember.deleteMany({ where: { memberId: memberIdBig } }),
-      this.prisma.roleMember.createMany({ data: roles.map((role) => ({ memberId: memberIdBig, roleId: role.id })), skipDuplicates: true }),
+      this.prisma.roleMember.createMany({
+        data: roles.map((role) => ({ memberId: memberIdBig, roleId: role.id })),
+        skipDuplicates: true,
+      }),
     ]);
     await this.invalidateMemberById(memberIdBig);
     return { memberId, roles: roles.map((role) => role.slug).sort() };
@@ -477,36 +638,70 @@ export class RbacRepository {
    */
   async defaultRoleIdsFor(workspaceId: string): Promise<bigint[]> {
     const roles = await this.prisma.role.findMany({
-      where: { workspaceId: toId(workspaceId), isDefault: true, isActive: true, isDeleted: false },
+      where: {
+        workspaceId: toId(workspaceId),
+        isDefault: true,
+        isActive: true,
+        isDeleted: false,
+      },
       select: { id: true },
     });
     return roles.map((role) => role.id);
   }
 
-  async grantPermissionToMember(workspaceId: string, userId: string, permissionSlug: string, actorUserId: string | null): Promise<void> {
+  async grantPermissionToMember(
+    workspaceId: string,
+    userId: string,
+    permissionSlug: string,
+    actorUserId: string | null,
+  ): Promise<void> {
     const member = await this.requireMember(workspaceId, userId);
     const permission = await this.ensurePermission(permissionSlug, actorUserId);
     await this.prisma.permissionMember.upsert({
-      where: { memberId_permissionId: { memberId: member.id, permissionId: permission.id } },
+      where: {
+        memberId_permissionId: {
+          memberId: member.id,
+          permissionId: permission.id,
+        },
+      },
       create: { memberId: member.id, permissionId: permission.id },
       update: {},
     });
     await this.invalidateMember(userId, workspaceId);
   }
 
-  async revokePermissionFromMember(workspaceId: string, userId: string, permissionSlug: string): Promise<void> {
+  async revokePermissionFromMember(
+    workspaceId: string,
+    userId: string,
+    permissionSlug: string,
+  ): Promise<void> {
     const member = await this.requireMember(workspaceId, userId);
-    const permission = await this.prisma.permission.findUnique({ where: { slug: permissionSlug }, select: { id: true } });
+    const permission = await this.prisma.permission.findUnique({
+      where: { slug: permissionSlug },
+      select: { id: true },
+    });
     if (!permission) return;
-    await this.prisma.permissionMember.deleteMany({ where: { memberId: member.id, permissionId: permission.id } });
+    await this.prisma.permissionMember.deleteMany({
+      where: { memberId: member.id, permissionId: permission.id },
+    });
     await this.invalidateMember(userId, workspaceId);
   }
 
   // Returns bigint directly: its one caller (assignRoleToMember) feeds the id straight into
   // another Prisma call.
-  private async requireRole(workspaceId: string, slug: string): Promise<{ id: bigint }> {
-    const role = await this.prisma.role.findUnique({ where: { workspaceId_slug: { workspaceId: toId(workspaceId), slug }, isDeleted: false }, select: { id: true } });
-    if (!role) throw new HttpError(404, `role "${slug}" not found in this workspace`);
+  private async requireRole(
+    workspaceId: string,
+    slug: string,
+  ): Promise<{ id: bigint }> {
+    const role = await this.prisma.role.findUnique({
+      where: {
+        workspaceId_slug: { workspaceId: toId(workspaceId), slug },
+        isDeleted: false,
+      },
+      select: { id: true },
+    });
+    if (!role)
+      throw new HttpError(404, `role "${slug}" not found in this workspace`);
     return role;
   }
 
@@ -514,12 +709,25 @@ export class RbacRepository {
    * Creates the row for a slug granted before anyone defined it; leaves an existing definition
    * alone. Returns bigint directly: both callers feed the id straight into another Prisma call.
    */
-  private async ensurePermission(slug: string, actorUserId: string | null): Promise<{ id: bigint }> {
-    const existing = await this.prisma.permission.findUnique({ where: { slug }, select: { id: true } });
+  private async ensurePermission(
+    slug: string,
+    actorUserId: string | null,
+  ): Promise<{ id: bigint }> {
+    const existing = await this.prisma.permission.findUnique({
+      where: { slug },
+      select: { id: true },
+    });
     return (
       existing ??
       (await this.prisma.permission.create({
-        data: { slug, name: slug, displayName: slug, group: "Custom", createdBy: toIdOrNull(actorUserId), updatedBy: toIdOrNull(actorUserId) },
+        data: {
+          slug,
+          name: slug,
+          displayName: slug,
+          group: "Custom",
+          createdBy: toIdOrNull(actorUserId),
+          updatedBy: toIdOrNull(actorUserId),
+        },
         select: { id: true },
       }))
     );