@simple-auth-kit/cli 1.4.2 → 1.5.0

package/registry/combos/nestjs-drizzle/variants/base/src/auth.module.ts

@@ -2,27 +2,34 @@ import { Pool } from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { DynamicModule, Module } from "@nestjs/common";
 import { APP_FILTER, APP_INTERCEPTOR } from "@nestjs/core";
-import { AbilityGuard } from "./ability.guard.js";
-import { AdminController } from "./admin.controller.js";
-import { AuditLogRepository } from "./audit-log.repository.js";
-import { AuthCoreErrorFilter } from "./auth-core-error.filter.js";
+import { AbilityGuard } from "./guards/ability.guard.js";
+import { AdminController } from "./controllers/admin.controller.js";
+import { AuditLogRepository } from "./repositories/audit-log.repository.js";
+import { AuthCoreErrorFilter } from "./filters/auth-core-error.filter.js";
 import { AUTH_CONFIG, AuthConfig, defaultAuthConfig } from "./auth.config.js";
-import { AuthController } from "./auth.controller.js";
-import { AuthGuard } from "./auth.guard.js";
-import { AuthService } from "./auth.service.js";
-import { AuthzGuard } from "./authz.guard.js";
+import { AuthController } from "./controllers/auth.controller.js";
+import { AuthGuard } from "./guards/auth.guard.js";
+import { AuthService } from "./services/auth.service.js";
+import { AuthzGuard } from "./guards/authz.guard.js";
 import { DRIZZLE_DB } from "./db.js";
 import { KeyProviderService } from "./key-provider.js";
-import { OAuthRepository } from "./oauth.repository.js";
-import { PasswordResetRepository } from "./password-reset.repository.js";
-import { InMemoryPermissionCacheStore, PERMISSION_CACHE_STORE, PermissionCache } from "./permission-cache.js";
-import { InMemoryRateLimitStore, RATE_LIMIT_STORE } from "./rate-limit.store.js";
-import { RbacRepository } from "./rbac.repository.js";
-import { ResponseInterceptor } from "./response.interceptor.js";
+import { OAuthRepository } from "./repositories/oauth.repository.js";
+import { PasswordResetRepository } from "./repositories/password-reset.repository.js";
+import {
+  InMemoryPermissionCacheStore,
+  PERMISSION_CACHE_STORE,
+  PermissionCache,
+} from "./permission-cache.js";
+import {
+  InMemoryRateLimitStore,
+  RATE_LIMIT_STORE,
+} from "./rate-limit.store.js";
+import { RbacRepository } from "./repositories/rbac.repository.js";
+import { ResponseInterceptor } from "./interceptors/response.interceptor.js";
 import { assertEveryRouteDeclaresATier } from "./route-tiers.js";
 import * as schema from "./schema.js";
-import { SessionRepository } from "./session.repository.js";
-import { TwoFactorRepository } from "./two-factor.repository.js";
+import { SessionRepository } from "./repositories/session.repository.js";
+import { TwoFactorRepository } from "./repositories/two-factor.repository.js";
 
 /**
  * Every controller this library ships, in one place. It is both what the module registers and
@@ -39,7 +46,10 @@ export class AuthModule {
     // stops the process here, by name, rather than shipping as an open endpoint nobody noticed.
     // Nothing above this line allocates a connection pool or a port, so a failed boot leaves
     // nothing behind.
-    assertEveryRouteDeclaresATier(AUTH_CONTROLLERS, { authentication: AuthGuard, ability: AbilityGuard });
+    assertEveryRouteDeclaresATier(AUTH_CONTROLLERS, {
+      authentication: AuthGuard,
+      ability: AbilityGuard,
+    });
 
     const pool = new Pool({ connectionString: process.env["DATABASE_URL"] });
     const db = drizzle(pool, { schema });
@@ -60,14 +70,21 @@ export class AuthModule {
         { provide: DRIZZLE_DB, useValue: db },
         // The cache seam. Swap the store for a Redis-backed one by passing `permissionCacheStore`
         // to forRoot — nothing in this library's source changes. Keys are namespaced simpleauthkit:authz:*.
-        { provide: PERMISSION_CACHE_STORE, useValue: config.permissionCacheStore ?? new InMemoryPermissionCacheStore() },
+        {
+          provide: PERMISSION_CACHE_STORE,
+          useValue:
+            config.permissionCacheStore ?? new InMemoryPermissionCacheStore(),
+        },
         PermissionCache,
         { provide: APP_FILTER, useClass: AuthCoreErrorFilter },
         { provide: APP_INTERCEPTOR, useClass: ResponseInterceptor },
         AuditLogRepository,
         SessionRepository,
         KeyProviderService,
-        { provide: RATE_LIMIT_STORE, useValue: config.rateLimitStore ?? new InMemoryRateLimitStore() },
+        {
+          provide: RATE_LIMIT_STORE,
+          useValue: config.rateLimitStore ?? new InMemoryRateLimitStore(),
+        },
         RbacRepository,
         TwoFactorRepository,
         OAuthRepository,
@@ -77,7 +94,14 @@ export class AuthModule {
         AuthzGuard,
         AbilityGuard,
       ],
-      exports: [AuthService, AuthGuard, AuthzGuard, AbilityGuard, PermissionCache, DRIZZLE_DB],
+      exports: [
+        AuthService,
+        AuthGuard,
+        AuthzGuard,
+        AbilityGuard,
+        PermissionCache,
+        DRIZZLE_DB,
+      ],
     };
   }
 }

package/registry/combos/nestjs-drizzle/variants/base/src/{admin.controller.ts → controllers/admin.controller.ts}

@@ -1,11 +1,33 @@
-import { BadRequestException, Body, Controller, Delete, ForbiddenException, Get, Inject, Param, Patch, Post, Query, Req, UseGuards } from "@nestjs/common";
-import { ApiBearerAuth, ApiBody, ApiOperation, ApiParam, ApiQuery, ApiResponse, ApiTags } from "@nestjs/swagger";
+import {
+  BadRequestException,
+  Body,
+  Controller,
+  Delete,
+  ForbiddenException,
+  Get,
+  Inject,
+  Param,
+  Patch,
+  Post,
+  Query,
+  Req,
+  UseGuards,
+} from "@nestjs/common";
+import {
+  ApiBearerAuth,
+  ApiBody,
+  ApiOperation,
+  ApiParam,
+  ApiQuery,
+  ApiResponse,
+  ApiTags,
+} from "@nestjs/swagger";
 import type { Request } from "express";
-import { AbilityGuard } from "./ability.guard.js";
-import { AuthGuard } from "./auth.guard.js";
-import { AuthService } from "./auth.service.js";
-import { AuthzGuard } from "./authz.guard.js";
-import { CheckAbility } from "./route-tiers.js";
+import { AbilityGuard } from "../guards/ability.guard.js";
+import { AuthGuard } from "../guards/auth.guard.js";
+import { AuthService } from "../services/auth.service.js";
+import { AuthzGuard } from "../guards/authz.guard.js";
+import { CheckAbility } from "../route-tiers.js";
 import {
   AssignRoleDto,
   AttachPermissionDto,
@@ -21,15 +43,21 @@ import {
   RoleSummaryDto,
   UpdateRoleDto,
   UpdateUserDto,
-} from "./dto/auth.dto.js";
-import { AuditLogListResponseDto, UserListResponseDto, UserSummaryDto } from "./dto/admin.dto.js";
+} from "../dto/auth.dto.js";
+import {
+  AuditLogListResponseDto,
+  UserListResponseDto,
+  UserSummaryDto,
+} from "../dto/admin.dto.js";
 
 function requireString(value: unknown, field: string): string {
-  if (typeof value !== "string" || value.length === 0) throw new BadRequestException(`${field} is required`);
+  if (typeof value !== "string" || value.length === 0)
+    throw new BadRequestException(`${field} is required`);
   return value;
 }
 
-const optionalString = (value: unknown): string | undefined => (typeof value === "string" ? value : undefined);
+const optionalString = (value: unknown): string | undefined =>
+  typeof value === "string" ? value : undefined;
 
 /**
  * Administration of the whole deployment. Authority is a permission, never a role name:
@@ -56,17 +84,41 @@ export class AdminController {
   @Get("users")
   @CheckAbility("users:read")
   @ApiOperation({ summary: "[admin] List users" })
-  @ApiQuery({ name: "search", required: false, description: "Email substring match" })
-  @ApiQuery({ name: "page", required: false, description: "1-indexed. Defaults to 1." })
-  @ApiQuery({ name: "limit", required: false, description: "Defaults to 25, capped at 100." })
+  @ApiQuery({
+    name: "search",
+    required: false,
+    description: "Email substring match",
+  })
+  @ApiQuery({
+    name: "page",
+    required: false,
+    description: "1-indexed. Defaults to 1.",
+  })
+  @ApiQuery({
+    name: "limit",
+    required: false,
+    description: "Defaults to 25, capped at 100.",
+  })
   @ApiResponse({ status: 200, type: UserListResponseDto })
-  async listUsers(@Query("search") search?: string, @Query("page") page?: string, @Query("limit") limit?: string) {
-    return this.auth.listUsers({ search, page: page ? Number(page) : undefined, limit: limit ? Number(limit) : undefined });
+  async listUsers(
+    @Query("search") search?: string,
+    @Query("page") page?: string,
+    @Query("limit") limit?: string,
+  ) {
+    return this.auth.listUsers({
+      search,
+      page: page ? Number(page) : undefined,
+      limit: limit ? Number(limit) : undefined,
+    });
   }
 
   @Post("users")
   @CheckAbility("users:manage")
-  @ApiOperation({ summary: "[admin] Create a user directly", description: "No invitation email — the account is usable immediately with the password given here." })
+  @ApiOperation({
+    summary: "[admin] Create a user directly",
+    description:
+      "No invitation email — the account is usable immediately with the password given here.",
+  })
   @ApiBody({ type: CreateUserDto })
   @ApiResponse({ status: 201, type: UserSummaryDto })
   async createUser(@Body() body: Record<string, unknown>, @Req() req: Request) {
@@ -82,8 +134,13 @@ export class AdminController {
         dob: optionalString(body.dob),
         gender: optionalString(body.gender),
         joinedDate: optionalString(body.joinedDate),
-        isActive: typeof body.isActive === "boolean" ? body.isActive : undefined,
-        roles: Array.isArray(body.roles) ? body.roles.filter((role): role is string => typeof role === "string") : undefined,
+        isActive:
+          typeof body.isActive === "boolean" ? body.isActive : undefined,
+        roles: Array.isArray(body.roles)
+          ? body.roles.filter(
+              (role): role is string => typeof role === "string",
+            )
+          : undefined,
       },
       req.auth!.sub,
     );
@@ -100,17 +157,27 @@ export class AdminController {
 
   @Patch("users/:userId")
   @CheckAbility("users:manage")
-  @ApiOperation({ summary: "[admin] Edit a user's profile", description: "Profile fields only — email is the login identifier and is not editable here." })
+  @ApiOperation({
+    summary: "[admin] Edit a user's profile",
+    description:
+      "Profile fields only — email is the login identifier and is not editable here.",
+  })
   @ApiParam({ name: "userId" })
   @ApiBody({ type: UpdateUserDto })
   @ApiResponse({ status: 200, type: UserSummaryDto })
-  async updateUser(@Param("userId") userId: string, @Body() body: Record<string, unknown>, @Req() req: Request) {
+  async updateUser(
+    @Param("userId") userId: string,
+    @Body() body: Record<string, unknown>,
+    @Req() req: Request,
+  ) {
     return this.auth.updateUser(
       userId,
       {
-        firstName: body.firstName === null ? null : optionalString(body.firstName),
+        firstName:
+          body.firstName === null ? null : optionalString(body.firstName),
         lastName: body.lastName === null ? null : optionalString(body.lastName),
-        displayName: body.displayName === null ? null : optionalString(body.displayName),
+        displayName:
+          body.displayName === null ? null : optionalString(body.displayName),
         phone: body.phone === null ? null : optionalString(body.phone),
         username: body.username === null ? null : optionalString(body.username),
         photo: body.photo === null ? null : optionalString(body.photo),
@@ -126,14 +193,24 @@ export class AdminController {
   @CheckAbility("users:manage")
   @ApiOperation({
     summary: "[admin] Delete a user",
-    description: "Soft-delete: the row survives for audit purposes, stops appearing in listings, and can no longer authenticate.",
+    description:
+      "Soft-delete: the row survives for audit purposes, stops appearing in listings, and can no longer authenticate.",
   })
   @ApiParam({ name: "userId" })
   @ApiBody({ type: DeleteReasonDto, required: false })
   @ApiResponse({ status: 200, type: OkResponseDto })
-  async deleteUser(@Param("userId") userId: string, @Body() body: Record<string, unknown>, @Req() req: Request) {
-    if (userId === req.auth!.sub) throw new ForbiddenException("cannot delete your own account");
-    await this.auth.deleteUser(userId, req.auth!.sub, optionalString(body?.reason));
+  async deleteUser(
+    @Param("userId") userId: string,
+    @Body() body: Record<string, unknown>,
+    @Req() req: Request,
+  ) {
+    if (userId === req.auth!.sub)
+      throw new ForbiddenException("cannot delete your own account");
+    await this.auth.deleteUser(
+      userId,
+      req.auth!.sub,
+      optionalString(body?.reason),
+    );
     return { ok: true };
   }
 
@@ -141,11 +218,31 @@ export class AdminController {
   @CheckAbility("audit-log:read")
   @ApiOperation({ summary: "[admin] List audit log entries, newest first" })
   @ApiQuery({ name: "userId", required: false })
-  @ApiQuery({ name: "action", required: false, description: "AuditEvent discriminant, e.g. 'role_assigned'" })
-  @ApiQuery({ name: "since", required: false, description: "ISO 8601 timestamp" })
-  @ApiQuery({ name: "until", required: false, description: "ISO 8601 timestamp" })
-  @ApiQuery({ name: "page", required: false, description: "1-indexed. Defaults to 1." })
-  @ApiQuery({ name: "limit", required: false, description: "Defaults to 25, capped at 100." })
+  @ApiQuery({
+    name: "action",
+    required: false,
+    description: "AuditEvent discriminant, e.g. 'role_assigned'",
+  })
+  @ApiQuery({
+    name: "since",
+    required: false,
+    description: "ISO 8601 timestamp",
+  })
+  @ApiQuery({
+    name: "until",
+    required: false,
+    description: "ISO 8601 timestamp",
+  })
+  @ApiQuery({
+    name: "page",
+    required: false,
+    description: "1-indexed. Defaults to 1.",
+  })
+  @ApiQuery({
+    name: "limit",
+    required: false,
+    description: "Defaults to 25, capped at 100.",
+  })
   @ApiResponse({ status: 200, type: AuditLogListResponseDto })
   async listAuditLog(
     @Query("userId") userId?: string,
@@ -155,14 +252,22 @@ export class AdminController {
     @Query("page") page?: string,
     @Query("limit") limit?: string,
   ) {
-    return this.auth.listAuditLog({ userId, action, since, until, page: page ? Number(page) : undefined, limit: limit ? Number(limit) : undefined });
+    return this.auth.listAuditLog({
+      userId,
+      action,
+      since,
+      until,
+      page: page ? Number(page) : undefined,
+      limit: limit ? Number(limit) : undefined,
+    });
   }
 
   @Get("permissions")
   @CheckAbility("permissions:read")
   @ApiOperation({
     summary: "[admin] List the permission catalog",
-    description: "Grouped and ordered for a permission matrix. This is the whole vocabulary of the deployment — there is nothing about authorization outside these rows.",
+    description:
+      "Grouped and ordered for a permission matrix. This is the whole vocabulary of the deployment — there is nothing about authorization outside these rows.",
   })
   @ApiResponse({ status: 200, type: PermissionListResponseDto })
   async listPermissions() {
@@ -179,17 +284,23 @@ export class AdminController {
   })
   @ApiBody({ type: DefinePermissionDto })
   @ApiResponse({ status: 201, type: PermissionSummaryDto })
-  async definePermission(@Body() body: Record<string, unknown>, @Req() req: Request) {
+  async definePermission(
+    @Body() body: Record<string, unknown>,
+    @Req() req: Request,
+  ) {
     return this.auth.definePermission(
       {
         slug: requireString(body.slug, "slug"),
         name: optionalString(body.name),
         displayName: optionalString(body.displayName),
-        description: body.description === null ? null : optionalString(body.description),
+        description:
+          body.description === null ? null : optionalString(body.description),
         group: optionalString(body.group),
-        groupOrder: typeof body.groupOrder === "number" ? body.groupOrder : undefined,
+        groupOrder:
+          typeof body.groupOrder === "number" ? body.groupOrder : undefined,
         order: typeof body.order === "number" ? body.order : undefined,
-        isActive: typeof body.isActive === "boolean" ? body.isActive : undefined,
+        isActive:
+          typeof body.isActive === "boolean" ? body.isActive : undefined,
       },
       req.auth!.sub,
     );
@@ -215,8 +326,10 @@ export class AdminController {
         name: optionalString(body.name),
         displayName: optionalString(body.displayName),
         description: optionalString(body.description) ?? null,
-        isDefault: typeof body.isDefault === "boolean" ? body.isDefault : undefined,
-        isActive: typeof body.isActive === "boolean" ? body.isActive : undefined,
+        isDefault:
+          typeof body.isDefault === "boolean" ? body.isDefault : undefined,
+        isActive:
+          typeof body.isActive === "boolean" ? body.isActive : undefined,
       },
       req.auth!.sub,
     );
@@ -228,15 +341,22 @@ export class AdminController {
   @ApiParam({ name: "roleId" })
   @ApiBody({ type: UpdateRoleDto })
   @ApiResponse({ status: 200, type: RoleSummaryDto })
-  async updateRole(@Param("roleId") roleId: string, @Body() body: Record<string, unknown>, @Req() req: Request) {
+  async updateRole(
+    @Param("roleId") roleId: string,
+    @Body() body: Record<string, unknown>,
+    @Req() req: Request,
+  ) {
     return this.auth.updateRole(
       roleId,
       {
         name: optionalString(body.name),
         displayName: optionalString(body.displayName),
-        description: body.description === null ? null : optionalString(body.description),
-        isDefault: typeof body.isDefault === "boolean" ? body.isDefault : undefined,
-        isActive: typeof body.isActive === "boolean" ? body.isActive : undefined,
+        description:
+          body.description === null ? null : optionalString(body.description),
+        isDefault:
+          typeof body.isDefault === "boolean" ? body.isDefault : undefined,
+        isActive:
+          typeof body.isActive === "boolean" ? body.isActive : undefined,
       },
       req.auth!.sub,
     );
@@ -246,13 +366,22 @@ export class AdminController {
   @CheckAbility("roles:manage")
   @ApiOperation({
     summary: "[admin] Delete a role",
-    description: "Soft-delete: existing assignments are left in place rather than cascade-deleted, and the role simply stops being resolved.",
+    description:
+      "Soft-delete: existing assignments are left in place rather than cascade-deleted, and the role simply stops being resolved.",
   })
   @ApiParam({ name: "roleId" })
   @ApiBody({ type: DeleteReasonDto, required: false })
   @ApiResponse({ status: 200, type: OkResponseDto })
-  async deleteRole(@Param("roleId") roleId: string, @Body() body: Record<string, unknown>, @Req() req: Request) {
-    await this.auth.deleteRole(roleId, req.auth!.sub, optionalString(body?.reason));
+  async deleteRole(
+    @Param("roleId") roleId: string,
+    @Body() body: Record<string, unknown>,
+    @Req() req: Request,
+  ) {
+    await this.auth.deleteRole(
+      roleId,
+      req.auth!.sub,
+      optionalString(body?.reason),
+    );
     return { ok: true };
   }
 
@@ -262,8 +391,16 @@ export class AdminController {
   @ApiParam({ name: "roleId" })
   @ApiBody({ type: AttachPermissionDto })
   @ApiResponse({ status: 201, type: OkResponseDto })
-  async attachPermissionToRole(@Param("roleId") roleId: string, @Body() body: Record<string, unknown>, @Req() req: Request) {
-    await this.auth.attachPermissionToRole(roleId, requireString(body.permission, "permission"), req.auth!.sub);
+  async attachPermissionToRole(
+    @Param("roleId") roleId: string,
+    @Body() body: Record<string, unknown>,
+    @Req() req: Request,
+  ) {
+    await this.auth.attachPermissionToRole(
+      roleId,
+      requireString(body.permission, "permission"),
+      req.auth!.sub,
+    );
     return { ok: true };
   }
 
@@ -273,7 +410,10 @@ export class AdminController {
   @ApiParam({ name: "userId" })
   @ApiBody({ type: AssignRoleDto })
   @ApiResponse({ status: 201, type: OkResponseDto })
-  async assignRole(@Param("userId") userId: string, @Body() body: Record<string, unknown>) {
+  async assignRole(
+    @Param("userId") userId: string,
+    @Body() body: Record<string, unknown>,
+  ) {
     await this.auth.assignRole(userId, requireString(body.role, "role"));
     return { ok: true };
   }
@@ -284,43 +424,66 @@ export class AdminController {
   @ApiParam({ name: "userId" })
   @ApiParam({ name: "roleSlug" })
   @ApiResponse({ status: 201, type: OkResponseDto })
-  async revokeRole(@Param("userId") userId: string, @Param("roleSlug") roleSlug: string, @Req() req: Request) {
+  async revokeRole(
+    @Param("userId") userId: string,
+    @Param("roleSlug") roleSlug: string,
+    @Req() req: Request,
+  ) {
     // Revoking your own `admin` would strip the very permission that let you call this,
     // with no route back in. Assigning to yourself is fine — it can't lock anyone out.
-    if (userId === req.auth!.sub) throw new ForbiddenException("cannot change your own roles");
+    if (userId === req.auth!.sub)
+      throw new ForbiddenException("cannot change your own roles");
     await this.auth.revokeRole(userId, roleSlug);
     return { ok: true };
   }
 
   @Post("users/:userId/permissions")
   @CheckAbility("permissions:grant")
-  @ApiOperation({ summary: "[admin] Grant a permission directly to a user, bypassing roles" })
+  @ApiOperation({
+    summary: "[admin] Grant a permission directly to a user, bypassing roles",
+  })
   @ApiParam({ name: "userId" })
   @ApiBody({ type: GrantPermissionDto })
   @ApiResponse({ status: 201, type: OkResponseDto })
-  async grantPermission(@Param("userId") userId: string, @Body() body: Record<string, unknown>, @Req() req: Request) {
-    await this.auth.grantPermission(userId, requireString(body.permission, "permission"), req.auth!.sub);
+  async grantPermission(
+    @Param("userId") userId: string,
+    @Body() body: Record<string, unknown>,
+    @Req() req: Request,
+  ) {
+    await this.auth.grantPermission(
+      userId,
+      requireString(body.permission, "permission"),
+      req.auth!.sub,
+    );
     return { ok: true };
   }
 
   @Post("users/:userId/permissions/:permissionSlug/revoke")
   @CheckAbility("permissions:grant")
-  @ApiOperation({ summary: "[admin] Revoke a direct permission grant from a user" })
+  @ApiOperation({
+    summary: "[admin] Revoke a direct permission grant from a user",
+  })
   @ApiParam({ name: "userId" })
   @ApiParam({ name: "permissionSlug" })
   @ApiResponse({ status: 201, type: OkResponseDto })
-  async revokePermission(@Param("userId") userId: string, @Param("permissionSlug") permissionSlug: string) {
+  async revokePermission(
+    @Param("userId") userId: string,
+    @Param("permissionSlug") permissionSlug: string,
+  ) {
     await this.auth.revokePermission(userId, permissionSlug);
     return { ok: true };
   }
 
   @Post("users/:userId/block")
   @CheckAbility("users:block")
-  @ApiOperation({ summary: "[admin] Block a user, revoking all their sessions immediately" })
+  @ApiOperation({
+    summary: "[admin] Block a user, revoking all their sessions immediately",
+  })
   @ApiParam({ name: "userId" })
   @ApiResponse({ status: 201, type: OkResponseDto })
   async block(@Param("userId") userId: string, @Req() req: Request) {
-    if (userId === req.auth!.sub) throw new ForbiddenException("cannot block your own account");
+    if (userId === req.auth!.sub)
+      throw new ForbiddenException("cannot block your own account");
     await this.auth.block(userId, { userId: req.auth!.sub, ip: req.ip });
     return { ok: true };
   }
@@ -338,13 +501,16 @@ export class AdminController {
   @Post("users/:userId/deactivate")
   @CheckAbility("users:block")
   @ApiOperation({
-    summary: "[admin] Deactivate a user, revoking all their sessions immediately",
-    description: "Distinct from block/unblock — a routine administrative toggle, not a security action. Both independently deny login.",
+    summary:
+      "[admin] Deactivate a user, revoking all their sessions immediately",
+    description:
+      "Distinct from block/unblock — a routine administrative toggle, not a security action. Both independently deny login.",
   })
   @ApiParam({ name: "userId" })
   @ApiResponse({ status: 201, type: OkResponseDto })
   async deactivate(@Param("userId") userId: string, @Req() req: Request) {
-    if (userId === req.auth!.sub) throw new ForbiddenException("cannot deactivate your own account");
+    if (userId === req.auth!.sub)
+      throw new ForbiddenException("cannot deactivate your own account");
     await this.auth.deactivate(userId, { userId: req.auth!.sub, ip: req.ip });
     return { ok: true };
   }

package/registry/combos/nestjs-drizzle/variants/base/src/{authz.guard.ts → guards/authz.guard.ts}

@@ -1,7 +1,12 @@
-import { CanActivate, ExecutionContext, Inject, Injectable } from "@nestjs/common";
-import { defineAbilitiesFor } from "./ability.js";
-import { PermissionCache } from "./permission-cache.js";
-import { RbacRepository } from "./rbac.repository.js";
+import {
+  CanActivate,
+  ExecutionContext,
+  Inject,
+  Injectable,
+} from "@nestjs/common";
+import { defineAbilitiesFor } from "../ability.js";
+import { PermissionCache } from "../permission-cache.js";
+import { RbacRepository } from "../repositories/rbac.repository.js";
 
 /**
  * Roles and permissions are global to this deployment: a user has one set, and it applies
@@ -45,7 +50,9 @@ export class AuthzGuard implements CanActivate {
     const req = context.switchToHttp().getRequest();
     if (req.auth) {
       const userId = req.auth.sub as string;
-      req.authz = (await this.cache.resolve<AuthzContext>(userId, () => this.rbac.resolveAuthzContext(userId))) ?? { roles: [], permissions: [] };
+      req.authz = (await this.cache.resolve<AuthzContext>(userId, () =>
+        this.rbac.resolveAuthzContext(userId),
+      )) ?? { roles: [], permissions: [] };
       req.ability = defineAbilitiesFor(req.authz.permissions);
     }
     return true;

package/registry/combos/nestjs-drizzle/variants/base/src/{audit-log.repository.ts → repositories/audit-log.repository.ts}

@@ -1,10 +1,15 @@
 import { Inject, Injectable } from "@nestjs/common";
 import { and, count, desc, eq, gte, lte, type SQL } from "drizzle-orm";
 import type { AuditEvent } from "@/lib/auth/core/types.js";
-import { DRIZZLE_DB, type Database } from "./db.js";
-import { buildPageMeta, normalizeLimit, normalizePage, type Paginated } from "./pagination.js";
-import { auditLogs } from "./schema.js";
-import { toIdOrNull, toIdOrUndefined } from "./id.helper.js";
+import { DRIZZLE_DB, type Database } from "../db.js";
+import {
+  buildPageMeta,
+  normalizeLimit,
+  normalizePage,
+  type Paginated,
+} from "../pagination.js";
+import { auditLogs } from "../schema.js";
+import { toIdOrNull, toIdOrUndefined } from "../id.helper.js";
 
 export interface AuditLogEntry {
   id: string;
@@ -46,14 +51,20 @@ export function toAuditLogEntry(row: AuditLogRow): AuditLogEntry {
 /** "role_assigned" -> "Role assigned". Derived rather than passed in, so core never has to carry display text. */
 export function humanizeAction(action: string): string {
   const words = action.split("_");
-  return [words[0].charAt(0).toUpperCase() + words[0].slice(1), ...words.slice(1)].join(" ");
+  return [
+    words[0].charAt(0).toUpperCase() + words[0].slice(1),
+    ...words.slice(1),
+  ].join(" ");
 }
 
 @Injectable()
 export class AuditLogRepository {
   constructor(@Inject(DRIZZLE_DB) private readonly db: Database) {}
 
-  async append(event: AuditEvent, opts: { remarks?: string } = {}): Promise<void> {
+  async append(
+    event: AuditEvent,
+    opts: { remarks?: string } = {},
+  ): Promise<void> {
     await this.db.insert(auditLogs).values({
       action: event.type,
       name: humanizeAction(event.type),
@@ -70,10 +81,13 @@ export class AuditLogRepository {
 
     const conditions: SQL[] = [];
     const userIdBig = toIdOrUndefined(filter.userId);
-    if (userIdBig !== undefined) conditions.push(eq(auditLogs.userId, userIdBig));
+    if (userIdBig !== undefined)
+      conditions.push(eq(auditLogs.userId, userIdBig));
     if (filter.action) conditions.push(eq(auditLogs.action, filter.action));
-    if (filter.since) conditions.push(gte(auditLogs.createdAt, new Date(filter.since)));
-    if (filter.until) conditions.push(lte(auditLogs.createdAt, new Date(filter.until)));
+    if (filter.since)
+      conditions.push(gte(auditLogs.createdAt, new Date(filter.since)));
+    if (filter.until)
+      conditions.push(lte(auditLogs.createdAt, new Date(filter.until)));
     const where = conditions.length ? and(...conditions) : undefined;
 
     const rows = await this.db
@@ -83,7 +97,10 @@ export class AuditLogRepository {
       .orderBy(desc(auditLogs.createdAt), desc(auditLogs.id))
       .limit(limit)
       .offset((page - 1) * limit);
-    const [{ value: total }] = await this.db.select({ value: count() }).from(auditLogs).where(where);
+    const [{ value: total }] = await this.db
+      .select({ value: count() })
+      .from(auditLogs)
+      .where(where);
 
     return { items: rows, meta: buildPageMeta(page, limit, total) };
   }