@simple-auth-kit/cli 1.4.2 → 1.5.0

package/registry/combos/nestjs-drizzle/variants/workspaces/src/auth.module.ts

@@ -2,29 +2,36 @@ import { Pool } from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { DynamicModule, Module } from "@nestjs/common";
 import { APP_FILTER, APP_INTERCEPTOR } from "@nestjs/core";
-import { AbilityGuard } from "./ability.guard.js";
-import { AdminController } from "./admin.controller.js";
-import { AuditLogRepository } from "./audit-log.repository.js";
-import { AuthCoreErrorFilter } from "./auth-core-error.filter.js";
+import { AbilityGuard } from "./guards/ability.guard.js";
+import { AdminController } from "./controllers/admin.controller.js";
+import { AuditLogRepository } from "./repositories/audit-log.repository.js";
+import { AuthCoreErrorFilter } from "./filters/auth-core-error.filter.js";
 import { AUTH_CONFIG, AuthConfig, defaultAuthConfig } from "./auth.config.js";
-import { AuthController } from "./auth.controller.js";
-import { AuthGuard } from "./auth.guard.js";
-import { AuthService } from "./auth.service.js";
-import { AuthzGuard, WorkspaceGuard } from "./authz.guard.js";
+import { AuthController } from "./controllers/auth.controller.js";
+import { AuthGuard } from "./guards/auth.guard.js";
+import { AuthService } from "./services/auth.service.js";
+import { AuthzGuard, WorkspaceGuard } from "./guards/authz.guard.js";
 import { DRIZZLE_DB } from "./db.js";
 import { KeyProviderService } from "./key-provider.js";
-import { OAuthRepository } from "./oauth.repository.js";
-import { PasswordResetRepository } from "./password-reset.repository.js";
-import { InMemoryPermissionCacheStore, PERMISSION_CACHE_STORE, PermissionCache } from "./permission-cache.js";
-import { InMemoryRateLimitStore, RATE_LIMIT_STORE } from "./rate-limit.store.js";
-import { RbacRepository } from "./rbac.repository.js";
-import { ResponseInterceptor } from "./response.interceptor.js";
+import { OAuthRepository } from "./repositories/oauth.repository.js";
+import { PasswordResetRepository } from "./repositories/password-reset.repository.js";
+import {
+  InMemoryPermissionCacheStore,
+  PERMISSION_CACHE_STORE,
+  PermissionCache,
+} from "./permission-cache.js";
+import {
+  InMemoryRateLimitStore,
+  RATE_LIMIT_STORE,
+} from "./rate-limit.store.js";
+import { RbacRepository } from "./repositories/rbac.repository.js";
+import { ResponseInterceptor } from "./interceptors/response.interceptor.js";
 import { assertEveryRouteDeclaresATier } from "./route-tiers.js";
 import * as schema from "./schema.js";
-import { SessionRepository } from "./session.repository.js";
-import { TwoFactorRepository } from "./two-factor.repository.js";
-import { WorkspaceController } from "./workspace.controller.js";
-import { WorkspaceRepository } from "./workspace.repository.js";
+import { SessionRepository } from "./repositories/session.repository.js";
+import { TwoFactorRepository } from "./repositories/two-factor.repository.js";
+import { WorkspaceController } from "./controllers/workspace.controller.js";
+import { WorkspaceRepository } from "./repositories/workspace.repository.js";
 
 /**
  * Every controller this library ships, in one place. It is both what the module registers and
@@ -41,7 +48,10 @@ export class AuthModule {
     // stops the process here, by name, rather than shipping as an open endpoint nobody noticed.
     // Nothing above this line allocates a connection pool or a port, so a failed boot leaves
     // nothing behind.
-    assertEveryRouteDeclaresATier(AUTH_CONTROLLERS, { authentication: AuthGuard, ability: AbilityGuard });
+    assertEveryRouteDeclaresATier(AUTH_CONTROLLERS, {
+      authentication: AuthGuard,
+      ability: AbilityGuard,
+    });
 
     const pool = new Pool({ connectionString: process.env["DATABASE_URL"] });
     const db = drizzle(pool, { schema });
@@ -62,14 +72,21 @@ export class AuthModule {
         { provide: DRIZZLE_DB, useValue: db },
         // The cache seam. Swap the store for a Redis-backed one by passing `permissionCacheStore`
         // to forRoot — nothing in this library's source changes. Keys are namespaced simpleauthkit:authz:*.
-        { provide: PERMISSION_CACHE_STORE, useValue: config.permissionCacheStore ?? new InMemoryPermissionCacheStore() },
+        {
+          provide: PERMISSION_CACHE_STORE,
+          useValue:
+            config.permissionCacheStore ?? new InMemoryPermissionCacheStore(),
+        },
         PermissionCache,
         { provide: APP_FILTER, useClass: AuthCoreErrorFilter },
         { provide: APP_INTERCEPTOR, useClass: ResponseInterceptor },
         AuditLogRepository,
         SessionRepository,
         KeyProviderService,
-        { provide: RATE_LIMIT_STORE, useValue: config.rateLimitStore ?? new InMemoryRateLimitStore() },
+        {
+          provide: RATE_LIMIT_STORE,
+          useValue: config.rateLimitStore ?? new InMemoryRateLimitStore(),
+        },
         RbacRepository,
         WorkspaceRepository,
         TwoFactorRepository,
@@ -81,7 +98,16 @@ export class AuthModule {
         WorkspaceGuard,
         AbilityGuard,
       ],
-      exports: [AuthService, AuthGuard, AuthzGuard, WorkspaceGuard, AbilityGuard, PermissionCache, WorkspaceRepository, DRIZZLE_DB],
+      exports: [
+        AuthService,
+        AuthGuard,
+        AuthzGuard,
+        WorkspaceGuard,
+        AbilityGuard,
+        PermissionCache,
+        WorkspaceRepository,
+        DRIZZLE_DB,
+      ],
     };
   }
 }

package/registry/combos/nestjs-drizzle/variants/workspaces/src/{admin.controller.ts → controllers/admin.controller.ts}

@@ -1,12 +1,36 @@
-import { BadRequestException, Body, Controller, Delete, ForbiddenException, Get, Inject, Ip, Param, Patch, Post, Query, Req, UseGuards } from "@nestjs/common";
-import { ApiBearerAuth, ApiBody, ApiHeader, ApiOperation, ApiParam, ApiQuery, ApiResponse, ApiTags } from "@nestjs/swagger";
+import {
+  BadRequestException,
+  Body,
+  Controller,
+  Delete,
+  ForbiddenException,
+  Get,
+  Inject,
+  Ip,
+  Param,
+  Patch,
+  Post,
+  Query,
+  Req,
+  UseGuards,
+} from "@nestjs/common";
+import {
+  ApiBearerAuth,
+  ApiBody,
+  ApiHeader,
+  ApiOperation,
+  ApiParam,
+  ApiQuery,
+  ApiResponse,
+  ApiTags,
+} from "@nestjs/swagger";
 import type { Request } from "express";
-import { AbilityGuard } from "./ability.guard.js";
-import { AuthGuard } from "./auth.guard.js";
-import { AuthService } from "./auth.service.js";
-import { WORKSPACE_HEADER, WorkspaceGuard } from "./authz.guard.js";
-import { CheckAbility } from "./route-tiers.js";
-import { WorkspaceRepository } from "./workspace.repository.js";
+import { AbilityGuard } from "../guards/ability.guard.js";
+import { AuthGuard } from "../guards/auth.guard.js";
+import { AuthService } from "../services/auth.service.js";
+import { WORKSPACE_HEADER, WorkspaceGuard } from "../guards/authz.guard.js";
+import { CheckAbility } from "../route-tiers.js";
+import { WorkspaceRepository } from "../repositories/workspace.repository.js";
 import { hashPassword } from "@/lib/auth/core/crypto.js";
 import {
   AssignRoleDto,
@@ -23,15 +47,21 @@ import {
   RoleSummaryDto,
   UpdateRoleDto,
   UpdateUserDto,
-} from "./dto/auth.dto.js";
-import { AuditLogListResponseDto, UserListResponseDto, UserSummaryDto } from "./dto/admin.dto.js";
+} from "../dto/auth.dto.js";
+import {
+  AuditLogListResponseDto,
+  UserListResponseDto,
+  UserSummaryDto,
+} from "../dto/admin.dto.js";
 
 function requireString(value: unknown, field: string): string {
-  if (typeof value !== "string" || value.length === 0) throw new BadRequestException(`${field} is required`);
+  if (typeof value !== "string" || value.length === 0)
+    throw new BadRequestException(`${field} is required`);
   return value;
 }
 
-const optionalString = (value: unknown): string | undefined => (typeof value === "string" ? value : undefined);
+const optionalString = (value: unknown): string | undefined =>
+  typeof value === "string" ? value : undefined;
 
 /**
  * Administration *of one workspace*, and of nothing else. Authority is a permission, never a role
@@ -55,35 +85,65 @@ const optionalString = (value: unknown): string | undefined => (typeof value ===
 @ApiTags("auth")
 @Controller("auth/admin")
 @ApiBearerAuth()
-@ApiHeader({ name: WORKSPACE_HEADER, required: true, description: "The workspace this request administers. The caller must be an admin member of it." })
+@ApiHeader({
+  name: WORKSPACE_HEADER,
+  required: true,
+  description:
+    "The workspace this request administers. The caller must be an admin member of it.",
+})
 @UseGuards(AuthGuard, WorkspaceGuard, AbilityGuard)
 export class AdminController {
   constructor(
     @Inject(AuthService) private readonly auth: AuthService,
-    @Inject(WorkspaceRepository) private readonly workspaces: WorkspaceRepository,
+    @Inject(WorkspaceRepository)
+    private readonly workspaces: WorkspaceRepository,
   ) {}
 
   @Get("users")
   @CheckAbility("users:read")
   @ApiOperation({ summary: "[admin] List the members of this workspace" })
-  @ApiQuery({ name: "search", required: false, description: "Email substring match" })
-  @ApiQuery({ name: "page", required: false, description: "1-indexed. Defaults to 1." })
-  @ApiQuery({ name: "limit", required: false, description: "Defaults to 25, capped at 100." })
+  @ApiQuery({
+    name: "search",
+    required: false,
+    description: "Email substring match",
+  })
+  @ApiQuery({
+    name: "page",
+    required: false,
+    description: "1-indexed. Defaults to 1.",
+  })
+  @ApiQuery({
+    name: "limit",
+    required: false,
+    description: "Defaults to 25, capped at 100.",
+  })
   @ApiResponse({ status: 200, type: UserListResponseDto })
-  async listUsers(@Req() req: Request, @Query("search") search?: string, @Query("page") page?: string, @Query("limit") limit?: string) {
-    return this.auth.listUsers(req.authz!, { search, page: page ? Number(page) : undefined, limit: limit ? Number(limit) : undefined });
+  async listUsers(
+    @Req() req: Request,
+    @Query("search") search?: string,
+    @Query("page") page?: string,
+    @Query("limit") limit?: string,
+  ) {
+    return this.auth.listUsers(req.authz!, {
+      search,
+      page: page ? Number(page) : undefined,
+      limit: limit ? Number(limit) : undefined,
+    });
   }
 
   @Post("users")
   @CheckAbility("users:manage")
   @ApiOperation({
     summary: "[admin] Create a user and add them to this workspace",
-    description: "No invitation email — the account is usable immediately with the password given here.",
+    description:
+      "No invitation email — the account is usable immediately with the password given here.",
   })
   @ApiBody({ type: CreateUserDto })
   @ApiResponse({ status: 201, type: UserSummaryDto })
   async createUser(@Body() body: Record<string, unknown>, @Req() req: Request) {
-    const passwordHash = await hashPassword(requireString(body.password, "password"));
+    const passwordHash = await hashPassword(
+      requireString(body.password, "password"),
+    );
     const member = await this.workspaces.createMember(
       req.authz!.workspaceId,
       {
@@ -94,7 +154,11 @@ export class AdminController {
         displayName: optionalString(body.displayName),
         phone: optionalString(body.phone),
         username: optionalString(body.username),
-        roles: Array.isArray(body.roles) ? body.roles.filter((role): role is string => typeof role === "string") : undefined,
+        roles: Array.isArray(body.roles)
+          ? body.roles.filter(
+              (role): role is string => typeof role === "string",
+            )
+          : undefined,
       },
       req.auth!.sub,
     );
@@ -112,18 +176,28 @@ export class AdminController {
 
   @Patch("users/:userId")
   @CheckAbility("users:manage")
-  @ApiOperation({ summary: "[admin] Edit a member's profile", description: "Profile fields only — email is the login identifier and is not editable here." })
+  @ApiOperation({
+    summary: "[admin] Edit a member's profile",
+    description:
+      "Profile fields only — email is the login identifier and is not editable here.",
+  })
   @ApiParam({ name: "userId" })
   @ApiBody({ type: UpdateUserDto })
   @ApiResponse({ status: 200, type: UserSummaryDto })
-  async updateUser(@Param("userId") userId: string, @Body() body: Record<string, unknown>, @Req() req: Request) {
+  async updateUser(
+    @Param("userId") userId: string,
+    @Body() body: Record<string, unknown>,
+    @Req() req: Request,
+  ) {
     return this.auth.updateUser(
       req.authz!,
       userId,
       {
-        firstName: body.firstName === null ? null : optionalString(body.firstName),
+        firstName:
+          body.firstName === null ? null : optionalString(body.firstName),
         lastName: body.lastName === null ? null : optionalString(body.lastName),
-        displayName: body.displayName === null ? null : optionalString(body.displayName),
+        displayName:
+          body.displayName === null ? null : optionalString(body.displayName),
         phone: body.phone === null ? null : optionalString(body.phone),
         username: body.username === null ? null : optionalString(body.username),
         photo: body.photo === null ? null : optionalString(body.photo),
@@ -143,21 +217,53 @@ export class AdminController {
   @ApiParam({ name: "userId" })
   @ApiBody({ type: DeleteReasonDto, required: false })
   @ApiResponse({ status: 200, type: OkResponseDto })
-  async deleteUser(@Param("userId") userId: string, @Body() body: Record<string, unknown>, @Req() req: Request) {
-    if (userId === req.auth!.sub) throw new ForbiddenException("cannot delete your own account");
-    await this.auth.deleteUser(req.authz!, userId, req.auth!.sub, optionalString(body?.reason));
+  async deleteUser(
+    @Param("userId") userId: string,
+    @Body() body: Record<string, unknown>,
+    @Req() req: Request,
+  ) {
+    if (userId === req.auth!.sub)
+      throw new ForbiddenException("cannot delete your own account");
+    await this.auth.deleteUser(
+      req.authz!,
+      userId,
+      req.auth!.sub,
+      optionalString(body?.reason),
+    );
     return { ok: true };
   }
 
   @Get("audit-log")
   @CheckAbility("audit-log:read")
-  @ApiOperation({ summary: "[admin] List this workspace's audit log entries, newest first" })
+  @ApiOperation({
+    summary: "[admin] List this workspace's audit log entries, newest first",
+  })
   @ApiQuery({ name: "userId", required: false })
-  @ApiQuery({ name: "action", required: false, description: "AuditEvent discriminant, e.g. 'role_assigned'" })
-  @ApiQuery({ name: "since", required: false, description: "ISO 8601 timestamp" })
-  @ApiQuery({ name: "until", required: false, description: "ISO 8601 timestamp" })
-  @ApiQuery({ name: "page", required: false, description: "1-indexed. Defaults to 1." })
-  @ApiQuery({ name: "limit", required: false, description: "Defaults to 25, capped at 100." })
+  @ApiQuery({
+    name: "action",
+    required: false,
+    description: "AuditEvent discriminant, e.g. 'role_assigned'",
+  })
+  @ApiQuery({
+    name: "since",
+    required: false,
+    description: "ISO 8601 timestamp",
+  })
+  @ApiQuery({
+    name: "until",
+    required: false,
+    description: "ISO 8601 timestamp",
+  })
+  @ApiQuery({
+    name: "page",
+    required: false,
+    description: "1-indexed. Defaults to 1.",
+  })
+  @ApiQuery({
+    name: "limit",
+    required: false,
+    description: "Defaults to 25, capped at 100.",
+  })
   @ApiResponse({ status: 200, type: AuditLogListResponseDto })
   async listAuditLog(
     @Req() req: Request,
@@ -200,17 +306,23 @@ export class AdminController {
   })
   @ApiBody({ type: DefinePermissionDto })
   @ApiResponse({ status: 201, type: PermissionSummaryDto })
-  async definePermission(@Body() body: Record<string, unknown>, @Req() req: Request) {
+  async definePermission(
+    @Body() body: Record<string, unknown>,
+    @Req() req: Request,
+  ) {
     return this.auth.definePermission(
       {
         slug: requireString(body.slug, "slug"),
         name: optionalString(body.name),
         displayName: optionalString(body.displayName),
-        description: body.description === null ? null : optionalString(body.description),
+        description:
+          body.description === null ? null : optionalString(body.description),
         group: optionalString(body.group),
-        groupOrder: typeof body.groupOrder === "number" ? body.groupOrder : undefined,
+        groupOrder:
+          typeof body.groupOrder === "number" ? body.groupOrder : undefined,
         order: typeof body.order === "number" ? body.order : undefined,
-        isActive: typeof body.isActive === "boolean" ? body.isActive : undefined,
+        isActive:
+          typeof body.isActive === "boolean" ? body.isActive : undefined,
       },
       req.auth!.sub,
     );
@@ -248,15 +360,21 @@ export class AdminController {
   @ApiParam({ name: "roleId" })
   @ApiBody({ type: UpdateRoleDto })
   @ApiResponse({ status: 200, type: RoleSummaryDto })
-  async updateRole(@Param("roleId") roleId: string, @Body() body: Record<string, unknown>, @Req() req: Request) {
+  async updateRole(
+    @Param("roleId") roleId: string,
+    @Body() body: Record<string, unknown>,
+    @Req() req: Request,
+  ) {
     return this.auth.updateRole(
       req.authz!,
       roleId,
       {
         name: optionalString(body.name),
         displayName: optionalString(body.displayName),
-        description: body.description === null ? null : optionalString(body.description),
-        isActive: typeof body.isActive === "boolean" ? body.isActive : undefined,
+        description:
+          body.description === null ? null : optionalString(body.description),
+        isActive:
+          typeof body.isActive === "boolean" ? body.isActive : undefined,
       },
       req.auth!.sub,
     );
@@ -266,83 +384,147 @@ export class AdminController {
   @CheckAbility("roles:manage")
   @ApiOperation({
     summary: "[admin] Delete one of this workspace's roles",
-    description: "Soft-delete: existing assignments are left in place rather than cascade-deleted, and the role simply stops being resolved.",
+    description:
+      "Soft-delete: existing assignments are left in place rather than cascade-deleted, and the role simply stops being resolved.",
   })
   @ApiParam({ name: "roleId" })
   @ApiBody({ type: DeleteReasonDto, required: false })
   @ApiResponse({ status: 200, type: OkResponseDto })
-  async deleteRole(@Param("roleId") roleId: string, @Body() body: Record<string, unknown>, @Req() req: Request) {
-    await this.auth.deleteRole(req.authz!, roleId, req.auth!.sub, optionalString(body?.reason));
+  async deleteRole(
+    @Param("roleId") roleId: string,
+    @Body() body: Record<string, unknown>,
+    @Req() req: Request,
+  ) {
+    await this.auth.deleteRole(
+      req.authz!,
+      roleId,
+      req.auth!.sub,
+      optionalString(body?.reason),
+    );
     return { ok: true };
   }
 
   @Post("roles/:roleId/permissions")
   @CheckAbility("roles:manage")
-  @ApiOperation({ summary: "[admin] Attach a permission to one of this workspace's roles" })
+  @ApiOperation({
+    summary: "[admin] Attach a permission to one of this workspace's roles",
+  })
   @ApiParam({ name: "roleId" })
   @ApiBody({ type: AttachPermissionDto })
   @ApiResponse({ status: 201, type: OkResponseDto })
-  async attachPermissionToRole(@Param("roleId") roleId: string, @Body() body: Record<string, unknown>, @Req() req: Request) {
-    await this.auth.attachPermissionToRole(req.authz!, roleId, requireString(body.permission, "permission"), req.auth!.sub);
+  async attachPermissionToRole(
+    @Param("roleId") roleId: string,
+    @Body() body: Record<string, unknown>,
+    @Req() req: Request,
+  ) {
+    await this.auth.attachPermissionToRole(
+      req.authz!,
+      roleId,
+      requireString(body.permission, "permission"),
+      req.auth!.sub,
+    );
     return { ok: true };
   }
 
   @Post("users/:userId/roles")
   @CheckAbility("roles:assign")
-  @ApiOperation({ summary: "[admin] Assign a role to a member of this workspace" })
+  @ApiOperation({
+    summary: "[admin] Assign a role to a member of this workspace",
+  })
   @ApiParam({ name: "userId" })
   @ApiBody({ type: AssignRoleDto })
   @ApiResponse({ status: 201, type: OkResponseDto })
-  async assignRole(@Param("userId") userId: string, @Body() body: Record<string, unknown>, @Req() req: Request) {
-    await this.auth.assignRole(req.authz!, userId, requireString(body.role, "role"));
+  async assignRole(
+    @Param("userId") userId: string,
+    @Body() body: Record<string, unknown>,
+    @Req() req: Request,
+  ) {
+    await this.auth.assignRole(
+      req.authz!,
+      userId,
+      requireString(body.role, "role"),
+    );
     return { ok: true };
   }
 
   @Post("users/:userId/roles/:roleSlug/revoke")
   @CheckAbility("roles:assign")
-  @ApiOperation({ summary: "[admin] Revoke a role from a member of this workspace" })
+  @ApiOperation({
+    summary: "[admin] Revoke a role from a member of this workspace",
+  })
   @ApiParam({ name: "userId" })
   @ApiParam({ name: "roleSlug" })
   @ApiResponse({ status: 201, type: OkResponseDto })
-  async revokeRole(@Param("userId") userId: string, @Param("roleSlug") roleSlug: string, @Req() req: Request) {
+  async revokeRole(
+    @Param("userId") userId: string,
+    @Param("roleSlug") roleSlug: string,
+    @Req() req: Request,
+  ) {
     // Revoking your own `admin` would strip the very permission that authorised the call. In a
     // workspace there is no way back in afterwards, so the route refuses it the same way
     // self-block does. Assigning to yourself is fine; it can't lock anyone out.
-    if (userId === req.auth!.sub) throw new ForbiddenException("cannot change your own roles");
+    if (userId === req.auth!.sub)
+      throw new ForbiddenException("cannot change your own roles");
     await this.auth.revokeRole(req.authz!, userId, roleSlug);
     return { ok: true };
   }
 
   @Post("users/:userId/permissions")
   @CheckAbility("permissions:grant")
-  @ApiOperation({ summary: "[admin] Grant a permission directly to a member, bypassing roles", description: "The grant is scoped to this workspace." })
+  @ApiOperation({
+    summary: "[admin] Grant a permission directly to a member, bypassing roles",
+    description: "The grant is scoped to this workspace.",
+  })
   @ApiParam({ name: "userId" })
   @ApiBody({ type: GrantPermissionDto })
   @ApiResponse({ status: 201, type: OkResponseDto })
-  async grantPermission(@Param("userId") userId: string, @Body() body: Record<string, unknown>, @Req() req: Request) {
-    await this.auth.grantPermission(req.authz!, userId, requireString(body.permission, "permission"), req.auth!.sub);
+  async grantPermission(
+    @Param("userId") userId: string,
+    @Body() body: Record<string, unknown>,
+    @Req() req: Request,
+  ) {
+    await this.auth.grantPermission(
+      req.authz!,
+      userId,
+      requireString(body.permission, "permission"),
+      req.auth!.sub,
+    );
     return { ok: true };
   }
 
   @Post("users/:userId/permissions/:permissionSlug/revoke")
   @CheckAbility("permissions:grant")
-  @ApiOperation({ summary: "[admin] Revoke a direct permission grant from a member" })
+  @ApiOperation({
+    summary: "[admin] Revoke a direct permission grant from a member",
+  })
   @ApiParam({ name: "userId" })
   @ApiParam({ name: "permissionSlug" })
   @ApiResponse({ status: 201, type: OkResponseDto })
-  async revokePermission(@Param("userId") userId: string, @Param("permissionSlug") permissionSlug: string, @Req() req: Request) {
+  async revokePermission(
+    @Param("userId") userId: string,
+    @Param("permissionSlug") permissionSlug: string,
+    @Req() req: Request,
+  ) {
     await this.auth.revokePermission(req.authz!, userId, permissionSlug);
     return { ok: true };
   }
 
   @Post("users/:userId/block")
   @CheckAbility("users:block")
-  @ApiOperation({ summary: "[admin] Block a member, revoking all their sessions immediately",
-    description: "Blocking disables the whole account, so it is only allowed against a member of the workspace you administer." })
+  @ApiOperation({
+    summary: "[admin] Block a member, revoking all their sessions immediately",
+    description:
+      "Blocking disables the whole account, so it is only allowed against a member of the workspace you administer.",
+  })
   @ApiParam({ name: "userId" })
   @ApiResponse({ status: 201, type: OkResponseDto })
-  async block(@Param("userId") userId: string, @Req() req: Request, @Ip() ip: string) {
-    if (userId === req.auth!.sub) throw new ForbiddenException("cannot block your own account");
+  async block(
+    @Param("userId") userId: string,
+    @Req() req: Request,
+    @Ip() ip: string,
+  ) {
+    if (userId === req.auth!.sub)
+      throw new ForbiddenException("cannot block your own account");
     await this.auth.block(req.authz!, userId, { userId: req.auth!.sub, ip });
     return { ok: true };
   }
@@ -353,21 +535,34 @@ export class AdminController {
   @ApiParam({ name: "userId" })
   @ApiResponse({ status: 201, type: OkResponseDto })
   async unblock(@Param("userId") userId: string, @Req() req: Request) {
-    await this.auth.unblock(req.authz!, userId, { userId: req.auth!.sub, ip: req.ip });
+    await this.auth.unblock(req.authz!, userId, {
+      userId: req.auth!.sub,
+      ip: req.ip,
+    });
     return { ok: true };
   }
 
   @Post("users/:userId/deactivate")
   @CheckAbility("users:block")
   @ApiOperation({
-    summary: "[admin] Deactivate a member, revoking all their sessions immediately",
-    description: "Distinct from block/unblock — a routine administrative toggle, not a security action. Both independently deny login.",
+    summary:
+      "[admin] Deactivate a member, revoking all their sessions immediately",
+    description:
+      "Distinct from block/unblock — a routine administrative toggle, not a security action. Both independently deny login.",
   })
   @ApiParam({ name: "userId" })
   @ApiResponse({ status: 201, type: OkResponseDto })
-  async deactivate(@Param("userId") userId: string, @Req() req: Request, @Ip() ip: string) {
-    if (userId === req.auth!.sub) throw new ForbiddenException("cannot deactivate your own account");
-    await this.auth.deactivate(req.authz!, userId, { userId: req.auth!.sub, ip });
+  async deactivate(
+    @Param("userId") userId: string,
+    @Req() req: Request,
+    @Ip() ip: string,
+  ) {
+    if (userId === req.auth!.sub)
+      throw new ForbiddenException("cannot deactivate your own account");
+    await this.auth.deactivate(req.authz!, userId, {
+      userId: req.auth!.sub,
+      ip,
+    });
     return { ok: true };
   }
 
@@ -376,7 +571,11 @@ export class AdminController {
   @ApiOperation({ summary: "[admin] Reactivate a member" })
   @ApiParam({ name: "userId" })
   @ApiResponse({ status: 201, type: OkResponseDto })
-  async activate(@Param("userId") userId: string, @Req() req: Request, @Ip() ip: string) {
+  async activate(
+    @Param("userId") userId: string,
+    @Req() req: Request,
+    @Ip() ip: string,
+  ) {
     await this.auth.activate(req.authz!, userId, { userId: req.auth!.sub, ip });
     return { ok: true };
   }