@simple-auth-kit/cli 1.4.2 → 1.5.0

package/registry/combos/express-drizzle/variants/base/src/{rbac.repository.ts → repositories/rbac.repository.ts}

@@ -1,11 +1,32 @@
-import { and, asc, count, desc, eq, ilike, inArray, type SQL } from "drizzle-orm";
+import {
+  and,
+  asc,
+  count,
+  desc,
+  eq,
+  ilike,
+  inArray,
+  type SQL,
+} from "drizzle-orm";
 import { resolvePermissions } from "@/lib/auth/core/rbac.js";
-import type { Database } from "./db.js";
-import { buildPageMeta, normalizeLimit, normalizePage, type Paginated } from "./pagination.js";
-import { PermissionCache } from "./permission-cache.js";
-import { permissionRole, permissionUser, permissions, roleUser, roles, users } from "./schema.js";
-import { HttpError } from "./http-error.js";
-import { toId, toIdOrNull } from "./id.helper.js";
+import type { Database } from "../db.js";
+import {
+  buildPageMeta,
+  normalizeLimit,
+  normalizePage,
+  type Paginated,
+} from "../pagination.js";
+import { PermissionCache } from "../permission-cache.js";
+import {
+  permissionRole,
+  permissionUser,
+  permissions,
+  roleUser,
+  roles,
+  users,
+} from "../schema.js";
+import { HttpError } from "../http-error.js";
+import { toId, toIdOrNull } from "../id.helper.js";
 
 /**
  * Every column the `users` table has, except the two secrets (`passwordHash`, `twoFactorSecret`
@@ -149,9 +170,15 @@ interface RoleRow {
   isActive: boolean;
 }
 
-const asPermissionSummary = (row: PermissionRow): PermissionSummary => ({ ...row, id: row.id.toString() });
+const asPermissionSummary = (row: PermissionRow): PermissionSummary => ({
+  ...row,
+  id: row.id.toString(),
+});
 
-const asRoleSummary = (row: RoleRow): RoleSummary => ({ ...row, id: row.id.toString() });
+const asRoleSummary = (row: RoleRow): RoleSummary => ({
+  ...row,
+  id: row.id.toString(),
+});
 
 export class RbacRepository {
   constructor(
@@ -177,7 +204,9 @@ export class RbacRepository {
    * makes deactivating either one enforcement-changing without unpicking any grant; `isDeleted`
    * on the user themselves takes the whole answer to empty.
    */
-  async resolveAuthzContext(userId: string): Promise<{ roles: string[]; permissions: string[] }> {
+  async resolveAuthzContext(
+    userId: string,
+  ): Promise<{ roles: string[]; permissions: string[] }> {
     const userIdBig = toId(userId);
     const [user] = await this.db
       .select({ id: users.id })
@@ -192,21 +221,44 @@ export class RbacRepository {
       this.db
         .select({ roleSlug: roles.slug, permissionSlug: permissions.slug })
         .from(roleUser)
-        .innerJoin(roles, and(eq(roles.id, roleUser.roleId), eq(roles.isActive, true), eq(roles.isDeleted, false)))
+        .innerJoin(
+          roles,
+          and(
+            eq(roles.id, roleUser.roleId),
+            eq(roles.isActive, true),
+            eq(roles.isDeleted, false),
+          ),
+        )
         .leftJoin(permissionRole, eq(permissionRole.roleId, roles.id))
-        .leftJoin(permissions, and(eq(permissions.id, permissionRole.permissionId), eq(permissions.isActive, true), eq(permissions.isDeleted, false)))
+        .leftJoin(
+          permissions,
+          and(
+            eq(permissions.id, permissionRole.permissionId),
+            eq(permissions.isActive, true),
+            eq(permissions.isDeleted, false),
+          ),
+        )
         .where(eq(roleUser.userId, userIdBig)),
       this.db
         .select({ slug: permissions.slug })
         .from(permissionUser)
-        .innerJoin(permissions, and(eq(permissions.id, permissionUser.permissionId), eq(permissions.isActive, true), eq(permissions.isDeleted, false)))
+        .innerJoin(
+          permissions,
+          and(
+            eq(permissions.id, permissionUser.permissionId),
+            eq(permissions.isActive, true),
+            eq(permissions.isDeleted, false),
+          ),
+        )
         .where(eq(permissionUser.userId, userIdBig)),
     ]);
 
     return {
       roles: [...new Set(roleRows.map((row) => row.roleSlug))].sort(),
       permissions: resolvePermissions(
-        roleRows.map((row) => row.permissionSlug).filter((slug): slug is string => slug !== null),
+        roleRows
+          .map((row) => row.permissionSlug)
+          .filter((slug): slug is string => slug !== null),
         directRows.map((row) => row.slug),
       ),
     };
@@ -222,7 +274,8 @@ export class RbacRepository {
     const limit = normalizeLimit(filter.limit);
 
     const conditions: SQL[] = [eq(users.isDeleted, false)];
-    if (filter.search) conditions.push(ilike(users.email, `%${filter.search}%`));
+    if (filter.search)
+      conditions.push(ilike(users.email, `%${filter.search}%`));
     const where = and(...conditions)!;
 
     const rows = await this.db
@@ -232,7 +285,10 @@ export class RbacRepository {
       .orderBy(desc(users.createdAt), desc(users.id))
       .limit(limit)
       .offset((page - 1) * limit);
-    const [{ value: total }] = await this.db.select({ value: count() }).from(users).where(where);
+    const [{ value: total }] = await this.db
+      .select({ value: count() })
+      .from(users)
+      .where(where);
 
     // One read for the page's role assignments rather than one per user.
     const assignments = rows.length
@@ -254,7 +310,10 @@ export class RbacRepository {
     }
 
     return {
-      items: rows.map((row) => ({ ...row, roles: (rolesByUser.get(row.id.toString()) ?? []).sort() })),
+      items: rows.map((row) => ({
+        ...row,
+        roles: (rolesByUser.get(row.id.toString()) ?? []).sort(),
+      })),
       meta: buildPageMeta(page, limit, total),
     };
   }
@@ -269,7 +328,11 @@ export class RbacRepository {
       .limit(1);
     if (!row) throw new HttpError(404, `user "${userId}" not found`);
 
-    const roleRows = await this.db.select({ slug: roles.slug }).from(roleUser).innerJoin(roles, eq(roles.id, roleUser.roleId)).where(eq(roleUser.userId, userIdBig));
+    const roleRows = await this.db
+      .select({ slug: roles.slug })
+      .from(roleUser)
+      .innerJoin(roles, eq(roles.id, roleUser.roleId))
+      .where(eq(roleUser.userId, userIdBig));
     return toUserSummary({ ...row, roles: roleRows.map((r) => r.slug).sort() });
   }
 
@@ -290,7 +353,11 @@ export class RbacRepository {
     },
     actorUserId: string | null,
   ): Promise<UserSummary> {
-    const [existing] = await this.db.select({ id: users.id }).from(users).where(eq(users.email, input.email)).limit(1);
+    const [existing] = await this.db
+      .select({ id: users.id })
+      .from(users)
+      .where(eq(users.email, input.email))
+      .limit(1);
     if (existing) throw new HttpError(409, "email already registered");
 
     const [user] = await this.db
@@ -311,7 +378,13 @@ export class RbacRepository {
       const granted = await this.db
         .select({ id: roles.id })
         .from(roles)
-        .where(and(inArray(roles.slug, input.roles), eq(roles.isActive, true), eq(roles.isDeleted, false)));
+        .where(
+          and(
+            inArray(roles.slug, input.roles),
+            eq(roles.isActive, true),
+            eq(roles.isDeleted, false),
+          ),
+        );
       if (granted.length) {
         await this.db
           .insert(roleUser)
@@ -332,7 +405,14 @@ export class RbacRepository {
    */
   async updateUser(
     userId: string,
-    input: { firstName?: string | null; lastName?: string | null; displayName?: string | null; phone?: string | null; username?: string | null; photo?: string | null },
+    input: {
+      firstName?: string | null;
+      lastName?: string | null;
+      displayName?: string | null;
+      phone?: string | null;
+      username?: string | null;
+      photo?: string | null;
+    },
     actorUserId: string | null,
   ): Promise<UserSummary> {
     const userIdBig = toId(userId);
@@ -355,7 +435,11 @@ export class RbacRepository {
    * pattern — the row survives for audit purposes, it just stops appearing in listings and can no
    * longer authenticate (mirrors how `block` already disables login without removing the row).
    */
-  async deleteUser(userId: string, actorUserId: string | null, reason?: string): Promise<void> {
+  async deleteUser(
+    userId: string,
+    actorUserId: string | null,
+    reason?: string,
+  ): Promise<void> {
     const userIdBig = toId(userId);
     const [existing] = await this.db
       .select({ id: users.id })
@@ -366,14 +450,24 @@ export class RbacRepository {
 
     await this.db
       .update(users)
-      .set({ isDeleted: true, deletedAt: new Date(), deletedBy: toIdOrNull(actorUserId), deletedReason: reason ?? null })
+      .set({
+        isDeleted: true,
+        deletedAt: new Date(),
+        deletedBy: toIdOrNull(actorUserId),
+        deletedReason: reason ?? null,
+      })
       .where(eq(users.id, userIdBig));
     await this.cache.invalidateSubject(userId);
   }
 
   async updateRole(
     roleId: string,
-    input: { name?: string; displayName?: string; description?: string | null; isActive?: boolean },
+    input: {
+      name?: string;
+      displayName?: string;
+      description?: string | null;
+      isActive?: boolean;
+    },
     actorUserId: string | null,
   ): Promise<RoleSummary> {
     const roleIdBig = toId(roleId);
@@ -399,7 +493,11 @@ export class RbacRepository {
    * deleted role simply stops being returned by `listRoles`/`resolveAuthzContext`, rather than
    * cascading a delete that would silently strip a user's other roles' foreign keys.
    */
-  async deleteRole(roleId: string, actorUserId: string | null, reason?: string): Promise<void> {
+  async deleteRole(
+    roleId: string,
+    actorUserId: string | null,
+    reason?: string,
+  ): Promise<void> {
     const roleIdBig = toId(roleId);
     const [existing] = await this.db
       .select({ id: roles.id })
@@ -410,7 +508,12 @@ export class RbacRepository {
 
     await this.db
       .update(roles)
-      .set({ isDeleted: true, deletedAt: new Date(), deletedBy: toIdOrNull(actorUserId), deletedReason: reason ?? null })
+      .set({
+        isDeleted: true,
+        deletedAt: new Date(),
+        deletedBy: toIdOrNull(actorUserId),
+        deletedReason: reason ?? null,
+      })
       .where(eq(roles.id, roleIdBig));
     await this.cache.invalidatePolicy();
   }
@@ -423,7 +526,12 @@ export class RbacRepository {
       .select(PERMISSION_COLUMNS)
       .from(permissions)
       .where(eq(permissions.isDeleted, false))
-      .orderBy(asc(permissions.groupOrder), asc(permissions.group), asc(permissions.order), asc(permissions.slug));
+      .orderBy(
+        asc(permissions.groupOrder),
+        asc(permissions.group),
+        asc(permissions.order),
+        asc(permissions.slug),
+      );
     return rows.map(asPermissionSummary);
   }
 
@@ -436,7 +544,10 @@ export class RbacRepository {
    * Upserted on `slug`, which stays the stable identifier grants and revocations use, so renaming
    * `name`/`displayName` never breaks a grant.
    */
-  async upsertPermission(input: PermissionInput, actorUserId: string | null): Promise<PermissionSummary> {
+  async upsertPermission(
+    input: PermissionInput,
+    actorUserId: string | null,
+  ): Promise<PermissionSummary> {
     const actorId = toIdOrNull(actorUserId);
     // Only the fields the caller sent are written; an absent one leaves its column alone, so a
     // partial edit cannot blank out metadata it did not mention.
@@ -467,7 +578,9 @@ export class RbacRepository {
       // returns none — so the no-op case rewrites the slug with itself.
       .onConflictDoUpdate({
         target: permissions.slug,
-        set: Object.keys(changed).length ? { ...changed, updatedBy: actorId } : { slug: input.slug, updatedBy: actorId },
+        set: Object.keys(changed).length
+          ? { ...changed, updatedBy: actorId }
+          : { slug: input.slug, updatedBy: actorId },
       })
       .returning(PERMISSION_COLUMNS);
 
@@ -477,11 +590,23 @@ export class RbacRepository {
   }
 
   async listRoles(): Promise<RoleSummary[]> {
-    const rows = await this.db.select(ROLE_COLUMNS).from(roles).where(eq(roles.isDeleted, false)).orderBy(asc(roles.order), asc(roles.slug));
+    const rows = await this.db
+      .select(ROLE_COLUMNS)
+      .from(roles)
+      .where(eq(roles.isDeleted, false))
+      .orderBy(asc(roles.order), asc(roles.slug));
     return rows.map(asRoleSummary);
   }
 
-  async createRole(input: { slug: string; name?: string; displayName?: string; description?: string | null }, actorUserId: string | null): Promise<RoleSummary> {
+  async createRole(
+    input: {
+      slug: string;
+      name?: string;
+      displayName?: string;
+      description?: string | null;
+    },
+    actorUserId: string | null,
+  ): Promise<RoleSummary> {
     const actorId = toIdOrNull(actorUserId);
     const [role] = await this.db
       .insert(roles)
@@ -503,7 +628,11 @@ export class RbacRepository {
    * closed-catalog property the routes always had — `@CheckAbility` only accepts slugs from
    * `rbac.defaults.ts`, so an invented slug cannot gate anything shipped by this library.
    */
-  async attachPermissionToRole(roleId: string, permissionSlug: string, actorUserId: string | null): Promise<void> {
+  async attachPermissionToRole(
+    roleId: string,
+    permissionSlug: string,
+    actorUserId: string | null,
+  ): Promise<void> {
     const roleIdBig = toId(roleId);
     const [role] = await this.db
       .select({ id: roles.id })
@@ -516,27 +645,46 @@ export class RbacRepository {
     await this.db
       .insert(permissionRole)
       .values({ permissionId: permission.id, roleId: roleIdBig })
-      .onConflictDoNothing({ target: [permissionRole.permissionId, permissionRole.roleId] });
+      .onConflictDoNothing({
+        target: [permissionRole.permissionId, permissionRole.roleId],
+      });
     await this.cache.invalidatePolicy(); // everyone holding this role is affected
   }
 
   async assignRoleToUser(userId: string, roleSlug: string): Promise<void> {
     const userIdBig = toId(userId);
-    const [role] = await this.db.select({ id: roles.id }).from(roles).where(eq(roles.slug, roleSlug)).limit(1);
+    const [role] = await this.db
+      .select({ id: roles.id })
+      .from(roles)
+      .where(eq(roles.slug, roleSlug))
+      .limit(1);
     if (!role) throw new HttpError(404, `role "${roleSlug}" not found`);
 
-    const [user] = await this.db.select({ id: users.id }).from(users).where(eq(users.id, userIdBig)).limit(1);
+    const [user] = await this.db
+      .select({ id: users.id })
+      .from(users)
+      .where(eq(users.id, userIdBig))
+      .limit(1);
     if (!user) throw new HttpError(404, `user "${userId}" not found`);
 
-    await this.db.insert(roleUser).values({ userId: userIdBig, roleId: role.id }).onConflictDoNothing({ target: [roleUser.userId, roleUser.roleId] });
+    await this.db
+      .insert(roleUser)
+      .values({ userId: userIdBig, roleId: role.id })
+      .onConflictDoNothing({ target: [roleUser.userId, roleUser.roleId] });
     await this.cache.invalidateSubject(userId);
   }
 
   async revokeRoleFromUser(userId: string, roleSlug: string): Promise<void> {
     const userIdBig = toId(userId);
-    const [role] = await this.db.select({ id: roles.id }).from(roles).where(eq(roles.slug, roleSlug)).limit(1);
+    const [role] = await this.db
+      .select({ id: roles.id })
+      .from(roles)
+      .where(eq(roles.slug, roleSlug))
+      .limit(1);
     if (!role) return;
-    await this.db.delete(roleUser).where(and(eq(roleUser.userId, userIdBig), eq(roleUser.roleId, role.id)));
+    await this.db
+      .delete(roleUser)
+      .where(and(eq(roleUser.userId, userIdBig), eq(roleUser.roleId, role.id)));
     await this.cache.invalidateSubject(userId);
   }
 
@@ -552,7 +700,13 @@ export class RbacRepository {
     const defaults = await this.db
       .select({ id: roles.id })
       .from(roles)
-      .where(and(eq(roles.isDefault, true), eq(roles.isActive, true), eq(roles.isDeleted, false)));
+      .where(
+        and(
+          eq(roles.isDefault, true),
+          eq(roles.isActive, true),
+          eq(roles.isDeleted, false),
+        ),
+      );
     if (!defaults.length) return;
     await this.db
       .insert(roleUser)
@@ -562,25 +716,48 @@ export class RbacRepository {
   }
 
   async hasAnyRole(userId: bigint): Promise<boolean> {
-    const [row] = await this.db.select({ value: count() }).from(roleUser).where(eq(roleUser.userId, userId));
+    const [row] = await this.db
+      .select({ value: count() })
+      .from(roleUser)
+      .where(eq(roleUser.userId, userId));
     return (row?.value ?? 0) > 0;
   }
 
-  async grantPermissionToUser(userId: string, permissionSlug: string, actorUserId: string | null): Promise<void> {
+  async grantPermissionToUser(
+    userId: string,
+    permissionSlug: string,
+    actorUserId: string | null,
+  ): Promise<void> {
     const userIdBig = toId(userId);
     const permission = await this.ensurePermission(permissionSlug, actorUserId);
     await this.db
       .insert(permissionUser)
       .values({ userId: userIdBig, permissionId: permission.id })
-      .onConflictDoNothing({ target: [permissionUser.userId, permissionUser.permissionId] });
+      .onConflictDoNothing({
+        target: [permissionUser.userId, permissionUser.permissionId],
+      });
     await this.cache.invalidateSubject(userId);
   }
 
-  async revokePermissionFromUser(userId: string, permissionSlug: string): Promise<void> {
+  async revokePermissionFromUser(
+    userId: string,
+    permissionSlug: string,
+  ): Promise<void> {
     const userIdBig = toId(userId);
-    const [permission] = await this.db.select({ id: permissions.id }).from(permissions).where(eq(permissions.slug, permissionSlug)).limit(1);
+    const [permission] = await this.db
+      .select({ id: permissions.id })
+      .from(permissions)
+      .where(eq(permissions.slug, permissionSlug))
+      .limit(1);
     if (!permission) return;
-    await this.db.delete(permissionUser).where(and(eq(permissionUser.userId, userIdBig), eq(permissionUser.permissionId, permission.id)));
+    await this.db
+      .delete(permissionUser)
+      .where(
+        and(
+          eq(permissionUser.userId, userIdBig),
+          eq(permissionUser.permissionId, permission.id),
+        ),
+      );
     await this.cache.invalidateSubject(userId);
   }
 
@@ -593,13 +770,27 @@ export class RbacRepository {
    * Creates the row for a slug granted before anyone defined it; leaves an existing definition
    * alone. Returns bigint directly: both callers feed the id straight into another database call.
    */
-  private async ensurePermission(slug: string, actorUserId: string | null): Promise<{ id: bigint }> {
-    const [existing] = await this.db.select({ id: permissions.id }).from(permissions).where(eq(permissions.slug, slug)).limit(1);
+  private async ensurePermission(
+    slug: string,
+    actorUserId: string | null,
+  ): Promise<{ id: bigint }> {
+    const [existing] = await this.db
+      .select({ id: permissions.id })
+      .from(permissions)
+      .where(eq(permissions.slug, slug))
+      .limit(1);
     if (existing) return existing;
     const actorId = toIdOrNull(actorUserId);
     const [created] = await this.db
       .insert(permissions)
-      .values({ slug, name: slug, displayName: slug, group: "Custom", createdBy: actorId, updatedBy: actorId })
+      .values({
+        slug,
+        name: slug,
+        displayName: slug,
+        group: "Custom",
+        createdBy: actorId,
+        updatedBy: actorId,
+      })
       .returning({ id: permissions.id });
     return created;
   }