@simple-auth-kit/cli 1.4.2 → 1.5.0

package/registry/combos/nestjs-drizzle/variants/workspaces/src/{workspace.controller.ts → controllers/workspace.controller.ts}

@@ -1,29 +1,60 @@
-import { BadRequestException, Body, Controller, Delete, ForbiddenException, Get, Inject, Param, Post, Put, Req, UseGuards } from "@nestjs/common";
-import { ApiBearerAuth, ApiBody, ApiHeader, ApiOperation, ApiParam, ApiResponse, ApiTags } from "@nestjs/swagger";
+import {
+  BadRequestException,
+  Body,
+  Controller,
+  Delete,
+  ForbiddenException,
+  Get,
+  Inject,
+  Param,
+  Post,
+  Put,
+  Req,
+  UseGuards,
+} from "@nestjs/common";
+import {
+  ApiBearerAuth,
+  ApiBody,
+  ApiHeader,
+  ApiOperation,
+  ApiParam,
+  ApiResponse,
+  ApiTags,
+} from "@nestjs/swagger";
 import type { Request } from "express";
-import { AbilityGuard } from "./ability.guard.js";
-import { AuthGuard } from "./auth.guard.js";
-import { WORKSPACE_HEADER, WorkspaceGuard } from "./authz.guard.js";
-import { Authenticated, CheckAbility } from "./route-tiers.js";
-import { OkResponseDto } from "./dto/auth.dto.js";
-import { AddMemberDto, CreateWorkspaceDto, MemberRolesResponseDto, MembershipSummaryDto, SetMemberRolesDto, WorkspaceSummaryDto } from "./dto/workspace.dto.js";
-import { RbacRepository } from "./rbac.repository.js";
-import { WorkspaceRepository } from "./workspace.repository.js";
+import { AbilityGuard } from "../guards/ability.guard.js";
+import { AuthGuard } from "../guards/auth.guard.js";
+import { WORKSPACE_HEADER, WorkspaceGuard } from "../guards/authz.guard.js";
+import { Authenticated, CheckAbility } from "../route-tiers.js";
+import { OkResponseDto } from "../dto/auth.dto.js";
+import {
+  AddMemberDto,
+  CreateWorkspaceDto,
+  MemberRolesResponseDto,
+  MembershipSummaryDto,
+  SetMemberRolesDto,
+  WorkspaceSummaryDto,
+} from "../dto/workspace.dto.js";
+import { RbacRepository } from "../repositories/rbac.repository.js";
+import { WorkspaceRepository } from "../repositories/workspace.repository.js";
 
 function requireString(value: unknown, field: string): string {
-  if (typeof value !== "string" || value.length === 0) throw new BadRequestException(`${field} is required`);
+  if (typeof value !== "string" || value.length === 0)
+    throw new BadRequestException(`${field} is required`);
   return value;
 }
 
 function requireStringArray(value: unknown, field: string): string[] {
-  if (!Array.isArray(value) || value.some((v) => typeof v !== "string")) throw new BadRequestException(`${field} must be an array of strings`);
+  if (!Array.isArray(value) || value.some((v) => typeof v !== "string"))
+    throw new BadRequestException(`${field} must be an array of strings`);
   return value as string[];
 }
 
 const WORKSPACE_HEADER_DOC = {
   name: WORKSPACE_HEADER,
   required: true,
-  description: "The workspace this request acts in. The caller must be a member of it.",
+  description:
+    "The workspace this request acts in. The caller must be a member of it.",
 };
 
 /**
@@ -48,24 +79,34 @@ const WORKSPACE_HEADER_DOC = {
 @ApiBearerAuth()
 export class WorkspaceController {
   constructor(
-    @Inject(WorkspaceRepository) private readonly workspaces: WorkspaceRepository,
+    @Inject(WorkspaceRepository)
+    private readonly workspaces: WorkspaceRepository,
     @Inject(RbacRepository) private readonly rbac: RbacRepository,
   ) {}
 
   @Post()
   @Authenticated()
   @UseGuards(AuthGuard)
-  @ApiOperation({ summary: "Create a workspace", description: "The creator becomes its first member, with the admin role." })
+  @ApiOperation({
+    summary: "Create a workspace",
+    description: "The creator becomes its first member, with the admin role.",
+  })
   @ApiBody({ type: CreateWorkspaceDto })
   @ApiResponse({ status: 201, type: WorkspaceSummaryDto })
   async create(@Body() body: Record<string, unknown>, @Req() req: Request) {
-    return this.workspaces.create(req.auth!.sub, requireString(body.name, "name"));
+    return this.workspaces.create(
+      req.auth!.sub,
+      requireString(body.name, "name"),
+    );
   }
 
   @Get()
   @Authenticated()
   @UseGuards(AuthGuard)
-  @ApiOperation({ summary: "List the workspaces the current user belongs to, with their roles in each" })
+  @ApiOperation({
+    summary:
+      "List the workspaces the current user belongs to, with their roles in each",
+  })
   @ApiResponse({ status: 200, type: [WorkspaceSummaryDto] })
   async listMine(@Req() req: Request) {
     return this.workspaces.listForUser(req.auth!.sub);
@@ -85,38 +126,64 @@ export class WorkspaceController {
   @UseGuards(AuthGuard, WorkspaceGuard, AbilityGuard)
   @CheckAbility("members:manage")
   @ApiHeader(WORKSPACE_HEADER_DOC)
-  @ApiOperation({ summary: "[admin] Add an existing user to the named workspace" })
+  @ApiOperation({
+    summary: "[admin] Add an existing user to the named workspace",
+  })
   @ApiBody({ type: AddMemberDto })
   @ApiResponse({ status: 201, type: MembershipSummaryDto })
   async addMember(@Body() body: Record<string, unknown>, @Req() req: Request) {
     // No `roles` in the body means "whatever this workspace flags as the default role" — the
     // default lives in a row, not in this line.
-    const roles = body.roles === undefined ? undefined : requireStringArray(body.roles, "roles");
-    return this.workspaces.addMember(req.authz!.workspaceId, requireString(body.email, "email"), roles);
+    const roles =
+      body.roles === undefined
+        ? undefined
+        : requireStringArray(body.roles, "roles");
+    return this.workspaces.addMember(
+      req.authz!.workspaceId,
+      requireString(body.email, "email"),
+      roles,
+    );
   }
 
   @Put("members/:memberId/roles")
   @UseGuards(AuthGuard, WorkspaceGuard, AbilityGuard)
   @CheckAbility("roles:assign")
   @ApiHeader(WORKSPACE_HEADER_DOC)
-  @ApiOperation({ summary: "[admin] Replace a member's roles within the named workspace" })
+  @ApiOperation({
+    summary: "[admin] Replace a member's roles within the named workspace",
+  })
   @ApiParam({ name: "memberId" })
   @ApiBody({ type: SetMemberRolesDto })
   @ApiResponse({ status: 200, type: MemberRolesResponseDto })
-  async setMemberRoles(@Param("memberId") memberId: string, @Body() body: Record<string, unknown>, @Req() req: Request) {
-    if (memberId === req.authz!.memberId) throw new ForbiddenException("cannot change your own roles");
-    return this.rbac.setMemberRoles(req.authz!.workspaceId, memberId, requireStringArray(body.roles, "roles"));
+  async setMemberRoles(
+    @Param("memberId") memberId: string,
+    @Body() body: Record<string, unknown>,
+    @Req() req: Request,
+  ) {
+    if (memberId === req.authz!.memberId)
+      throw new ForbiddenException("cannot change your own roles");
+    return this.rbac.setMemberRoles(
+      req.authz!.workspaceId,
+      memberId,
+      requireStringArray(body.roles, "roles"),
+    );
   }
 
   @Delete("members/:memberId")
   @UseGuards(AuthGuard, WorkspaceGuard, AbilityGuard)
   @CheckAbility("members:manage")
   @ApiHeader(WORKSPACE_HEADER_DOC)
-  @ApiOperation({ summary: "[admin] Remove a member from the named workspace", description: "Their direct permission grants go with the membership." })
+  @ApiOperation({
+    summary: "[admin] Remove a member from the named workspace",
+    description: "Their direct permission grants go with the membership.",
+  })
   @ApiParam({ name: "memberId" })
   @ApiResponse({ status: 200, type: OkResponseDto })
   async removeMember(@Param("memberId") memberId: string, @Req() req: Request) {
-    if (memberId === req.authz!.memberId) throw new ForbiddenException("cannot remove yourself from a workspace you administer");
+    if (memberId === req.authz!.memberId)
+      throw new ForbiddenException(
+        "cannot remove yourself from a workspace you administer",
+      );
     await this.workspaces.removeMember(req.authz!.workspaceId, memberId);
     return { ok: true };
   }

package/registry/combos/nestjs-drizzle/variants/workspaces/src/{authz.guard.ts → guards/authz.guard.ts}

@@ -1,7 +1,16 @@
-import { CanActivate, ExecutionContext, ForbiddenException, Inject, Injectable } from "@nestjs/common";
-import { defineAbilitiesFor } from "./ability.js";
-import { PermissionCache } from "./permission-cache.js";
-import { memberCacheKey, RbacRepository } from "./rbac.repository.js";
+import {
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  Inject,
+  Injectable,
+} from "@nestjs/common";
+import { defineAbilitiesFor } from "../ability.js";
+import { PermissionCache } from "../permission-cache.js";
+import {
+  memberCacheKey,
+  RbacRepository,
+} from "../repositories/rbac.repository.js";
 
 export const WORKSPACE_HEADER = "x-workspace-id";
 
@@ -34,15 +43,23 @@ export interface AuthzContext {
  * Idempotent: a route may legitimately sit behind both guards, and resolving twice would double
  * the hot path's query count for no gain.
  */
-async function resolve(rbac: RbacRepository, cache: PermissionCache, context: ExecutionContext): Promise<void> {
+async function resolve(
+  rbac: RbacRepository,
+  cache: PermissionCache,
+  context: ExecutionContext,
+): Promise<void> {
   const req = context.switchToHttp().getRequest();
   if (req.authz) return;
 
   const workspaceId = req.headers[WORKSPACE_HEADER];
-  if (!req.auth || typeof workspaceId !== "string" || workspaceId.length === 0) return;
+  if (!req.auth || typeof workspaceId !== "string" || workspaceId.length === 0)
+    return;
 
   const userId = req.auth.sub as string;
-  const authz = await cache.resolve<AuthzContext>(memberCacheKey(userId, workspaceId), () => rbac.resolveAuthzContext(userId, workspaceId));
+  const authz = await cache.resolve<AuthzContext>(
+    memberCacheKey(userId, workspaceId),
+    () => rbac.resolveAuthzContext(userId, workspaceId),
+  );
   // Deliberately the same answer for "no such workspace" and "not your workspace": a caller
   // outside a workspace must not be able to probe whether it exists.
   if (!authz) throw new ForbiddenException("not a member of this workspace");
@@ -81,7 +98,8 @@ export class WorkspaceGuard implements CanActivate {
   async canActivate(context: ExecutionContext): Promise<boolean> {
     await resolve(this.rbac, this.cache, context);
     const req = context.switchToHttp().getRequest();
-    if (!req.authz) throw new ForbiddenException(`${WORKSPACE_HEADER} header is required`);
+    if (!req.authz)
+      throw new ForbiddenException(`${WORKSPACE_HEADER} header is required`);
     return true;
   }
 }

package/registry/combos/nestjs-drizzle/variants/workspaces/src/{audit-log.repository.ts → repositories/audit-log.repository.ts}

@@ -1,10 +1,15 @@
 import { Inject, Injectable } from "@nestjs/common";
 import { and, count, desc, eq, gte, lte, type SQL } from "drizzle-orm";
 import type { AuditEvent } from "@/lib/auth/core/types.js";
-import { DRIZZLE_DB, type Database } from "./db.js";
-import { buildPageMeta, normalizeLimit, normalizePage, type Paginated } from "./pagination.js";
-import { auditLogs } from "./schema.js";
-import { toIdOrNull, toIdOrUndefined } from "./id.helper.js";
+import { DRIZZLE_DB, type Database } from "../db.js";
+import {
+  buildPageMeta,
+  normalizeLimit,
+  normalizePage,
+  type Paginated,
+} from "../pagination.js";
+import { auditLogs } from "../schema.js";
+import { toIdOrNull, toIdOrUndefined } from "../id.helper.js";
 
 export interface AuditLogEntry {
   id: string;
@@ -50,7 +55,10 @@ export function toAuditLogEntry(row: AuditLogRow): AuditLogEntry {
 /** "role_assigned" -> "Role assigned". Derived rather than passed in, so core never has to carry display text. */
 export function humanizeAction(action: string): string {
   const words = action.split("_");
-  return [words[0].charAt(0).toUpperCase() + words[0].slice(1), ...words.slice(1)].join(" ");
+  return [
+    words[0].charAt(0).toUpperCase() + words[0].slice(1),
+    ...words.slice(1),
+  ].join(" ");
 }
 
 @Injectable()
@@ -62,7 +70,10 @@ export class AuditLogRepository {
    * those happen to a user, not inside a workspace. Callers that *are* acting in a workspace
    * pass it, which is what scopes the admin audit-log read below.
    */
-  async append(event: AuditEvent, opts: { workspaceId?: string; remarks?: string } = {}): Promise<void> {
+  async append(
+    event: AuditEvent,
+    opts: { workspaceId?: string; remarks?: string } = {},
+  ): Promise<void> {
     await this.db.insert(auditLogs).values({
       action: event.type,
       name: humanizeAction(event.type),
@@ -80,12 +91,16 @@ export class AuditLogRepository {
 
     const conditions: SQL[] = [];
     const workspaceIdBig = toIdOrUndefined(filter.workspaceId);
-    if (workspaceIdBig !== undefined) conditions.push(eq(auditLogs.workspaceId, workspaceIdBig));
+    if (workspaceIdBig !== undefined)
+      conditions.push(eq(auditLogs.workspaceId, workspaceIdBig));
     const userIdBig = toIdOrUndefined(filter.userId);
-    if (userIdBig !== undefined) conditions.push(eq(auditLogs.userId, userIdBig));
+    if (userIdBig !== undefined)
+      conditions.push(eq(auditLogs.userId, userIdBig));
     if (filter.action) conditions.push(eq(auditLogs.action, filter.action));
-    if (filter.since) conditions.push(gte(auditLogs.createdAt, new Date(filter.since)));
-    if (filter.until) conditions.push(lte(auditLogs.createdAt, new Date(filter.until)));
+    if (filter.since)
+      conditions.push(gte(auditLogs.createdAt, new Date(filter.since)));
+    if (filter.until)
+      conditions.push(lte(auditLogs.createdAt, new Date(filter.until)));
     const where = conditions.length ? and(...conditions) : undefined;
 
     const rows = await this.db
@@ -95,7 +110,10 @@ export class AuditLogRepository {
       .orderBy(desc(auditLogs.createdAt), desc(auditLogs.id))
       .limit(limit)
       .offset((page - 1) * limit);
-    const [{ value: total }] = await this.db.select({ value: count() }).from(auditLogs).where(where);
+    const [{ value: total }] = await this.db
+      .select({ value: count() })
+      .from(auditLogs)
+      .where(where);
 
     return { items: rows, meta: buildPageMeta(page, limit, total) };
   }