@simple-auth-kit/cli 1.4.2 → 1.5.0

package/registry/combos/nestjs-prisma/shared/src/{auth.controller.ts → controllers/auth.controller.ts}

@@ -27,11 +27,11 @@ import {
   AUTH_CONFIG,
   AuthConfig,
   defaultThrottleBuckets,
-} from "./auth.config.js";
-import { AuthGuard } from "./auth.guard.js";
-import { AuthService } from "./auth.service.js";
-import { AuthzGuard } from "./authz.guard.js";
-import { Authenticated, Public } from "./route-tiers.js";
+} from "../auth.config.js";
+import { AuthGuard } from "../guards/auth.guard.js";
+import { AuthService } from "../services/auth.service.js";
+import { AuthzGuard } from "../guards/authz.guard.js";
+import { Authenticated, Public } from "../route-tiers.js";
 import {
   AuthTokensDto,
   ChangePasswordDto,
@@ -51,7 +51,7 @@ import {
   SignupDto,
   TwoFactorCodeDto,
   UpdateUserDto,
-} from "./dto/auth.dto.js";
+} from "../dto/auth.dto.js";
 
 function requireString(value: unknown, field: string): string {
   if (typeof value !== "string" || value.length === 0)

package/registry/combos/nestjs-prisma/shared/src/{auth-core-error.filter.ts → filters/auth-core-error.filter.ts}

@@ -1,4 +1,10 @@
-import { ArgumentsHost, Catch, ExceptionFilter, HttpException, HttpStatus } from "@nestjs/common";
+import {
+  ArgumentsHost,
+  Catch,
+  ExceptionFilter,
+  HttpException,
+  HttpStatus,
+} from "@nestjs/common";
 import { AuthCoreError } from "@/lib/auth/core/types.js";
 
 /**
@@ -14,19 +20,37 @@ export class AuthCoreErrorFilter implements ExceptionFilter {
     const res = host.switchToHttp().getResponse();
 
     if (exception instanceof AuthCoreError) {
-      res.status(HttpStatus.UNAUTHORIZED).json({ success: false, statusCode: HttpStatus.UNAUTHORIZED, code: exception.code, message: exception.message });
+      res
+        .status(HttpStatus.UNAUTHORIZED)
+        .json({
+          success: false,
+          statusCode: HttpStatus.UNAUTHORIZED,
+          code: exception.code,
+          message: exception.message,
+        });
       return;
     }
 
     if (exception instanceof HttpException) {
       const status = exception.getStatus();
       const body = exception.getResponse();
-      const shaped = typeof body === "string" ? { message: body } : (body as Record<string, unknown>);
-      res.status(status).json({ success: false, statusCode: status, ...shaped });
+      const shaped =
+        typeof body === "string"
+          ? { message: body }
+          : (body as Record<string, unknown>);
+      res
+        .status(status)
+        .json({ success: false, statusCode: status, ...shaped });
       return;
     }
 
     // Anything not thrown deliberately — don't leak internals in the response.
-    res.status(HttpStatus.INTERNAL_SERVER_ERROR).json({ success: false, statusCode: HttpStatus.INTERNAL_SERVER_ERROR, message: "internal server error" });
+    res
+      .status(HttpStatus.INTERNAL_SERVER_ERROR)
+      .json({
+        success: false,
+        statusCode: HttpStatus.INTERNAL_SERVER_ERROR,
+        message: "internal server error",
+      });
   }
 }

package/registry/combos/nestjs-prisma/shared/src/{ability.guard.ts → guards/ability.guard.ts}

@@ -1,7 +1,13 @@
-import { CanActivate, ExecutionContext, ForbiddenException, Inject, Injectable } from "@nestjs/common";
+import {
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  Inject,
+  Injectable,
+} from "@nestjs/common";
 import { Reflector } from "@nestjs/core";
-import { ABILITY_SUBJECT } from "./ability.js";
-import { CHECK_ABILITY_KEY } from "./route-tiers.js";
+import { ABILITY_SUBJECT } from "../ability.js";
+import { CHECK_ABILITY_KEY } from "../route-tiers.js";
 
 // The authorization boundary for tier-3 routes — no role-based bypass beside it, so a role
 // carrying no permissions confers no authority. Fail-closed: no ability, a missing slug, or a
@@ -13,16 +19,23 @@ export class AbilityGuard implements CanActivate {
   constructor(@Inject(Reflector) private readonly reflector: Reflector) {}
 
   canActivate(context: ExecutionContext): boolean {
-    const required = this.reflector.getAllAndOverride<string[] | undefined>(CHECK_ABILITY_KEY, [context.getHandler(), context.getClass()]);
+    const required = this.reflector.getAllAndOverride<string[] | undefined>(
+      CHECK_ABILITY_KEY,
+      [context.getHandler(), context.getClass()],
+    );
     if (!required?.length) {
-      throw new Error(`${context.getClass().name}.${context.getHandler().name} is guarded by AbilityGuard but declares no @CheckAbility`);
+      throw new Error(
+        `${context.getClass().name}.${context.getHandler().name} is guarded by AbilityGuard but declares no @CheckAbility`,
+      );
     }
 
     const ability = context.switchToHttp().getRequest().ability;
-    if (!ability) throw new ForbiddenException("no authorization context for this request");
+    if (!ability)
+      throw new ForbiddenException("no authorization context for this request");
 
     for (const permission of required) {
-      if (!ability.can(permission, ABILITY_SUBJECT)) throw new ForbiddenException(`missing permission: ${permission}`);
+      if (!ability.can(permission, ABILITY_SUBJECT))
+        throw new ForbiddenException(`missing permission: ${permission}`);
     }
     return true;
   }

package/registry/combos/nestjs-prisma/shared/src/{auth.guard.ts → guards/auth.guard.ts}

@@ -1,8 +1,14 @@
-import { CanActivate, ExecutionContext, Inject, Injectable, UnauthorizedException } from "@nestjs/common";
+import {
+  CanActivate,
+  ExecutionContext,
+  Inject,
+  Injectable,
+  UnauthorizedException,
+} from "@nestjs/common";
 import { verifyAccessToken } from "@/lib/auth/core/token-service.js";
-import { KeyProviderService } from "./key-provider.js";
-import "./request-context.js";
-import { SessionRepository } from "./session.repository.js";
+import { KeyProviderService } from "../key-provider.js";
+import "../request-context.js";
+import { SessionRepository } from "../repositories/session.repository.js";
 
 // Authentication only — proves who the caller is and populates `req.auth`. Pair with
 // `AuthzGuard` on any route that checks roles or permissions.
@@ -16,15 +22,21 @@ export class AuthGuard implements CanActivate {
   async canActivate(context: ExecutionContext): Promise<boolean> {
     const req = context.switchToHttp().getRequest();
     const header: string | undefined = req.headers["authorization"];
-    if (!header?.startsWith("Bearer ")) throw new UnauthorizedException("missing bearer token");
+    if (!header?.startsWith("Bearer "))
+      throw new UnauthorizedException("missing bearer token");
 
     try {
       req.auth = await verifyAccessToken(
-        { secret: this.keys.secret, isDenylisted: (jti) => this.sessions.isDenylisted(jti) },
+        {
+          secret: this.keys.secret,
+          isDenylisted: (jti) => this.sessions.isDenylisted(jti),
+        },
         header.slice("Bearer ".length),
       );
     } catch (err) {
-      throw new UnauthorizedException(err instanceof Error ? err.message : "invalid access token");
+      throw new UnauthorizedException(
+        err instanceof Error ? err.message : "invalid access token",
+      );
     }
     return true;
   }

package/registry/combos/{nestjs-drizzle/shared/src → nestjs-prisma/shared/src/interceptors}/response.interceptor.ts

@@ -1,4 +1,9 @@
-import { CallHandler, ExecutionContext, Injectable, NestInterceptor } from "@nestjs/common";
+import {
+  CallHandler,
+  ExecutionContext,
+  Injectable,
+  NestInterceptor,
+} from "@nestjs/common";
 import { Observable, map } from "rxjs";
 import type { Request, Response } from "express";
 
@@ -32,7 +37,10 @@ function deriveMessage(method: string): string {
 
 @Injectable()
 export class ResponseInterceptor<T> implements NestInterceptor<T, Envelope<T>> {
-  intercept(context: ExecutionContext, next: CallHandler<T>): Observable<Envelope<T>> {
+  intercept(
+    context: ExecutionContext,
+    next: CallHandler<T>,
+  ): Observable<Envelope<T>> {
     const http = context.switchToHttp();
     const req = http.getRequest<Request>();
     const res = http.getResponse<Response>();

package/registry/combos/nestjs-prisma/shared/src/{oauth.repository.ts → repositories/oauth.repository.ts}

@@ -1,21 +1,31 @@
 import { BadRequestException, Inject, Injectable } from "@nestjs/common";
 import type { OAuthStoreDeps } from "@/lib/auth/core/oauth.js";
-import { PrismaClient } from "../generated/prisma/client.js";
-import { toId } from "./id.helper.js";
+import { PrismaClient } from "../../generated/prisma/client.js";
+import { toId } from "../id.helper.js";
 
 @Injectable()
 export class OAuthRepository implements OAuthStoreDeps {
   constructor(@Inject(PrismaClient) private readonly prisma: PrismaClient) {}
 
-  async findAccountByProvider(provider: string, providerAccountId: string): Promise<{ userId: string } | null> {
+  async findAccountByProvider(
+    provider: string,
+    providerAccountId: string,
+  ): Promise<{ userId: string } | null> {
     const row = await this.prisma.oAuthAccount.findUnique({
       where: { provider_providerAccountId: { provider, providerAccountId } },
     });
     return row ? { userId: row.userId.toString() } : null;
   }
 
-  async linkAccount(input: { userId: string; provider: string; providerAccountId: string; email?: string }): Promise<void> {
-    await this.prisma.oAuthAccount.create({ data: { ...input, userId: toId(input.userId) } });
+  async linkAccount(input: {
+    userId: string;
+    provider: string;
+    providerAccountId: string;
+    email?: string;
+  }): Promise<void> {
+    await this.prisma.oAuthAccount.create({
+      data: { ...input, userId: toId(input.userId) },
+    });
   }
 
   async findUserByVerifiedEmail(email: string): Promise<{ id: string } | null> {
@@ -24,9 +34,16 @@ export class OAuthRepository implements OAuthStoreDeps {
   }
 
   // OAuth-only signup: no password is set, which is why `User.passwordHash` is nullable.
-  async createUserFromOAuth(input: { email?: string }): Promise<{ id: string }> {
-    if (!input.email) throw new BadRequestException("OAuth provider did not return an email address");
-    const row = await this.prisma.user.create({ data: { email: input.email, passwordHash: null } });
+  async createUserFromOAuth(input: {
+    email?: string;
+  }): Promise<{ id: string }> {
+    if (!input.email)
+      throw new BadRequestException(
+        "OAuth provider did not return an email address",
+      );
+    const row = await this.prisma.user.create({
+      data: { email: input.email, passwordHash: null },
+    });
     return { id: row.id.toString() };
   }
 }

package/registry/combos/nestjs-prisma/shared/src/repositories/password-reset.repository.ts

@@ -0,0 +1,55 @@
+import { Inject, Injectable } from "@nestjs/common";
+import type { PasswordResetStoreDeps } from "@/lib/auth/core/password-reset.js";
+import { PrismaClient } from "../../generated/prisma/client.js";
+import { toId } from "../id.helper.js";
+
+@Injectable()
+export class PasswordResetRepository implements PasswordResetStoreDeps {
+  constructor(@Inject(PrismaClient) private readonly prisma: PrismaClient) {}
+
+  async saveResetToken(input: {
+    userId: string;
+    tokenHash: string;
+    expiresAt: string;
+  }): Promise<void> {
+    await this.prisma.passwordResetToken.create({
+      data: {
+        userId: toId(input.userId),
+        tokenHash: input.tokenHash,
+        expiresAt: new Date(input.expiresAt),
+      },
+    });
+  }
+
+  async findValidResetToken(
+    tokenHash: string,
+  ): Promise<{
+    userId: string;
+    expiresAt: string;
+    consumedAt: string | null;
+  } | null> {
+    const row = await this.prisma.passwordResetToken.findUnique({
+      where: { tokenHash },
+    });
+    if (!row) return null;
+    return {
+      userId: row.userId.toString(),
+      expiresAt: row.expiresAt.toISOString(),
+      consumedAt: row.consumedAt?.toISOString() ?? null,
+    };
+  }
+
+  async consumeResetToken(tokenHash: string): Promise<void> {
+    await this.prisma.passwordResetToken.update({
+      where: { tokenHash },
+      data: { consumedAt: new Date() },
+    });
+  }
+
+  async setPasswordHash(userId: string, passwordHash: string): Promise<void> {
+    await this.prisma.user.update({
+      where: { id: toId(userId) },
+      data: { passwordHash },
+    });
+  }
+}

package/registry/combos/nestjs-prisma/shared/src/{session.repository.ts → repositories/session.repository.ts}

@@ -1,11 +1,15 @@
 import { randomUUID } from "node:crypto";
 import { Inject, Injectable } from "@nestjs/common";
 import type { SessionStoreDeps } from "@/lib/auth/core/session-policy.js";
-import type { AuditEvent, Revoker, SessionRecord } from "@/lib/auth/core/types.js";
-import { PrismaClient } from "../generated/prisma/client.js";
-import { AUTH_CONFIG, AuthConfig } from "./auth.config.js";
+import type {
+  AuditEvent,
+  Revoker,
+  SessionRecord,
+} from "@/lib/auth/core/types.js";
+import { PrismaClient } from "../../generated/prisma/client.js";
+import { AUTH_CONFIG, AuthConfig } from "../auth.config.js";
 import { AuditLogRepository } from "./audit-log.repository.js";
-import { toId, toIdOrNull } from "./id.helper.js";
+import { toId, toIdOrNull } from "../id.helper.js";
 
 function toSessionRecord(row: {
   id: bigint;
@@ -60,7 +64,9 @@ export class SessionRepository implements SessionStoreDeps {
   }
 
   async findSession(id: string): Promise<SessionRecord | null> {
-    const row = await this.prisma.session.findUnique({ where: { id: toId(id) } });
+    const row = await this.prisma.session.findUnique({
+      where: { id: toId(id) },
+    });
     return row ? toSessionRecord(row) : null;
   }
 
@@ -82,7 +88,12 @@ export class SessionRepository implements SessionStoreDeps {
 
   // expiresAt is set once here and never rewritten — an absolute cap, not a sliding window.
   // `id` is no longer client-supplied — the bigint PK auto-increments.
-  async createSession(input: { userId: string; userAgent?: string; ip?: string; provider?: string }): Promise<SessionRecord> {
+  async createSession(input: {
+    userId: string;
+    userAgent?: string;
+    ip?: string;
+    provider?: string;
+  }): Promise<SessionRecord> {
     const userIdBig = toId(input.userId);
     const row = await this.prisma.session.create({
       data: {
@@ -105,9 +116,17 @@ export class SessionRepository implements SessionStoreDeps {
     });
   }
 
-  async revokeAllByUserExcept(userId: string, keepSessionId: string, revoker?: Revoker): Promise<void> {
+  async revokeAllByUserExcept(
+    userId: string,
+    keepSessionId: string,
+    revoker?: Revoker,
+  ): Promise<void> {
     await this.prisma.session.updateMany({
-      where: { userId: toId(userId), id: { not: toId(keepSessionId) }, revokedAt: null },
+      where: {
+        userId: toId(userId),
+        id: { not: toId(keepSessionId) },
+        revokedAt: null,
+      },
       data: { ...revocationFields(revoker), sessionVersion: { increment: 1 } },
     });
   }
@@ -121,7 +140,9 @@ export class SessionRepository implements SessionStoreDeps {
   }
 
   async isDenylisted(jti: string): Promise<boolean> {
-    const row = await this.prisma.denylistedAccessToken.findUnique({ where: { jti } });
+    const row = await this.prisma.denylistedAccessToken.findUnique({
+      where: { jti },
+    });
     if (!row) return false;
     if (row.expiresAt.getTime() < Date.now()) return false; // expired; a cleanup job reaps these, see Phase 6
     return true;

package/registry/combos/nestjs-prisma/shared/src/{two-factor.repository.ts → repositories/two-factor.repository.ts}

@@ -1,6 +1,6 @@
 import { Inject, Injectable } from "@nestjs/common";
 import { verifyBackupCode } from "@/lib/auth/core/two-factor.js";
-import { PrismaClient } from "../generated/prisma/client.js";
+import { PrismaClient } from "../../generated/prisma/client.js";
 
 // Takes bigint directly, not string: every caller already has the user row's id in hand from
 // its own Prisma lookup, so there's nothing to parse here.
@@ -11,15 +11,22 @@ export class TwoFactorRepository {
   /** Replaces any prior set — re-confirming enrollment invalidates old backup codes. */
   async saveBackupCodes(userId: bigint, hashes: string[]): Promise<void> {
     await this.prisma.twoFactorBackupCode.deleteMany({ where: { userId } });
-    await this.prisma.twoFactorBackupCode.createMany({ data: hashes.map((codeHash) => ({ userId, codeHash })) });
+    await this.prisma.twoFactorBackupCode.createMany({
+      data: hashes.map((codeHash) => ({ userId, codeHash })),
+    });
   }
 
   async consumeBackupCode(userId: bigint, code: string): Promise<boolean> {
-    const unused = await this.prisma.twoFactorBackupCode.findMany({ where: { userId, usedAt: null } });
+    const unused = await this.prisma.twoFactorBackupCode.findMany({
+      where: { userId, usedAt: null },
+    });
     const match = unused.find((row) => verifyBackupCode(code, row.codeHash));
     if (!match) return false;
 
-    await this.prisma.twoFactorBackupCode.update({ where: { id: match.id }, data: { usedAt: new Date() } });
+    await this.prisma.twoFactorBackupCode.update({
+      where: { id: match.id },
+      data: { usedAt: new Date() },
+    });
     return true;
   }
 

package/registry/combos/nestjs-prisma/shared/src/request-context.ts

@@ -8,7 +8,7 @@
 // Importing this module for its side effect installs the Express `Request` augmentation.
 import type { AccessTokenClaims } from "@/lib/auth/core/types.js";
 import type { AppAbility } from "./ability.js";
-import type { AuthzContext } from "./authz.guard.js";
+import type { AuthzContext } from "./guards/authz.guard.js";
 
 declare module "express" {
   interface Request {