@simple-auth-kit/cli 1.4.2 → 1.5.0

package/registry/combos/nestjs-prisma/variants/base/src/{audit-log.gateway.ts → gateways/audit-log.gateway.ts}

@@ -1,15 +1,25 @@
 import { Inject } from "@nestjs/common";
-import { OnGatewayConnection, WebSocketGateway, WebSocketServer } from "@nestjs/websockets";
+import {
+  OnGatewayConnection,
+  WebSocketGateway,
+  WebSocketServer,
+} from "@nestjs/websockets";
 import type { Server, Socket } from "socket.io";
 import { verifyAccessToken } from "@/lib/auth/core/token-service.js";
-import { AuditLogEntry, AuditLogRepository } from "./audit-log.repository.js";
-import { KeyProviderService } from "./key-provider.js";
-import { SessionRepository } from "./session.repository.js";
+import {
+  AuditLogEntry,
+  AuditLogRepository,
+} from "../repositories/audit-log.repository.js";
+import { KeyProviderService } from "../key-provider.js";
+import { SessionRepository } from "../repositories/session.repository.js";
 
 // socket.io clients disagree on where a bearer token travels: `auth.token` (the socket.io-native
 // slot), an Authorization header, or a `token` query param. Accept all three, first present wins.
 function extractToken(client: Socket): string | undefined {
-  const raw = client.handshake.auth?.["token"] ?? client.handshake.headers.authorization ?? client.handshake.query?.["token"];
+  const raw =
+    client.handshake.auth?.["token"] ??
+    client.handshake.headers.authorization ??
+    client.handshake.query?.["token"];
   const value = Array.isArray(raw) ? raw[0] : raw;
   if (typeof value !== "string" || value.length === 0) return undefined;
   return value.startsWith("Bearer ") ? value.slice("Bearer ".length) : value;
@@ -38,7 +48,13 @@ export class AuditLogGateway implements OnGatewayConnection {
       return;
     }
     try {
-      await verifyAccessToken({ secret: this.keys.secret, isDenylisted: (jti) => this.sessions.isDenylisted(jti) }, token);
+      await verifyAccessToken(
+        {
+          secret: this.keys.secret,
+          isDenylisted: (jti) => this.sessions.isDenylisted(jti),
+        },
+        token,
+      );
     } catch {
       client.disconnect(true);
     }

package/registry/combos/nestjs-prisma/variants/base/src/{authz.guard.ts → guards/authz.guard.ts}

@@ -1,7 +1,12 @@
-import { CanActivate, ExecutionContext, Inject, Injectable } from "@nestjs/common";
-import { defineAbilitiesFor } from "./ability.js";
-import { PermissionCache } from "./permission-cache.js";
-import { RbacRepository } from "./rbac.repository.js";
+import {
+  CanActivate,
+  ExecutionContext,
+  Inject,
+  Injectable,
+} from "@nestjs/common";
+import { defineAbilitiesFor } from "../ability.js";
+import { PermissionCache } from "../permission-cache.js";
+import { RbacRepository } from "../repositories/rbac.repository.js";
 
 // Roles and permissions are global to this deployment — one set per user, resolved from the
 // database on the request that uses them. The access token carries identity only.
@@ -26,7 +31,9 @@ export class AuthzGuard implements CanActivate {
     const req = context.switchToHttp().getRequest();
     if (req.auth) {
       const userId = req.auth.sub as string;
-      req.authz = (await this.cache.resolve<AuthzContext>(userId, () => this.rbac.resolveAuthzContext(userId))) ?? { roles: [], permissions: [] };
+      req.authz = (await this.cache.resolve<AuthzContext>(userId, () =>
+        this.rbac.resolveAuthzContext(userId),
+      )) ?? { roles: [], permissions: [] };
       req.ability = defineAbilitiesFor(req.authz.permissions);
     }
     return true;

package/registry/combos/nestjs-prisma/variants/base/src/rbac.defaults.ts

@@ -4,7 +4,7 @@
 // `provisionDefaultRoles` writes these rows once at seed time; from then on the database is
 // authoritative and nothing in the request path reads this file. Callers: `src/seed.ts` and
 // `variants/base/test/variant-hooks.ts`.
-import type { PrismaClient } from "../generated/prisma/client.js";
+import type { PrismaClient } from "./../generated/prisma/client.js";
 
 export interface PermissionSeed {
   displayName: string;
@@ -17,8 +17,18 @@ export interface PermissionSeed {
 // same noun are separate slugs; block and unblock share one since they're a single capability
 // used in two directions.
 export const PERMISSION_CATALOG = {
-  "users:read": { displayName: "List users", description: "GET /auth/admin/users, GET /auth/admin/users/:userId", group: "Users", order: 1 },
-  "users:block": { displayName: "Block and unblock users", description: "POST /auth/admin/users/:userId/block, .../unblock", group: "Users", order: 2 },
+  "users:read": {
+    displayName: "List users",
+    description: "GET /auth/admin/users, GET /auth/admin/users/:userId",
+    group: "Users",
+    order: 1,
+  },
+  "users:block": {
+    displayName: "Block and unblock users",
+    description: "POST /auth/admin/users/:userId/block, .../unblock",
+    group: "Users",
+    order: 2,
+  },
   "users:manage": {
     displayName: "Create, edit, and delete users",
     description:
@@ -28,69 +38,107 @@ export const PERMISSION_CATALOG = {
   },
   "roles:manage": {
     displayName: "Define roles",
-    description: "Create, edit, or delete roles and say what they carry — POST/PATCH/DELETE /auth/admin/roles(/:roleId), POST /auth/admin/roles/:roleId/permissions",
+    description:
+      "Create, edit, or delete roles and say what they carry — POST/PATCH/DELETE /auth/admin/roles(/:roleId), POST /auth/admin/roles/:roleId/permissions",
     group: "Roles",
     order: 1,
   },
   "roles:assign": {
     displayName: "Assign roles",
-    description: "Assign and revoke a user's roles — POST /auth/admin/users/:userId/roles, .../roles/:roleSlug/revoke",
+    description:
+      "Assign and revoke a user's roles — POST /auth/admin/users/:userId/roles, .../roles/:roleSlug/revoke",
     group: "Roles",
     order: 2,
   },
-  "permissions:read": { displayName: "Read the permission catalog", description: "GET /auth/admin/permissions", group: "Permissions", order: 1 },
+  "permissions:read": {
+    displayName: "Read the permission catalog",
+    description: "GET /auth/admin/permissions",
+    group: "Permissions",
+    order: 1,
+  },
   "permissions:define": {
     displayName: "Define permissions",
-    description: "Create a permission, rename it, or deactivate it — POST /auth/admin/permissions. The authority that defines all the others.",
+    description:
+      "Create a permission, rename it, or deactivate it — POST /auth/admin/permissions. The authority that defines all the others.",
     group: "Permissions",
     order: 2,
   },
   "permissions:grant": {
     displayName: "Grant permissions directly",
-    description: "Grant and revoke a permission straight to a user, bypassing roles — POST /auth/admin/users/:userId/permissions, .../permissions/:slug/revoke",
+    description:
+      "Grant and revoke a permission straight to a user, bypassing roles — POST /auth/admin/users/:userId/permissions, .../permissions/:slug/revoke",
     group: "Permissions",
     order: 3,
   },
-  "audit-log:read": { displayName: "Read the audit log", description: "GET /auth/admin/audit-log", group: "Audit", order: 1 },
+  "audit-log:read": {
+    displayName: "Read the audit log",
+    description: "GET /auth/admin/audit-log",
+    group: "Audit",
+    order: 1,
+  },
 
-  "countries:read": { displayName: "List countries", description: "GET /auth/admin/countries, GET /auth/admin/countries/:countryId", group: "Countries", order: 1 },
+  "countries:read": {
+    displayName: "List countries",
+    description:
+      "GET /auth/admin/countries, GET /auth/admin/countries/:countryId",
+    group: "Countries",
+    order: 1,
+  },
   "countries:manage": {
     displayName: "Create, edit, and delete countries",
-    description: "POST /auth/admin/countries, PATCH /auth/admin/countries/:countryId, DELETE /auth/admin/countries/:countryId",
+    description:
+      "POST /auth/admin/countries, PATCH /auth/admin/countries/:countryId, DELETE /auth/admin/countries/:countryId",
     group: "Countries",
     order: 2,
   },
   "countries:status": {
     displayName: "Activate and deactivate countries",
-    description: "POST /auth/admin/countries/:countryId/activate, .../deactivate",
+    description:
+      "POST /auth/admin/countries/:countryId/activate, .../deactivate",
     group: "Countries",
     order: 3,
   },
 
-  "languages:read": { displayName: "List languages", description: "GET /auth/admin/languages, GET /auth/admin/languages/:languageId", group: "Languages", order: 1 },
+  "languages:read": {
+    displayName: "List languages",
+    description:
+      "GET /auth/admin/languages, GET /auth/admin/languages/:languageId",
+    group: "Languages",
+    order: 1,
+  },
   "languages:manage": {
     displayName: "Create, edit, and delete languages",
-    description: "POST /auth/admin/languages, PATCH /auth/admin/languages/:languageId, DELETE /auth/admin/languages/:languageId",
+    description:
+      "POST /auth/admin/languages, PATCH /auth/admin/languages/:languageId, DELETE /auth/admin/languages/:languageId",
     group: "Languages",
     order: 2,
   },
   "languages:status": {
     displayName: "Activate and deactivate languages",
-    description: "POST /auth/admin/languages/:languageId/activate, .../deactivate",
+    description:
+      "POST /auth/admin/languages/:languageId/activate, .../deactivate",
     group: "Languages",
     order: 3,
   },
 
-  "customers:read": { displayName: "List customers", description: "GET /auth/admin/customers, GET /auth/admin/customers/:customerId", group: "Customers", order: 1 },
+  "customers:read": {
+    displayName: "List customers",
+    description:
+      "GET /auth/admin/customers, GET /auth/admin/customers/:customerId",
+    group: "Customers",
+    order: 1,
+  },
   "customers:manage": {
     displayName: "Create, edit, and delete customers",
-    description: "POST /auth/admin/customers, PATCH /auth/admin/customers/:customerId, DELETE /auth/admin/customers/:customerId",
+    description:
+      "POST /auth/admin/customers, PATCH /auth/admin/customers/:customerId, DELETE /auth/admin/customers/:customerId",
     group: "Customers",
     order: 2,
   },
   "customers:status": {
     displayName: "Activate and deactivate customers",
-    description: "POST /auth/admin/customers/:customerId/activate, .../deactivate",
+    description:
+      "POST /auth/admin/customers/:customerId/activate, .../deactivate",
     group: "Customers",
     order: 3,
   },
@@ -101,10 +149,14 @@ export const PERMISSION_CATALOG = {
 // type at compile time.
 export type PermissionSlug = keyof typeof PERMISSION_CATALOG;
 
-export const PERMISSION_SLUGS = Object.keys(PERMISSION_CATALOG) as PermissionSlug[];
+export const PERMISSION_SLUGS = Object.keys(
+  PERMISSION_CATALOG,
+) as PermissionSlug[];
 
 /** Groups, in render order for an admin console. Derived from the catalog so it can't drift. */
-export const PERMISSION_GROUP_ORDER: string[] = [...new Set(PERMISSION_SLUGS.map((slug) => PERMISSION_CATALOG[slug].group))];
+export const PERMISSION_GROUP_ORDER: string[] = [
+  ...new Set(PERMISSION_SLUGS.map((slug) => PERMISSION_CATALOG[slug].group)),
+];
 
 export interface RoleSeed {
   slug: string;
@@ -131,7 +183,8 @@ export const DEFAULT_ROLES: readonly RoleSeed[] = [
   {
     slug: "superadmin",
     displayName: "Super Admin",
-    description: "Carries every permission in the catalog — same authority as admin, held by the seeded super_admin account (see SEED_SUPERADMIN_* in seed.ts).",
+    description:
+      "Carries every permission in the catalog — same authority as admin, held by the seeded super_admin account (see SEED_SUPERADMIN_* in seed.ts).",
     isDefault: false,
     order: 1,
     permissions: PERMISSION_SLUGS,
@@ -152,7 +205,10 @@ export const SEED_ADMIN_ROLES: string[] = ["admin", "member"];
 /** Role slugs given to the seeded super_admin. `member` is included so they're also an ordinary user. */
 export const SEED_SUPERADMIN_ROLES: string[] = ["superadmin", "member"];
 
-export type RbacWriter = Pick<PrismaClient, "permission" | "role" | "permissionRole">;
+export type RbacWriter = Pick<
+  PrismaClient,
+  "permission" | "role" | "permissionRole"
+>;
 
 // Idempotent and safe to run concurrently: every insert is `skipDuplicates` on the natural
 // unique key, and nothing is ever deleted or updated.
@@ -164,12 +220,17 @@ export async function provisionDefaultRoles(db: RbacWriter): Promise<void> {
       displayName: PERMISSION_CATALOG[slug].displayName,
       description: PERMISSION_CATALOG[slug].description,
       group: PERMISSION_CATALOG[slug].group,
-      groupOrder: PERMISSION_GROUP_ORDER.indexOf(PERMISSION_CATALOG[slug].group),
+      groupOrder: PERMISSION_GROUP_ORDER.indexOf(
+        PERMISSION_CATALOG[slug].group,
+      ),
       order: PERMISSION_CATALOG[slug].order,
     })),
     skipDuplicates: true,
   });
-  const permissions = await db.permission.findMany({ where: { slug: { in: PERMISSION_SLUGS } }, select: { id: true, slug: true } });
+  const permissions = await db.permission.findMany({
+    where: { slug: { in: PERMISSION_SLUGS } },
+    select: { id: true, slug: true },
+  });
   const permissionId = new Map(permissions.map((p) => [p.slug, p.id]));
 
   await db.role.createMany({
@@ -183,11 +244,21 @@ export async function provisionDefaultRoles(db: RbacWriter): Promise<void> {
     })),
     skipDuplicates: true,
   });
-  const roles = await db.role.findMany({ where: { slug: { in: DEFAULT_ROLES.map((r) => r.slug) } }, select: { id: true, slug: true } });
+  const roles = await db.role.findMany({
+    where: { slug: { in: DEFAULT_ROLES.map((r) => r.slug) } },
+    select: { id: true, slug: true },
+  });
   const seedBySlug = new Map(DEFAULT_ROLES.map((role) => [role.slug, role]));
 
   const rolePermissions = roles.flatMap((role) =>
-    (seedBySlug.get(role.slug)?.permissions ?? []).map((slug) => ({ roleId: role.id, permissionId: permissionId.get(slug)! })),
+    (seedBySlug.get(role.slug)?.permissions ?? []).map((slug) => ({
+      roleId: role.id,
+      permissionId: permissionId.get(slug)!,
+    })),
   );
-  if (rolePermissions.length) await db.permissionRole.createMany({ data: rolePermissions, skipDuplicates: true });
+  if (rolePermissions.length)
+    await db.permissionRole.createMany({
+      data: rolePermissions,
+      skipDuplicates: true,
+    });
 }

package/registry/combos/nestjs-prisma/variants/base/src/{audit-log.repository.ts → repositories/audit-log.repository.ts}

@@ -1,8 +1,13 @@
 import { Inject, Injectable } from "@nestjs/common";
 import type { AuditEvent } from "@/lib/auth/core/types.js";
-import { Prisma, PrismaClient } from "../generated/prisma/client.js";
-import { toIdOrNull, toIdOrUndefined } from "./id.helper.js";
-import { buildPageMeta, normalizeLimit, normalizePage, type Paginated } from "./pagination.js";
+import { Prisma, PrismaClient } from "../../generated/prisma/client.js";
+import { toIdOrNull, toIdOrUndefined } from "../id.helper.js";
+import {
+  buildPageMeta,
+  normalizeLimit,
+  normalizePage,
+  type Paginated,
+} from "../pagination.js";
 
 export interface AuditLogEntry {
   id: string;
@@ -27,7 +32,10 @@ export interface AuditLogListFilter {
 // "role_assigned" -> "Role assigned". Derived rather than passed in, so core never carries display text.
 export function humanizeAction(action: string): string {
   const words = action.split("_");
-  return [words[0].charAt(0).toUpperCase() + words[0].slice(1), ...words.slice(1)].join(" ");
+  return [
+    words[0].charAt(0).toUpperCase() + words[0].slice(1),
+    ...words.slice(1),
+  ].join(" ");
 }
 
 /** An `AuditLog` row as `findMany` returns it. */
@@ -63,7 +71,10 @@ export class AuditLogRepository {
     this.listeners.add(listener);
   }
 
-  async append(event: AuditEvent, opts: { remarks?: string } = {}): Promise<void> {
+  async append(
+    event: AuditEvent,
+    opts: { remarks?: string } = {},
+  ): Promise<void> {
     const row = await this.prisma.auditLog.create({
       data: {
         action: event.type,

package/registry/combos/nestjs-prisma/variants/base/src/{country.repository.ts → repositories/country.repository.ts}

@@ -1,7 +1,17 @@
-import { ConflictException, Inject, Injectable, NotFoundException } from "@nestjs/common";
-import { Prisma, PrismaClient } from "../generated/prisma/client.js";
-import { toId, toIdOrNull } from "./id.helper.js";
-import { buildPageMeta, normalizeLimit, normalizePage, type Paginated } from "./pagination.js";
+import {
+  ConflictException,
+  Inject,
+  Injectable,
+  NotFoundException,
+} from "@nestjs/common";
+import { Prisma, PrismaClient } from "../../generated/prisma/client.js";
+import { toId, toIdOrNull } from "../id.helper.js";
+import {
+  buildPageMeta,
+  normalizeLimit,
+  normalizePage,
+  type Paginated,
+} from "../pagination.js";
 
 /** A `Country` row as `findUnique`/`findMany` return it. */
 export type CountryRow = Prisma.CountryGetPayload<object>;
@@ -90,60 +100,123 @@ export class CountryRepository {
     };
 
     const [rows, total] = await this.prisma.$transaction([
-      this.prisma.country.findMany({ where, orderBy: [{ createdAt: "desc" }, { id: "desc" }], take: limit, skip: (page - 1) * limit }),
+      this.prisma.country.findMany({
+        where,
+        orderBy: [{ createdAt: "desc" }, { id: "desc" }],
+        take: limit,
+        skip: (page - 1) * limit,
+      }),
       this.prisma.country.count({ where }),
     ]);
 
-    return { items: rows.map(toCountrySummary), meta: buildPageMeta(page, limit, total) };
+    return {
+      items: rows.map(toCountrySummary),
+      meta: buildPageMeta(page, limit, total),
+    };
   }
 
   async get(countryId: string): Promise<CountrySummary> {
-    const row = await this.prisma.country.findUnique({ where: { id: toId(countryId), isDeleted: false } });
+    const row = await this.prisma.country.findUnique({
+      where: { id: toId(countryId), isDeleted: false },
+    });
     if (!row) throw new NotFoundException(`country "${countryId}" not found`);
     return toCountrySummary(row);
   }
 
-  async create(input: CountryInput, actorUserId: string | null): Promise<CountrySummary> {
-    const existing = await this.prisma.country.findFirst({ where: { OR: [{ code: input.code }, { isoCode: input.isoCode }] } });
-    if (existing) throw new ConflictException("a country with this code or ISO code already exists");
+  async create(
+    input: CountryInput,
+    actorUserId: string | null,
+  ): Promise<CountrySummary> {
+    const existing = await this.prisma.country.findFirst({
+      where: { OR: [{ code: input.code }, { isoCode: input.isoCode }] },
+    });
+    if (existing)
+      throw new ConflictException(
+        "a country with this code or ISO code already exists",
+      );
 
     const row = await this.prisma.country.create({
-      data: { ...input, createdBy: toIdOrNull(actorUserId), updatedBy: toIdOrNull(actorUserId) },
+      data: {
+        ...input,
+        createdBy: toIdOrNull(actorUserId),
+        updatedBy: toIdOrNull(actorUserId),
+      },
     });
     return toCountrySummary(row);
   }
 
-  async update(countryId: string, input: Partial<CountryInput>, actorUserId: string | null): Promise<CountrySummary> {
+  async update(
+    countryId: string,
+    input: Partial<CountryInput>,
+    actorUserId: string | null,
+  ): Promise<CountrySummary> {
     const countryIdBig = toId(countryId);
-    const existing = await this.prisma.country.findUnique({ where: { id: countryIdBig, isDeleted: false }, select: { id: true } });
-    if (!existing) throw new NotFoundException(`country "${countryId}" not found`);
+    const existing = await this.prisma.country.findUnique({
+      where: { id: countryIdBig, isDeleted: false },
+      select: { id: true },
+    });
+    if (!existing)
+      throw new NotFoundException(`country "${countryId}" not found`);
 
     if (input.code !== undefined || input.isoCode !== undefined) {
       const clash = await this.prisma.country.findFirst({
-        where: { NOT: { id: countryIdBig }, OR: [{ code: input.code }, { isoCode: input.isoCode }] },
+        where: {
+          NOT: { id: countryIdBig },
+          OR: [{ code: input.code }, { isoCode: input.isoCode }],
+        },
       });
-      if (clash) throw new ConflictException("a country with this code or ISO code already exists");
+      if (clash)
+        throw new ConflictException(
+          "a country with this code or ISO code already exists",
+        );
     }
 
-    const row = await this.prisma.country.update({ where: { id: countryIdBig }, data: { ...input, updatedBy: toIdOrNull(actorUserId) } });
+    const row = await this.prisma.country.update({
+      where: { id: countryIdBig },
+      data: { ...input, updatedBy: toIdOrNull(actorUserId) },
+    });
     return toCountrySummary(row);
   }
 
   // Soft-delete, matching every other table's isDeleted/deletedAt/deletedBy/deletedReason pattern.
-  async delete(countryId: string, actorUserId: string | null, reason?: string): Promise<void> {
+  async delete(
+    countryId: string,
+    actorUserId: string | null,
+    reason?: string,
+  ): Promise<void> {
     const countryIdBig = toId(countryId);
-    const existing = await this.prisma.country.findUnique({ where: { id: countryIdBig, isDeleted: false }, select: { id: true } });
-    if (!existing) throw new NotFoundException(`country "${countryId}" not found`);
+    const existing = await this.prisma.country.findUnique({
+      where: { id: countryIdBig, isDeleted: false },
+      select: { id: true },
+    });
+    if (!existing)
+      throw new NotFoundException(`country "${countryId}" not found`);
     await this.prisma.country.update({
       where: { id: countryIdBig },
-      data: { isDeleted: true, deletedAt: new Date(), deletedBy: toIdOrNull(actorUserId), deletedReason: reason ?? null },
+      data: {
+        isDeleted: true,
+        deletedAt: new Date(),
+        deletedBy: toIdOrNull(actorUserId),
+        deletedReason: reason ?? null,
+      },
     });
   }
 
-  async setActive(countryId: string, isActive: boolean, actorUserId: string | null): Promise<void> {
+  async setActive(
+    countryId: string,
+    isActive: boolean,
+    actorUserId: string | null,
+  ): Promise<void> {
     const countryIdBig = toId(countryId);
-    const existing = await this.prisma.country.findUnique({ where: { id: countryIdBig, isDeleted: false }, select: { id: true } });
-    if (!existing) throw new NotFoundException(`country "${countryId}" not found`);
-    await this.prisma.country.update({ where: { id: countryIdBig }, data: { isActive, updatedBy: toIdOrNull(actorUserId) } });
+    const existing = await this.prisma.country.findUnique({
+      where: { id: countryIdBig, isDeleted: false },
+      select: { id: true },
+    });
+    if (!existing)
+      throw new NotFoundException(`country "${countryId}" not found`);
+    await this.prisma.country.update({
+      where: { id: countryIdBig },
+      data: { isActive, updatedBy: toIdOrNull(actorUserId) },
+    });
   }
 }