@simple-auth-kit/cli 1.4.2 → 1.5.0

package/registry/combos/nestjs-prisma/variants/base/src/{rbac.repository.ts → repositories/rbac.repository.ts}

@@ -1,14 +1,28 @@
-import { ConflictException, Inject, Injectable, NotFoundException } from "@nestjs/common";
+import {
+  ConflictException,
+  Inject,
+  Injectable,
+  NotFoundException,
+} from "@nestjs/common";
 import { resolvePermissions } from "@/lib/auth/core/rbac.js";
-import { Prisma, PrismaClient } from "../generated/prisma/client.js";
-import { PermissionCache } from "./permission-cache.js";
-import { toId, toIdOrNull } from "./id.helper.js";
-import { buildPageMeta, normalizeLimit, normalizePage, type Paginated } from "./pagination.js";
-
-const USER_ROLES_INCLUDE = { roles: { select: { role: { select: { slug: true } } } } } as const;
+import { Prisma, PrismaClient } from "../../generated/prisma/client.js";
+import { PermissionCache } from "../permission-cache.js";
+import { toId, toIdOrNull } from "../id.helper.js";
+import {
+  buildPageMeta,
+  normalizeLimit,
+  normalizePage,
+  type Paginated,
+} from "../pagination.js";
+
+const USER_ROLES_INCLUDE = {
+  roles: { select: { role: { select: { slug: true } } } },
+} as const;
 
 /** A `User` row as `findUnique`/`findMany` return it with its roles joined in. */
-export type UserRow = Prisma.UserGetPayload<{ include: typeof USER_ROLES_INCLUDE }>;
+export type UserRow = Prisma.UserGetPayload<{
+  include: typeof USER_ROLES_INCLUDE;
+}>;
 
 /**
  * Shapes a raw row into the wire DTO — bigint id to string, `Date` to ISO, the roles relation
@@ -116,7 +130,9 @@ export interface RoleSummary {
   permissions: string[];
 }
 
-const ROLE_PERMISSIONS_INCLUDE = { permissions: { select: { permission: { select: { slug: true } } } } } as const;
+const ROLE_PERMISSIONS_INCLUDE = {
+  permissions: { select: { permission: { select: { slug: true } } } },
+} as const;
 
 const PERMISSION_SELECT = {
   id: true,
@@ -130,7 +146,14 @@ const PERMISSION_SELECT = {
   isActive: true,
 } as const;
 
-const ROLE_SELECT = { id: true, slug: true, name: true, displayName: true, isDefault: true, isActive: true } as const;
+const ROLE_SELECT = {
+  id: true,
+  slug: true,
+  name: true,
+  displayName: true,
+  isDefault: true,
+  isActive: true,
+} as const;
 
 @Injectable()
 export class RbacRepository {
@@ -146,7 +169,9 @@ export class RbacRepository {
   // The hot path: every authenticated request runs this once. Walks user → role_user → roles →
   // permission_role → permissions, and user → permission_user → permissions — constant cost in
   // the number of users, since every hop is an indexed read.
-  async resolveAuthzContext(userId: string): Promise<{ roles: string[]; permissions: string[] }> {
+  async resolveAuthzContext(
+    userId: string,
+  ): Promise<{ roles: string[]; permissions: string[] }> {
     const user = await this.prisma.user.findUnique({
       where: { id: toId(userId), isDeleted: false },
       select: {
@@ -156,17 +181,25 @@ export class RbacRepository {
             role: {
               select: {
                 slug: true,
-                permissions: { where: { permission: { isActive: true, isDeleted: false } }, select: { permission: { select: { slug: true } } } },
+                permissions: {
+                  where: { permission: { isActive: true, isDeleted: false } },
+                  select: { permission: { select: { slug: true } } },
+                },
               },
             },
           },
         },
-        permissions: { where: { permission: { isActive: true, isDeleted: false } }, select: { permission: { select: { slug: true } } } },
+        permissions: {
+          where: { permission: { isActive: true, isDeleted: false } },
+          select: { permission: { select: { slug: true } } },
+        },
       },
     });
     if (!user) return { roles: [], permissions: [] };
 
-    const rolePermissions = user.roles.flatMap((roleUser) => roleUser.role.permissions.map((pr) => pr.permission.slug));
+    const rolePermissions = user.roles.flatMap((roleUser) =>
+      roleUser.role.permissions.map((pr) => pr.permission.slug),
+    );
     const directPermissions = user.permissions.map((pu) => pu.permission.slug);
 
     return {
@@ -185,7 +218,9 @@ export class RbacRepository {
     const limit = normalizeLimit(filter.limit);
     const where = {
       isDeleted: false,
-      email: filter.search ? { contains: filter.search, mode: "insensitive" as const } : undefined,
+      email: filter.search
+        ? { contains: filter.search, mode: "insensitive" as const }
+        : undefined,
     };
 
     const [rows, total] = await this.prisma.$transaction([
@@ -233,7 +268,9 @@ export class RbacRepository {
     },
     actorUserId: string | null,
   ): Promise<UserSummary> {
-    const existing = await this.prisma.user.findUnique({ where: { email: input.email } });
+    const existing = await this.prisma.user.findUnique({
+      where: { email: input.email },
+    });
     if (existing) throw new ConflictException("email already registered");
 
     const user = await this.prisma.user.create({
@@ -255,9 +292,15 @@ export class RbacRepository {
     });
 
     if (input.roles && input.roles.length > 0) {
-      const roles = await this.prisma.role.findMany({ where: { slug: { in: input.roles }, isActive: true, isDeleted: false }, select: { id: true } });
+      const roles = await this.prisma.role.findMany({
+        where: { slug: { in: input.roles }, isActive: true, isDeleted: false },
+        select: { id: true },
+      });
       if (roles.length > 0) {
-        await this.prisma.roleUser.createMany({ data: roles.map((role) => ({ userId: user.id, roleId: role.id })), skipDuplicates: true });
+        await this.prisma.roleUser.createMany({
+          data: roles.map((role) => ({ userId: user.id, roleId: role.id })),
+          skipDuplicates: true,
+        });
         await this.cache.invalidateSubject(user.id.toString());
       }
     } else {
@@ -285,15 +328,26 @@ export class RbacRepository {
     actorUserId: string | null,
   ): Promise<UserSummary> {
     const userIdBig = toId(userId);
-    const existing = await this.prisma.user.findUnique({ where: { id: userIdBig, isDeleted: false }, select: { id: true } });
+    const existing = await this.prisma.user.findUnique({
+      where: { id: userIdBig, isDeleted: false },
+      select: { id: true },
+    });
     if (!existing) throw new NotFoundException(`user "${userId}" not found`);
     await this.prisma.user.update({
       where: { id: userIdBig },
       data: {
         ...input,
         // Date columns need Date values; `undefined` leaves them alone, like every other field here.
-        dob: input.dob === undefined ? undefined : input.dob === null ? null : new Date(input.dob),
-        joinedDate: input.joinedDate === undefined ? undefined : new Date(input.joinedDate),
+        dob:
+          input.dob === undefined
+            ? undefined
+            : input.dob === null
+              ? null
+              : new Date(input.dob),
+        joinedDate:
+          input.joinedDate === undefined
+            ? undefined
+            : new Date(input.joinedDate),
         updatedBy: toIdOrNull(actorUserId),
       },
     });
@@ -303,24 +357,45 @@ export class RbacRepository {
   // Soft-delete, matching every other table's `isDeleted`/`deletedAt`/`deletedBy`/`deletedReason`
   // pattern — the row survives for audit purposes, it just stops appearing in listings and can
   // no longer authenticate (mirrors how `block` already disables login without removing the row).
-  async deleteUser(userId: string, actorUserId: string | null, reason?: string): Promise<void> {
+  async deleteUser(
+    userId: string,
+    actorUserId: string | null,
+    reason?: string,
+  ): Promise<void> {
     const userIdBig = toId(userId);
-    const existing = await this.prisma.user.findUnique({ where: { id: userIdBig, isDeleted: false }, select: { id: true } });
+    const existing = await this.prisma.user.findUnique({
+      where: { id: userIdBig, isDeleted: false },
+      select: { id: true },
+    });
     if (!existing) throw new NotFoundException(`user "${userId}" not found`);
     await this.prisma.user.update({
       where: { id: userIdBig },
-      data: { isDeleted: true, deletedAt: new Date(), deletedBy: toIdOrNull(actorUserId), deletedReason: reason ?? null },
+      data: {
+        isDeleted: true,
+        deletedAt: new Date(),
+        deletedBy: toIdOrNull(actorUserId),
+        deletedReason: reason ?? null,
+      },
     });
     await this.cache.invalidateSubject(userId);
   }
 
   async updateRole(
     roleId: string,
-    input: { name?: string; displayName?: string; description?: string | null; isDefault?: boolean; isActive?: boolean },
+    input: {
+      name?: string;
+      displayName?: string;
+      description?: string | null;
+      isDefault?: boolean;
+      isActive?: boolean;
+    },
     actorUserId: string | null,
   ): Promise<RoleSummary> {
     const roleIdBig = toId(roleId);
-    const existing = await this.prisma.role.findUnique({ where: { id: roleIdBig, isDeleted: false }, select: { id: true } });
+    const existing = await this.prisma.role.findUnique({
+      where: { id: roleIdBig, isDeleted: false },
+      select: { id: true },
+    });
     if (!existing) throw new NotFoundException("role not found");
     const role = await this.prisma.role.update({
       where: { id: roleIdBig },
@@ -329,19 +404,35 @@ export class RbacRepository {
     });
     // Renaming/deactivating changes what every holder resolves to.
     await this.cache.invalidatePolicy();
-    return { ...role, id: role.id.toString(), permissions: role.permissions.map((p) => p.permission.slug).sort() };
+    return {
+      ...role,
+      id: role.id.toString(),
+      permissions: role.permissions.map((p) => p.permission.slug).sort(),
+    };
   }
 
   // Soft-delete. The `role_user`/`permission_role` rows pointing at it are left in place — a
   // deleted role simply stops being returned by `listRoles`/`resolveAuthzContext`, rather than
   // cascading a delete that would silently strip a user's other roles' foreign keys.
-  async deleteRole(roleId: string, actorUserId: string | null, reason?: string): Promise<void> {
+  async deleteRole(
+    roleId: string,
+    actorUserId: string | null,
+    reason?: string,
+  ): Promise<void> {
     const roleIdBig = toId(roleId);
-    const existing = await this.prisma.role.findUnique({ where: { id: roleIdBig, isDeleted: false }, select: { id: true } });
+    const existing = await this.prisma.role.findUnique({
+      where: { id: roleIdBig, isDeleted: false },
+      select: { id: true },
+    });
     if (!existing) throw new NotFoundException("role not found");
     await this.prisma.role.update({
       where: { id: roleIdBig },
-      data: { isDeleted: true, deletedAt: new Date(), deletedBy: toIdOrNull(actorUserId), deletedReason: reason ?? null },
+      data: {
+        isDeleted: true,
+        deletedAt: new Date(),
+        deletedBy: toIdOrNull(actorUserId),
+        deletedReason: reason ?? null,
+      },
     });
     await this.cache.invalidatePolicy();
   }
@@ -351,14 +442,22 @@ export class RbacRepository {
     const rows = await this.prisma.permission.findMany({
       where: { isDeleted: false, isActive: activeOnly ? true : undefined },
       select: PERMISSION_SELECT,
-      orderBy: [{ groupOrder: "asc" }, { group: "asc" }, { order: "asc" }, { slug: "asc" }],
+      orderBy: [
+        { groupOrder: "asc" },
+        { group: "asc" },
+        { order: "asc" },
+        { slug: "asc" },
+      ],
     });
     return rows.map((row) => ({ ...row, id: row.id.toString() }));
   }
 
   // Upserted on `slug`, the stable identifier grants/revocations use, so renaming the display
   // name never breaks a grant.
-  async upsertPermission(input: PermissionInput, actorUserId: string | null): Promise<PermissionSummary> {
+  async upsertPermission(
+    input: PermissionInput,
+    actorUserId: string | null,
+  ): Promise<PermissionSummary> {
     const shared = {
       name: input.name,
       displayName: input.displayName,
@@ -394,11 +493,22 @@ export class RbacRepository {
       select: { ...ROLE_SELECT, ...ROLE_PERMISSIONS_INCLUDE },
       orderBy: [{ order: "asc" }, { slug: "asc" }],
     });
-    return rows.map((row) => ({ ...row, id: row.id.toString(), permissions: row.permissions.map((p) => p.permission.slug).sort() }));
+    return rows.map((row) => ({
+      ...row,
+      id: row.id.toString(),
+      permissions: row.permissions.map((p) => p.permission.slug).sort(),
+    }));
   }
 
   async createRole(
-    input: { slug: string; name?: string; displayName?: string; description?: string | null; isDefault?: boolean; isActive?: boolean },
+    input: {
+      slug: string;
+      name?: string;
+      displayName?: string;
+      description?: string | null;
+      isDefault?: boolean;
+      isActive?: boolean;
+    },
     actorUserId: string | null,
   ): Promise<RoleSummary> {
     const role = await this.prisma.role.create({
@@ -417,38 +527,64 @@ export class RbacRepository {
     return { ...role, id: role.id.toString(), permissions: [] };
   }
 
-  async attachPermissionToRole(roleId: string, permissionSlug: string, actorUserId: string | null): Promise<void> {
+  async attachPermissionToRole(
+    roleId: string,
+    permissionSlug: string,
+    actorUserId: string | null,
+  ): Promise<void> {
     const roleIdBig = toId(roleId);
-    const role = await this.prisma.role.findUnique({ where: { id: roleIdBig, isDeleted: false }, select: { id: true } });
+    const role = await this.prisma.role.findUnique({
+      where: { id: roleIdBig, isDeleted: false },
+      select: { id: true },
+    });
     if (!role) throw new NotFoundException("role not found");
 
     const permission = await this.ensurePermission(permissionSlug, actorUserId);
     await this.prisma.permissionRole.upsert({
-      where: { permissionId_roleId: { permissionId: permission.id, roleId: roleIdBig } },
+      where: {
+        permissionId_roleId: { permissionId: permission.id, roleId: roleIdBig },
+      },
       create: { permissionId: permission.id, roleId: roleIdBig },
       update: {},
     });
     await this.cache.invalidatePolicy(); // everyone holding this role is affected
   }
 
-  async detachPermissionFromRole(roleId: string, permissionSlug: string): Promise<void> {
+  async detachPermissionFromRole(
+    roleId: string,
+    permissionSlug: string,
+  ): Promise<void> {
     const roleIdBig = toId(roleId);
-    const role = await this.prisma.role.findUnique({ where: { id: roleIdBig, isDeleted: false }, select: { id: true } });
+    const role = await this.prisma.role.findUnique({
+      where: { id: roleIdBig, isDeleted: false },
+      select: { id: true },
+    });
     if (!role) throw new NotFoundException("role not found");
 
-    const permission = await this.prisma.permission.findUnique({ where: { slug: permissionSlug }, select: { id: true } });
+    const permission = await this.prisma.permission.findUnique({
+      where: { slug: permissionSlug },
+      select: { id: true },
+    });
     if (!permission) throw new NotFoundException("permission not found");
 
-    await this.prisma.permissionRole.deleteMany({ where: { roleId: roleIdBig, permissionId: permission.id } });
+    await this.prisma.permissionRole.deleteMany({
+      where: { roleId: roleIdBig, permissionId: permission.id },
+    });
     await this.cache.invalidatePolicy(); // everyone holding this role is affected
   }
 
   async assignRoleToUser(userId: string, roleSlug: string): Promise<void> {
     const userIdBig = toId(userId);
-    const role = await this.prisma.role.findUnique({ where: { slug: roleSlug, isDeleted: false }, select: { id: true } });
+    const role = await this.prisma.role.findUnique({
+      where: { slug: roleSlug, isDeleted: false },
+      select: { id: true },
+    });
     if (!role) throw new NotFoundException(`role "${roleSlug}" not found`);
 
-    await this.prisma.user.findUniqueOrThrow({ where: { id: userIdBig }, select: { id: true } });
+    await this.prisma.user.findUniqueOrThrow({
+      where: { id: userIdBig },
+      select: { id: true },
+    });
     await this.prisma.roleUser.upsert({
       where: { userId_roleId: { userId: userIdBig, roleId: role.id } },
       create: { userId: userIdBig, roleId: role.id },
@@ -458,9 +594,14 @@ export class RbacRepository {
   }
 
   async revokeRoleFromUser(userId: string, roleSlug: string): Promise<void> {
-    const role = await this.prisma.role.findUnique({ where: { slug: roleSlug }, select: { id: true } });
+    const role = await this.prisma.role.findUnique({
+      where: { slug: roleSlug },
+      select: { id: true },
+    });
     if (!role) return;
-    await this.prisma.roleUser.deleteMany({ where: { userId: toId(userId), roleId: role.id } });
+    await this.prisma.roleUser.deleteMany({
+      where: { userId: toId(userId), roleId: role.id },
+    });
     await this.cache.invalidateSubject(userId);
   }
 
@@ -468,9 +609,15 @@ export class RbacRepository {
   // Takes the bigint directly: every caller already has the user row in hand (just created or
   // just fetched), so there's no string to convert from.
   async assignDefaultRoles(userId: bigint): Promise<void> {
-    const defaults = await this.prisma.role.findMany({ where: { isDefault: true, isActive: true, isDeleted: false }, select: { id: true } });
+    const defaults = await this.prisma.role.findMany({
+      where: { isDefault: true, isActive: true, isDeleted: false },
+      select: { id: true },
+    });
     if (!defaults.length) return;
-    await this.prisma.roleUser.createMany({ data: defaults.map((role) => ({ userId, roleId: role.id })), skipDuplicates: true });
+    await this.prisma.roleUser.createMany({
+      data: defaults.map((role) => ({ userId, roleId: role.id })),
+      skipDuplicates: true,
+    });
     await this.cache.invalidateSubject(userId.toString());
   }
 
@@ -478,21 +625,35 @@ export class RbacRepository {
     return (await this.prisma.roleUser.count({ where: { userId } })) > 0;
   }
 
-  async grantPermissionToUser(userId: string, permissionSlug: string, actorUserId: string | null): Promise<void> {
+  async grantPermissionToUser(
+    userId: string,
+    permissionSlug: string,
+    actorUserId: string | null,
+  ): Promise<void> {
     const userIdBig = toId(userId);
     const permission = await this.ensurePermission(permissionSlug, actorUserId);
     await this.prisma.permissionUser.upsert({
-      where: { userId_permissionId: { userId: userIdBig, permissionId: permission.id } },
+      where: {
+        userId_permissionId: { userId: userIdBig, permissionId: permission.id },
+      },
       create: { userId: userIdBig, permissionId: permission.id },
       update: {},
     });
     await this.cache.invalidateSubject(userId);
   }
 
-  async revokePermissionFromUser(userId: string, permissionSlug: string): Promise<void> {
-    const permission = await this.prisma.permission.findUnique({ where: { slug: permissionSlug }, select: { id: true } });
+  async revokePermissionFromUser(
+    userId: string,
+    permissionSlug: string,
+  ): Promise<void> {
+    const permission = await this.prisma.permission.findUnique({
+      where: { slug: permissionSlug },
+      select: { id: true },
+    });
     if (!permission) return;
-    await this.prisma.permissionUser.deleteMany({ where: { userId: toId(userId), permissionId: permission.id } });
+    await this.prisma.permissionUser.deleteMany({
+      where: { userId: toId(userId), permissionId: permission.id },
+    });
     await this.cache.invalidateSubject(userId);
   }
 
@@ -501,12 +662,25 @@ export class RbacRepository {
   }
 
   // Creates the row for a slug granted before anyone defined it; leaves an existing definition alone.
-  private async ensurePermission(slug: string, actorUserId: string | null): Promise<{ id: bigint }> {
-    const existing = await this.prisma.permission.findUnique({ where: { slug }, select: { id: true } });
+  private async ensurePermission(
+    slug: string,
+    actorUserId: string | null,
+  ): Promise<{ id: bigint }> {
+    const existing = await this.prisma.permission.findUnique({
+      where: { slug },
+      select: { id: true },
+    });
     return (
       existing ??
       (await this.prisma.permission.create({
-        data: { slug, name: slug, displayName: slug, group: "Custom", createdBy: toIdOrNull(actorUserId), updatedBy: toIdOrNull(actorUserId) },
+        data: {
+          slug,
+          name: slug,
+          displayName: slug,
+          group: "Custom",
+          createdBy: toIdOrNull(actorUserId),
+          updatedBy: toIdOrNull(actorUserId),
+        },
         select: { id: true },
       }))
     );

package/registry/combos/nestjs-prisma/variants/base/src/seed.ts

@@ -5,44 +5,82 @@
 // existing admin keeps the password they already have.
 import { PrismaPg } from "@prisma/adapter-pg";
 import { hashPassword } from "@/lib/auth/core/crypto.js";
-import { PrismaClient } from "../generated/prisma/client.js";
-import { DEFAULT_ROLES, PERMISSION_SLUGS, provisionDefaultRoles, SEED_ADMIN_ROLES, SEED_SUPERADMIN_ROLES } from "./rbac.defaults.js";
+import { PrismaClient } from "./../generated/prisma/client.js";
+import {
+  DEFAULT_ROLES,
+  PERMISSION_SLUGS,
+  provisionDefaultRoles,
+  SEED_ADMIN_ROLES,
+  SEED_SUPERADMIN_ROLES,
+} from "./rbac.defaults.js";
 
 function requireEnv(name: string): string {
   const value = process.env[name];
-  if (!value) throw new Error(`${name} is not set — the seeder cannot reach the database without it`);
+  if (!value)
+    throw new Error(
+      `${name} is not set — the seeder cannot reach the database without it`,
+    );
   return value;
 }
 
 async function seedRbacDefaults(prisma: PrismaClient): Promise<void> {
   await provisionDefaultRoles(prisma);
   console.log(`permissions: ${PERMISSION_SLUGS.length} slug(s) in the catalog`);
-  for (const role of DEFAULT_ROLES) console.log(`role "${role.slug}": ${role.permissions.length} permission(s)${role.isDefault ? " (signup default)" : ""}`);
+  for (const role of DEFAULT_ROLES)
+    console.log(
+      `role "${role.slug}": ${role.permissions.length} permission(s)${role.isDefault ? " (signup default)" : ""}`,
+    );
 
   // Slugs in the database but not this build's catalog aren't an error — a deployment can
   // define its own — but a typo would otherwise silently grant nothing, so surface them.
-  const rows = await prisma.permission.findMany({ select: { slug: true, isActive: true } });
-  const unknown = rows.filter((row) => !(PERMISSION_SLUGS as string[]).includes(row.slug));
-  if (unknown.length) console.log(`permissions: ${unknown.length} slug(s) outside this build's catalog (no route names them): ${unknown.map((r) => r.slug).join(", ")}`);
+  const rows = await prisma.permission.findMany({
+    select: { slug: true, isActive: true },
+  });
+  const unknown = rows.filter(
+    (row) => !(PERMISSION_SLUGS as string[]).includes(row.slug),
+  );
+  if (unknown.length)
+    console.log(
+      `permissions: ${unknown.length} slug(s) outside this build's catalog (no route names them): ${unknown.map((r) => r.slug).join(", ")}`,
+    );
   const inactive = rows.filter((row) => !row.isActive);
-  if (inactive.length) console.log(`permissions: ${inactive.length} deactivated, granting nothing: ${inactive.map((r) => r.slug).join(", ")}`);
+  if (inactive.length)
+    console.log(
+      `permissions: ${inactive.length} deactivated, granting nothing: ${inactive.map((r) => r.slug).join(", ")}`,
+    );
 }
 
 async function seedAdminUser(prisma: PrismaClient): Promise<void> {
   const email = process.env["SEED_ADMIN_EMAIL"];
   const password = process.env["SEED_ADMIN_PASSWORD"];
   if (!email || !password) {
-    console.log("admin: skipped — set SEED_ADMIN_EMAIL and SEED_ADMIN_PASSWORD to create one (there is no default password)");
+    console.log(
+      "admin: skipped — set SEED_ADMIN_EMAIL and SEED_ADMIN_PASSWORD to create one (there is no default password)",
+    );
     return;
   }
 
   // Rewriting the password here would silently reset one the user may have already changed.
   const existing = await prisma.user.findUnique({ where: { email } });
-  const user = existing ?? (await prisma.user.create({ data: { email, passwordHash: await hashPassword(password) } }));
-  console.log(existing ? `admin: ${email} already exists — password left unchanged` : `admin: created ${email}`);
+  const user =
+    existing ??
+    (await prisma.user.create({
+      data: { email, passwordHash: await hashPassword(password) },
+    }));
+  console.log(
+    existing
+      ? `admin: ${email} already exists — password left unchanged`
+      : `admin: created ${email}`,
+  );
 
-  const roles = await prisma.role.findMany({ where: { slug: { in: SEED_ADMIN_ROLES } }, select: { id: true, slug: true } });
-  await prisma.roleUser.createMany({ data: roles.map((role) => ({ userId: user.id, roleId: role.id })), skipDuplicates: true });
+  const roles = await prisma.role.findMany({
+    where: { slug: { in: SEED_ADMIN_ROLES } },
+    select: { id: true, slug: true },
+  });
+  await prisma.roleUser.createMany({
+    data: roles.map((role) => ({ userId: user.id, roleId: role.id })),
+    skipDuplicates: true,
+  });
   console.log(`admin: holds roles ${roles.map((r) => r.slug).join(", ")}`);
 }
 
@@ -50,19 +88,37 @@ async function seedSuperAdminUser(prisma: PrismaClient): Promise<void> {
   const email = process.env["SEED_SUPERADMIN_EMAIL"];
   const password = process.env["SEED_SUPERADMIN_PASSWORD"];
   if (!email || !password) {
-    console.log("super admin: skipped — set SEED_SUPERADMIN_EMAIL and SEED_SUPERADMIN_PASSWORD to create one (there is no default password)");
+    console.log(
+      "super admin: skipped — set SEED_SUPERADMIN_EMAIL and SEED_SUPERADMIN_PASSWORD to create one (there is no default password)",
+    );
     return;
   }
   const username = process.env["SEED_SUPERADMIN_USERNAME"] || undefined;
 
   // Rewriting the password here would silently reset one the user may have already changed.
   const existing = await prisma.user.findUnique({ where: { email } });
-  const user = existing ?? (await prisma.user.create({ data: { email, username, passwordHash: await hashPassword(password) } }));
-  console.log(existing ? `super admin: ${email} already exists — password left unchanged` : `super admin: created ${email}${username ? ` (username ${username})` : ""}`);
+  const user =
+    existing ??
+    (await prisma.user.create({
+      data: { email, username, passwordHash: await hashPassword(password) },
+    }));
+  console.log(
+    existing
+      ? `super admin: ${email} already exists — password left unchanged`
+      : `super admin: created ${email}${username ? ` (username ${username})` : ""}`,
+  );
 
-  const roles = await prisma.role.findMany({ where: { slug: { in: SEED_SUPERADMIN_ROLES } }, select: { id: true, slug: true } });
-  await prisma.roleUser.createMany({ data: roles.map((role) => ({ userId: user.id, roleId: role.id })), skipDuplicates: true });
-  console.log(`super admin: holds roles ${roles.map((r) => r.slug).join(", ")}`);
+  const roles = await prisma.role.findMany({
+    where: { slug: { in: SEED_SUPERADMIN_ROLES } },
+    select: { id: true, slug: true },
+  });
+  await prisma.roleUser.createMany({
+    data: roles.map((role) => ({ userId: user.id, roleId: role.id })),
+    skipDuplicates: true,
+  });
+  console.log(
+    `super admin: holds roles ${roles.map((r) => r.slug).join(", ")}`,
+  );
 }
 
 async function main(): Promise<void> {
@@ -72,7 +128,9 @@ async function main(): Promise<void> {
     // No .env file — the environment is expected to carry the variables itself.
   }
 
-  const prisma = new PrismaClient({ adapter: new PrismaPg({ connectionString: requireEnv("DATABASE_URL") }) });
+  const prisma = new PrismaClient({
+    adapter: new PrismaPg({ connectionString: requireEnv("DATABASE_URL") }),
+  });
   try {
     await seedRbacDefaults(prisma);
     await seedAdminUser(prisma);