@simple-auth-kit/cli 1.4.2 → 1.5.0

package/registry/combos/nestjs-prisma/variants/workspaces/src/{workspace.controller.ts → controllers/workspace.controller.ts}

@@ -1,29 +1,60 @@
-import { BadRequestException, Body, Controller, Delete, ForbiddenException, Get, Inject, Param, Post, Put, Req, UseGuards } from "@nestjs/common";
-import { ApiBearerAuth, ApiBody, ApiHeader, ApiOperation, ApiParam, ApiResponse, ApiTags } from "@nestjs/swagger";
+import {
+  BadRequestException,
+  Body,
+  Controller,
+  Delete,
+  ForbiddenException,
+  Get,
+  Inject,
+  Param,
+  Post,
+  Put,
+  Req,
+  UseGuards,
+} from "@nestjs/common";
+import {
+  ApiBearerAuth,
+  ApiBody,
+  ApiHeader,
+  ApiOperation,
+  ApiParam,
+  ApiResponse,
+  ApiTags,
+} from "@nestjs/swagger";
 import type { Request } from "express";
-import { AbilityGuard } from "./ability.guard.js";
-import { AuthGuard } from "./auth.guard.js";
-import { WORKSPACE_HEADER, WorkspaceGuard } from "./authz.guard.js";
-import { Authenticated, CheckAbility } from "./route-tiers.js";
-import { OkResponseDto } from "./dto/auth.dto.js";
-import { AddMemberDto, CreateWorkspaceDto, MemberRolesResponseDto, MembershipSummaryDto, SetMemberRolesDto, WorkspaceSummaryDto } from "./dto/workspace.dto.js";
-import { RbacRepository } from "./rbac.repository.js";
-import { WorkspaceRepository } from "./workspace.repository.js";
+import { AbilityGuard } from "../guards/ability.guard.js";
+import { AuthGuard } from "../guards/auth.guard.js";
+import { WORKSPACE_HEADER, WorkspaceGuard } from "../guards/authz.guard.js";
+import { Authenticated, CheckAbility } from "../route-tiers.js";
+import { OkResponseDto } from "../dto/auth.dto.js";
+import {
+  AddMemberDto,
+  CreateWorkspaceDto,
+  MemberRolesResponseDto,
+  MembershipSummaryDto,
+  SetMemberRolesDto,
+  WorkspaceSummaryDto,
+} from "../dto/workspace.dto.js";
+import { RbacRepository } from "../repositories/rbac.repository.js";
+import { WorkspaceRepository } from "../repositories/workspace.repository.js";
 
 function requireString(value: unknown, field: string): string {
-  if (typeof value !== "string" || value.length === 0) throw new BadRequestException(`${field} is required`);
+  if (typeof value !== "string" || value.length === 0)
+    throw new BadRequestException(`${field} is required`);
   return value;
 }
 
 function requireStringArray(value: unknown, field: string): string[] {
-  if (!Array.isArray(value) || value.some((v) => typeof v !== "string")) throw new BadRequestException(`${field} must be an array of strings`);
+  if (!Array.isArray(value) || value.some((v) => typeof v !== "string"))
+    throw new BadRequestException(`${field} must be an array of strings`);
   return value as string[];
 }
 
 const WORKSPACE_HEADER_DOC = {
   name: WORKSPACE_HEADER,
   required: true,
-  description: "The workspace this request acts in. The caller must be a member of it.",
+  description:
+    "The workspace this request acts in. The caller must be a member of it.",
 };
 
 // Every route below that acts *inside* a workspace names it with the `X-Workspace-Id` header
@@ -37,24 +68,34 @@ const WORKSPACE_HEADER_DOC = {
 @ApiBearerAuth()
 export class WorkspaceController {
   constructor(
-    @Inject(WorkspaceRepository) private readonly workspaces: WorkspaceRepository,
+    @Inject(WorkspaceRepository)
+    private readonly workspaces: WorkspaceRepository,
     @Inject(RbacRepository) private readonly rbac: RbacRepository,
   ) {}
 
   @Post()
   @Authenticated()
   @UseGuards(AuthGuard)
-  @ApiOperation({ summary: "Create a workspace", description: "The creator becomes its first member, with the admin role." })
+  @ApiOperation({
+    summary: "Create a workspace",
+    description: "The creator becomes its first member, with the admin role.",
+  })
   @ApiBody({ type: CreateWorkspaceDto })
   @ApiResponse({ status: 201, type: WorkspaceSummaryDto })
   async create(@Body() body: Record<string, unknown>, @Req() req: Request) {
-    return this.workspaces.create(req.auth!.sub, requireString(body.name, "name"));
+    return this.workspaces.create(
+      req.auth!.sub,
+      requireString(body.name, "name"),
+    );
   }
 
   @Get()
   @Authenticated()
   @UseGuards(AuthGuard)
-  @ApiOperation({ summary: "List the workspaces the current user belongs to, with their roles in each" })
+  @ApiOperation({
+    summary:
+      "List the workspaces the current user belongs to, with their roles in each",
+  })
   @ApiResponse({ status: 200, type: [WorkspaceSummaryDto] })
   async listMine(@Req() req: Request) {
     return this.workspaces.listForUser(req.auth!.sub);
@@ -74,37 +115,63 @@ export class WorkspaceController {
   @UseGuards(AuthGuard, WorkspaceGuard, AbilityGuard)
   @CheckAbility("members:manage")
   @ApiHeader(WORKSPACE_HEADER_DOC)
-  @ApiOperation({ summary: "[admin] Add an existing user to the named workspace" })
+  @ApiOperation({
+    summary: "[admin] Add an existing user to the named workspace",
+  })
   @ApiBody({ type: AddMemberDto })
   @ApiResponse({ status: 201, type: MembershipSummaryDto })
   async addMember(@Body() body: Record<string, unknown>, @Req() req: Request) {
     // No `roles` in the body means "whatever this workspace flags as the default role".
-    const roles = body.roles === undefined ? undefined : requireStringArray(body.roles, "roles");
-    return this.workspaces.addMember(req.authz!.workspaceId, requireString(body.email, "email"), roles);
+    const roles =
+      body.roles === undefined
+        ? undefined
+        : requireStringArray(body.roles, "roles");
+    return this.workspaces.addMember(
+      req.authz!.workspaceId,
+      requireString(body.email, "email"),
+      roles,
+    );
   }
 
   @Put("members/:memberId/roles")
   @UseGuards(AuthGuard, WorkspaceGuard, AbilityGuard)
   @CheckAbility("roles:assign")
   @ApiHeader(WORKSPACE_HEADER_DOC)
-  @ApiOperation({ summary: "[admin] Replace a member's roles within the named workspace" })
+  @ApiOperation({
+    summary: "[admin] Replace a member's roles within the named workspace",
+  })
   @ApiParam({ name: "memberId" })
   @ApiBody({ type: SetMemberRolesDto })
   @ApiResponse({ status: 200, type: MemberRolesResponseDto })
-  async setMemberRoles(@Param("memberId") memberId: string, @Body() body: Record<string, unknown>, @Req() req: Request) {
-    if (memberId === req.authz!.memberId) throw new ForbiddenException("cannot change your own roles");
-    return this.rbac.setMemberRoles(req.authz!.workspaceId, memberId, requireStringArray(body.roles, "roles"));
+  async setMemberRoles(
+    @Param("memberId") memberId: string,
+    @Body() body: Record<string, unknown>,
+    @Req() req: Request,
+  ) {
+    if (memberId === req.authz!.memberId)
+      throw new ForbiddenException("cannot change your own roles");
+    return this.rbac.setMemberRoles(
+      req.authz!.workspaceId,
+      memberId,
+      requireStringArray(body.roles, "roles"),
+    );
   }
 
   @Delete("members/:memberId")
   @UseGuards(AuthGuard, WorkspaceGuard, AbilityGuard)
   @CheckAbility("members:manage")
   @ApiHeader(WORKSPACE_HEADER_DOC)
-  @ApiOperation({ summary: "[admin] Remove a member from the named workspace", description: "Their direct permission grants go with the membership." })
+  @ApiOperation({
+    summary: "[admin] Remove a member from the named workspace",
+    description: "Their direct permission grants go with the membership.",
+  })
   @ApiParam({ name: "memberId" })
   @ApiResponse({ status: 200, type: OkResponseDto })
   async removeMember(@Param("memberId") memberId: string, @Req() req: Request) {
-    if (memberId === req.authz!.memberId) throw new ForbiddenException("cannot remove yourself from a workspace you administer");
+    if (memberId === req.authz!.memberId)
+      throw new ForbiddenException(
+        "cannot remove yourself from a workspace you administer",
+      );
     await this.workspaces.removeMember(req.authz!.workspaceId, memberId);
     return { ok: true };
   }

package/registry/combos/nestjs-prisma/variants/workspaces/src/{authz.guard.ts → guards/authz.guard.ts}

@@ -1,7 +1,16 @@
-import { CanActivate, ExecutionContext, ForbiddenException, Inject, Injectable } from "@nestjs/common";
-import { defineAbilitiesFor } from "./ability.js";
-import { PermissionCache } from "./permission-cache.js";
-import { memberCacheKey, RbacRepository } from "./rbac.repository.js";
+import {
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  Inject,
+  Injectable,
+} from "@nestjs/common";
+import { defineAbilitiesFor } from "../ability.js";
+import { PermissionCache } from "../permission-cache.js";
+import {
+  memberCacheKey,
+  RbacRepository,
+} from "../repositories/rbac.repository.js";
 
 export const WORKSPACE_HEADER = "x-workspace-id";
 
@@ -20,15 +29,23 @@ export interface AuthzContext {
 // steady-state cost is a cache read. A non-member is never cached, so being added to a
 // workspace is effective immediately. Idempotent: a route may sit behind both guards, and
 // resolving twice would double the hot path's query count for no gain.
-async function resolve(rbac: RbacRepository, cache: PermissionCache, context: ExecutionContext): Promise<void> {
+async function resolve(
+  rbac: RbacRepository,
+  cache: PermissionCache,
+  context: ExecutionContext,
+): Promise<void> {
   const req = context.switchToHttp().getRequest();
   if (req.authz) return;
 
   const workspaceId = req.headers[WORKSPACE_HEADER];
-  if (!req.auth || typeof workspaceId !== "string" || workspaceId.length === 0) return;
+  if (!req.auth || typeof workspaceId !== "string" || workspaceId.length === 0)
+    return;
 
   const userId = req.auth.sub as string;
-  const authz = await cache.resolve<AuthzContext>(memberCacheKey(userId, workspaceId), () => rbac.resolveAuthzContext(userId, workspaceId));
+  const authz = await cache.resolve<AuthzContext>(
+    memberCacheKey(userId, workspaceId),
+    () => rbac.resolveAuthzContext(userId, workspaceId),
+  );
   // Same answer for "no such workspace" and "not your workspace" — a caller outside a workspace
   // must not be able to probe whether it exists.
   if (!authz) throw new ForbiddenException("not a member of this workspace");
@@ -63,7 +80,8 @@ export class WorkspaceGuard implements CanActivate {
   async canActivate(context: ExecutionContext): Promise<boolean> {
     await resolve(this.rbac, this.cache, context);
     const req = context.switchToHttp().getRequest();
-    if (!req.authz) throw new ForbiddenException(`${WORKSPACE_HEADER} header is required`);
+    if (!req.authz)
+      throw new ForbiddenException(`${WORKSPACE_HEADER} header is required`);
     return true;
   }
 }

package/registry/combos/nestjs-prisma/variants/workspaces/src/rbac.defaults.ts

@@ -9,7 +9,7 @@
 // thing that creates a workspace — callers are `src/seed.ts` (the first workspace) and
 // `src/workspace.repository.ts` (every workspace created afterward, in the same transaction
 // that creates it).
-import type { PrismaClient } from "../generated/prisma/client.js";
+import type { PrismaClient } from "./../generated/prisma/client.js";
 
 export interface PermissionSeed {
   displayName: string;
@@ -22,8 +22,18 @@ export interface PermissionSeed {
 // is the `Permission` table); the authority they confer is scoped to the workspace the request
 // names, because it's that workspace's roles and that membership's grants that point at them.
 export const PERMISSION_CATALOG = {
-  "users:read": { displayName: "List members", description: "GET /auth/admin/users, GET /auth/admin/users/:userId", group: "Users", order: 1 },
-  "users:block": { displayName: "Block and unblock members", description: "POST /auth/admin/users/:userId/block, .../unblock", group: "Users", order: 2 },
+  "users:read": {
+    displayName: "List members",
+    description: "GET /auth/admin/users, GET /auth/admin/users/:userId",
+    group: "Users",
+    order: 1,
+  },
+  "users:block": {
+    displayName: "Block and unblock members",
+    description: "POST /auth/admin/users/:userId/block, .../unblock",
+    group: "Users",
+    order: 2,
+  },
   "users:manage": {
     displayName: "Create, edit, and delete members",
     description:
@@ -40,69 +50,107 @@ export const PERMISSION_CATALOG = {
   },
   "roles:assign": {
     displayName: "Assign roles",
-    description: "Assign and revoke a member's roles — POST /auth/admin/users/:userId/roles, .../roles/:roleSlug/revoke, PUT /workspaces/members/:memberId/roles",
+    description:
+      "Assign and revoke a member's roles — POST /auth/admin/users/:userId/roles, .../roles/:roleSlug/revoke, PUT /workspaces/members/:memberId/roles",
     group: "Roles",
     order: 2,
   },
-  "permissions:read": { displayName: "Read the permission catalog", description: "GET /auth/admin/permissions", group: "Permissions", order: 1 },
+  "permissions:read": {
+    displayName: "Read the permission catalog",
+    description: "GET /auth/admin/permissions",
+    group: "Permissions",
+    order: 1,
+  },
   "permissions:define": {
     displayName: "Define permissions",
-    description: "Create a permission, rename it, or deactivate it — POST /auth/admin/permissions. The authority that defines all the others.",
+    description:
+      "Create a permission, rename it, or deactivate it — POST /auth/admin/permissions. The authority that defines all the others.",
     group: "Permissions",
     order: 2,
   },
   "permissions:grant": {
     displayName: "Grant permissions directly",
-    description: "Grant and revoke a permission straight to a member, bypassing roles — POST /auth/admin/users/:userId/permissions, .../permissions/:slug/revoke",
+    description:
+      "Grant and revoke a permission straight to a member, bypassing roles — POST /auth/admin/users/:userId/permissions, .../permissions/:slug/revoke",
     group: "Permissions",
     order: 3,
   },
   "members:manage": {
     displayName: "Add and remove members",
-    description: "POST /workspaces/members, DELETE /workspaces/members/:memberId",
+    description:
+      "POST /workspaces/members, DELETE /workspaces/members/:memberId",
     group: "Members",
     order: 1,
   },
-  "audit-log:read": { displayName: "Read the audit log", description: "GET /auth/admin/audit-log", group: "Audit", order: 1 },
+  "audit-log:read": {
+    displayName: "Read the audit log",
+    description: "GET /auth/admin/audit-log",
+    group: "Audit",
+    order: 1,
+  },
 
-  "countries:read": { displayName: "List countries", description: "GET /auth/admin/countries, GET /auth/admin/countries/:countryId", group: "Countries", order: 1 },
+  "countries:read": {
+    displayName: "List countries",
+    description:
+      "GET /auth/admin/countries, GET /auth/admin/countries/:countryId",
+    group: "Countries",
+    order: 1,
+  },
   "countries:manage": {
     displayName: "Create, edit, and delete countries",
-    description: "POST /auth/admin/countries, PATCH /auth/admin/countries/:countryId, DELETE /auth/admin/countries/:countryId",
+    description:
+      "POST /auth/admin/countries, PATCH /auth/admin/countries/:countryId, DELETE /auth/admin/countries/:countryId",
     group: "Countries",
     order: 2,
   },
   "countries:status": {
     displayName: "Activate and deactivate countries",
-    description: "POST /auth/admin/countries/:countryId/activate, .../deactivate",
+    description:
+      "POST /auth/admin/countries/:countryId/activate, .../deactivate",
     group: "Countries",
     order: 3,
   },
 
-  "languages:read": { displayName: "List languages", description: "GET /auth/admin/languages, GET /auth/admin/languages/:languageId", group: "Languages", order: 1 },
+  "languages:read": {
+    displayName: "List languages",
+    description:
+      "GET /auth/admin/languages, GET /auth/admin/languages/:languageId",
+    group: "Languages",
+    order: 1,
+  },
   "languages:manage": {
     displayName: "Create, edit, and delete languages",
-    description: "POST /auth/admin/languages, PATCH /auth/admin/languages/:languageId, DELETE /auth/admin/languages/:languageId",
+    description:
+      "POST /auth/admin/languages, PATCH /auth/admin/languages/:languageId, DELETE /auth/admin/languages/:languageId",
     group: "Languages",
     order: 2,
   },
   "languages:status": {
     displayName: "Activate and deactivate languages",
-    description: "POST /auth/admin/languages/:languageId/activate, .../deactivate",
+    description:
+      "POST /auth/admin/languages/:languageId/activate, .../deactivate",
     group: "Languages",
     order: 3,
   },
 
-  "customers:read": { displayName: "List customers", description: "GET /auth/admin/customers, GET /auth/admin/customers/:customerId", group: "Customers", order: 1 },
+  "customers:read": {
+    displayName: "List customers",
+    description:
+      "GET /auth/admin/customers, GET /auth/admin/customers/:customerId",
+    group: "Customers",
+    order: 1,
+  },
   "customers:manage": {
     displayName: "Create, edit, and delete customers",
-    description: "POST /auth/admin/customers, PATCH /auth/admin/customers/:customerId, DELETE /auth/admin/customers/:customerId",
+    description:
+      "POST /auth/admin/customers, PATCH /auth/admin/customers/:customerId, DELETE /auth/admin/customers/:customerId",
     group: "Customers",
     order: 2,
   },
   "customers:status": {
     displayName: "Activate and deactivate customers",
-    description: "POST /auth/admin/customers/:customerId/activate, .../deactivate",
+    description:
+      "POST /auth/admin/customers/:customerId/activate, .../deactivate",
     group: "Customers",
     order: 3,
   },
@@ -113,10 +161,14 @@ export const PERMISSION_CATALOG = {
 // type at compile time.
 export type PermissionSlug = keyof typeof PERMISSION_CATALOG;
 
-export const PERMISSION_SLUGS = Object.keys(PERMISSION_CATALOG) as PermissionSlug[];
+export const PERMISSION_SLUGS = Object.keys(
+  PERMISSION_CATALOG,
+) as PermissionSlug[];
 
 /** Groups, in render order for an admin console. Derived from the catalog so it can't drift. */
-export const PERMISSION_GROUP_ORDER: string[] = [...new Set(PERMISSION_SLUGS.map((slug) => PERMISSION_CATALOG[slug].group))];
+export const PERMISSION_GROUP_ORDER: string[] = [
+  ...new Set(PERMISSION_SLUGS.map((slug) => PERMISSION_CATALOG[slug].group)),
+];
 
 export interface RoleSeed {
   slug: string;
@@ -143,7 +195,8 @@ export const DEFAULT_ROLES: readonly RoleSeed[] = [
   {
     slug: "superadmin",
     displayName: "Super Admin",
-    description: "Carries every permission in the catalog — same authority as admin, held by the seeded super_admin account's membership (see SEED_SUPERADMIN_* in seed.ts).",
+    description:
+      "Carries every permission in the catalog — same authority as admin, held by the seeded super_admin account's membership (see SEED_SUPERADMIN_* in seed.ts).",
     isDefault: false,
     order: 1,
     permissions: PERMISSION_SLUGS,
@@ -151,7 +204,8 @@ export const DEFAULT_ROLES: readonly RoleSeed[] = [
   {
     slug: "member",
     displayName: "Member",
-    description: "The default for a new membership. Carries no administrative permission.",
+    description:
+      "The default for a new membership. Carries no administrative permission.",
     isDefault: true,
     order: 2,
     permissions: [],
@@ -166,14 +220,20 @@ export const WORKSPACE_CREATOR_ROLES: string[] = ["admin", "member"];
 /** Role slugs given to the seeded super_admin's membership. `member` is included so they're also an ordinary member. */
 export const SEED_SUPERADMIN_ROLES: string[] = ["superadmin", "member"];
 
-export type RbacWriter = Pick<PrismaClient, "permission" | "role" | "permissionRole">;
+export type RbacWriter = Pick<
+  PrismaClient,
+  "permission" | "role" | "permissionRole"
+>;
 
 // `db` may be a transaction client — `WorkspaceRepository.create` passes one, so the workspace,
 // its creator's membership, and its roles all land together or not at all. Idempotent and safe
 // to run concurrently: every insert is `skipDuplicates` on the natural unique key.
 // Takes bigint directly: both callers (`WorkspaceRepository.create`, `seed.ts`) already have the
 // workspace row's id in hand from their own Prisma call.
-export async function provisionDefaultRoles(db: RbacWriter, workspaceId: bigint): Promise<void> {
+export async function provisionDefaultRoles(
+  db: RbacWriter,
+  workspaceId: bigint,
+): Promise<void> {
   await db.permission.createMany({
     data: PERMISSION_SLUGS.map((slug) => ({
       slug,
@@ -181,12 +241,17 @@ export async function provisionDefaultRoles(db: RbacWriter, workspaceId: bigint)
       displayName: PERMISSION_CATALOG[slug].displayName,
       description: PERMISSION_CATALOG[slug].description,
       group: PERMISSION_CATALOG[slug].group,
-      groupOrder: PERMISSION_GROUP_ORDER.indexOf(PERMISSION_CATALOG[slug].group),
+      groupOrder: PERMISSION_GROUP_ORDER.indexOf(
+        PERMISSION_CATALOG[slug].group,
+      ),
       order: PERMISSION_CATALOG[slug].order,
     })),
     skipDuplicates: true,
   });
-  const permissions = await db.permission.findMany({ where: { slug: { in: PERMISSION_SLUGS } }, select: { id: true, slug: true } });
+  const permissions = await db.permission.findMany({
+    where: { slug: { in: PERMISSION_SLUGS } },
+    select: { id: true, slug: true },
+  });
   const permissionId = new Map(permissions.map((p) => [p.slug, p.id]));
 
   await db.role.createMany({
@@ -201,11 +266,21 @@ export async function provisionDefaultRoles(db: RbacWriter, workspaceId: bigint)
     })),
     skipDuplicates: true,
   });
-  const roles = await db.role.findMany({ where: { workspaceId, slug: { in: DEFAULT_ROLES.map((r) => r.slug) } }, select: { id: true, slug: true } });
+  const roles = await db.role.findMany({
+    where: { workspaceId, slug: { in: DEFAULT_ROLES.map((r) => r.slug) } },
+    select: { id: true, slug: true },
+  });
   const seedBySlug = new Map(DEFAULT_ROLES.map((role) => [role.slug, role]));
 
   const rolePermissions = roles.flatMap((role) =>
-    (seedBySlug.get(role.slug)?.permissions ?? []).map((slug) => ({ roleId: role.id, permissionId: permissionId.get(slug)! })),
+    (seedBySlug.get(role.slug)?.permissions ?? []).map((slug) => ({
+      roleId: role.id,
+      permissionId: permissionId.get(slug)!,
+    })),
   );
-  if (rolePermissions.length) await db.permissionRole.createMany({ data: rolePermissions, skipDuplicates: true });
+  if (rolePermissions.length)
+    await db.permissionRole.createMany({
+      data: rolePermissions,
+      skipDuplicates: true,
+    });
 }

package/registry/combos/nestjs-prisma/variants/workspaces/src/{audit-log.repository.ts → repositories/audit-log.repository.ts}

@@ -1,8 +1,13 @@
 import { Inject, Injectable } from "@nestjs/common";
 import type { AuditEvent } from "@/lib/auth/core/types.js";
-import { Prisma, PrismaClient } from "../generated/prisma/client.js";
-import { toIdOrNull, toIdOrUndefined } from "./id.helper.js";
-import { buildPageMeta, normalizeLimit, normalizePage, type Paginated } from "./pagination.js";
+import { Prisma, PrismaClient } from "../../generated/prisma/client.js";
+import { toIdOrNull, toIdOrUndefined } from "../id.helper.js";
+import {
+  buildPageMeta,
+  normalizeLimit,
+  normalizePage,
+  type Paginated,
+} from "../pagination.js";
 
 export interface AuditLogEntry {
   id: string;
@@ -29,7 +34,10 @@ export interface AuditLogListFilter {
 // "role_assigned" -> "Role assigned". Derived rather than passed in, so core never carries display text.
 export function humanizeAction(action: string): string {
   const words = action.split("_");
-  return [words[0].charAt(0).toUpperCase() + words[0].slice(1), ...words.slice(1)].join(" ");
+  return [
+    words[0].charAt(0).toUpperCase() + words[0].slice(1),
+    ...words.slice(1),
+  ].join(" ");
 }
 
 /** An `AuditLog` row as `findMany` returns it. */
@@ -56,7 +64,10 @@ export class AuditLogRepository {
 
   // workspaceId is left null for events core raises (login, logout, password reset, ...) —
   // those happen to a user, not inside a workspace.
-  async append(event: AuditEvent, opts: { workspaceId?: string; remarks?: string } = {}): Promise<void> {
+  async append(
+    event: AuditEvent,
+    opts: { workspaceId?: string; remarks?: string } = {},
+  ): Promise<void> {
     await this.prisma.auditLog.create({
       data: {
         action: event.type,