@simple-auth-kit/cli 1.4.2 → 1.5.0

package/registry/combos/nestjs-prisma/variants/workspaces/src/{workspace.repository.ts → repositories/workspace.repository.ts}

@@ -1,8 +1,16 @@
-import { ConflictException, Inject, Injectable, NotFoundException } from "@nestjs/common";
-import { PrismaClient } from "../generated/prisma/client.js";
-import { provisionDefaultRoles, WORKSPACE_CREATOR_ROLES } from "./rbac.defaults.js";
+import {
+  ConflictException,
+  Inject,
+  Injectable,
+  NotFoundException,
+} from "@nestjs/common";
+import { PrismaClient } from "../../generated/prisma/client.js";
+import {
+  provisionDefaultRoles,
+  WORKSPACE_CREATOR_ROLES,
+} from "../rbac.defaults.js";
 import { RbacRepository } from "./rbac.repository.js";
-import { toId } from "./id.helper.js";
+import { toId } from "../id.helper.js";
 
 export interface WorkspaceSummary {
   id: string;
@@ -33,11 +41,23 @@ export class WorkspaceRepository {
   async create(userId: string, name: string): Promise<WorkspaceSummary> {
     const userIdBig = toId(userId);
     const workspace = await this.prisma.$transaction(async (tx) => {
-      const created = await tx.workspace.create({ data: { name, createdBy: userIdBig, updatedBy: userIdBig } });
+      const created = await tx.workspace.create({
+        data: { name, createdBy: userIdBig, updatedBy: userIdBig },
+      });
       await provisionDefaultRoles(tx, created.id);
-      const roles = await tx.role.findMany({ where: { workspaceId: created.id, slug: { in: WORKSPACE_CREATOR_ROLES } }, select: { id: true } });
+      const roles = await tx.role.findMany({
+        where: {
+          workspaceId: created.id,
+          slug: { in: WORKSPACE_CREATOR_ROLES },
+        },
+        select: { id: true },
+      });
       await tx.workspaceMember.create({
-        data: { workspaceId: created.id, userId: userIdBig, roles: { create: roles.map((role) => ({ roleId: role.id })) } },
+        data: {
+          workspaceId: created.id,
+          userId: userIdBig,
+          roles: { create: roles.map((role) => ({ roleId: role.id })) },
+        },
       });
       return created;
     });
@@ -51,8 +71,14 @@ export class WorkspaceRepository {
 
   async listForUser(userId: string): Promise<WorkspaceSummary[]> {
     const memberships = await this.prisma.workspaceMember.findMany({
-      where: { userId: toId(userId), workspace: { isDeleted: false, isActive: true } },
-      include: { workspace: true, roles: { select: { role: { select: { slug: true } } } } },
+      where: {
+        userId: toId(userId),
+        workspace: { isDeleted: false, isActive: true },
+      },
+      include: {
+        workspace: true,
+        roles: { select: { role: { select: { slug: true } } } },
+      },
       orderBy: { createdAt: "asc" },
     });
     return memberships.map((m) => ({
@@ -66,7 +92,10 @@ export class WorkspaceRepository {
   async listMembers(workspaceId: string): Promise<MembershipSummary[]> {
     const rows = await this.prisma.workspaceMember.findMany({
       where: { workspaceId: toId(workspaceId), user: { isDeleted: false } },
-      include: { user: true, roles: { select: { role: { select: { slug: true } } } } },
+      include: {
+        user: true,
+        roles: { select: { role: { select: { slug: true } } } },
+      },
       orderBy: { createdAt: "asc" },
     });
     return rows.map((row) => ({
@@ -78,31 +107,63 @@ export class WorkspaceRepository {
     }));
   }
 
-  private async resolveMemberRoles(workspaceIdBig: bigint, roleSlugs?: string[]) {
+  private async resolveMemberRoles(
+    workspaceIdBig: bigint,
+    roleSlugs?: string[],
+  ) {
     const roles = await this.prisma.role.findMany({
       where: roleSlugs
-        ? { workspaceId: workspaceIdBig, slug: { in: roleSlugs }, isDeleted: false }
-        : { workspaceId: workspaceIdBig, isDefault: true, isActive: true, isDeleted: false },
+        ? {
+            workspaceId: workspaceIdBig,
+            slug: { in: roleSlugs },
+            isDeleted: false,
+          }
+        : {
+            workspaceId: workspaceIdBig,
+            isDefault: true,
+            isActive: true,
+            isDeleted: false,
+          },
       select: { id: true, slug: true },
     });
-    const unknown = (roleSlugs ?? []).filter((slug) => !roles.some((role) => role.slug === slug));
-    if (unknown.length) throw new NotFoundException(`role(s) not defined in this workspace: ${unknown.join(", ")}`);
+    const unknown = (roleSlugs ?? []).filter(
+      (slug) => !roles.some((role) => role.slug === slug),
+    );
+    if (unknown.length)
+      throw new NotFoundException(
+        `role(s) not defined in this workspace: ${unknown.join(", ")}`,
+      );
     return roles;
   }
 
   // Adds an existing user by email — there is no invite/email flow in this library. With no
   // roles named, the new membership gets whichever of this workspace's roles are flagged `isDefault`.
-  async addMember(workspaceId: string, email: string, roleSlugs?: string[]): Promise<MembershipSummary> {
+  async addMember(
+    workspaceId: string,
+    email: string,
+    roleSlugs?: string[],
+  ): Promise<MembershipSummary> {
     const workspaceIdBig = toId(workspaceId);
-    const user = await this.prisma.user.findUnique({ where: { email, isDeleted: false } });
+    const user = await this.prisma.user.findUnique({
+      where: { email, isDeleted: false },
+    });
     if (!user) throw new NotFoundException("no user with that email");
 
-    const existing = await this.prisma.workspaceMember.findUnique({ where: { userId_workspaceId: { userId: user.id, workspaceId: workspaceIdBig } } });
-    if (existing) throw new ConflictException("already a member of this workspace");
+    const existing = await this.prisma.workspaceMember.findUnique({
+      where: {
+        userId_workspaceId: { userId: user.id, workspaceId: workspaceIdBig },
+      },
+    });
+    if (existing)
+      throw new ConflictException("already a member of this workspace");
 
     const roles = await this.resolveMemberRoles(workspaceIdBig, roleSlugs);
     const member = await this.prisma.workspaceMember.create({
-      data: { workspaceId: workspaceIdBig, userId: user.id, roles: { create: roles.map((role) => ({ roleId: role.id })) } },
+      data: {
+        workspaceId: workspaceIdBig,
+        userId: user.id,
+        roles: { create: roles.map((role) => ({ roleId: role.id })) },
+      },
     });
     return {
       memberId: member.id.toString(),
@@ -134,7 +195,9 @@ export class WorkspaceRepository {
     actorUserId: string | null,
   ): Promise<MembershipSummary> {
     const workspaceIdBig = toId(workspaceId);
-    const existing = await this.prisma.user.findUnique({ where: { email: input.email } });
+    const existing = await this.prisma.user.findUnique({
+      where: { email: input.email },
+    });
     if (existing) throw new ConflictException("email already registered");
 
     const roles = await this.resolveMemberRoles(workspaceIdBig, input.roles);
@@ -152,7 +215,11 @@ export class WorkspaceRepository {
       },
     });
     const member = await this.prisma.workspaceMember.create({
-      data: { workspaceId: workspaceIdBig, userId: user.id, roles: { create: roles.map((role) => ({ roleId: role.id })) } },
+      data: {
+        workspaceId: workspaceIdBig,
+        userId: user.id,
+        roles: { create: roles.map((role) => ({ roleId: role.id })) },
+      },
     });
     return {
       memberId: member.id.toString(),
@@ -166,8 +233,11 @@ export class WorkspaceRepository {
   async removeMember(workspaceId: string, memberId: string): Promise<void> {
     const workspaceIdBig = toId(workspaceId);
     const memberIdBig = toId(memberId);
-    const member = await this.prisma.workspaceMember.findUnique({ where: { id: memberIdBig } });
-    if (!member || member.workspaceId !== workspaceIdBig) throw new NotFoundException("member not found in this workspace");
+    const member = await this.prisma.workspaceMember.findUnique({
+      where: { id: memberIdBig },
+    });
+    if (!member || member.workspaceId !== workspaceIdBig)
+      throw new NotFoundException("member not found in this workspace");
 
     // Role assignments and direct grants belong to the membership, so `onDelete: Cascade` on
     // both join tables takes them with it.

package/registry/combos/nestjs-prisma/variants/workspaces/src/seed.ts

@@ -11,21 +11,35 @@
 // routes demand.
 import { PrismaPg } from "@prisma/adapter-pg";
 import { hashPassword } from "@/lib/auth/core/crypto.js";
-import { PrismaClient } from "../generated/prisma/client.js";
-import { DEFAULT_ROLES, PERMISSION_SLUGS, provisionDefaultRoles, SEED_SUPERADMIN_ROLES, WORKSPACE_CREATOR_ROLES } from "./rbac.defaults.js";
+import { PrismaClient } from "./../generated/prisma/client.js";
+import {
+  DEFAULT_ROLES,
+  PERMISSION_SLUGS,
+  provisionDefaultRoles,
+  SEED_SUPERADMIN_ROLES,
+  WORKSPACE_CREATOR_ROLES,
+} from "./rbac.defaults.js";
 
 const DEFAULT_WORKSPACE_NAME = "Default workspace";
 
 function requireEnv(name: string): string {
   const value = process.env[name];
-  if (!value) throw new Error(`${name} is not set — the seeder cannot reach the database without it`);
+  if (!value)
+    throw new Error(
+      `${name} is not set — the seeder cannot reach the database without it`,
+    );
   return value;
 }
 
 // Workspace names aren't unique in the schema, so re-running adopts the one it made last time.
-async function seedWorkspace(prisma: PrismaClient): Promise<{ id: bigint; name: string }> {
+async function seedWorkspace(
+  prisma: PrismaClient,
+): Promise<{ id: bigint; name: string }> {
   const name = process.env["SEED_WORKSPACE_NAME"] || DEFAULT_WORKSPACE_NAME;
-  const existing = await prisma.workspace.findFirst({ where: { name }, orderBy: { createdAt: "asc" } });
+  const existing = await prisma.workspace.findFirst({
+    where: { name },
+    orderBy: { createdAt: "asc" },
+  });
   if (existing) {
     console.log(`workspace: "${name}" already exists (${existing.id})`);
     return existing;
@@ -35,66 +49,130 @@ async function seedWorkspace(prisma: PrismaClient): Promise<{ id: bigint; name:
   return created;
 }
 
-async function seedRbacDefaults(prisma: PrismaClient, workspaceId: bigint): Promise<void> {
+async function seedRbacDefaults(
+  prisma: PrismaClient,
+  workspaceId: bigint,
+): Promise<void> {
   await provisionDefaultRoles(prisma, workspaceId);
   console.log(`permissions: ${PERMISSION_SLUGS.length} slug(s) in the catalog`);
-  for (const role of DEFAULT_ROLES) console.log(`role "${role.slug}": ${role.permissions.length} permission(s)${role.isDefault ? " (new-member default)" : ""}`);
+  for (const role of DEFAULT_ROLES)
+    console.log(
+      `role "${role.slug}": ${role.permissions.length} permission(s)${role.isDefault ? " (new-member default)" : ""}`,
+    );
 
   // Slugs in the database but not this build's catalog aren't an error — a deployment can
   // define its own — but a typo would otherwise silently grant nothing, so surface them.
-  const rows = await prisma.permission.findMany({ select: { slug: true, isActive: true } });
-  const unknown = rows.filter((row) => !(PERMISSION_SLUGS as string[]).includes(row.slug));
-  if (unknown.length) console.log(`permissions: ${unknown.length} slug(s) outside this build's catalog (no route names them): ${unknown.map((r) => r.slug).join(", ")}`);
+  const rows = await prisma.permission.findMany({
+    select: { slug: true, isActive: true },
+  });
+  const unknown = rows.filter(
+    (row) => !(PERMISSION_SLUGS as string[]).includes(row.slug),
+  );
+  if (unknown.length)
+    console.log(
+      `permissions: ${unknown.length} slug(s) outside this build's catalog (no route names them): ${unknown.map((r) => r.slug).join(", ")}`,
+    );
   const inactive = rows.filter((row) => !row.isActive);
-  if (inactive.length) console.log(`permissions: ${inactive.length} deactivated, granting nothing: ${inactive.map((r) => r.slug).join(", ")}`);
+  if (inactive.length)
+    console.log(
+      `permissions: ${inactive.length} deactivated, granting nothing: ${inactive.map((r) => r.slug).join(", ")}`,
+    );
 }
 
-async function seedAdminUser(prisma: PrismaClient, workspace: { id: bigint; name: string }): Promise<void> {
+async function seedAdminUser(
+  prisma: PrismaClient,
+  workspace: { id: bigint; name: string },
+): Promise<void> {
   const email = process.env["SEED_ADMIN_EMAIL"];
   const password = process.env["SEED_ADMIN_PASSWORD"];
   if (!email || !password) {
-    console.log(`admin: skipped — set SEED_ADMIN_EMAIL and SEED_ADMIN_PASSWORD to create one (there is no default password)`);
-    console.log(`admin: "${workspace.name}" has no members until you re-run with them set`);
+    console.log(
+      `admin: skipped — set SEED_ADMIN_EMAIL and SEED_ADMIN_PASSWORD to create one (there is no default password)`,
+    );
+    console.log(
+      `admin: "${workspace.name}" has no members until you re-run with them set`,
+    );
     return;
   }
 
   // Rewriting the password here would silently reset one the user may have already changed.
   const existing = await prisma.user.findUnique({ where: { email } });
-  const user = existing ?? (await prisma.user.create({ data: { email, passwordHash: await hashPassword(password) } }));
-  console.log(existing ? `admin: ${email} already exists — password left unchanged` : `admin: created ${email}`);
+  const user =
+    existing ??
+    (await prisma.user.create({
+      data: { email, passwordHash: await hashPassword(password) },
+    }));
+  console.log(
+    existing
+      ? `admin: ${email} already exists — password left unchanged`
+      : `admin: created ${email}`,
+  );
 
   const membership = await prisma.workspaceMember.upsert({
-    where: { userId_workspaceId: { userId: user.id, workspaceId: workspace.id } },
+    where: {
+      userId_workspaceId: { userId: user.id, workspaceId: workspace.id },
+    },
     create: { userId: user.id, workspaceId: workspace.id },
     update: {},
   });
-  const roles = await prisma.role.findMany({ where: { workspaceId: workspace.id, slug: { in: WORKSPACE_CREATOR_ROLES } }, select: { id: true, slug: true } });
-  await prisma.roleMember.createMany({ data: roles.map((role) => ({ memberId: membership.id, roleId: role.id })), skipDuplicates: true });
-  console.log(`admin: member of "${workspace.name}" with roles ${roles.map((r) => r.slug).join(", ")}`);
+  const roles = await prisma.role.findMany({
+    where: { workspaceId: workspace.id, slug: { in: WORKSPACE_CREATOR_ROLES } },
+    select: { id: true, slug: true },
+  });
+  await prisma.roleMember.createMany({
+    data: roles.map((role) => ({ memberId: membership.id, roleId: role.id })),
+    skipDuplicates: true,
+  });
+  console.log(
+    `admin: member of "${workspace.name}" with roles ${roles.map((r) => r.slug).join(", ")}`,
+  );
 }
 
-async function seedSuperAdminUser(prisma: PrismaClient, workspace: { id: bigint; name: string }): Promise<void> {
+async function seedSuperAdminUser(
+  prisma: PrismaClient,
+  workspace: { id: bigint; name: string },
+): Promise<void> {
   const email = process.env["SEED_SUPERADMIN_EMAIL"];
   const password = process.env["SEED_SUPERADMIN_PASSWORD"];
   if (!email || !password) {
-    console.log(`super admin: skipped — set SEED_SUPERADMIN_EMAIL and SEED_SUPERADMIN_PASSWORD to create one (there is no default password)`);
+    console.log(
+      `super admin: skipped — set SEED_SUPERADMIN_EMAIL and SEED_SUPERADMIN_PASSWORD to create one (there is no default password)`,
+    );
     return;
   }
   const username = process.env["SEED_SUPERADMIN_USERNAME"] || undefined;
 
   // Rewriting the password here would silently reset one the user may have already changed.
   const existing = await prisma.user.findUnique({ where: { email } });
-  const user = existing ?? (await prisma.user.create({ data: { email, username, passwordHash: await hashPassword(password) } }));
-  console.log(existing ? `super admin: ${email} already exists — password left unchanged` : `super admin: created ${email}${username ? ` (username ${username})` : ""}`);
+  const user =
+    existing ??
+    (await prisma.user.create({
+      data: { email, username, passwordHash: await hashPassword(password) },
+    }));
+  console.log(
+    existing
+      ? `super admin: ${email} already exists — password left unchanged`
+      : `super admin: created ${email}${username ? ` (username ${username})` : ""}`,
+  );
 
   const membership = await prisma.workspaceMember.upsert({
-    where: { userId_workspaceId: { userId: user.id, workspaceId: workspace.id } },
+    where: {
+      userId_workspaceId: { userId: user.id, workspaceId: workspace.id },
+    },
     create: { userId: user.id, workspaceId: workspace.id },
     update: {},
   });
-  const roles = await prisma.role.findMany({ where: { workspaceId: workspace.id, slug: { in: SEED_SUPERADMIN_ROLES } }, select: { id: true, slug: true } });
-  await prisma.roleMember.createMany({ data: roles.map((role) => ({ memberId: membership.id, roleId: role.id })), skipDuplicates: true });
-  console.log(`super admin: member of "${workspace.name}" with roles ${roles.map((r) => r.slug).join(", ")}`);
+  const roles = await prisma.role.findMany({
+    where: { workspaceId: workspace.id, slug: { in: SEED_SUPERADMIN_ROLES } },
+    select: { id: true, slug: true },
+  });
+  await prisma.roleMember.createMany({
+    data: roles.map((role) => ({ memberId: membership.id, roleId: role.id })),
+    skipDuplicates: true,
+  });
+  console.log(
+    `super admin: member of "${workspace.name}" with roles ${roles.map((r) => r.slug).join(", ")}`,
+  );
 }
 
 async function main(): Promise<void> {
@@ -104,7 +182,9 @@ async function main(): Promise<void> {
     // No .env file — the environment is expected to carry the variables itself.
   }
 
-  const prisma = new PrismaClient({ adapter: new PrismaPg({ connectionString: requireEnv("DATABASE_URL") }) });
+  const prisma = new PrismaClient({
+    adapter: new PrismaPg({ connectionString: requireEnv("DATABASE_URL") }),
+  });
   try {
     const workspace = await seedWorkspace(prisma);
     await seedRbacDefaults(prisma, workspace.id);