@simple-auth-kit/cli 1.4.2 → 1.5.0

package/registry/combos/express-drizzle/shared/src/auth.router.ts

@@ -1,266 +0,0 @@
-import type { NextFunction, Request, RequestHandler, Response } from "express";
-import type { AuthConfig } from "./auth.config.js";
-import { AuthService } from "./auth.service.js";
-import { HttpError } from "./http-error.js";
-import { authenticated, createTieredRouter, publicRoute, type TierMiddleware } from "./route-tiers.js";
-import "./request-context.js";
-
-function requireString(value: unknown, field: string): string {
-  if (typeof value !== "string" || value.length === 0) throw new HttpError(400, `${field} is required`);
-  return value;
-}
-
-const optionalString = (value: unknown): string | undefined => (typeof value === "string" ? value : undefined);
-
-export interface AuthRouterDeps extends TierMiddleware {
-  auth: AuthService;
-  config: AuthConfig;
-}
-
-/**
- * Identity endpoints — everything that is about *a user*, never about a group of them.
- * Administration lives in admin.router.ts.
- *
- * Replaces the reference combo's `AuthController` (a Nest `@Controller`). Same endpoints, same
- * validation, same status codes — just an Express `Router()` instead of a decorated class, and
- * middleware passed in where the controller lists `@UseGuards(...)`. Every handler is wrapped in
- * try/catch + `next(err)` so a thrown `HttpError`/`AuthCoreError` reaches the error-handling
- * middleware mounted in create-auth-app.ts instead of leaking a bare 500.
- */
-export function createAuthRouter(deps: AuthRouterDeps): RequestHandler {
-  const { auth, config, authentication, authorization } = deps;
-  const router = createTieredRouter({ authentication, authorization });
-
-  router.route("post", "/signup", publicRoute(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const body = req.body as Record<string, unknown>;
-      const tokens = await auth.signup({
-        email: requireString(body.email, "email"),
-        password: requireString(body.password, "password"),
-        firstName: optionalString(body.firstName),
-        lastName: optionalString(body.lastName),
-        displayName: optionalString(body.displayName),
-        phone: optionalString(body.phone),
-        username: optionalString(body.username),
-        userAgent: req.headers["user-agent"],
-        ip: req.ip,
-      });
-      res.status(201).json(tokens);
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  router.route("post", "/login", publicRoute(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const body = req.body as Record<string, unknown>;
-      const result = await auth.login({
-        identifier: requireString(body.identifier, "identifier"),
-        password: requireString(body.password, "password"),
-        userAgent: req.headers["user-agent"],
-        ip: req.ip,
-      });
-      res.status(200).json(result);
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  router.route("post", "/login/2fa", publicRoute(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const body = req.body as Record<string, unknown>;
-      const tokens = await auth.loginTwoFactor({
-        challengeToken: requireString(body.challengeToken, "challengeToken"),
-        code: requireString(body.code, "code"),
-        userAgent: req.headers["user-agent"],
-        ip: req.ip,
-      });
-      res.status(200).json(tokens);
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  router.route("post", "/refresh", publicRoute(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const body = req.body as Record<string, unknown>;
-      const tokens = await auth.refresh(requireString(body.refreshToken, "refreshToken"));
-      res.status(200).json(tokens);
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  // `roles`/`permissions` are whatever applies to this request — see authz.middleware.ts for how
-  // they are resolved. A request that names no authorization scope gets empty arrays.
-  //
-  // `permissions` is the caller's whole authorization: `defineAbilitiesFor(permissions)` from
-  // ability.ts rebuilds, in the client, the identical CASL ability the server's own route check
-  // just answered with, so the UI cannot disagree with what the API will allow. The slugs go on
-  // the wire rather than a serialised ability, so the payload is something a human can read in a
-  // log — and it is the same `req.authz` the ability was built from, not a re-resolution.
-  router.route("get", "/me", authenticated(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const { sub, sessionId } = req.auth!;
-      const [{ twoFactorEnabled }, profile] = await Promise.all([auth.getTwoFactorStatus(sub), auth.getProfile(sub)]);
-      res.status(200).json({
-        sub,
-        sessionId,
-        roles: req.authz?.roles ?? [],
-        permissions: req.authz?.permissions ?? [],
-        twoFactorEnabled,
-        email: profile.email,
-        firstName: profile.firstName,
-        lastName: profile.lastName,
-        displayName: profile.displayName,
-        phone: profile.phone,
-        username: profile.username,
-        photo: profile.photo,
-      });
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  router.route("get", "/sessions", authenticated(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const sessions = await auth.listActiveSessions(req.auth!.sub);
-      res.status(200).json(sessions);
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  router.route("post", "/logout", authenticated(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const { sessionId, jti, sub } = req.auth!;
-      // Recorded so the row can later be told apart from a session an administrator ended —
-      // see `sessions.revoked_by`.
-      await auth.logout(sessionId, jti, config.accessTokenTtlSeconds, { userId: sub, ip: req.ip });
-      res.status(200).json({ ok: true });
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  router.route("post", "/logout-all", authenticated(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      await auth.logoutAll(req.auth!.sub, { userId: req.auth!.sub, ip: req.ip });
-      res.status(200).json({ ok: true });
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  router.route("post", "/logout-others", authenticated(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      await auth.logoutOthers(req.auth!.sub, req.auth!.sessionId, { userId: req.auth!.sub, ip: req.ip });
-      res.status(200).json({ ok: true });
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  router.route("post", "/password/change", authenticated(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const body = req.body as Record<string, unknown>;
-      await auth.changePassword(req.auth!.sub, req.auth!.sessionId, {
-        currentPassword: requireString(body.currentPassword, "currentPassword"),
-        newPassword: requireString(body.newPassword, "newPassword"),
-      });
-      res.status(200).json({ ok: true });
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  router.route("patch", "/me", authenticated(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const body = req.body as Record<string, unknown>;
-      const profile = await auth.updateProfile(req.auth!.sub, {
-        firstName: body.firstName === null ? null : optionalString(body.firstName),
-        lastName: body.lastName === null ? null : optionalString(body.lastName),
-        displayName: body.displayName === null ? null : optionalString(body.displayName),
-        phone: body.phone === null ? null : optionalString(body.phone),
-        username: body.username === null ? null : optionalString(body.username),
-        photo: body.photo === null ? null : optionalString(body.photo),
-      });
-      res.status(200).json(profile);
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  router.route("post", "/2fa/enroll", authenticated(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const result = await auth.enrollTwoFactor(req.auth!.sub);
-      res.status(200).json(result);
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  router.route("post", "/2fa/confirm", authenticated(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const body = req.body as Record<string, unknown>;
-      const result = await auth.confirmTwoFactor(req.auth!.sub, requireString(body.code, "code"));
-      res.status(200).json(result);
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  router.route("post", "/2fa/disable", authenticated(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const body = req.body as Record<string, unknown>;
-      await auth.disableTwoFactor(req.auth!.sub, requireString(body.code, "code"));
-      res.status(200).json({ ok: true });
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  router.route("post", "/password/forgot", publicRoute(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const body = req.body as Record<string, unknown>;
-      await auth.requestPasswordReset(requireString(body.email, "email"));
-      res.status(200).json({ ok: true }); // always 200 — never reveal whether the email exists
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  router.route("post", "/password/reset", publicRoute(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const body = req.body as Record<string, unknown>;
-      await auth.resetPassword(requireString(body.token, "token"), requireString(body.newPassword, "newPassword"));
-      res.status(200).json({ ok: true });
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  router.route("get", "/oauth/:provider/start", publicRoute(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const result = await auth.startOAuth(requireString(req.params.provider, "provider"));
-      res.status(200).json(result);
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  router.route("get", "/oauth/:provider/callback", publicRoute(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const tokens = await auth.completeOAuthCallback(
-        requireString(req.params.provider, "provider"),
-        requireString(req.query.code, "code"),
-        requireString(req.query.state, "state"),
-      );
-      res.status(200).json(tokens);
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  return router.handler;
-}

package/registry/combos/express-drizzle/shared/src/password-reset.repository.ts

@@ -1,35 +0,0 @@
-import { eq } from "drizzle-orm";
-import type { NodePgDatabase } from "drizzle-orm/node-postgres";
-import type { PasswordResetStoreDeps } from "@/lib/auth/core/password-reset.js";
-import * as schema from "./schema.js";
-import { toId } from "./id.helper.js";
-
-/**
- * Plain class, no decorators — Drizzle-specific implementation of `PasswordResetStoreDeps`
- * (registry/core/password-reset.js), mirroring the reference combo's PasswordResetRepository.
- */
-export class PasswordResetRepository implements PasswordResetStoreDeps {
-  constructor(private readonly db: NodePgDatabase<typeof schema>) {}
-
-  async saveResetToken(input: { userId: string; tokenHash: string; expiresAt: string }): Promise<void> {
-    await this.db.insert(schema.passwordResetTokens).values({
-      userId: toId(input.userId),
-      tokenHash: input.tokenHash,
-      expiresAt: new Date(input.expiresAt),
-    });
-  }
-
-  async findValidResetToken(tokenHash: string): Promise<{ userId: string; expiresAt: string; consumedAt: string | null } | null> {
-    const [row] = await this.db.select().from(schema.passwordResetTokens).where(eq(schema.passwordResetTokens.tokenHash, tokenHash)).limit(1);
-    if (!row) return null;
-    return { userId: row.userId.toString(), expiresAt: row.expiresAt.toISOString(), consumedAt: row.consumedAt?.toISOString() ?? null };
-  }
-
-  async consumeResetToken(tokenHash: string): Promise<void> {
-    await this.db.update(schema.passwordResetTokens).set({ consumedAt: new Date() }).where(eq(schema.passwordResetTokens.tokenHash, tokenHash));
-  }
-
-  async setPasswordHash(userId: string, passwordHash: string): Promise<void> {
-    await this.db.update(schema.users).set({ passwordHash }).where(eq(schema.users.id, toId(userId)));
-  }
-}

package/registry/combos/express-drizzle/variants/base/src/admin.router.ts

@@ -1,307 +0,0 @@
-import type { NextFunction, Request, RequestHandler, Response } from "express";
-import { AuthService } from "./auth.service.js";
-import { HttpError } from "./http-error.js";
-import { ability, createTieredRouter, type TierMiddleware } from "./route-tiers.js";
-import "./request-context.js";
-
-function requireString(value: unknown, field: string): string {
-  if (typeof value !== "string" || value.length === 0) throw new HttpError(400, `${field} is required`);
-  return value;
-}
-
-const optionalString = (value: unknown): string | undefined => (typeof value === "string" ? value : undefined);
-
-export interface AdminRouterDeps extends TierMiddleware {
-  auth: AuthService;
-}
-
-/**
- * Administration of the whole deployment. Authority is a permission, never a role name: the authz
- * middleware resolves the caller's roles and permissions from the database on this request, builds
- * the CASL ability from them, and each route's `ability(...)` tier checks its slugs against it.
- * There is no role-based bypass — holding a role called "admin" that carries no permissions gets
- * exactly the same 403 as holding no role at all, which is why `npm run seed` (which provisions the
- * catalog and the roles that carry it) is a prerequisite for this router doing anything.
- *
- * Each route says what it demands; the rows say who is granted it. The slugs below are checked at
- * compile time against `PERMISSION_CATALOG` in `rbac.defaults.ts`, while who holds them — and
- * whether the permission is active at all — is edited through this very router and takes effect on
- * the next request. `GET /auth/me` returns the caller's slugs, and a console rebuilds the same
- * ability from them with the same function the middleware used.
- *
- * Replaces the reference combo's `AdminController`. Mounted under `/auth/admin` by
- * create-auth-app.ts; `createTieredRouter` stands in for its
- * `@UseGuards(AuthGuard, AuthzGuard, AbilityGuard)` — see route-tiers.ts for why the tier is a
- * required argument rather than a decorator.
- */
-export function createAdminRouter(deps: AdminRouterDeps): RequestHandler {
-  const { auth, authentication, authorization } = deps;
-  const admin = createTieredRouter({ authentication, authorization });
-
-  admin.route("get", "/users", ability("users:read"), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const { search, page, limit } = req.query as Record<string, string | undefined>;
-      res.status(200).json(await auth.listUsers({ search, page: page ? Number(page) : undefined, limit: limit ? Number(limit) : undefined }));
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  admin.route("post", "/users", ability("users:manage"), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const body = req.body as Record<string, unknown>;
-      res.status(201).json(
-        await auth.createUser(
-          {
-            email: requireString(body.email, "email"),
-            password: requireString(body.password, "password"),
-            firstName: optionalString(body.firstName),
-            lastName: optionalString(body.lastName),
-            displayName: optionalString(body.displayName),
-            phone: optionalString(body.phone),
-            username: optionalString(body.username),
-            roles: Array.isArray(body.roles) ? body.roles.filter((role): role is string => typeof role === "string") : undefined,
-          },
-          req.auth!.sub,
-        ),
-      );
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  admin.route("get", "/users/:userId", ability("users:read"), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      res.status(200).json(await auth.getUser(requireString(req.params.userId, "userId")));
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  admin.route("patch", "/users/:userId", ability("users:manage"), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const body = req.body as Record<string, unknown>;
-      res.status(200).json(
-        await auth.updateUser(
-          requireString(req.params.userId, "userId"),
-          {
-            firstName: body.firstName === null ? null : optionalString(body.firstName),
-            lastName: body.lastName === null ? null : optionalString(body.lastName),
-            displayName: body.displayName === null ? null : optionalString(body.displayName),
-            phone: body.phone === null ? null : optionalString(body.phone),
-            username: body.username === null ? null : optionalString(body.username),
-            photo: body.photo === null ? null : optionalString(body.photo),
-          },
-          req.auth!.sub,
-        ),
-      );
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  admin.route("delete", "/users/:userId", ability("users:manage"), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const userId = requireString(req.params.userId, "userId");
-      if (userId === req.auth!.sub) throw new HttpError(403, "cannot delete your own account");
-      const body = (req.body ?? {}) as Record<string, unknown>;
-      await auth.deleteUser(userId, req.auth!.sub, optionalString(body.reason));
-      res.status(200).json({ ok: true });
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  admin.route("get", "/audit-log", ability("audit-log:read"), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const { userId, action, since, until, page, limit } = req.query as Record<string, string | undefined>;
-      res.status(200).json(
-        await auth.listAuditLog({ userId, action, since, until, page: page ? Number(page) : undefined, limit: limit ? Number(limit) : undefined }),
-      );
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  admin.route("get", "/permissions", ability("permissions:read"), async (_req: Request, res: Response, next: NextFunction) => {
-    try {
-      res.status(200).json(await auth.listPermissions());
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  admin.route("post", "/permissions", ability("permissions:define"), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const body = req.body as Record<string, unknown>;
-      res.status(201).json(
-        await auth.definePermission(
-          {
-            slug: requireString(body.slug, "slug"),
-            name: optionalString(body.name),
-            displayName: optionalString(body.displayName),
-            description: body.description === null ? null : optionalString(body.description),
-            group: optionalString(body.group),
-            groupOrder: typeof body.groupOrder === "number" ? body.groupOrder : undefined,
-            order: typeof body.order === "number" ? body.order : undefined,
-            isActive: typeof body.isActive === "boolean" ? body.isActive : undefined,
-          },
-          req.auth!.sub,
-        ),
-      );
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  admin.route("get", "/roles", ability("roles:manage"), async (_req: Request, res: Response, next: NextFunction) => {
-    try {
-      res.status(200).json(await auth.listRoles());
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  admin.route("post", "/roles", ability("roles:manage"), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const body = req.body as Record<string, unknown>;
-      res.status(201).json(
-        await auth.createRole(
-          {
-            slug: requireString(body.slug, "slug"),
-            name: optionalString(body.name),
-            displayName: optionalString(body.displayName),
-            description: optionalString(body.description) ?? null,
-          },
-          req.auth!.sub,
-        ),
-      );
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  admin.route("patch", "/roles/:roleId", ability("roles:manage"), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const body = req.body as Record<string, unknown>;
-      res.status(200).json(
-        await auth.updateRole(
-          requireString(req.params.roleId, "roleId"),
-          {
-            name: optionalString(body.name),
-            displayName: optionalString(body.displayName),
-            description: body.description === null ? null : optionalString(body.description),
-            isActive: typeof body.isActive === "boolean" ? body.isActive : undefined,
-          },
-          req.auth!.sub,
-        ),
-      );
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  admin.route("delete", "/roles/:roleId", ability("roles:manage"), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const body = (req.body ?? {}) as Record<string, unknown>;
-      await auth.deleteRole(requireString(req.params.roleId, "roleId"), req.auth!.sub, optionalString(body.reason));
-      res.status(200).json({ ok: true });
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  admin.route("post", "/roles/:roleId/permissions", ability("roles:manage"), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const body = req.body as Record<string, unknown>;
-      await auth.attachPermissionToRole(requireString(req.params.roleId, "roleId"), requireString(body.permission, "permission"), req.auth!.sub);
-      res.status(201).json({ ok: true });
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  admin.route("post", "/users/:userId/roles", ability("roles:assign"), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const body = req.body as Record<string, unknown>;
-      await auth.assignRole(requireString(req.params.userId, "userId"), requireString(body.role, "role"));
-      res.status(201).json({ ok: true });
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  admin.route("post", "/users/:userId/roles/:roleSlug/revoke", ability("roles:assign"), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const userId = requireString(req.params.userId, "userId");
-      // Revoking your own `admin` would strip the very permission that let you call this,
-      // with no route back in. Assigning to yourself is fine — it can't lock anyone out.
-      if (userId === req.auth!.sub) throw new HttpError(403, "cannot change your own roles");
-      await auth.revokeRole(userId, requireString(req.params.roleSlug, "roleSlug"));
-      res.status(201).json({ ok: true });
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  admin.route("post", "/users/:userId/permissions", ability("permissions:grant"), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const body = req.body as Record<string, unknown>;
-      await auth.grantPermission(requireString(req.params.userId, "userId"), requireString(body.permission, "permission"), req.auth!.sub);
-      res.status(201).json({ ok: true });
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  admin.route("post", "/users/:userId/permissions/:permissionSlug/revoke", ability("permissions:grant"), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      await auth.revokePermission(requireString(req.params.userId, "userId"), requireString(req.params.permissionSlug, "permissionSlug"));
-      res.status(201).json({ ok: true });
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  admin.route("post", "/users/:userId/block", ability("users:block"), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const userId = requireString(req.params.userId, "userId");
-      if (userId === req.auth!.sub) throw new HttpError(403, "cannot block your own account");
-      await auth.block(userId, { userId: req.auth!.sub, ip: req.ip });
-      res.status(201).json({ ok: true });
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  admin.route("post", "/users/:userId/unblock", ability("users:block"), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      await auth.unblock(requireString(req.params.userId, "userId"), { userId: req.auth!.sub, ip: req.ip });
-      res.status(201).json({ ok: true });
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  admin.route("post", "/users/:userId/deactivate", ability("users:block"), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const userId = requireString(req.params.userId, "userId");
-      if (userId === req.auth!.sub) throw new HttpError(403, "cannot deactivate your own account");
-      await auth.deactivate(userId, { userId: req.auth!.sub, ip: req.ip });
-      res.status(201).json({ ok: true });
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  admin.route("post", "/users/:userId/activate", ability("users:block"), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      await auth.activate(requireString(req.params.userId, "userId"), { userId: req.auth!.sub, ip: req.ip });
-      res.status(201).json({ ok: true });
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  return admin.handler;
-}