@simple-auth-kit/cli 1.4.2 → 1.5.0

package/registry/combos/express-drizzle/variants/workspaces/src/create-auth-app.ts

@@ -3,27 +3,33 @@ import swaggerUi from "swagger-ui-express";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { Pool } from "pg";
 import type { RateLimitDeps } from "@/lib/auth/core/rate-limit.js";
-import { createAdminRouter } from "./admin.router.js";
-import { AuditLogRepository } from "./audit-log.repository.js";
-import { authCoreErrorMiddleware } from "./auth-core-error.middleware.js";
+import { createAdminRouter } from "./routers/admin.router.js";
+import { AuditLogRepository } from "./repositories/audit-log.repository.js";
+import { authCoreErrorMiddleware } from "./middleware/auth-core-error.middleware.js";
 import { AuthConfig, defaultAuthConfig } from "./auth.config.js";
-import { createAuthMiddleware } from "./auth.middleware.js";
-import { createAuthRouter } from "./auth.router.js";
-import { AuthService } from "./auth.service.js";
-import { createAuthzMiddleware, createWorkspaceMiddleware } from "./authz.middleware.js";
+import { createAuthMiddleware } from "./middleware/auth.middleware.js";
+import { createAuthRouter } from "./routers/auth.router.js";
+import { AuthService } from "./services/auth.service.js";
+import {
+  createAuthzMiddleware,
+  createWorkspaceMiddleware,
+} from "./middleware/authz.middleware.js";
 import { KeyProviderService } from "./key-provider.js";
-import { OAuthRepository } from "./oauth.repository.js";
+import { OAuthRepository } from "./repositories/oauth.repository.js";
 import { openApiSpec } from "./openapi-spec.js";
-import { PasswordResetRepository } from "./password-reset.repository.js";
-import { InMemoryPermissionCacheStore, PermissionCache } from "./permission-cache.js";
+import { PasswordResetRepository } from "./repositories/password-reset.repository.js";
+import {
+  InMemoryPermissionCacheStore,
+  PermissionCache,
+} from "./permission-cache.js";
 import { InMemoryRateLimitStore } from "./rate-limit.store.js";
-import { RbacRepository } from "./rbac.repository.js";
-import { responseEnvelope } from "./response-envelope.middleware.js";
+import { RbacRepository } from "./repositories/rbac.repository.js";
+import { responseEnvelope } from "./middleware/response-envelope.middleware.js";
 import * as schema from "./schema.js";
-import { SessionRepository } from "./session.repository.js";
-import { TwoFactorRepository } from "./two-factor.repository.js";
-import { createWorkspaceRouter } from "./workspace.router.js";
-import { WorkspaceRepository } from "./workspace.repository.js";
+import { SessionRepository } from "./repositories/session.repository.js";
+import { TwoFactorRepository } from "./repositories/two-factor.repository.js";
+import { createWorkspaceRouter } from "./routers/workspace.router.js";
+import { WorkspaceRepository } from "./repositories/workspace.repository.js";
 
 /**
  * Factory wiring a Drizzle `NodePgDatabase` (from a `pg.Pool`) plus all the plain classes,
@@ -41,23 +47,41 @@ export function createAuthApp(config: Partial<AuthConfig> = {}): Express {
   const keys = new KeyProviderService();
   // Swap the store for a Redis-backed one by passing `rateLimitStore` in `config` — nothing in
   // this library's source changes.
-  const rateLimit: RateLimitDeps = resolvedConfig.rateLimitStore ?? new InMemoryRateLimitStore();
+  const rateLimit: RateLimitDeps =
+    resolvedConfig.rateLimitStore ?? new InMemoryRateLimitStore();
   // The cache seam. Swap the store for a Redis-backed one by passing `permissionCacheStore` in
   // `config` — nothing in this library's source changes. Keys are namespaced simpleauthkit:authz:*.
-  const permissionCache = new PermissionCache(resolvedConfig.permissionCacheStore ?? new InMemoryPermissionCacheStore(), resolvedConfig);
+  const permissionCache = new PermissionCache(
+    resolvedConfig.permissionCacheStore ?? new InMemoryPermissionCacheStore(),
+    resolvedConfig,
+  );
   const rbac = new RbacRepository(db, permissionCache);
   const workspaces = new WorkspaceRepository(db, rbac);
   const twoFactor = new TwoFactorRepository(db);
   const oauth = new OAuthRepository(db);
   const passwordReset = new PasswordResetRepository(db);
-  const authService = new AuthService(db, sessions, keys, rateLimit, auditLog, rbac, twoFactor, oauth, passwordReset, resolvedConfig);
+  const authService = new AuthService(
+    db,
+    sessions,
+    keys,
+    rateLimit,
+    auditLog,
+    rbac,
+    twoFactor,
+    oauth,
+    passwordReset,
+    resolvedConfig,
+  );
 
   const requireAuth = createAuthMiddleware(keys, sessions);
   // Roles belong to a workspace membership, resolved from the database on the request that names
   // the workspace. `requireAuthz` tolerates a request that names none (GET /auth/me answers with
   // empty roles); `requireWorkspace` does not. See authz.middleware.ts.
   const requireAuthz = createAuthzMiddleware({ rbac, cache: permissionCache });
-  const requireWorkspace = createWorkspaceMiddleware({ rbac, cache: permissionCache });
+  const requireWorkspace = createWorkspaceMiddleware({
+    rbac,
+    cache: permissionCache,
+  });
 
   if (!resolvedConfig.permissionCacheStore || !resolvedConfig.rateLimitStore) {
     console.warn(
@@ -71,11 +95,33 @@ export function createAuthApp(config: Partial<AuthConfig> = {}): Express {
   const app = express();
   app.use(express.json());
   app.use(responseEnvelope());
-  app.use("/auth/admin", createAdminRouter({ auth: authService, workspaces, authentication: requireAuth, workspaceScope: requireWorkspace }));
-  app.use("/auth", createAuthRouter({ auth: authService, config: resolvedConfig, authentication: requireAuth, authorization: requireAuthz }));
+  app.use(
+    "/auth/admin",
+    createAdminRouter({
+      auth: authService,
+      workspaces,
+      authentication: requireAuth,
+      workspaceScope: requireWorkspace,
+    }),
+  );
+  app.use(
+    "/auth",
+    createAuthRouter({
+      auth: authService,
+      config: resolvedConfig,
+      authentication: requireAuth,
+      authorization: requireAuthz,
+    }),
+  );
   app.use(
     "/workspaces",
-    createWorkspaceRouter({ workspaces, rbac, authentication: requireAuth, authorization: requireAuthz, workspaceScope: requireWorkspace }),
+    createWorkspaceRouter({
+      workspaces,
+      rbac,
+      authentication: requireAuth,
+      authorization: requireAuthz,
+      workspaceScope: requireWorkspace,
+    }),
   );
   // Hand-authored OpenAPI spec (see openapi-spec.ts) — this combo has no NestJS decorators to
   // generate one from, so it's served as static JSON, same as the nestjs-* combos' /docs-json.

package/registry/combos/express-drizzle/variants/workspaces/src/{authz.middleware.ts → middleware/authz.middleware.ts}

@@ -1,9 +1,12 @@
 import type { NextFunction, Request, RequestHandler, Response } from "express";
-import { defineAbilitiesFor } from "./ability.js";
-import { HttpError } from "./http-error.js";
-import type { PermissionCache } from "./permission-cache.js";
-import { memberCacheKey, type RbacRepository } from "./rbac.repository.js";
-import "./request-context.js";
+import { defineAbilitiesFor } from "../ability.js";
+import { HttpError } from "../http-error.js";
+import type { PermissionCache } from "../permission-cache.js";
+import {
+  memberCacheKey,
+  type RbacRepository,
+} from "../repositories/rbac.repository.js";
+import "../request-context.js";
 
 export const WORKSPACE_HEADER = "x-workspace-id";
 
@@ -45,10 +48,14 @@ async function resolve(deps: AuthzMiddlewareDeps, req: Request): Promise<void> {
   if (req.authz) return;
 
   const workspaceId = req.headers[WORKSPACE_HEADER];
-  if (!req.auth || typeof workspaceId !== "string" || workspaceId.length === 0) return;
+  if (!req.auth || typeof workspaceId !== "string" || workspaceId.length === 0)
+    return;
 
   const userId = req.auth.sub;
-  const authz = await deps.cache.resolve<AuthzContext>(memberCacheKey(userId, workspaceId), () => deps.rbac.resolveAuthzContext(userId, workspaceId));
+  const authz = await deps.cache.resolve<AuthzContext>(
+    memberCacheKey(userId, workspaceId),
+    () => deps.rbac.resolveAuthzContext(userId, workspaceId),
+  );
   // Deliberately the same answer for "no such workspace" and "not your workspace": a caller
   // outside a workspace must not be able to probe whether it exists.
   if (!authz) throw new HttpError(403, "not a member of this workspace");
@@ -65,8 +72,14 @@ async function resolve(deps: AuthzMiddlewareDeps, req: Request): Promise<void> {
  *
  * Replaces the reference combo's `AuthzGuard`.
  */
-export function createAuthzMiddleware(deps: AuthzMiddlewareDeps): RequestHandler {
-  return async function authzMiddleware(req: Request, _res: Response, next: NextFunction): Promise<void> {
+export function createAuthzMiddleware(
+  deps: AuthzMiddlewareDeps,
+): RequestHandler {
+  return async function authzMiddleware(
+    req: Request,
+    _res: Response,
+    next: NextFunction,
+  ): Promise<void> {
     try {
       await resolve(deps, req);
       next();
@@ -81,11 +94,18 @@ export function createAuthzMiddleware(deps: AuthzMiddlewareDeps): RequestHandler
  *
  * Replaces the reference combo's `WorkspaceGuard`.
  */
-export function createWorkspaceMiddleware(deps: AuthzMiddlewareDeps): RequestHandler {
-  return async function workspaceMiddleware(req: Request, _res: Response, next: NextFunction): Promise<void> {
+export function createWorkspaceMiddleware(
+  deps: AuthzMiddlewareDeps,
+): RequestHandler {
+  return async function workspaceMiddleware(
+    req: Request,
+    _res: Response,
+    next: NextFunction,
+  ): Promise<void> {
     try {
       await resolve(deps, req);
-      if (!req.authz) throw new HttpError(403, `${WORKSPACE_HEADER} header is required`);
+      if (!req.authz)
+        throw new HttpError(403, `${WORKSPACE_HEADER} header is required`);
       next();
     } catch (err) {
       next(err);

package/registry/combos/express-drizzle/variants/workspaces/src/openapi-workspace.ts

@@ -1,8 +1,13 @@
 // The workspace-membership half of the OpenAPI document. Mirrors the reference combo's
 // `dto/workspace.dto.ts`; merged into the administration fragment by openapi-admin.ts, which is
 // what openapi-spec.ts assembles into the document.
-import { errorResponse, missingPermission, requiresPermission, type OpenApiFragment } from "./openapi-fragment.js";
-import { WORKSPACE_HEADER } from "./authz.middleware.js";
+import {
+  errorResponse,
+  missingPermission,
+  requiresPermission,
+  type OpenApiFragment,
+} from "./openapi-fragment.js";
+import { WORKSPACE_HEADER } from "./middleware/authz.middleware.js";
 
 /** Every route that acts *inside* a workspace names it with this header, never a path segment. */
 export const workspaceHeaderParameter = {
@@ -10,7 +15,8 @@ export const workspaceHeaderParameter = {
   in: "header",
   required: true,
   schema: { type: "string" },
-  description: "The workspace this request acts in. The caller must be a member of it.",
+  description:
+    "The workspace this request acts in. The caller must be a member of it.",
 };
 
 export const workspaceSpec: OpenApiFragment = {
@@ -18,7 +24,14 @@ export const workspaceSpec: OpenApiFragment = {
 
   // `GET /auth/me` works with or without it: named, it answers with that workspace's roles;
   // omitted, with none.
-  scopeParameters: [{ ...workspaceHeaderParameter, required: false, description: "Answer for this workspace. Omitted, `roles` and `permissions` come back empty." }],
+  scopeParameters: [
+    {
+      ...workspaceHeaderParameter,
+      required: false,
+      description:
+        "Answer for this workspace. Omitted, `roles` and `permissions` come back empty.",
+    },
+  ],
 
   schemas: {
     CreateWorkspaceRequest: {
@@ -32,15 +45,27 @@ export const workspaceSpec: OpenApiFragment = {
       type: "object",
       required: ["email"],
       properties: {
-        email: { type: "string", description: "Must already be a registered user — this library has no invite flow" },
-        roles: { type: "array", items: { type: "string" }, description: 'Defaults to ["member"]' },
+        email: {
+          type: "string",
+          description:
+            "Must already be a registered user — this library has no invite flow",
+        },
+        roles: {
+          type: "array",
+          items: { type: "string" },
+          description: 'Defaults to ["member"]',
+        },
       },
     },
     SetMemberRolesRequest: {
       type: "object",
       required: ["roles"],
       properties: {
-        roles: { type: "array", items: { type: "string" }, description: "Replaces the member's whole role set" },
+        roles: {
+          type: "array",
+          items: { type: "string" },
+          description: "Replaces the member's whole role set",
+        },
       },
     },
     WorkspaceSummary: {
@@ -50,7 +75,11 @@ export const workspaceSpec: OpenApiFragment = {
         id: { type: "string" },
         name: { type: "string" },
         createdAt: { type: "string", format: "date-time" },
-        roles: { type: "array", items: { type: "string" }, description: "The calling user's roles in this workspace" },
+        roles: {
+          type: "array",
+          items: { type: "string" },
+          description: "The calling user's roles in this workspace",
+        },
       },
     },
     MembershipSummary: {
@@ -84,23 +113,43 @@ export const workspaceSpec: OpenApiFragment = {
         security: [{ bearerAuth: [] }],
         requestBody: {
           required: true,
-          content: { "application/json": { schema: { $ref: "#/components/schemas/CreateWorkspaceRequest" } } },
+          content: {
+            "application/json": {
+              schema: { $ref: "#/components/schemas/CreateWorkspaceRequest" },
+            },
+          },
         },
         responses: {
-          "201": { description: "Created", content: { "application/json": { schema: { $ref: "#/components/schemas/WorkspaceSummary" } } } },
+          "201": {
+            description: "Created",
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/WorkspaceSummary" },
+              },
+            },
+          },
           "400": errorResponse("Missing required field"),
           "401": errorResponse("Missing or invalid access token"),
         },
       },
       get: {
         tags: ["workspaces"],
-        summary: "List the workspaces the current user belongs to, with their roles in each",
-        description: "Deliberately not permission-gated: it acts outside every workspace and only ever answers with the caller's own memberships.",
+        summary:
+          "List the workspaces the current user belongs to, with their roles in each",
+        description:
+          "Deliberately not permission-gated: it acts outside every workspace and only ever answers with the caller's own memberships.",
         security: [{ bearerAuth: [] }],
         responses: {
           "200": {
             description: "OK",
-            content: { "application/json": { schema: { type: "array", items: { $ref: "#/components/schemas/WorkspaceSummary" } } } },
+            content: {
+              "application/json": {
+                schema: {
+                  type: "array",
+                  items: { $ref: "#/components/schemas/WorkspaceSummary" },
+                },
+              },
+            },
           },
           "401": errorResponse("Missing or invalid access token"),
         },
@@ -110,16 +159,26 @@ export const workspaceSpec: OpenApiFragment = {
       get: {
         tags: ["workspaces"],
         summary: "List the members of the named workspace",
-        description: "Gated on membership of the named workspace rather than on a permission — seeing who else is in a room you are in is not an administrative capability.",
+        description:
+          "Gated on membership of the named workspace rather than on a permission — seeing who else is in a room you are in is not an administrative capability.",
         security: [{ bearerAuth: [] }],
         parameters: [workspaceHeaderParameter],
         responses: {
           "200": {
             description: "OK",
-            content: { "application/json": { schema: { type: "array", items: { $ref: "#/components/schemas/MembershipSummary" } } } },
+            content: {
+              "application/json": {
+                schema: {
+                  type: "array",
+                  items: { $ref: "#/components/schemas/MembershipSummary" },
+                },
+              },
+            },
           },
           "401": errorResponse("Missing or invalid access token"),
-          "403": errorResponse("Not a member of this workspace, or no workspace named"),
+          "403": errorResponse(
+            "Not a member of this workspace, or no workspace named",
+          ),
         },
       },
       post: {
@@ -130,13 +189,27 @@ export const workspaceSpec: OpenApiFragment = {
         parameters: [workspaceHeaderParameter],
         requestBody: {
           required: true,
-          content: { "application/json": { schema: { $ref: "#/components/schemas/AddMemberRequest" } } },
+          content: {
+            "application/json": {
+              schema: { $ref: "#/components/schemas/AddMemberRequest" },
+            },
+          },
         },
         responses: {
-          "201": { description: "Created", content: { "application/json": { schema: { $ref: "#/components/schemas/MembershipSummary" } } } },
+          "201": {
+            description: "Created",
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/MembershipSummary" },
+              },
+            },
+          },
           "400": errorResponse("Missing required field"),
           "401": errorResponse("Missing or invalid access token"),
-          "403": missingPermission("members:manage", "the request named no workspace you belong to"),
+          "403": missingPermission(
+            "members:manage",
+            "the request named no workspace you belong to",
+          ),
           "404": errorResponse("No user with that email"),
           "409": errorResponse("Already a member of this workspace"),
         },
@@ -150,17 +223,42 @@ export const workspaceSpec: OpenApiFragment = {
           requiresPermission("roles:assign") +
           " It deliberately shares that key with `POST /auth/admin/users/{userId}/roles` rather than minting one of its own: it is the same capability reached by a different path.",
         security: [{ bearerAuth: [] }],
-        parameters: [workspaceHeaderParameter, { name: "memberId", in: "path", required: true, schema: { type: "string" } }],
+        parameters: [
+          workspaceHeaderParameter,
+          {
+            name: "memberId",
+            in: "path",
+            required: true,
+            schema: { type: "string" },
+          },
+        ],
         requestBody: {
           required: true,
-          content: { "application/json": { schema: { $ref: "#/components/schemas/SetMemberRolesRequest" } } },
+          content: {
+            "application/json": {
+              schema: { $ref: "#/components/schemas/SetMemberRolesRequest" },
+            },
+          },
         },
         responses: {
-          "200": { description: "OK", content: { "application/json": { schema: { $ref: "#/components/schemas/MemberRolesResponse" } } } },
+          "200": {
+            description: "OK",
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/MemberRolesResponse" },
+              },
+            },
+          },
           "400": errorResponse("Missing required field"),
           "401": errorResponse("Missing or invalid access token"),
-          "403": missingPermission("roles:assign", "cannot change your own roles", "the request named no workspace you belong to"),
-          "404": errorResponse("Member not found in this workspace, or a role is not defined in it"),
+          "403": missingPermission(
+            "roles:assign",
+            "cannot change your own roles",
+            "the request named no workspace you belong to",
+          ),
+          "404": errorResponse(
+            "Member not found in this workspace, or a role is not defined in it",
+          ),
         },
       },
     },
@@ -168,13 +266,34 @@ export const workspaceSpec: OpenApiFragment = {
       delete: {
         tags: ["workspaces"],
         summary: "[admin] Remove a member from the named workspace",
-        description: requiresPermission("members:manage") + " Their direct permission grants go with the membership.",
+        description:
+          requiresPermission("members:manage") +
+          " Their direct permission grants go with the membership.",
         security: [{ bearerAuth: [] }],
-        parameters: [workspaceHeaderParameter, { name: "memberId", in: "path", required: true, schema: { type: "string" } }],
+        parameters: [
+          workspaceHeaderParameter,
+          {
+            name: "memberId",
+            in: "path",
+            required: true,
+            schema: { type: "string" },
+          },
+        ],
         responses: {
-          "200": { description: "OK", content: { "application/json": { schema: { $ref: "#/components/schemas/OkResponse" } } } },
+          "200": {
+            description: "OK",
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/OkResponse" },
+              },
+            },
+          },
           "401": errorResponse("Missing or invalid access token"),
-          "403": missingPermission("members:manage", "cannot remove yourself from a workspace you administer", "the request named no workspace you belong to"),
+          "403": missingPermission(
+            "members:manage",
+            "cannot remove yourself from a workspace you administer",
+            "the request named no workspace you belong to",
+          ),
           "404": errorResponse("Member not found in this workspace"),
         },
       },

package/registry/combos/express-drizzle/variants/workspaces/src/{audit-log.repository.ts → repositories/audit-log.repository.ts}

@@ -1,9 +1,14 @@
 import { and, count, desc, eq, gte, lte, type SQL } from "drizzle-orm";
 import type { NodePgDatabase } from "drizzle-orm/node-postgres";
 import type { AuditEvent } from "@/lib/auth/core/types.js";
-import { buildPageMeta, normalizeLimit, normalizePage, type Paginated } from "./pagination.js";
-import * as schema from "./schema.js";
-import { toIdOrNull, toIdOrUndefined } from "./id.helper.js";
+import {
+  buildPageMeta,
+  normalizeLimit,
+  normalizePage,
+  type Paginated,
+} from "../pagination.js";
+import * as schema from "../schema.js";
+import { toIdOrNull, toIdOrUndefined } from "../id.helper.js";
 
 export interface AuditLogEntry {
   id: string;
@@ -49,7 +54,10 @@ export function toAuditLogEntry(row: AuditLogRow): AuditLogEntry {
 /** "role_assigned" -> "Role assigned". Derived rather than passed in, so core never has to carry display text. */
 export function humanizeAction(action: string): string {
   const words = action.split("_");
-  return [words[0].charAt(0).toUpperCase() + words[0].slice(1), ...words.slice(1)].join(" ");
+  return [
+    words[0].charAt(0).toUpperCase() + words[0].slice(1),
+    ...words.slice(1),
+  ].join(" ");
 }
 
 /**
@@ -65,7 +73,10 @@ export class AuditLogRepository {
    * those happen to a user, not inside a workspace. Callers that *are* acting in a workspace
    * pass it, which is what scopes the admin audit-log read below.
    */
-  async append(event: AuditEvent, opts: { workspaceId?: string; remarks?: string } = {}): Promise<void> {
+  async append(
+    event: AuditEvent,
+    opts: { workspaceId?: string; remarks?: string } = {},
+  ): Promise<void> {
     await this.db.insert(schema.auditLogs).values({
       action: event.type,
       name: humanizeAction(event.type),
@@ -83,12 +94,17 @@ export class AuditLogRepository {
     const conditions: SQL[] = [];
 
     const workspaceIdBig = toIdOrUndefined(filter.workspaceId);
-    if (workspaceIdBig !== undefined) conditions.push(eq(schema.auditLogs.workspaceId, workspaceIdBig));
+    if (workspaceIdBig !== undefined)
+      conditions.push(eq(schema.auditLogs.workspaceId, workspaceIdBig));
     const userIdBig = toIdOrUndefined(filter.userId);
-    if (userIdBig !== undefined) conditions.push(eq(schema.auditLogs.userId, userIdBig));
-    if (filter.action) conditions.push(eq(schema.auditLogs.action, filter.action));
-    if (filter.since) conditions.push(gte(schema.auditLogs.createdAt, new Date(filter.since)));
-    if (filter.until) conditions.push(lte(schema.auditLogs.createdAt, new Date(filter.until)));
+    if (userIdBig !== undefined)
+      conditions.push(eq(schema.auditLogs.userId, userIdBig));
+    if (filter.action)
+      conditions.push(eq(schema.auditLogs.action, filter.action));
+    if (filter.since)
+      conditions.push(gte(schema.auditLogs.createdAt, new Date(filter.since)));
+    if (filter.until)
+      conditions.push(lte(schema.auditLogs.createdAt, new Date(filter.until)));
     const where = conditions.length ? and(...conditions) : undefined;
 
     const rows = await this.db
@@ -98,7 +114,10 @@ export class AuditLogRepository {
       .orderBy(desc(schema.auditLogs.createdAt), desc(schema.auditLogs.id))
       .limit(limit)
       .offset((page - 1) * limit);
-    const [{ value: total }] = await this.db.select({ value: count() }).from(schema.auditLogs).where(where);
+    const [{ value: total }] = await this.db
+      .select({ value: count() })
+      .from(schema.auditLogs)
+      .where(where);
 
     return { items: rows, meta: buildPageMeta(page, limit, total) };
   }