@simple-auth-kit/cli 1.4.3 → 1.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@simple-auth-kit/cli",
-  "version": "1.4.3",
+  "version": "1.5.0",
   "license": "MIT",
   "description": "simple-auth-kit add <combo> — copies registry source (backend combos, admin consoles, mobile apps) into a consumer repo, shadcn-CLI-style. Nothing is ever installed as a runtime dependency of the consumer.",
   "bin": {

package/registry/combos/express-drizzle/shared/src/{auth-core-error.middleware.ts → middleware/auth-core-error.middleware.ts}

@@ -1,6 +1,6 @@
 import type { NextFunction, Request, Response } from "express";
 import { AuthCoreError } from "@/lib/auth/core/types.js";
-import { HttpError } from "./http-error.js";
+import { HttpError } from "../http-error.js";
 
 /**
  * Replaces the reference combo's `AuthCoreErrorFilter` (a Nest global `@Catch` exception
@@ -11,19 +11,32 @@ import { HttpError } from "./http-error.js";
  * maps this combo's own `HttpError` to its intended status code — the plain-Express stand-in
  * for the NestJS exception classes the reference throws.
  */
-export function authCoreErrorMiddleware(err: unknown, _req: Request, res: Response, next: NextFunction): void {
+export function authCoreErrorMiddleware(
+  err: unknown,
+  _req: Request,
+  res: Response,
+  next: NextFunction,
+): void {
   if (res.headersSent) {
     next(err);
     return;
   }
 
   if (err instanceof AuthCoreError) {
-    res.status(401).json({ statusCode: 401, code: err.code, message: err.message });
+    res
+      .status(401)
+      .json({ statusCode: 401, code: err.code, message: err.message });
     return;
   }
 
   if (err instanceof HttpError) {
-    res.status(err.statusCode).json({ statusCode: err.statusCode, code: err.name, message: err.message });
+    res
+      .status(err.statusCode)
+      .json({
+        statusCode: err.statusCode,
+        code: err.name,
+        message: err.message,
+      });
     return;
   }
 

package/registry/combos/express-drizzle/shared/src/{auth.middleware.ts → middleware/auth.middleware.ts}

@@ -1,8 +1,8 @@
 import type { NextFunction, Request, Response } from "express";
 import { verifyAccessToken } from "@/lib/auth/core/token-service.js";
-import { KeyProviderService } from "./key-provider.js";
-import "./request-context.js";
-import { SessionRepository } from "./session.repository.js";
+import { KeyProviderService } from "../key-provider.js";
+import "../request-context.js";
+import { SessionRepository } from "../repositories/session.repository.js";
 
 /**
  * Authentication only — proves who the caller is and populates `req.auth`. Authorization
@@ -13,17 +13,33 @@ import { SessionRepository } from "./session.repository.js";
  * `CanActivate`). Express has no guard/decorator system, so this is a plain factory function
  * returning a request handler — mount it directly on whichever routes need it.
  */
-export function createAuthMiddleware(keys: KeyProviderService, sessions: SessionRepository) {
-  return async function authMiddleware(req: Request, res: Response, next: NextFunction): Promise<void> {
+export function createAuthMiddleware(
+  keys: KeyProviderService,
+  sessions: SessionRepository,
+) {
+  return async function authMiddleware(
+    req: Request,
+    res: Response,
+    next: NextFunction,
+  ): Promise<void> {
     const header = req.headers["authorization"];
     if (!header?.startsWith("Bearer ")) {
-      res.status(401).json({ statusCode: 401, code: "UNAUTHORIZED", message: "missing bearer token" });
+      res
+        .status(401)
+        .json({
+          statusCode: 401,
+          code: "UNAUTHORIZED",
+          message: "missing bearer token",
+        });
       return;
     }
 
     try {
       req.auth = await verifyAccessToken(
-        { secret: keys.secret, isDenylisted: (jti) => sessions.isDenylisted(jti) },
+        {
+          secret: keys.secret,
+          isDenylisted: (jti) => sessions.isDenylisted(jti),
+        },
         header.slice("Bearer ".length),
       );
       next();

package/registry/combos/{express-prisma/shared/src → express-drizzle/shared/src/middleware}/response-envelope.middleware.ts

@@ -36,10 +36,22 @@ export function responseEnvelope(): RequestHandler {
     const originalJson = res.json.bind(res);
     res.json = ((body: unknown) => {
       if (res.statusCode >= 400) {
-        const shaped = body && typeof body === "object" ? (body as Record<string, unknown>) : { message: body };
-        return originalJson({ success: false, statusCode: res.statusCode, ...shaped });
+        const shaped =
+          body && typeof body === "object"
+            ? (body as Record<string, unknown>)
+            : { message: body };
+        return originalJson({
+          success: false,
+          statusCode: res.statusCode,
+          ...shaped,
+        });
       }
-      return originalJson({ success: true, statusCode: res.statusCode, message: deriveMessage(req.method), data: body });
+      return originalJson({
+        success: true,
+        statusCode: res.statusCode,
+        message: deriveMessage(req.method),
+        data: body,
+      });
     }) as typeof res.json;
     next();
   };

package/registry/combos/express-drizzle/shared/src/{oauth.repository.ts → repositories/oauth.repository.ts}

@@ -1,9 +1,9 @@
 import { and, eq } from "drizzle-orm";
 import type { NodePgDatabase } from "drizzle-orm/node-postgres";
 import type { OAuthStoreDeps } from "@/lib/auth/core/oauth.js";
-import { HttpError } from "./http-error.js";
-import * as schema from "./schema.js";
-import { toId } from "./id.helper.js";
+import { HttpError } from "../http-error.js";
+import * as schema from "../schema.js";
+import { toId } from "../id.helper.js";
 
 /**
  * Plain class, no decorators — Drizzle-specific implementation of `OAuthStoreDeps`
@@ -12,16 +12,29 @@ import { toId } from "./id.helper.js";
 export class OAuthRepository implements OAuthStoreDeps {
   constructor(private readonly db: NodePgDatabase<typeof schema>) {}
 
-  async findAccountByProvider(provider: string, providerAccountId: string): Promise<{ userId: string } | null> {
+  async findAccountByProvider(
+    provider: string,
+    providerAccountId: string,
+  ): Promise<{ userId: string } | null> {
     const [row] = await this.db
       .select()
       .from(schema.oauthAccounts)
-      .where(and(eq(schema.oauthAccounts.provider, provider), eq(schema.oauthAccounts.providerAccountId, providerAccountId)))
+      .where(
+        and(
+          eq(schema.oauthAccounts.provider, provider),
+          eq(schema.oauthAccounts.providerAccountId, providerAccountId),
+        ),
+      )
       .limit(1);
     return row ? { userId: row.userId.toString() } : null;
   }
 
-  async linkAccount(input: { userId: string; provider: string; providerAccountId: string; email?: string }): Promise<void> {
+  async linkAccount(input: {
+    userId: string;
+    provider: string;
+    providerAccountId: string;
+    email?: string;
+  }): Promise<void> {
     await this.db.insert(schema.oauthAccounts).values({
       userId: toId(input.userId),
       provider: input.provider,
@@ -31,13 +44,23 @@ export class OAuthRepository implements OAuthStoreDeps {
   }
 
   async findUserByVerifiedEmail(email: string): Promise<{ id: string } | null> {
-    const [row] = await this.db.select().from(schema.users).where(eq(schema.users.email, email)).limit(1);
+    const [row] = await this.db
+      .select()
+      .from(schema.users)
+      .where(eq(schema.users.email, email))
+      .limit(1);
     return row ? { id: row.id.toString() } : null;
   }
 
   /** OAuth-only signup: no password is ever set, which is why `User.passwordHash` is nullable. */
-  async createUserFromOAuth(input: { email?: string }): Promise<{ id: string }> {
-    if (!input.email) throw new HttpError(400, "OAuth provider did not return an email address");
+  async createUserFromOAuth(input: {
+    email?: string;
+  }): Promise<{ id: string }> {
+    if (!input.email)
+      throw new HttpError(
+        400,
+        "OAuth provider did not return an email address",
+      );
     const [row] = await this.db
       .insert(schema.users)
       .values({ email: input.email, passwordHash: null })

package/registry/combos/express-drizzle/shared/src/repositories/password-reset.repository.ts

@@ -0,0 +1,59 @@
+import { eq } from "drizzle-orm";
+import type { NodePgDatabase } from "drizzle-orm/node-postgres";
+import type { PasswordResetStoreDeps } from "@/lib/auth/core/password-reset.js";
+import * as schema from "../schema.js";
+import { toId } from "../id.helper.js";
+
+/**
+ * Plain class, no decorators — Drizzle-specific implementation of `PasswordResetStoreDeps`
+ * (registry/core/password-reset.js), mirroring the reference combo's PasswordResetRepository.
+ */
+export class PasswordResetRepository implements PasswordResetStoreDeps {
+  constructor(private readonly db: NodePgDatabase<typeof schema>) {}
+
+  async saveResetToken(input: {
+    userId: string;
+    tokenHash: string;
+    expiresAt: string;
+  }): Promise<void> {
+    await this.db.insert(schema.passwordResetTokens).values({
+      userId: toId(input.userId),
+      tokenHash: input.tokenHash,
+      expiresAt: new Date(input.expiresAt),
+    });
+  }
+
+  async findValidResetToken(
+    tokenHash: string,
+  ): Promise<{
+    userId: string;
+    expiresAt: string;
+    consumedAt: string | null;
+  } | null> {
+    const [row] = await this.db
+      .select()
+      .from(schema.passwordResetTokens)
+      .where(eq(schema.passwordResetTokens.tokenHash, tokenHash))
+      .limit(1);
+    if (!row) return null;
+    return {
+      userId: row.userId.toString(),
+      expiresAt: row.expiresAt.toISOString(),
+      consumedAt: row.consumedAt?.toISOString() ?? null,
+    };
+  }
+
+  async consumeResetToken(tokenHash: string): Promise<void> {
+    await this.db
+      .update(schema.passwordResetTokens)
+      .set({ consumedAt: new Date() })
+      .where(eq(schema.passwordResetTokens.tokenHash, tokenHash));
+  }
+
+  async setPasswordHash(userId: string, passwordHash: string): Promise<void> {
+    await this.db
+      .update(schema.users)
+      .set({ passwordHash })
+      .where(eq(schema.users.id, toId(userId)));
+  }
+}

package/registry/combos/express-drizzle/shared/src/{session.repository.ts → repositories/session.repository.ts}

@@ -1,12 +1,16 @@
 import { randomUUID } from "node:crypto";
 import { and, eq, isNull, ne, sql } from "drizzle-orm";
 import type { SessionStoreDeps } from "@/lib/auth/core/session-policy.js";
-import type { AuditEvent, Revoker, SessionRecord } from "@/lib/auth/core/types.js";
+import type {
+  AuditEvent,
+  Revoker,
+  SessionRecord,
+} from "@/lib/auth/core/types.js";
 import { AuditLogRepository } from "./audit-log.repository.js";
-import type { AuthConfig } from "./auth.config.js";
-import type { Database } from "./db.js";
-import { denylistedAccessTokens, sessions } from "./schema.js";
-import { toId, toIdOrNull } from "./id.helper.js";
+import type { AuthConfig } from "../auth.config.js";
+import type { Database } from "../db.js";
+import { denylistedAccessTokens, sessions } from "../schema.js";
+import { toId, toIdOrNull } from "../id.helper.js";
 
 function toSessionRecord(row: typeof sessions.$inferSelect): SessionRecord {
   return {
@@ -53,7 +57,11 @@ export class SessionRepository implements SessionStoreDeps {
   }
 
   async findSession(id: string): Promise<SessionRecord | null> {
-    const [row] = await this.db.select().from(sessions).where(eq(sessions.id, toId(id))).limit(1);
+    const [row] = await this.db
+      .select()
+      .from(sessions)
+      .where(eq(sessions.id, toId(id)))
+      .limit(1);
     return row ? toSessionRecord(row) : null;
   }
 
@@ -81,7 +89,12 @@ export class SessionRepository implements SessionStoreDeps {
    * `createdBy` is the user themselves. A session is only ever created by the person logging in,
    * so recording it costs nothing and leaves the column meaningful rather than always null.
    */
-  async createSession(input: { userId: string; userAgent?: string; ip?: string; provider?: string }): Promise<SessionRecord> {
+  async createSession(input: {
+    userId: string;
+    userAgent?: string;
+    ip?: string;
+    provider?: string;
+  }): Promise<SessionRecord> {
     const userIdBig = toId(input.userId);
     const [row] = await this.db
       .insert(sessions)
@@ -102,15 +115,33 @@ export class SessionRepository implements SessionStoreDeps {
   async revokeAllByUser(userId: string, revoker?: Revoker): Promise<void> {
     await this.db
       .update(sessions)
-      .set({ ...revocationFields(revoker), sessionVersion: sql`${sessions.sessionVersion} + 1` })
-      .where(and(eq(sessions.userId, toId(userId)), isNull(sessions.revokedAt)));
+      .set({
+        ...revocationFields(revoker),
+        sessionVersion: sql`${sessions.sessionVersion} + 1`,
+      })
+      .where(
+        and(eq(sessions.userId, toId(userId)), isNull(sessions.revokedAt)),
+      );
   }
 
-  async revokeAllByUserExcept(userId: string, keepSessionId: string, revoker?: Revoker): Promise<void> {
+  async revokeAllByUserExcept(
+    userId: string,
+    keepSessionId: string,
+    revoker?: Revoker,
+  ): Promise<void> {
     await this.db
       .update(sessions)
-      .set({ ...revocationFields(revoker), sessionVersion: sql`${sessions.sessionVersion} + 1` })
-      .where(and(eq(sessions.userId, toId(userId)), ne(sessions.id, toId(keepSessionId)), isNull(sessions.revokedAt)));
+      .set({
+        ...revocationFields(revoker),
+        sessionVersion: sql`${sessions.sessionVersion} + 1`,
+      })
+      .where(
+        and(
+          eq(sessions.userId, toId(userId)),
+          ne(sessions.id, toId(keepSessionId)),
+          isNull(sessions.revokedAt),
+        ),
+      );
   }
 
   async denylistJti(jti: string, ttlSeconds: number): Promise<void> {
@@ -118,11 +149,18 @@ export class SessionRepository implements SessionStoreDeps {
     await this.db
       .insert(denylistedAccessTokens)
       .values({ jti, expiresAt })
-      .onConflictDoUpdate({ target: denylistedAccessTokens.jti, set: { expiresAt } });
+      .onConflictDoUpdate({
+        target: denylistedAccessTokens.jti,
+        set: { expiresAt },
+      });
   }
 
   async isDenylisted(jti: string): Promise<boolean> {
-    const [row] = await this.db.select().from(denylistedAccessTokens).where(eq(denylistedAccessTokens.jti, jti)).limit(1);
+    const [row] = await this.db
+      .select()
+      .from(denylistedAccessTokens)
+      .where(eq(denylistedAccessTokens.jti, jti))
+      .limit(1);
     if (!row) return false;
     if (row.expiresAt.getTime() < Date.now()) return false; // expired; a cleanup job reaps these, see Phase 6
     return true;

package/registry/combos/express-drizzle/shared/src/{two-factor.repository.ts → repositories/two-factor.repository.ts}

@@ -1,7 +1,7 @@
 import { and, eq, isNull } from "drizzle-orm";
 import type { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { verifyBackupCode } from "@/lib/auth/core/two-factor.js";
-import * as schema from "./schema.js";
+import * as schema from "../schema.js";
 
 /**
  * Plain class, no decorators — Drizzle-specific implementation mirroring the reference
@@ -15,24 +15,38 @@ export class TwoFactorRepository {
 
   /** Replaces any prior set — re-confirming enrollment invalidates old backup codes. */
   async saveBackupCodes(userId: bigint, hashes: string[]): Promise<void> {
-    await this.db.delete(schema.twoFactorBackupCodes).where(eq(schema.twoFactorBackupCodes.userId, userId));
+    await this.db
+      .delete(schema.twoFactorBackupCodes)
+      .where(eq(schema.twoFactorBackupCodes.userId, userId));
     if (hashes.length === 0) return;
-    await this.db.insert(schema.twoFactorBackupCodes).values(hashes.map((codeHash) => ({ userId, codeHash })));
+    await this.db
+      .insert(schema.twoFactorBackupCodes)
+      .values(hashes.map((codeHash) => ({ userId, codeHash })));
   }
 
   async consumeBackupCode(userId: bigint, code: string): Promise<boolean> {
     const unused = await this.db
       .select()
       .from(schema.twoFactorBackupCodes)
-      .where(and(eq(schema.twoFactorBackupCodes.userId, userId), isNull(schema.twoFactorBackupCodes.usedAt)));
+      .where(
+        and(
+          eq(schema.twoFactorBackupCodes.userId, userId),
+          isNull(schema.twoFactorBackupCodes.usedAt),
+        ),
+      );
     const match = unused.find((row) => verifyBackupCode(code, row.codeHash));
     if (!match) return false;
 
-    await this.db.update(schema.twoFactorBackupCodes).set({ usedAt: new Date() }).where(eq(schema.twoFactorBackupCodes.id, match.id));
+    await this.db
+      .update(schema.twoFactorBackupCodes)
+      .set({ usedAt: new Date() })
+      .where(eq(schema.twoFactorBackupCodes.id, match.id));
     return true;
   }
 
   async clearBackupCodes(userId: bigint): Promise<void> {
-    await this.db.delete(schema.twoFactorBackupCodes).where(eq(schema.twoFactorBackupCodes.userId, userId));
+    await this.db
+      .delete(schema.twoFactorBackupCodes)
+      .where(eq(schema.twoFactorBackupCodes.userId, userId));
   }
 }

package/registry/combos/express-drizzle/shared/src/request-context.ts

@@ -20,7 +20,7 @@
 // `declare module "express"`.
 import type { AccessTokenClaims } from "@/lib/auth/core/types.js";
 import type { AppAbility } from "./ability.js";
-import type { AuthzContext } from "./authz.middleware.js";
+import type { AuthzContext } from "./middleware/authz.middleware.js";
 
 declare global {
   // Express's own declaration-merging style for augmenting its Request type requires a