@simple-auth-kit/cli 1.4.3 → 1.5.0

package/registry/combos/express-prisma/variants/workspaces/src/{auth.service.ts → services/auth.service.ts}

@@ -10,8 +10,14 @@ import {
   signAppleClientSecret,
   verifyIdTokenAndExtractProfile,
 } from "@/lib/auth/core/oauth.js";
-import { requestPasswordReset as coreRequestPasswordReset, resetPassword as coreResetPassword } from "@/lib/auth/core/password-reset.js";
-import { checkRateLimit, type RateLimitDeps } from "@/lib/auth/core/rate-limit.js";
+import {
+  requestPasswordReset as coreRequestPasswordReset,
+  resetPassword as coreResetPassword,
+} from "@/lib/auth/core/password-reset.js";
+import {
+  checkRateLimit,
+  type RateLimitDeps,
+} from "@/lib/auth/core/rate-limit.js";
 import {
   blockUser,
   createSession,
@@ -22,22 +28,47 @@ import {
   revokeSession,
   rotateRefreshToken,
 } from "@/lib/auth/core/session-policy.js";
-import { signAccessToken, signRefreshToken, signTwoFactorChallengeToken, verifyRefreshToken, verifyTwoFactorChallengeToken } from "@/lib/auth/core/token-service.js";
-import { buildTotpProvisioningUri, generateBackupCodes, generateTotpSecret, verifyTotpCode } from "@/lib/auth/core/two-factor.js";
+import {
+  signAccessToken,
+  signRefreshToken,
+  signTwoFactorChallengeToken,
+  verifyRefreshToken,
+  verifyTwoFactorChallengeToken,
+} from "@/lib/auth/core/token-service.js";
+import {
+  buildTotpProvisioningUri,
+  generateBackupCodes,
+  generateTotpSecret,
+  verifyTotpCode,
+} from "@/lib/auth/core/two-factor.js";
 import type { Revoker } from "@/lib/auth/core/types.js";
-import type { AuthConfig } from "./auth.config.js";
-import { HttpError } from "./http-error.js";
-import type { AuthzContext } from "./authz.middleware.js";
-import { AuditLogEntry, AuditLogListFilter, AuditLogRepository, toAuditLogEntry } from "./audit-log.repository.js";
-import type { Paginated } from "./pagination.js";
-import { PrismaClient } from "../generated/prisma/client.js";
-import { KeyProviderService } from "./key-provider.js";
-import { OAuthRepository } from "./oauth.repository.js";
-import { PasswordResetRepository } from "./password-reset.repository.js";
-import { MemberListFilter, MemberListResult, MemberSummary, PermissionInput, PermissionSummary, RbacRepository, RoleSummary, toMemberSummary } from "./rbac.repository.js";
-import { SessionRepository } from "./session.repository.js";
-import { TwoFactorRepository } from "./two-factor.repository.js";
-import { toId, toIdOrNull } from "./id.helper.js";
+import type { AuthConfig } from "../auth.config.js";
+import { HttpError } from "../http-error.js";
+import type { AuthzContext } from "../middleware/authz.middleware.js";
+import {
+  AuditLogEntry,
+  AuditLogListFilter,
+  AuditLogRepository,
+  toAuditLogEntry,
+} from "../repositories/audit-log.repository.js";
+import type { Paginated } from "../pagination.js";
+import { PrismaClient } from "../../generated/prisma/client.js";
+import { KeyProviderService } from "../key-provider.js";
+import { OAuthRepository } from "../repositories/oauth.repository.js";
+import { PasswordResetRepository } from "../repositories/password-reset.repository.js";
+import {
+  MemberListFilter,
+  MemberListResult,
+  MemberSummary,
+  PermissionInput,
+  PermissionSummary,
+  RbacRepository,
+  RoleSummary,
+  toMemberSummary,
+} from "../repositories/rbac.repository.js";
+import { SessionRepository } from "../repositories/session.repository.js";
+import { TwoFactorRepository } from "../repositories/two-factor.repository.js";
+import { toId, toIdOrNull } from "../id.helper.js";
 
 export interface AuthTokens {
   accessToken: string;
@@ -92,7 +123,9 @@ export class AuthService {
     userAgent?: string;
     ip?: string;
   }): Promise<AuthTokens> {
-    const existing = await this.prisma.user.findUnique({ where: { email: input.email } });
+    const existing = await this.prisma.user.findUnique({
+      where: { email: input.email },
+    });
     if (existing) throw new HttpError(409, "email already registered");
 
     const passwordHash = await hashPassword(input.password);
@@ -107,82 +140,174 @@ export class AuthService {
         username: input.username,
       },
     });
-    return this.issueSessionTokens(user, { userAgent: input.userAgent, ip: input.ip });
+    return this.issueSessionTokens(user, {
+      userAgent: input.userAgent,
+      ip: input.ip,
+    });
   }
 
   /** Returns full tokens directly, or a short-lived challenge if the account has 2FA enabled — see `loginTwoFactor`. */
-  async login(input: { identifier: string; password: string; userAgent?: string; ip?: string }): Promise<AuthTokens | TwoFactorChallenge> {
-    const { allowed } = await checkRateLimit(this.rateLimit, "login", input.identifier);
+  async login(input: {
+    identifier: string;
+    password: string;
+    userAgent?: string;
+    ip?: string;
+  }): Promise<AuthTokens | TwoFactorChallenge> {
+    const { allowed } = await checkRateLimit(
+      this.rateLimit,
+      "login",
+      input.identifier,
+    );
     if (!allowed) throw new HttpError(429, "too many login attempts");
 
     const user = await this.prisma.user.findFirst({
-      where: { OR: [{ email: input.identifier }, { username: input.identifier }, { phone: input.identifier }] },
+      where: {
+        OR: [
+          { email: input.identifier },
+          { username: input.identifier },
+          { phone: input.identifier },
+        ],
+      },
     });
-    if (!user || user.blocked || !user.isActive || user.isDeleted || !user.passwordHash) throw new HttpError(401, "invalid credentials");
+    if (
+      !user ||
+      user.blocked ||
+      !user.isActive ||
+      user.isDeleted ||
+      !user.passwordHash
+    )
+      throw new HttpError(401, "invalid credentials");
 
     const valid = await verifyPassword(user.passwordHash, input.password);
     if (!valid) throw new HttpError(401, "invalid credentials");
 
     if (user.twoFactorEnabled) {
       const key = await this.keys.getActiveKey();
-      const { token } = await signTwoFactorChallengeToken({ activeKey: key }, user.id.toString()); // core-facing: sub must be string
+      const { token } = await signTwoFactorChallengeToken(
+        { activeKey: key },
+        user.id.toString(),
+      ); // core-facing: sub must be string
       return { twoFactorRequired: true, challengeToken: token };
     }
 
-    return this.issueSessionTokens(user, { userAgent: input.userAgent, ip: input.ip });
+    return this.issueSessionTokens(user, {
+      userAgent: input.userAgent,
+      ip: input.ip,
+    });
   }
 
   /** Completes the challenge `login()` returned when 2FA is enabled — a TOTP code or an unused backup code. */
-  async loginTwoFactor(input: { challengeToken: string; code: string; userAgent?: string; ip?: string }): Promise<AuthTokens> {
-    const { sub } = await verifyTwoFactorChallengeToken({ secret: this.keys.secret }, input.challengeToken);
+  async loginTwoFactor(input: {
+    challengeToken: string;
+    code: string;
+    userAgent?: string;
+    ip?: string;
+  }): Promise<AuthTokens> {
+    const { sub } = await verifyTwoFactorChallengeToken(
+      { secret: this.keys.secret },
+      input.challengeToken,
+    );
 
-    const user = await this.prisma.user.findUnique({ where: { id: toId(sub) } });
-    if (!user || user.blocked || !user.isActive || user.isDeleted || !user.twoFactorEnabled || !user.twoFactorSecret) throw new HttpError(401, "invalid credentials");
+    const user = await this.prisma.user.findUnique({
+      where: { id: toId(sub) },
+    });
+    if (
+      !user ||
+      user.blocked ||
+      !user.isActive ||
+      user.isDeleted ||
+      !user.twoFactorEnabled ||
+      !user.twoFactorSecret
+    )
+      throw new HttpError(401, "invalid credentials");
 
     const validTotp = verifyTotpCode(user.twoFactorSecret, input.code);
-    const validBackup = !validTotp && (await this.twoFactor.consumeBackupCode(user.id, input.code));
+    const validBackup =
+      !validTotp &&
+      (await this.twoFactor.consumeBackupCode(user.id, input.code));
     if (!validTotp && !validBackup) {
-      await this.sessions.appendAuditEvent({ type: "two_factor_challenge_failed", userId: user.id.toString() }); // core-facing: string
+      await this.sessions.appendAuditEvent({
+        type: "two_factor_challenge_failed",
+        userId: user.id.toString(),
+      }); // core-facing: string
       throw new HttpError(401, "invalid two-factor code");
     }
 
-    return this.issueSessionTokens(user, { userAgent: input.userAgent, ip: input.ip });
+    return this.issueSessionTokens(user, {
+      userAgent: input.userAgent,
+      ip: input.ip,
+    });
   }
 
-  async enrollTwoFactor(userId: string): Promise<{ secret: string; provisioningUri: string }> {
+  async enrollTwoFactor(
+    userId: string,
+  ): Promise<{ secret: string; provisioningUri: string }> {
     const idBig = toId(userId);
     const user = await this.getUserOrThrow(userId);
     const secret = generateTotpSecret();
     // Not enabled yet — confirmTwoFactor() flips that, so an abandoned enrollment never locks the account out.
-    await this.prisma.user.update({ where: { id: idBig }, data: { twoFactorSecret: secret, twoFactorEnabled: false } });
-    return { secret, provisioningUri: buildTotpProvisioningUri({ secret, accountName: user.email, issuer: this.config.twoFactorIssuer }) };
+    await this.prisma.user.update({
+      where: { id: idBig },
+      data: { twoFactorSecret: secret, twoFactorEnabled: false },
+    });
+    return {
+      secret,
+      provisioningUri: buildTotpProvisioningUri({
+        secret,
+        accountName: user.email,
+        issuer: this.config.twoFactorIssuer,
+      }),
+    };
   }
 
-  async confirmTwoFactor(userId: string, code: string): Promise<{ backupCodes: string[] }> {
+  async confirmTwoFactor(
+    userId: string,
+    code: string,
+  ): Promise<{ backupCodes: string[] }> {
     const idBig = toId(userId);
     const user = await this.getUserOrThrow(userId);
-    if (!user.twoFactorSecret) throw new HttpError(400, "call enrollTwoFactor first");
-    if (!verifyTotpCode(user.twoFactorSecret, code)) throw new HttpError(401, "invalid two-factor code");
+    if (!user.twoFactorSecret)
+      throw new HttpError(400, "call enrollTwoFactor first");
+    if (!verifyTotpCode(user.twoFactorSecret, code))
+      throw new HttpError(401, "invalid two-factor code");
 
     const backupCodes = generateBackupCodes();
-    await this.twoFactor.saveBackupCodes(idBig, backupCodes.map((c) => c.hash));
-    await this.prisma.user.update({ where: { id: idBig }, data: { twoFactorEnabled: true } });
-    await this.sessions.appendAuditEvent({ type: "two_factor_enabled", userId });
+    await this.twoFactor.saveBackupCodes(
+      idBig,
+      backupCodes.map((c) => c.hash),
+    );
+    await this.prisma.user.update({
+      where: { id: idBig },
+      data: { twoFactorEnabled: true },
+    });
+    await this.sessions.appendAuditEvent({
+      type: "two_factor_enabled",
+      userId,
+    });
     return { backupCodes: backupCodes.map((c) => c.code) };
   }
 
   async disableTwoFactor(userId: string, code: string): Promise<void> {
     const idBig = toId(userId);
     const user = await this.getUserOrThrow(userId);
-    if (!user.twoFactorEnabled || !user.twoFactorSecret) throw new HttpError(400, "two-factor is not enabled");
+    if (!user.twoFactorEnabled || !user.twoFactorSecret)
+      throw new HttpError(400, "two-factor is not enabled");
 
     const validTotp = verifyTotpCode(user.twoFactorSecret, code);
-    const validBackup = !validTotp && (await this.twoFactor.consumeBackupCode(idBig, code));
-    if (!validTotp && !validBackup) throw new HttpError(401, "invalid two-factor code");
+    const validBackup =
+      !validTotp && (await this.twoFactor.consumeBackupCode(idBig, code));
+    if (!validTotp && !validBackup)
+      throw new HttpError(401, "invalid two-factor code");
 
-    await this.prisma.user.update({ where: { id: idBig }, data: { twoFactorEnabled: false, twoFactorSecret: null } });
+    await this.prisma.user.update({
+      where: { id: idBig },
+      data: { twoFactorEnabled: false, twoFactorSecret: null },
+    });
     await this.twoFactor.clearBackupCodes(idBig);
-    await this.sessions.appendAuditEvent({ type: "two_factor_disabled", userId });
+    await this.sessions.appendAuditEvent({
+      type: "two_factor_disabled",
+      userId,
+    });
   }
 
   /** Always succeeds from the caller's point of view — an unknown email or a throttled request looks identical, to avoid enumeration. */
@@ -190,15 +315,27 @@ export class AuthService {
     const user = await this.prisma.user.findUnique({ where: { email } });
     if (!user || user.isDeleted) return;
 
-    const { allowed } = await checkRateLimit(this.rateLimit, "password-reset", email);
+    const { allowed } = await checkRateLimit(
+      this.rateLimit,
+      "password-reset",
+      email,
+    );
     if (!allowed) return;
 
-    const { token } = await coreRequestPasswordReset(this.passwordReset, user.id.toString());
-    if (this.config.sendPasswordResetEmail) await this.config.sendPasswordResetEmail(email, token);
+    const { token } = await coreRequestPasswordReset(
+      this.passwordReset,
+      user.id.toString(),
+    );
+    if (this.config.sendPasswordResetEmail)
+      await this.config.sendPasswordResetEmail(email, token);
   }
 
   async resetPassword(token: string, newPassword: string): Promise<void> {
-    const { userId } = await coreResetPassword(this.passwordReset, token, newPassword);
+    const { userId } = await coreResetPassword(
+      this.passwordReset,
+      token,
+      newPassword,
+    );
     // The old password is no longer trusted, so neither are its sessions. The revoker is the user
     // themselves — they proved control of the account by consuming the reset token.
     await revokeAllSessionsForUser(this.sessions, userId, { userId });
@@ -206,22 +343,40 @@ export class AuthService {
 
   /** Builds the redirect URL for `provider`. `state` is an opaque anti-CSRF nonce the provider echoes back verbatim. */
   async startOAuth(provider: string): Promise<{ url: string }> {
-    const state = Buffer.from(JSON.stringify({ nonce: randomUUID() })).toString("base64url");
+    const state = Buffer.from(JSON.stringify({ nonce: randomUUID() })).toString(
+      "base64url",
+    );
 
     if (provider === "google") {
       const creds = this.config.oauthProviders.google;
       if (!creds) throw new HttpError(400, "google OAuth is not configured");
-      return { url: buildAuthorizationUrl(GOOGLE_OIDC_PROVIDER, { clientId: creds.clientId, redirectUri: creds.redirectUri, state }) };
+      return {
+        url: buildAuthorizationUrl(GOOGLE_OIDC_PROVIDER, {
+          clientId: creds.clientId,
+          redirectUri: creds.redirectUri,
+          state,
+        }),
+      };
     }
     if (provider === "apple") {
       const creds = this.config.oauthProviders.apple;
       if (!creds) throw new HttpError(400, "apple OAuth is not configured");
-      return { url: buildAuthorizationUrl(APPLE_OIDC_PROVIDER, { clientId: creds.clientId, redirectUri: creds.redirectUri, state }) };
+      return {
+        url: buildAuthorizationUrl(APPLE_OIDC_PROVIDER, {
+          clientId: creds.clientId,
+          redirectUri: creds.redirectUri,
+          state,
+        }),
+      };
     }
     throw new HttpError(400, `unknown OAuth provider "${provider}"`);
   }
 
-  async completeOAuthCallback(provider: string, code: string, _state: string): Promise<AuthTokens> {
+  async completeOAuthCallback(
+    provider: string,
+    code: string,
+    _state: string,
+  ): Promise<AuthTokens> {
     let providerDescriptor: OAuthProviderDescriptor;
     let clientId: string;
     let idToken: string;
@@ -232,44 +387,91 @@ export class AuthService {
       providerDescriptor = GOOGLE_OIDC_PROVIDER;
       clientId = creds.clientId;
       idToken = (
-        await exchangeCodeForTokens(GOOGLE_OIDC_PROVIDER, { clientId: creds.clientId, clientSecret: creds.clientSecret, redirectUri: creds.redirectUri, code })
+        await exchangeCodeForTokens(GOOGLE_OIDC_PROVIDER, {
+          clientId: creds.clientId,
+          clientSecret: creds.clientSecret,
+          redirectUri: creds.redirectUri,
+          code,
+        })
       ).idToken;
     } else if (provider === "apple") {
       const creds = this.config.oauthProviders.apple;
       if (!creds) throw new HttpError(400, "apple OAuth is not configured");
       providerDescriptor = APPLE_OIDC_PROVIDER;
       clientId = creds.clientId;
-      const clientSecret = await signAppleClientSecret({ teamId: creds.teamId, clientId: creds.clientId, keyId: creds.keyId, privateKeyPem: creds.privateKey });
-      idToken = (await exchangeCodeForTokens(APPLE_OIDC_PROVIDER, { clientId: creds.clientId, clientSecret, redirectUri: creds.redirectUri, code })).idToken;
+      const clientSecret = await signAppleClientSecret({
+        teamId: creds.teamId,
+        clientId: creds.clientId,
+        keyId: creds.keyId,
+        privateKeyPem: creds.privateKey,
+      });
+      idToken = (
+        await exchangeCodeForTokens(APPLE_OIDC_PROVIDER, {
+          clientId: creds.clientId,
+          clientSecret,
+          redirectUri: creds.redirectUri,
+          code,
+        })
+      ).idToken;
     } else {
       throw new HttpError(400, `unknown OAuth provider "${provider}"`);
     }
 
-    const profile = await verifyIdTokenAndExtractProfile(providerDescriptor, { clientId, idToken });
-    const { userId } = await completeOAuthLogin(this.oauth, { provider, profile });
+    const profile = await verifyIdTokenAndExtractProfile(providerDescriptor, {
+      clientId,
+      idToken,
+    });
+    const { userId } = await completeOAuthLogin(this.oauth, {
+      provider,
+      profile,
+    });
 
     const user = await this.getUserOrThrow(userId);
-    if (user.blocked || !user.isActive || user.isDeleted) throw new HttpError(401, "account is blocked");
+    if (user.blocked || !user.isActive || user.isDeleted)
+      throw new HttpError(401, "account is blocked");
     return this.issueSessionTokens(user, { provider });
   }
 
   /** Pinned to the caller's workspace — the filter argument cannot widen it. */
-  async listAuditLog(ctx: AuthzContext, filter: AuditLogListFilter): Promise<Paginated<AuditLogEntry>> {
-    const { items, meta } = await this.auditLog.list({ ...filter, workspaceId: ctx.workspaceId });
+  async listAuditLog(
+    ctx: AuthzContext,
+    filter: AuditLogListFilter,
+  ): Promise<Paginated<AuditLogEntry>> {
+    const { items, meta } = await this.auditLog.list({
+      ...filter,
+      workspaceId: ctx.workspaceId,
+    });
     return { items: items.map(toAuditLogEntry), meta };
   }
 
   /** `req.auth` (the JWT claims) never carries 2FA status, so `/auth/me` fetches it fresh — the one bit of the response that isn't just echoing the token. */
-  async getTwoFactorStatus(userId: string): Promise<{ twoFactorEnabled: boolean }> {
+  async getTwoFactorStatus(
+    userId: string,
+  ): Promise<{ twoFactorEnabled: boolean }> {
     const user = await this.getUserOrThrow(userId);
     return { twoFactorEnabled: user.twoFactorEnabled };
   }
 
-  async listActiveSessions(userId: string): Promise<Array<{ id: string; createdAt: string; expiresAt: string; provider?: string; userAgent?: string; ip?: string }>> {
+  async listActiveSessions(
+    userId: string,
+  ): Promise<
+    Array<{
+      id: string;
+      createdAt: string;
+      expiresAt: string;
+      provider?: string;
+      userAgent?: string;
+      ip?: string;
+    }>
+  > {
     // "Active" is now three conditions, not one: not revoked, and not past its own absolute
     // expiry. `sessions_user_active_idx` is (user_id, is_revoked, expires_at) for exactly this read.
     const rows = await this.prisma.session.findMany({
-      where: { userId: toId(userId), isRevoked: false, expiresAt: { gt: new Date() } },
+      where: {
+        userId: toId(userId),
+        isRevoked: false,
+        expiresAt: { gt: new Date() },
+      },
       orderBy: { createdAt: "desc" },
     });
     return rows.map((row) => ({
@@ -288,8 +490,14 @@ export class AuthService {
   // database through a workspace-scoped query. That is the security property this model rests on:
   // an admin of one workspace has no expressible way to name a row in another.
 
-  async listUsers(ctx: AuthzContext, filter: MemberListFilter): Promise<MemberListResult> {
-    const { items, meta } = await this.rbac.listMembers(ctx.workspaceId, filter);
+  async listUsers(
+    ctx: AuthzContext,
+    filter: MemberListFilter,
+  ): Promise<MemberListResult> {
+    const { items, meta } = await this.rbac.listMembers(
+      ctx.workspaceId,
+      filter,
+    );
     return { items: items.map(toMemberSummary), meta };
   }
 
@@ -300,13 +508,25 @@ export class AuthService {
   async updateUser(
     ctx: AuthzContext,
     userId: string,
-    input: { firstName?: string | null; lastName?: string | null; displayName?: string | null; phone?: string | null; username?: string | null; photo?: string | null },
+    input: {
+      firstName?: string | null;
+      lastName?: string | null;
+      displayName?: string | null;
+      phone?: string | null;
+      username?: string | null;
+      photo?: string | null;
+    },
     actorUserId: string | null,
   ): Promise<MemberSummary> {
     return this.rbac.updateMember(ctx.workspaceId, userId, input, actorUserId);
   }
 
-  async deleteUser(ctx: AuthzContext, userId: string, actorUserId: string | null, reason?: string): Promise<void> {
+  async deleteUser(
+    ctx: AuthzContext,
+    userId: string,
+    actorUserId: string | null,
+    reason?: string,
+  ): Promise<void> {
     await this.rbac.deleteMember(ctx.workspaceId, userId, actorUserId, reason);
   }
 
@@ -319,7 +539,10 @@ export class AuthService {
   }
 
   /** Defines a permission, or edits one — including deactivating it. The write path for "the catalog is editable in the database". */
-  async definePermission(input: PermissionInput, actorUserId: string | null): Promise<PermissionSummary> {
+  async definePermission(
+    input: PermissionInput,
+    actorUserId: string | null,
+  ): Promise<PermissionSummary> {
     return this.rbac.upsertPermission(input, actorUserId);
   }
 
@@ -329,7 +552,12 @@ export class AuthService {
 
   async createRole(
     ctx: AuthzContext,
-    input: { slug: string; name?: string; displayName?: string; description?: string | null },
+    input: {
+      slug: string;
+      name?: string;
+      displayName?: string;
+      description?: string | null;
+    },
     actorUserId: string | null,
   ): Promise<RoleSummary> {
     return this.rbac.createRole(ctx.workspaceId, input, actorUserId);
@@ -338,47 +566,114 @@ export class AuthService {
   async updateRole(
     ctx: AuthzContext,
     roleId: string,
-    input: { name?: string; displayName?: string; description?: string | null; isActive?: boolean },
+    input: {
+      name?: string;
+      displayName?: string;
+      description?: string | null;
+      isActive?: boolean;
+    },
     actorUserId: string | null,
   ): Promise<RoleSummary> {
     return this.rbac.updateRole(ctx.workspaceId, roleId, input, actorUserId);
   }
 
-  async deleteRole(ctx: AuthzContext, roleId: string, actorUserId: string | null, reason?: string): Promise<void> {
+  async deleteRole(
+    ctx: AuthzContext,
+    roleId: string,
+    actorUserId: string | null,
+    reason?: string,
+  ): Promise<void> {
     await this.rbac.deleteRole(ctx.workspaceId, roleId, actorUserId, reason);
   }
 
-  async attachPermissionToRole(ctx: AuthzContext, roleId: string, permissionSlug: string, actorUserId: string | null): Promise<void> {
-    await this.rbac.attachPermissionToRole(ctx.workspaceId, roleId, permissionSlug, actorUserId);
+  async attachPermissionToRole(
+    ctx: AuthzContext,
+    roleId: string,
+    permissionSlug: string,
+    actorUserId: string | null,
+  ): Promise<void> {
+    await this.rbac.attachPermissionToRole(
+      ctx.workspaceId,
+      roleId,
+      permissionSlug,
+      actorUserId,
+    );
   }
 
-  async assignRole(ctx: AuthzContext, userId: string, roleSlug: string): Promise<void> {
+  async assignRole(
+    ctx: AuthzContext,
+    userId: string,
+    roleSlug: string,
+  ): Promise<void> {
     await this.rbac.assignRoleToMember(ctx.workspaceId, userId, roleSlug);
-    await this.auditLog.append({ type: "role_assigned", userId, role: roleSlug }, { workspaceId: ctx.workspaceId });
+    await this.auditLog.append(
+      { type: "role_assigned", userId, role: roleSlug },
+      { workspaceId: ctx.workspaceId },
+    );
   }
 
-  async revokeRole(ctx: AuthzContext, userId: string, roleSlug: string): Promise<void> {
+  async revokeRole(
+    ctx: AuthzContext,
+    userId: string,
+    roleSlug: string,
+  ): Promise<void> {
     await this.rbac.revokeRoleFromMember(ctx.workspaceId, userId, roleSlug);
-    await this.auditLog.append({ type: "role_revoked", userId, role: roleSlug }, { workspaceId: ctx.workspaceId });
+    await this.auditLog.append(
+      { type: "role_revoked", userId, role: roleSlug },
+      { workspaceId: ctx.workspaceId },
+    );
   }
 
-  async grantPermission(ctx: AuthzContext, userId: string, permissionSlug: string, actorUserId: string | null): Promise<void> {
-    await this.rbac.grantPermissionToMember(ctx.workspaceId, userId, permissionSlug, actorUserId);
-    await this.auditLog.append({ type: "permission_granted", userId, permission: permissionSlug }, { workspaceId: ctx.workspaceId });
+  async grantPermission(
+    ctx: AuthzContext,
+    userId: string,
+    permissionSlug: string,
+    actorUserId: string | null,
+  ): Promise<void> {
+    await this.rbac.grantPermissionToMember(
+      ctx.workspaceId,
+      userId,
+      permissionSlug,
+      actorUserId,
+    );
+    await this.auditLog.append(
+      { type: "permission_granted", userId, permission: permissionSlug },
+      { workspaceId: ctx.workspaceId },
+    );
   }
 
-  async revokePermission(ctx: AuthzContext, userId: string, permissionSlug: string): Promise<void> {
-    await this.rbac.revokePermissionFromMember(ctx.workspaceId, userId, permissionSlug);
-    await this.auditLog.append({ type: "permission_revoked", userId, permission: permissionSlug }, { workspaceId: ctx.workspaceId });
+  async revokePermission(
+    ctx: AuthzContext,
+    userId: string,
+    permissionSlug: string,
+  ): Promise<void> {
+    await this.rbac.revokePermissionFromMember(
+      ctx.workspaceId,
+      userId,
+      permissionSlug,
+    );
+    await this.auditLog.append(
+      { type: "permission_revoked", userId, permission: permissionSlug },
+      { workspaceId: ctx.workspaceId },
+    );
   }
 
   async refresh(refreshToken: string): Promise<Omit<AuthTokens, "sessionId">> {
     const key = await this.keys.getActiveKey();
-    const presented = await verifyRefreshToken({ secret: this.keys.secret }, refreshToken);
-    const { session, nextJti } = await rotateRefreshToken(this.sessions, presented);
+    const presented = await verifyRefreshToken(
+      { secret: this.keys.secret },
+      refreshToken,
+    );
+    const { session, nextJti } = await rotateRefreshToken(
+      this.sessions,
+      presented,
+    );
 
-    const user = await this.prisma.user.findUnique({ where: { id: toId(session.userId) } });
-    if (!user || user.blocked || !user.isActive || user.isDeleted) throw new HttpError(401, "invalid credentials");
+    const user = await this.prisma.user.findUnique({
+      where: { id: toId(session.userId) },
+    });
+    if (!user || user.blocked || !user.isActive || user.isDeleted)
+      throw new HttpError(401, "invalid credentials");
 
     const access = await signAccessToken(
       { activeKey: key },
@@ -387,38 +682,81 @@ export class AuthService {
     );
     const refresh = await signRefreshToken(
       { activeKey: key },
-      { sub: user.id.toString(), sessionId: session.id, sv: session.sessionVersion },
+      {
+        sub: user.id.toString(),
+        sessionId: session.id,
+        sv: session.sessionVersion,
+      },
       { jti: nextJti, ttlSeconds: this.config.refreshTokenTtlSeconds },
     );
     return { accessToken: access.token, refreshToken: refresh.token };
   }
 
-  async logout(sessionId: string, accessJti: string, accessRemainingTtlSeconds: number, revoker?: Revoker): Promise<void> {
+  async logout(
+    sessionId: string,
+    accessJti: string,
+    accessRemainingTtlSeconds: number,
+    revoker?: Revoker,
+  ): Promise<void> {
     await revokeSession(this.sessions, sessionId, revoker);
-    await revokeAccessToken(this.sessions, accessJti, accessRemainingTtlSeconds);
+    await revokeAccessToken(
+      this.sessions,
+      accessJti,
+      accessRemainingTtlSeconds,
+    );
   }
 
   async logoutAll(userId: string, revoker?: Revoker): Promise<void> {
     await revokeAllSessionsForUser(this.sessions, userId, revoker);
   }
 
-  async logoutOthers(userId: string, keepSessionId: string, revoker?: Revoker): Promise<void> {
-    await revokeOtherSessionsForUser(this.sessions, userId, keepSessionId, revoker);
+  async logoutOthers(
+    userId: string,
+    keepSessionId: string,
+    revoker?: Revoker,
+  ): Promise<void> {
+    await revokeOtherSessionsForUser(
+      this.sessions,
+      userId,
+      keepSessionId,
+      revoker,
+    );
   }
 
-  async changePassword(userId: string, currentSessionId: string, input: { currentPassword: string; newPassword: string }): Promise<void> {
+  async changePassword(
+    userId: string,
+    currentSessionId: string,
+    input: { currentPassword: string; newPassword: string },
+  ): Promise<void> {
     const userIdBig = toId(userId);
-    const user = await this.prisma.user.findUnique({ where: { id: userIdBig } });
-    if (!user || user.blocked || !user.isActive || user.isDeleted || !user.passwordHash) throw new HttpError(401, "invalid credentials");
-
-    const valid = await verifyPassword(user.passwordHash, input.currentPassword);
+    const user = await this.prisma.user.findUnique({
+      where: { id: userIdBig },
+    });
+    if (
+      !user ||
+      user.blocked ||
+      !user.isActive ||
+      user.isDeleted ||
+      !user.passwordHash
+    )
+      throw new HttpError(401, "invalid credentials");
+
+    const valid = await verifyPassword(
+      user.passwordHash,
+      input.currentPassword,
+    );
     if (!valid) throw new HttpError(401, "invalid credentials");
 
     const passwordHash = await hashPassword(input.newPassword);
-    await this.prisma.user.update({ where: { id: userIdBig }, data: { passwordHash, updatedBy: userIdBig } });
+    await this.prisma.user.update({
+      where: { id: userIdBig },
+      data: { passwordHash, updatedBy: userIdBig },
+    });
     // The old password is no longer trusted everywhere else it's signed in — but leave the
     // session making this very call alone, the same courtesy `logoutOthers` extends.
-    await revokeOtherSessionsForUser(this.sessions, userId, currentSessionId, { userId });
+    await revokeOtherSessionsForUser(this.sessions, userId, currentSessionId, {
+      userId,
+    });
   }
 
   /** Backs both `GET`- and `PATCH /auth/me` — deliberately not workspace-scoped, see `updateProfile`. */
@@ -449,7 +787,9 @@ export class AuthService {
   /** Self-service — no `users:manage` permission required, callable by anyone on their own row, and deliberately not workspace-scoped, see `updateProfile`. */
   async getProfile(userId: string): Promise<SelfProfile> {
     const userIdBig = toId(userId);
-    const user = await this.prisma.user.findUnique({ where: { id: userIdBig, isDeleted: false } });
+    const user = await this.prisma.user.findUnique({
+      where: { id: userIdBig, isDeleted: false },
+    });
     if (!user) throw new HttpError(401, "invalid credentials");
     return this.toSelfProfile(user);
   }
@@ -462,12 +802,24 @@ export class AuthService {
    */
   async updateProfile(
     userId: string,
-    input: { firstName?: string | null; lastName?: string | null; displayName?: string | null; phone?: string | null; username?: string | null; photo?: string | null },
+    input: {
+      firstName?: string | null;
+      lastName?: string | null;
+      displayName?: string | null;
+      phone?: string | null;
+      username?: string | null;
+      photo?: string | null;
+    },
   ): Promise<SelfProfile> {
     const userIdBig = toId(userId);
-    const existing = await this.prisma.user.findUnique({ where: { id: userIdBig, isDeleted: false } });
+    const existing = await this.prisma.user.findUnique({
+      where: { id: userIdBig, isDeleted: false },
+    });
     if (!existing) throw new HttpError(401, "invalid credentials");
-    const user = await this.prisma.user.update({ where: { id: userIdBig }, data: { ...input, updatedBy: userIdBig } });
+    const user = await this.prisma.user.update({
+      where: { id: userIdBig },
+      data: { ...input, updatedBy: userIdBig },
+    });
     return this.toSelfProfile(user);
   }
 
@@ -476,9 +828,16 @@ export class AuthService {
    * caller's workspace — otherwise an admin of one workspace could disable an account they
    * have no relationship with.
    */
-  async block(ctx: AuthzContext, userId: string, revoker?: Revoker): Promise<void> {
+  async block(
+    ctx: AuthzContext,
+    userId: string,
+    revoker?: Revoker,
+  ): Promise<void> {
     await this.rbac.requireMember(ctx.workspaceId, userId);
-    await this.prisma.user.update({ where: { id: toId(userId) }, data: { blocked: true, updatedBy: toIdOrNull(revoker?.userId) } });
+    await this.prisma.user.update({
+      where: { id: toId(userId) },
+      data: { blocked: true, updatedBy: toIdOrNull(revoker?.userId) },
+    });
     // The administrator, not the blocked user, is what lands in `sessions.revoked_by`.
     await blockUser(this.sessions, userId, revoker);
     // Belt and braces. The block is enforced on the authentication path — login and refresh both
@@ -488,30 +847,53 @@ export class AuthService {
     await this.rbac.invalidateMember(userId, ctx.workspaceId);
   }
 
-  async unblock(ctx: AuthzContext, userId: string, revoker?: Revoker): Promise<void> {
+  async unblock(
+    ctx: AuthzContext,
+    userId: string,
+    revoker?: Revoker,
+  ): Promise<void> {
     await this.rbac.requireMember(ctx.workspaceId, userId);
-    await this.prisma.user.update({ where: { id: toId(userId) }, data: { blocked: false, updatedBy: toIdOrNull(revoker?.userId) } });
+    await this.prisma.user.update({
+      where: { id: toId(userId) },
+      data: { blocked: false, updatedBy: toIdOrNull(revoker?.userId) },
+    });
   }
 
   /**
    * A routine administrative on/off toggle — distinct from `block`/`unblock`, which is a
    * security/moderation action. Both independently deny login; see the note on the `User` model.
    */
-  async deactivate(ctx: AuthzContext, userId: string, revoker?: Revoker): Promise<void> {
+  async deactivate(
+    ctx: AuthzContext,
+    userId: string,
+    revoker?: Revoker,
+  ): Promise<void> {
     await this.rbac.requireMember(ctx.workspaceId, userId);
-    await this.prisma.user.update({ where: { id: toId(userId) }, data: { isActive: false, updatedBy: toIdOrNull(revoker?.userId) } });
+    await this.prisma.user.update({
+      where: { id: toId(userId) },
+      data: { isActive: false, updatedBy: toIdOrNull(revoker?.userId) },
+    });
     await deactivateUser(this.sessions, userId, revoker);
     await this.rbac.invalidateMember(userId, ctx.workspaceId);
   }
 
-  async activate(ctx: AuthzContext, userId: string, revoker?: Revoker): Promise<void> {
+  async activate(
+    ctx: AuthzContext,
+    userId: string,
+    revoker?: Revoker,
+  ): Promise<void> {
     await this.rbac.requireMember(ctx.workspaceId, userId);
-    await this.prisma.user.update({ where: { id: toId(userId) }, data: { isActive: true, updatedBy: toIdOrNull(revoker?.userId) } });
+    await this.prisma.user.update({
+      where: { id: toId(userId) },
+      data: { isActive: true, updatedBy: toIdOrNull(revoker?.userId) },
+    });
   }
 
   /** Nest's filter turns Prisma's `findUniqueOrThrow` into a 404; without one, this does it by hand. */
   private async getUserOrThrow(userId: string) {
-    const user = await this.prisma.user.findUnique({ where: { id: toId(userId) } });
+    const user = await this.prisma.user.findUnique({
+      where: { id: toId(userId) },
+    });
     if (!user) throw new HttpError(404, `user "${userId}" not found`);
     return user;
   }
@@ -522,8 +904,14 @@ export class AuthService {
    * Each request resolves its own — see AuthzGuard. Takes the raw Prisma user row (bigint id) —
    * every call site already has one in hand.
    */
-  private async issueSessionTokens(user: { id: bigint }, meta: { userAgent?: string; ip?: string; provider?: string }): Promise<AuthTokens> {
-    const session = await createSession(this.sessions, { userId: user.id.toString(), ...meta });
+  private async issueSessionTokens(
+    user: { id: bigint },
+    meta: { userAgent?: string; ip?: string; provider?: string },
+  ): Promise<AuthTokens> {
+    const session = await createSession(this.sessions, {
+      userId: user.id.toString(),
+      ...meta,
+    });
     const key = await this.keys.getActiveKey();
 
     const access = await signAccessToken(
@@ -533,10 +921,21 @@ export class AuthService {
     );
     const refresh = await signRefreshToken(
       { activeKey: key },
-      { sub: user.id.toString(), sessionId: session.id, sv: session.sessionVersion },
-      { jti: session.currentRefreshJti, ttlSeconds: this.config.refreshTokenTtlSeconds },
+      {
+        sub: user.id.toString(),
+        sessionId: session.id,
+        sv: session.sessionVersion,
+      },
+      {
+        jti: session.currentRefreshJti,
+        ttlSeconds: this.config.refreshTokenTtlSeconds,
+      },
     );
 
-    return { accessToken: access.token, refreshToken: refresh.token, sessionId: session.id };
+    return {
+      accessToken: access.token,
+      refreshToken: refresh.token,
+      sessionId: session.id,
+    };
   }
 }