@simple-auth-kit/cli 1.4.3 → 1.5.0

package/registry/combos/express-prisma/variants/workspaces/src/workspace.router.ts

@@ -1,123 +0,0 @@
-import { Router } from "express";
-import type { NextFunction, Request, RequestHandler, Response } from "express";
-import { HttpError } from "./http-error.js";
-import { RbacRepository } from "./rbac.repository.js";
-import { ability, authenticated, createTieredRouter } from "./route-tiers.js";
-import { WorkspaceRepository } from "./workspace.repository.js";
-import "./request-context.js";
-
-function requireString(value: unknown, field: string): string {
-  if (typeof value !== "string" || value.length === 0) throw new HttpError(400, `${field} is required`);
-  return value;
-}
-
-function requireStringArray(value: unknown, field: string): string[] {
-  if (!Array.isArray(value) || value.some((v) => typeof v !== "string")) throw new HttpError(400, `${field} must be an array of strings`);
-  return value as string[];
-}
-
-export interface WorkspaceRouterDeps {
-  workspaces: WorkspaceRepository;
-  rbac: RbacRepository;
-  authentication: RequestHandler;
-  /** Resolves a workspace when the request names one, and does nothing when it does not. */
-  authorization: RequestHandler;
-  /** The same resolution, but the `X-Workspace-Id` header is mandatory. */
-  workspaceScope: RequestHandler;
-}
-
-/**
- * Workspace membership. Every route below that acts *inside* a workspace names it with the
- * `X-Workspace-Id` header rather than a path segment — the same rule the `/auth/admin/*` routes
- * follow, so there is exactly one way a request says which workspace it means.
- *
- * Three routes here are deliberately tier 2 — `authenticated()`, any logged-in caller — and the
- * permission catalog mints no slugs for them. That is a decision written on each route, not an
- * omission: the tier is a required argument, so a route with none is a compile error
- * (route-tiers.ts).
- *   • `POST /workspaces` and `GET /workspaces` are outside every workspace — any authenticated
- *     user may create one or list their own. There is no workspace whose permissions could be
- *     checked, and gating them on a permission granted *inside* some other workspace would mean
- *     your first workspace could only be created by someone who already had one.
- *   • `GET /workspaces/members` is gated on membership itself: the workspace middleware already
- *     proved the caller belongs to the workspace, and seeing who else is in a room you are in is
- *     not an administrative capability.
- * The three that mutate membership are permission-gated — see `rbac.defaults.ts` for the catalog.
- *
- * Two tiered routers, because the tier's middleware is what enforces the tier: the unscoped
- * routes resolve a workspace only if one is named, while everything under a workspace uses the
- * mandatory resolution. Mounting them in this order matters — the scoped router is consulted
- * first, so `/workspaces/members` reaches it rather than falling through.
- *
- * Replaces the reference combo's `WorkspaceController`.
- */
-export function createWorkspaceRouter(deps: WorkspaceRouterDeps): RequestHandler {
-  const { workspaces, rbac, authentication, authorization, workspaceScope } = deps;
-
-  const scoped = createTieredRouter({ authentication, authorization: workspaceScope });
-  const unscoped = createTieredRouter({ authentication, authorization });
-
-  unscoped.route("post", "/", authenticated(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const body = req.body as Record<string, unknown>;
-      res.status(201).json(await workspaces.create(req.auth!.sub, requireString(body.name, "name")));
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  unscoped.route("get", "/", authenticated(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      res.status(200).json(await workspaces.listForUser(req.auth!.sub));
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  scoped.route("get", "/members", authenticated(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      res.status(200).json(await workspaces.listMembers(req.authz!.workspaceId));
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  scoped.route("post", "/members", ability("members:manage"), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const body = req.body as Record<string, unknown>;
-      // No `roles` in the body means "whatever this workspace flags as the default role" — the
-      // default lives in a row, not in this line.
-      const roles = body.roles === undefined ? undefined : requireStringArray(body.roles, "roles");
-      res.status(201).json(await workspaces.addMember(req.authz!.workspaceId, requireString(body.email, "email"), roles));
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  scoped.route("put", "/members/:memberId/roles", ability("roles:assign"), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const memberId = requireString(req.params.memberId, "memberId");
-      if (memberId === req.authz!.memberId) throw new HttpError(403, "cannot change your own roles");
-      const body = req.body as Record<string, unknown>;
-      res.status(200).json(await rbac.setMemberRoles(req.authz!.workspaceId, memberId, requireStringArray(body.roles, "roles")));
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  scoped.route("delete", "/members/:memberId", ability("members:manage"), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const memberId = requireString(req.params.memberId, "memberId");
-      if (memberId === req.authz!.memberId) throw new HttpError(403, "cannot remove yourself from a workspace you administer");
-      await workspaces.removeMember(req.authz!.workspaceId, memberId);
-      res.status(200).json({ ok: true });
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  const router = Router();
-  router.use(scoped.handler);
-  router.use(unscoped.handler);
-  return router;
-}

package/registry/combos/nestjs-drizzle/shared/src/oauth.repository.ts

@@ -1,36 +0,0 @@
-import { BadRequestException, Inject, Injectable } from "@nestjs/common";
-import { and, eq } from "drizzle-orm";
-import type { OAuthStoreDeps } from "@/lib/auth/core/oauth.js";
-import { DRIZZLE_DB, type Database } from "./db.js";
-import { oauthAccounts, users } from "./schema.js";
-import { toId } from "./id.helper.js";
-
-@Injectable()
-export class OAuthRepository implements OAuthStoreDeps {
-  constructor(@Inject(DRIZZLE_DB) private readonly db: Database) {}
-
-  async findAccountByProvider(provider: string, providerAccountId: string): Promise<{ userId: string } | null> {
-    const [row] = await this.db
-      .select()
-      .from(oauthAccounts)
-      .where(and(eq(oauthAccounts.provider, provider), eq(oauthAccounts.providerAccountId, providerAccountId)))
-      .limit(1);
-    return row ? { userId: row.userId.toString() } : null;
-  }
-
-  async linkAccount(input: { userId: string; provider: string; providerAccountId: string; email?: string }): Promise<void> {
-    await this.db.insert(oauthAccounts).values({ ...input, userId: toId(input.userId) });
-  }
-
-  async findUserByVerifiedEmail(email: string): Promise<{ id: string } | null> {
-    const [row] = await this.db.select().from(users).where(eq(users.email, email)).limit(1);
-    return row ? { id: row.id.toString() } : null;
-  }
-
-  /** OAuth-only signup: no password is ever set, which is why `User.passwordHash` is nullable. */
-  async createUserFromOAuth(input: { email?: string }): Promise<{ id: string }> {
-    if (!input.email) throw new BadRequestException("OAuth provider did not return an email address");
-    const [row] = await this.db.insert(users).values({ email: input.email, passwordHash: null }).returning();
-    return { id: row.id.toString() };
-  }
-}

package/registry/combos/nestjs-drizzle/shared/src/password-reset.repository.ts

@@ -1,29 +0,0 @@
-import { Inject, Injectable } from "@nestjs/common";
-import { eq } from "drizzle-orm";
-import type { PasswordResetStoreDeps } from "@/lib/auth/core/password-reset.js";
-import { DRIZZLE_DB, type Database } from "./db.js";
-import { passwordResetTokens, users } from "./schema.js";
-import { toId } from "./id.helper.js";
-
-@Injectable()
-export class PasswordResetRepository implements PasswordResetStoreDeps {
-  constructor(@Inject(DRIZZLE_DB) private readonly db: Database) {}
-
-  async saveResetToken(input: { userId: string; tokenHash: string; expiresAt: string }): Promise<void> {
-    await this.db.insert(passwordResetTokens).values({ userId: toId(input.userId), tokenHash: input.tokenHash, expiresAt: new Date(input.expiresAt) });
-  }
-
-  async findValidResetToken(tokenHash: string): Promise<{ userId: string; expiresAt: string; consumedAt: string | null } | null> {
-    const [row] = await this.db.select().from(passwordResetTokens).where(eq(passwordResetTokens.tokenHash, tokenHash)).limit(1);
-    if (!row) return null;
-    return { userId: row.userId.toString(), expiresAt: row.expiresAt.toISOString(), consumedAt: row.consumedAt?.toISOString() ?? null };
-  }
-
-  async consumeResetToken(tokenHash: string): Promise<void> {
-    await this.db.update(passwordResetTokens).set({ consumedAt: new Date() }).where(eq(passwordResetTokens.tokenHash, tokenHash));
-  }
-
-  async setPasswordHash(userId: string, passwordHash: string): Promise<void> {
-    await this.db.update(users).set({ passwordHash }).where(eq(users.id, toId(userId)));
-  }
-}