@simple-auth-kit/cli 1.4.3 → 1.5.0

package/registry/combos/express-drizzle/variants/workspaces/src/{rbac.repository.ts → repositories/rbac.repository.ts}

@@ -1,12 +1,34 @@
-import { and, asc, count, desc, eq, ilike, inArray, type SQL } from "drizzle-orm";
+import {
+  and,
+  asc,
+  count,
+  desc,
+  eq,
+  ilike,
+  inArray,
+  type SQL,
+} from "drizzle-orm";
 import { resolvePermissions } from "@/lib/auth/core/rbac.js";
-import type { AuthzContext } from "./authz.middleware.js";
-import type { Database } from "./db.js";
-import { buildPageMeta, normalizeLimit, normalizePage, type Paginated } from "./pagination.js";
-import { PermissionCache } from "./permission-cache.js";
-import { permissionMember, permissionRole, permissions, roleMember, roles, users, workspaceMembers } from "./schema.js";
-import { HttpError } from "./http-error.js";
-import { toId, toIdOrNull } from "./id.helper.js";
+import type { AuthzContext } from "../middleware/authz.middleware.js";
+import type { Database } from "../db.js";
+import {
+  buildPageMeta,
+  normalizeLimit,
+  normalizePage,
+  type Paginated,
+} from "../pagination.js";
+import { PermissionCache } from "../permission-cache.js";
+import {
+  permissionMember,
+  permissionRole,
+  permissions,
+  roleMember,
+  roles,
+  users,
+  workspaceMembers,
+} from "../schema.js";
+import { HttpError } from "../http-error.js";
+import { toId, toIdOrNull } from "../id.helper.js";
 
 /**
  * Every column the `users` table has (plus the membership's own `memberId`/`createdAt`), except
@@ -187,9 +209,15 @@ interface RoleRow {
   isActive: boolean;
 }
 
-const asPermissionSummary = (row: PermissionRow): PermissionSummary => ({ ...row, id: row.id.toString() });
+const asPermissionSummary = (row: PermissionRow): PermissionSummary => ({
+  ...row,
+  id: row.id.toString(),
+});
 
-const asRoleSummary = (row: RoleRow): RoleSummary => ({ ...row, id: row.id.toString() });
+const asRoleSummary = (row: RoleRow): RoleSummary => ({
+  ...row,
+  id: row.id.toString(),
+});
 
 /**
  * The cache subject in this variant: authorization belongs to a membership, so the key has to be
@@ -200,7 +228,8 @@ const asRoleSummary = (row: RoleRow): RoleSummary => ({ ...row, id: row.id.toStr
  * between the two one-directional — the guard needs this repository at runtime, so the repository
  * must not need the guard.
  */
-export const memberCacheKey = (userId: string, workspaceId: string) => `${userId}:${workspaceId}`;
+export const memberCacheKey = (userId: string, workspaceId: string) =>
+  `${userId}:${workspaceId}`;
 
 export class RbacRepository {
   constructor(
@@ -224,11 +253,18 @@ export class RbacRepository {
   // hand from its own database lookup, so there's nothing to parse here.
   private async invalidateMemberById(memberId: bigint): Promise<void> {
     const [member] = await this.db
-      .select({ userId: workspaceMembers.userId, workspaceId: workspaceMembers.workspaceId })
+      .select({
+        userId: workspaceMembers.userId,
+        workspaceId: workspaceMembers.workspaceId,
+      })
       .from(workspaceMembers)
       .where(eq(workspaceMembers.id, memberId))
       .limit(1);
-    if (member) await this.invalidateMember(member.userId.toString(), member.workspaceId.toString());
+    if (member)
+      await this.invalidateMember(
+        member.userId.toString(),
+        member.workspaceId.toString(),
+      );
   }
 
   /**
@@ -246,7 +282,10 @@ export class RbacRepository {
    * `isActive: false` on a role or a permission takes it out of the answer, which is what makes
    * deactivating either one enforcement-changing without unpicking any grant.
    */
-  async resolveAuthzContext(userId: string, workspaceId: string): Promise<AuthzContext | null> {
+  async resolveAuthzContext(
+    userId: string,
+    workspaceId: string,
+  ): Promise<AuthzContext | null> {
     // workspaceId arrives straight from the untrusted `X-Workspace-Id` header — a value that
     // isn't a valid bigint is exactly as "not a member" as one that parses but names no
     // membership, so it must not throw and 500 the request.
@@ -262,8 +301,16 @@ export class RbacRepository {
     const [member] = await this.db
       .select({ id: workspaceMembers.id })
       .from(workspaceMembers)
-      .innerJoin(users, and(eq(users.id, workspaceMembers.userId), eq(users.isDeleted, false)))
-      .where(and(eq(workspaceMembers.userId, userIdBig), eq(workspaceMembers.workspaceId, workspaceIdBig)))
+      .innerJoin(
+        users,
+        and(eq(users.id, workspaceMembers.userId), eq(users.isDeleted, false)),
+      )
+      .where(
+        and(
+          eq(workspaceMembers.userId, userIdBig),
+          eq(workspaceMembers.workspaceId, workspaceIdBig),
+        ),
+      )
       .limit(1);
     if (!member) return null;
 
@@ -273,14 +320,35 @@ export class RbacRepository {
       this.db
         .select({ roleSlug: roles.slug, permissionSlug: permissions.slug })
         .from(roleMember)
-        .innerJoin(roles, and(eq(roles.id, roleMember.roleId), eq(roles.isActive, true), eq(roles.isDeleted, false)))
+        .innerJoin(
+          roles,
+          and(
+            eq(roles.id, roleMember.roleId),
+            eq(roles.isActive, true),
+            eq(roles.isDeleted, false),
+          ),
+        )
         .leftJoin(permissionRole, eq(permissionRole.roleId, roles.id))
-        .leftJoin(permissions, and(eq(permissions.id, permissionRole.permissionId), eq(permissions.isActive, true), eq(permissions.isDeleted, false)))
+        .leftJoin(
+          permissions,
+          and(
+            eq(permissions.id, permissionRole.permissionId),
+            eq(permissions.isActive, true),
+            eq(permissions.isDeleted, false),
+          ),
+        )
         .where(eq(roleMember.memberId, member.id)),
       this.db
         .select({ slug: permissions.slug })
         .from(permissionMember)
-        .innerJoin(permissions, and(eq(permissions.id, permissionMember.permissionId), eq(permissions.isActive, true), eq(permissions.isDeleted, false)))
+        .innerJoin(
+          permissions,
+          and(
+            eq(permissions.id, permissionMember.permissionId),
+            eq(permissions.isActive, true),
+            eq(permissions.isDeleted, false),
+          ),
+        )
         .where(eq(permissionMember.memberId, member.id)),
     ]);
 
@@ -289,7 +357,9 @@ export class RbacRepository {
       memberId: member.id.toString(),
       roles: [...new Set(roleRows.map((row) => row.roleSlug))].sort(),
       permissions: resolvePermissions(
-        roleRows.map((row) => row.permissionSlug).filter((slug): slug is string => slug !== null),
+        roleRows
+          .map((row) => row.permissionSlug)
+          .filter((slug): slug is string => slug !== null),
         directRows.map((row) => row.slug),
       ),
     };
@@ -301,13 +371,22 @@ export class RbacRepository {
    * caller feeds the id straight into another database call, and the one external caller
    * (AuthService) discards the result.
    */
-  async requireMember(workspaceId: string, userId: string): Promise<{ id: bigint }> {
+  async requireMember(
+    workspaceId: string,
+    userId: string,
+  ): Promise<{ id: bigint }> {
     const [member] = await this.db
       .select({ id: workspaceMembers.id })
       .from(workspaceMembers)
-      .where(and(eq(workspaceMembers.userId, toId(userId)), eq(workspaceMembers.workspaceId, toId(workspaceId))))
+      .where(
+        and(
+          eq(workspaceMembers.userId, toId(userId)),
+          eq(workspaceMembers.workspaceId, toId(workspaceId)),
+        ),
+      )
       .limit(1);
-    if (!member) throw new HttpError(404, "user is not a member of this workspace");
+    if (!member)
+      throw new HttpError(404, "user is not a member of this workspace");
     return member;
   }
 
@@ -315,12 +394,19 @@ export class RbacRepository {
    * Newest-first, page-paginated; `search` matches an email substring. Returns raw rows —
    * shaping the collection is the caller's job, see `toMemberSummary`.
    */
-  async listMembers(workspaceId: string, filter: MemberListFilter = {}): Promise<Paginated<MemberRow>> {
+  async listMembers(
+    workspaceId: string,
+    filter: MemberListFilter = {},
+  ): Promise<Paginated<MemberRow>> {
     const page = normalizePage(filter.page);
     const limit = normalizeLimit(filter.limit);
     const workspaceIdBig = toId(workspaceId);
-    const conditions: SQL[] = [eq(workspaceMembers.workspaceId, workspaceIdBig), eq(users.isDeleted, false)];
-    if (filter.search) conditions.push(ilike(users.email, `%${filter.search}%`));
+    const conditions: SQL[] = [
+      eq(workspaceMembers.workspaceId, workspaceIdBig),
+      eq(users.isDeleted, false),
+    ];
+    if (filter.search)
+      conditions.push(ilike(users.email, `%${filter.search}%`));
     const where = and(...conditions)!;
 
     const rows = await this.db
@@ -357,7 +443,10 @@ export class RbacRepository {
     }
 
     return {
-      items: rows.map((row) => ({ ...row, roles: (rolesByMember.get(row.memberId.toString()) ?? []).sort() })),
+      items: rows.map((row) => ({
+        ...row,
+        roles: (rolesByMember.get(row.memberId.toString()) ?? []).sort(),
+      })),
       meta: buildPageMeta(page, limit, total),
     };
   }
@@ -374,7 +463,10 @@ export class RbacRepository {
     const [row] = await this.db
       .select(MEMBER_SELECT)
       .from(workspaceMembers)
-      .innerJoin(users, and(eq(users.id, workspaceMembers.userId), eq(users.isDeleted, false)))
+      .innerJoin(
+        users,
+        and(eq(users.id, workspaceMembers.userId), eq(users.isDeleted, false)),
+      )
       .where(eq(workspaceMembers.id, member.id))
       .limit(1);
     if (!row) throw new HttpError(404, `user "${userId}" not found`);
@@ -385,14 +477,24 @@ export class RbacRepository {
       .innerJoin(roles, eq(roles.id, roleMember.roleId))
       .where(eq(roleMember.memberId, member.id));
 
-    return toMemberSummary({ ...row, roles: roleRows.map((r) => r.slug).sort() });
+    return toMemberSummary({
+      ...row,
+      roles: roleRows.map((r) => r.slug).sort(),
+    });
   }
 
   /** Profile fields only — email is the login identifier and stays out of this endpoint. */
   async updateMember(
     workspaceId: string,
     userId: string,
-    input: { firstName?: string | null; lastName?: string | null; displayName?: string | null; phone?: string | null; username?: string | null; photo?: string | null },
+    input: {
+      firstName?: string | null;
+      lastName?: string | null;
+      displayName?: string | null;
+      phone?: string | null;
+      username?: string | null;
+      photo?: string | null;
+    },
     actorUserId: string | null,
   ): Promise<MemberSummary> {
     await this.requireMember(workspaceId, userId);
@@ -409,11 +511,21 @@ export class RbacRepository {
    * member's account — this disables the account across every workspace it belongs to, not just
    * this one, which is why it's gated the same way `block` is.
    */
-  async deleteMember(workspaceId: string, userId: string, actorUserId: string | null, reason?: string): Promise<void> {
+  async deleteMember(
+    workspaceId: string,
+    userId: string,
+    actorUserId: string | null,
+    reason?: string,
+  ): Promise<void> {
     await this.requireMember(workspaceId, userId);
     await this.db
       .update(users)
-      .set({ isDeleted: true, deletedAt: new Date(), deletedBy: toIdOrNull(actorUserId), deletedReason: reason ?? null })
+      .set({
+        isDeleted: true,
+        deletedAt: new Date(),
+        deletedBy: toIdOrNull(actorUserId),
+        deletedReason: reason ?? null,
+      })
       .where(eq(users.id, toId(userId)));
     await this.invalidateMember(userId, workspaceId);
   }
@@ -421,7 +533,12 @@ export class RbacRepository {
   async updateRole(
     workspaceId: string,
     roleId: string,
-    input: { name?: string; displayName?: string; description?: string | null; isActive?: boolean },
+    input: {
+      name?: string;
+      displayName?: string;
+      description?: string | null;
+      isActive?: boolean;
+    },
     actorUserId: string | null,
   ): Promise<RoleSummary> {
     const workspaceIdBig = toId(workspaceId);
@@ -431,7 +548,8 @@ export class RbacRepository {
       .from(roles)
       .where(and(eq(roles.id, roleIdBig), eq(roles.isDeleted, false)))
       .limit(1);
-    if (!existing || existing.workspaceId !== workspaceIdBig) throw new HttpError(404, "role not found in this workspace");
+    if (!existing || existing.workspaceId !== workspaceIdBig)
+      throw new HttpError(404, "role not found in this workspace");
 
     const [role] = await this.db
       .update(roles)
@@ -446,7 +564,12 @@ export class RbacRepository {
    * Soft-delete. `role_member`/`permission_role` rows pointing at it are left in place — the role
    * simply stops being resolved by `resolveAuthzContext`/`listRoles`.
    */
-  async deleteRole(workspaceId: string, roleId: string, actorUserId: string | null, reason?: string): Promise<void> {
+  async deleteRole(
+    workspaceId: string,
+    roleId: string,
+    actorUserId: string | null,
+    reason?: string,
+  ): Promise<void> {
     const workspaceIdBig = toId(workspaceId);
     const roleIdBig = toId(roleId);
     const [existing] = await this.db
@@ -454,11 +577,17 @@ export class RbacRepository {
       .from(roles)
       .where(and(eq(roles.id, roleIdBig), eq(roles.isDeleted, false)))
       .limit(1);
-    if (!existing || existing.workspaceId !== workspaceIdBig) throw new HttpError(404, "role not found in this workspace");
+    if (!existing || existing.workspaceId !== workspaceIdBig)
+      throw new HttpError(404, "role not found in this workspace");
 
     await this.db
       .update(roles)
-      .set({ isDeleted: true, deletedAt: new Date(), deletedBy: toIdOrNull(actorUserId), deletedReason: reason ?? null })
+      .set({
+        isDeleted: true,
+        deletedAt: new Date(),
+        deletedBy: toIdOrNull(actorUserId),
+        deletedReason: reason ?? null,
+      })
       .where(eq(roles.id, roleIdBig));
     await this.cache.invalidatePolicy();
   }
@@ -475,7 +604,12 @@ export class RbacRepository {
       .select(PERMISSION_COLUMNS)
       .from(permissions)
       .where(eq(permissions.isDeleted, false))
-      .orderBy(asc(permissions.groupOrder), asc(permissions.group), asc(permissions.order), asc(permissions.slug));
+      .orderBy(
+        asc(permissions.groupOrder),
+        asc(permissions.group),
+        asc(permissions.order),
+        asc(permissions.slug),
+      );
     return rows.map(asPermissionSummary);
   }
 
@@ -488,7 +622,10 @@ export class RbacRepository {
    * Upserted on `slug`, which stays the stable identifier grants and revocations use, so renaming
    * `name`/`displayName` never breaks a grant.
    */
-  async upsertPermission(input: PermissionInput, actorUserId: string | null): Promise<PermissionSummary> {
+  async upsertPermission(
+    input: PermissionInput,
+    actorUserId: string | null,
+  ): Promise<PermissionSummary> {
     const actorId = toIdOrNull(actorUserId);
     // Only the fields the caller sent are written; an absent one leaves its column alone, so a
     // partial edit cannot blank out metadata it did not mention.
@@ -519,7 +656,9 @@ export class RbacRepository {
       // returns none — so the no-op case rewrites the slug with itself.
       .onConflictDoUpdate({
         target: permissions.slug,
-        set: Object.keys(changed).length ? { ...changed, updatedBy: actorId } : { slug: input.slug, updatedBy: actorId },
+        set: Object.keys(changed).length
+          ? { ...changed, updatedBy: actorId }
+          : { slug: input.slug, updatedBy: actorId },
       })
       .returning(PERMISSION_COLUMNS);
 
@@ -532,14 +671,24 @@ export class RbacRepository {
     const rows = await this.db
       .select(ROLE_COLUMNS)
       .from(roles)
-      .where(and(eq(roles.workspaceId, toId(workspaceId)), eq(roles.isDeleted, false)))
+      .where(
+        and(
+          eq(roles.workspaceId, toId(workspaceId)),
+          eq(roles.isDeleted, false),
+        ),
+      )
       .orderBy(asc(roles.order), asc(roles.slug));
     return rows.map(asRoleSummary);
   }
 
   async createRole(
     workspaceId: string,
-    input: { slug: string; name?: string; displayName?: string; description?: string | null },
+    input: {
+      slug: string;
+      name?: string;
+      displayName?: string;
+      description?: string | null;
+    },
     actorUserId: string | null,
   ): Promise<RoleSummary> {
     const actorId = toIdOrNull(actorUserId);
@@ -564,7 +713,12 @@ export class RbacRepository {
    * be granted, and it opens nothing until a route names it — and no route shipped by this
    * library can name it, because `@CheckAbility` only accepts slugs from `rbac.defaults.ts`.
    */
-  async attachPermissionToRole(workspaceId: string, roleId: string, permissionSlug: string, actorUserId: string | null): Promise<void> {
+  async attachPermissionToRole(
+    workspaceId: string,
+    roleId: string,
+    permissionSlug: string,
+    actorUserId: string | null,
+  ): Promise<void> {
     const workspaceIdBig = toId(workspaceId);
     const roleIdBig = toId(roleId);
     const [role] = await this.db
@@ -572,57 +726,95 @@ export class RbacRepository {
       .from(roles)
       .where(and(eq(roles.id, roleIdBig), eq(roles.isDeleted, false)))
       .limit(1);
-    if (!role || role.workspaceId !== workspaceIdBig) throw new HttpError(404, "role not found in this workspace");
+    if (!role || role.workspaceId !== workspaceIdBig)
+      throw new HttpError(404, "role not found in this workspace");
 
     const permission = await this.ensurePermission(permissionSlug, actorUserId);
     await this.db
       .insert(permissionRole)
       .values({ permissionId: permission.id, roleId: roleIdBig })
-      .onConflictDoNothing({ target: [permissionRole.permissionId, permissionRole.roleId] });
+      .onConflictDoNothing({
+        target: [permissionRole.permissionId, permissionRole.roleId],
+      });
     await this.cache.invalidatePolicy(); // every membership holding this role is affected
   }
 
-  async assignRoleToMember(workspaceId: string, userId: string, roleSlug: string): Promise<void> {
+  async assignRoleToMember(
+    workspaceId: string,
+    userId: string,
+    roleSlug: string,
+  ): Promise<void> {
     const role = await this.requireRole(workspaceId, roleSlug);
     const member = await this.requireMember(workspaceId, userId);
     await this.db
       .insert(roleMember)
       .values({ memberId: member.id, roleId: role.id })
-      .onConflictDoNothing({ target: [roleMember.memberId, roleMember.roleId] });
+      .onConflictDoNothing({
+        target: [roleMember.memberId, roleMember.roleId],
+      });
     await this.invalidateMember(userId, workspaceId);
   }
 
-  async revokeRoleFromMember(workspaceId: string, userId: string, roleSlug: string): Promise<void> {
+  async revokeRoleFromMember(
+    workspaceId: string,
+    userId: string,
+    roleSlug: string,
+  ): Promise<void> {
     const member = await this.requireMember(workspaceId, userId);
     const [role] = await this.db
       .select({ id: roles.id })
       .from(roles)
-      .where(and(eq(roles.workspaceId, toId(workspaceId)), eq(roles.slug, roleSlug)))
+      .where(
+        and(eq(roles.workspaceId, toId(workspaceId)), eq(roles.slug, roleSlug)),
+      )
       .limit(1);
     if (!role) return;
-    await this.db.delete(roleMember).where(and(eq(roleMember.memberId, member.id), eq(roleMember.roleId, role.id)));
+    await this.db
+      .delete(roleMember)
+      .where(
+        and(eq(roleMember.memberId, member.id), eq(roleMember.roleId, role.id)),
+      );
     await this.invalidateMember(userId, workspaceId);
   }
 
   /** Replaces the whole set — the "set a member's roles" operation, as opposed to assign/revoke one at a time. */
-  async setMemberRoles(workspaceId: string, memberId: string, roleSlugs: string[]): Promise<{ memberId: string; roles: string[] }> {
+  async setMemberRoles(
+    workspaceId: string,
+    memberId: string,
+    roleSlugs: string[],
+  ): Promise<{ memberId: string; roles: string[] }> {
     const workspaceIdBig = toId(workspaceId);
     const memberIdBig = toId(memberId);
     const [member] = await this.db
-      .select({ id: workspaceMembers.id, workspaceId: workspaceMembers.workspaceId })
+      .select({
+        id: workspaceMembers.id,
+        workspaceId: workspaceMembers.workspaceId,
+      })
       .from(workspaceMembers)
       .where(eq(workspaceMembers.id, memberIdBig))
       .limit(1);
-    if (!member || member.workspaceId !== workspaceIdBig) throw new HttpError(404, "member not found in this workspace");
+    if (!member || member.workspaceId !== workspaceIdBig)
+      throw new HttpError(404, "member not found in this workspace");
 
     const found = roleSlugs.length
       ? await this.db
           .select({ id: roles.id, slug: roles.slug })
           .from(roles)
-          .where(and(eq(roles.workspaceId, workspaceIdBig), inArray(roles.slug, roleSlugs)))
+          .where(
+            and(
+              eq(roles.workspaceId, workspaceIdBig),
+              inArray(roles.slug, roleSlugs),
+            ),
+          )
       : [];
-    const unknown = roleSlugs.filter((slug) => !found.some((role) => role.slug === slug));
-    if (unknown.length) throw new HttpError(404, `role(s) not defined in this workspace: ${unknown.join(", ")}`);
+    const unknown = roleSlugs.filter(
+      (slug) => !found.some((role) => role.slug === slug),
+    );
+    if (unknown.length)
+      throw new HttpError(
+        404,
+        `role(s) not defined in this workspace: ${unknown.join(", ")}`,
+      );
 
     // Replace, in one transaction: a member must never be briefly role-less to a concurrent request.
     await this.db.transaction(async (tx) => {
@@ -630,8 +822,12 @@ export class RbacRepository {
       if (found.length) {
         await tx
           .insert(roleMember)
-          .values(found.map((role) => ({ memberId: memberIdBig, roleId: role.id })))
-          .onConflictDoNothing({ target: [roleMember.memberId, roleMember.roleId] });
+          .values(
+            found.map((role) => ({ memberId: memberIdBig, roleId: role.id })),
+          )
+          .onConflictDoNothing({
+            target: [roleMember.memberId, roleMember.roleId],
+          });
       }
     });
     await this.invalidateMemberById(memberIdBig);
@@ -647,37 +843,76 @@ export class RbacRepository {
     const rows = await this.db
       .select({ id: roles.id })
       .from(roles)
-      .where(and(eq(roles.workspaceId, toId(workspaceId)), eq(roles.isDefault, true), eq(roles.isActive, true), eq(roles.isDeleted, false)));
+      .where(
+        and(
+          eq(roles.workspaceId, toId(workspaceId)),
+          eq(roles.isDefault, true),
+          eq(roles.isActive, true),
+          eq(roles.isDeleted, false),
+        ),
+      );
     return rows.map((role) => role.id);
   }
 
-  async grantPermissionToMember(workspaceId: string, userId: string, permissionSlug: string, actorUserId: string | null): Promise<void> {
+  async grantPermissionToMember(
+    workspaceId: string,
+    userId: string,
+    permissionSlug: string,
+    actorUserId: string | null,
+  ): Promise<void> {
     const member = await this.requireMember(workspaceId, userId);
     const permission = await this.ensurePermission(permissionSlug, actorUserId);
     await this.db
       .insert(permissionMember)
       .values({ memberId: member.id, permissionId: permission.id })
-      .onConflictDoNothing({ target: [permissionMember.memberId, permissionMember.permissionId] });
+      .onConflictDoNothing({
+        target: [permissionMember.memberId, permissionMember.permissionId],
+      });
     await this.invalidateMember(userId, workspaceId);
   }
 
-  async revokePermissionFromMember(workspaceId: string, userId: string, permissionSlug: string): Promise<void> {
+  async revokePermissionFromMember(
+    workspaceId: string,
+    userId: string,
+    permissionSlug: string,
+  ): Promise<void> {
     const member = await this.requireMember(workspaceId, userId);
-    const [permission] = await this.db.select({ id: permissions.id }).from(permissions).where(eq(permissions.slug, permissionSlug)).limit(1);
+    const [permission] = await this.db
+      .select({ id: permissions.id })
+      .from(permissions)
+      .where(eq(permissions.slug, permissionSlug))
+      .limit(1);
     if (!permission) return;
-    await this.db.delete(permissionMember).where(and(eq(permissionMember.memberId, member.id), eq(permissionMember.permissionId, permission.id)));
+    await this.db
+      .delete(permissionMember)
+      .where(
+        and(
+          eq(permissionMember.memberId, member.id),
+          eq(permissionMember.permissionId, permission.id),
+        ),
+      );
     await this.invalidateMember(userId, workspaceId);
   }
 
   // Returns bigint directly: its one caller (assignRoleToMember) feeds the id straight into
   // another database call.
-  private async requireRole(workspaceId: string, slug: string): Promise<{ id: bigint }> {
+  private async requireRole(
+    workspaceId: string,
+    slug: string,
+  ): Promise<{ id: bigint }> {
     const [role] = await this.db
       .select({ id: roles.id })
       .from(roles)
-      .where(and(eq(roles.workspaceId, toId(workspaceId)), eq(roles.slug, slug), eq(roles.isDeleted, false)))
+      .where(
+        and(
+          eq(roles.workspaceId, toId(workspaceId)),
+          eq(roles.slug, slug),
+          eq(roles.isDeleted, false),
+        ),
+      )
       .limit(1);
-    if (!role) throw new HttpError(404, `role "${slug}" not found in this workspace`);
+    if (!role)
+      throw new HttpError(404, `role "${slug}" not found in this workspace`);
     return role;
   }
 
@@ -685,13 +920,27 @@ export class RbacRepository {
    * Creates the row for a slug granted before anyone defined it; leaves an existing definition
    * alone. Returns bigint directly: both callers feed the id straight into another database call.
    */
-  private async ensurePermission(slug: string, actorUserId: string | null): Promise<{ id: bigint }> {
-    const [existing] = await this.db.select({ id: permissions.id }).from(permissions).where(eq(permissions.slug, slug)).limit(1);
+  private async ensurePermission(
+    slug: string,
+    actorUserId: string | null,
+  ): Promise<{ id: bigint }> {
+    const [existing] = await this.db
+      .select({ id: permissions.id })
+      .from(permissions)
+      .where(eq(permissions.slug, slug))
+      .limit(1);
     if (existing) return existing;
     const actorId = toIdOrNull(actorUserId);
     const [created] = await this.db
       .insert(permissions)
-      .values({ slug, name: slug, displayName: slug, group: "Custom", createdBy: actorId, updatedBy: actorId })
+      .values({
+        slug,
+        name: slug,
+        displayName: slug,
+        group: "Custom",
+        createdBy: actorId,
+        updatedBy: actorId,
+      })
       .returning({ id: permissions.id });
     return created;
   }