@simple-auth-kit/cli 1.4.3 → 1.5.0

package/registry/combos/express-drizzle/variants/workspaces/src/{workspace.repository.ts → repositories/workspace.repository.ts}

@@ -1,10 +1,19 @@
 import { and, asc, eq, inArray } from "drizzle-orm";
-import type { Database } from "./db.js";
-import { provisionDefaultRoles, WORKSPACE_CREATOR_ROLES } from "./rbac.defaults.js";
+import type { Database } from "../db.js";
+import {
+  provisionDefaultRoles,
+  WORKSPACE_CREATOR_ROLES,
+} from "../rbac.defaults.js";
 import { RbacRepository } from "./rbac.repository.js";
-import { roleMember, roles, users, workspaceMembers, workspaces } from "./schema.js";
-import { HttpError } from "./http-error.js";
-import { toId } from "./id.helper.js";
+import {
+  roleMember,
+  roles,
+  users,
+  workspaceMembers,
+  workspaces,
+} from "../schema.js";
+import { HttpError } from "../http-error.js";
+import { toId } from "../id.helper.js";
 
 export interface WorkspaceSummary {
   id: string;
@@ -42,16 +51,34 @@ export class WorkspaceRepository {
   async create(userId: string, name: string): Promise<WorkspaceSummary> {
     const userIdBig = toId(userId);
     const workspace = await this.db.transaction(async (tx) => {
-      const [created] = await tx.insert(workspaces).values({ name, createdBy: userIdBig, updatedBy: userIdBig }).returning();
+      const [created] = await tx
+        .insert(workspaces)
+        .values({ name, createdBy: userIdBig, updatedBy: userIdBig })
+        .returning();
       await provisionDefaultRoles(tx, created.id);
 
       const creatorRoles = await tx
         .select({ id: roles.id })
         .from(roles)
-        .where(and(eq(roles.workspaceId, created.id), inArray(roles.slug, WORKSPACE_CREATOR_ROLES)));
-      const [member] = await tx.insert(workspaceMembers).values({ workspaceId: created.id, userId: userIdBig }).returning({ id: workspaceMembers.id });
+        .where(
+          and(
+            eq(roles.workspaceId, created.id),
+            inArray(roles.slug, WORKSPACE_CREATOR_ROLES),
+          ),
+        );
+      const [member] = await tx
+        .insert(workspaceMembers)
+        .values({ workspaceId: created.id, userId: userIdBig })
+        .returning({ id: workspaceMembers.id });
       if (creatorRoles.length) {
-        await tx.insert(roleMember).values(creatorRoles.map((role) => ({ memberId: member.id, roleId: role.id })));
+        await tx
+          .insert(roleMember)
+          .values(
+            creatorRoles.map((role) => ({
+              memberId: member.id,
+              roleId: role.id,
+            })),
+          );
       }
       return created;
     });
@@ -73,11 +100,19 @@ export class WorkspaceRepository {
         createdAt: workspaces.createdAt,
       })
       .from(workspaceMembers)
-      .innerJoin(workspaces, and(eq(workspaces.id, workspaceMembers.workspaceId), eq(workspaces.isDeleted, false)))
+      .innerJoin(
+        workspaces,
+        and(
+          eq(workspaces.id, workspaceMembers.workspaceId),
+          eq(workspaces.isDeleted, false),
+        ),
+      )
       .where(eq(workspaceMembers.userId, toId(userId)))
       .orderBy(asc(workspaceMembers.createdAt));
 
-    const rolesByMember = await this.rolesByMember(memberships.map((m) => m.memberId));
+    const rolesByMember = await this.rolesByMember(
+      memberships.map((m) => m.memberId),
+    );
     return memberships.map((m) => ({
       id: m.id.toString(),
       name: m.name,
@@ -95,7 +130,10 @@ export class WorkspaceRepository {
         email: users.email,
       })
       .from(workspaceMembers)
-      .innerJoin(users, and(eq(users.id, workspaceMembers.userId), eq(users.isDeleted, false)))
+      .innerJoin(
+        users,
+        and(eq(users.id, workspaceMembers.userId), eq(users.isDeleted, false)),
+      )
       .where(eq(workspaceMembers.workspaceId, toId(workspaceId)))
       .orderBy(asc(workspaceMembers.createdAt));
 
@@ -115,17 +153,33 @@ export class WorkspaceRepository {
    * Shared by `addMember` (an existing account) and `createMember` (a brand-new one), so both
    * fail the same way against an unknown role slug.
    */
-  private async resolveMemberRoles(workspaceIdBig: bigint, roleSlugs?: string[]): Promise<Array<{ id: bigint; slug: string }>> {
+  private async resolveMemberRoles(
+    workspaceIdBig: bigint,
+    roleSlugs?: string[],
+  ): Promise<Array<{ id: bigint; slug: string }>> {
     const granted = await this.db
       .select({ id: roles.id, slug: roles.slug })
       .from(roles)
       .where(
         roleSlugs
-          ? and(eq(roles.workspaceId, workspaceIdBig), inArray(roles.slug, roleSlugs))
-          : and(eq(roles.workspaceId, workspaceIdBig), eq(roles.isDefault, true), eq(roles.isActive, true)),
+          ? and(
+              eq(roles.workspaceId, workspaceIdBig),
+              inArray(roles.slug, roleSlugs),
+            )
+          : and(
+              eq(roles.workspaceId, workspaceIdBig),
+              eq(roles.isDefault, true),
+              eq(roles.isActive, true),
+            ),
+      );
+    const unknown = (roleSlugs ?? []).filter(
+      (slug) => !granted.some((role) => role.slug === slug),
+    );
+    if (unknown.length)
+      throw new HttpError(
+        404,
+        `role(s) not defined in this workspace: ${unknown.join(", ")}`,
       );
-    const unknown = (roleSlugs ?? []).filter((slug) => !granted.some((role) => role.slug === slug));
-    if (unknown.length) throw new HttpError(404, `role(s) not defined in this workspace: ${unknown.join(", ")}`);
     return granted;
   }
 
@@ -134,23 +188,45 @@ export class WorkspaceRepository {
    * consuming app's job. With no roles named, the new membership gets whichever of this
    * workspace's roles are flagged `isDefault`, not a slug spelled in code.
    */
-  async addMember(workspaceId: string, email: string, roleSlugs?: string[]): Promise<MembershipSummary> {
+  async addMember(
+    workspaceId: string,
+    email: string,
+    roleSlugs?: string[],
+  ): Promise<MembershipSummary> {
     const workspaceIdBig = toId(workspaceId);
-    const [user] = await this.db.select({ id: users.id, email: users.email }).from(users).where(eq(users.email, email)).limit(1);
+    const [user] = await this.db
+      .select({ id: users.id, email: users.email })
+      .from(users)
+      .where(eq(users.email, email))
+      .limit(1);
     if (!user) throw new HttpError(404, "no user with that email");
 
     const [existing] = await this.db
       .select({ id: workspaceMembers.id })
       .from(workspaceMembers)
-      .where(and(eq(workspaceMembers.userId, user.id), eq(workspaceMembers.workspaceId, workspaceIdBig)))
+      .where(
+        and(
+          eq(workspaceMembers.userId, user.id),
+          eq(workspaceMembers.workspaceId, workspaceIdBig),
+        ),
+      )
       .limit(1);
-    if (existing) throw new HttpError(409, "already a member of this workspace");
+    if (existing)
+      throw new HttpError(409, "already a member of this workspace");
 
     const granted = await this.resolveMemberRoles(workspaceIdBig, roleSlugs);
 
     const member = await this.db.transaction(async (tx) => {
-      const [created] = await tx.insert(workspaceMembers).values({ workspaceId: workspaceIdBig, userId: user.id }).returning();
-      if (granted.length) await tx.insert(roleMember).values(granted.map((role) => ({ memberId: created.id, roleId: role.id })));
+      const [created] = await tx
+        .insert(workspaceMembers)
+        .values({ workspaceId: workspaceIdBig, userId: user.id })
+        .returning();
+      if (granted.length)
+        await tx
+          .insert(roleMember)
+          .values(
+            granted.map((role) => ({ memberId: created.id, roleId: role.id })),
+          );
       return created;
     });
 
@@ -183,7 +259,11 @@ export class WorkspaceRepository {
     actorUserId: string | null,
   ): Promise<MembershipSummary> {
     const workspaceIdBig = toId(workspaceId);
-    const [existing] = await this.db.select({ id: users.id }).from(users).where(eq(users.email, input.email)).limit(1);
+    const [existing] = await this.db
+      .select({ id: users.id })
+      .from(users)
+      .where(eq(users.email, input.email))
+      .limit(1);
     if (existing) throw new HttpError(409, "email already registered");
 
     const granted = await this.resolveMemberRoles(workspaceIdBig, input.roles);
@@ -202,8 +282,16 @@ export class WorkspaceRepository {
           createdBy: actorUserId ? toId(actorUserId) : null,
         })
         .returning();
-      const [created] = await tx.insert(workspaceMembers).values({ workspaceId: workspaceIdBig, userId: user.id }).returning();
-      if (granted.length) await tx.insert(roleMember).values(granted.map((role) => ({ memberId: created.id, roleId: role.id })));
+      const [created] = await tx
+        .insert(workspaceMembers)
+        .values({ workspaceId: workspaceIdBig, userId: user.id })
+        .returning();
+      if (granted.length)
+        await tx
+          .insert(roleMember)
+          .values(
+            granted.map((role) => ({ memberId: created.id, roleId: role.id })),
+          );
       return { member: created, user };
     });
 
@@ -220,23 +308,32 @@ export class WorkspaceRepository {
     const workspaceIdBig = toId(workspaceId);
     const memberIdBig = toId(memberId);
     const [member] = await this.db
-      .select({ id: workspaceMembers.id, userId: workspaceMembers.userId, workspaceId: workspaceMembers.workspaceId })
+      .select({
+        id: workspaceMembers.id,
+        userId: workspaceMembers.userId,
+        workspaceId: workspaceMembers.workspaceId,
+      })
       .from(workspaceMembers)
       .where(eq(workspaceMembers.id, memberIdBig))
       .limit(1);
-    if (!member || member.workspaceId !== workspaceIdBig) throw new HttpError(404, "member not found in this workspace");
+    if (!member || member.workspaceId !== workspaceIdBig)
+      throw new HttpError(404, "member not found in this workspace");
 
     // Role assignments and direct grants belong to the membership, so they go with it — that is
     // the point of hanging them off the member row. `onDelete: "cascade"` on both join tables is
     // what makes that a database guarantee rather than two deletes someone has to remember.
-    await this.db.delete(workspaceMembers).where(eq(workspaceMembers.id, memberIdBig));
+    await this.db
+      .delete(workspaceMembers)
+      .where(eq(workspaceMembers.id, memberIdBig));
     // A removed member must lose access on their very next request, so their entry has to become
     // unreachable — the resolution that replaces it returns "not a member", which is never cached.
     await this.rbac.invalidateMember(member.userId.toString(), workspaceId);
   }
 
   /** One read for a page's role assignments rather than one per membership. */
-  private async rolesByMember(memberIds: bigint[]): Promise<Map<string, string[]>> {
+  private async rolesByMember(
+    memberIds: bigint[],
+  ): Promise<Map<string, string[]>> {
     if (!memberIds.length) return new Map();
     const rows = await this.db
       .select({ memberId: roleMember.memberId, slug: roles.slug })