@simple-auth-kit/cli 1.4.3 → 1.5.1

package/registry/combos/express-prisma/shared/src/{auth-core-error.middleware.ts → middleware/auth-core-error.middleware.ts}

@@ -1,6 +1,6 @@
 import type { NextFunction, Request, Response } from "express";
 import { AuthCoreError } from "@/lib/auth/core/types.js";
-import { HttpError } from "./http-error.js";
+import { HttpError } from "../http-error.js";
 
 /**
  * Replaces the reference combo's `AuthCoreErrorFilter` (a Nest global `@Catch` exception
@@ -11,19 +11,32 @@ import { HttpError } from "./http-error.js";
  * maps this combo's own `HttpError` to its intended status code — the plain-Express stand-in
  * for the NestJS exception classes the reference throws.
  */
-export function authCoreErrorMiddleware(err: unknown, _req: Request, res: Response, next: NextFunction): void {
+export function authCoreErrorMiddleware(
+  err: unknown,
+  _req: Request,
+  res: Response,
+  next: NextFunction,
+): void {
   if (res.headersSent) {
     next(err);
     return;
   }
 
   if (err instanceof AuthCoreError) {
-    res.status(401).json({ statusCode: 401, code: err.code, message: err.message });
+    res
+      .status(401)
+      .json({ statusCode: 401, code: err.code, message: err.message });
     return;
   }
 
   if (err instanceof HttpError) {
-    res.status(err.statusCode).json({ statusCode: err.statusCode, code: err.name, message: err.message });
+    res
+      .status(err.statusCode)
+      .json({
+        statusCode: err.statusCode,
+        code: err.name,
+        message: err.message,
+      });
     return;
   }
 

package/registry/combos/express-prisma/shared/src/{auth.middleware.ts → middleware/auth.middleware.ts}

@@ -1,8 +1,8 @@
 import type { NextFunction, Request, Response } from "express";
 import { verifyAccessToken } from "@/lib/auth/core/token-service.js";
-import { KeyProviderService } from "./key-provider.js";
-import "./request-context.js";
-import { SessionRepository } from "./session.repository.js";
+import { KeyProviderService } from "../key-provider.js";
+import "../request-context.js";
+import { SessionRepository } from "../repositories/session.repository.js";
 
 export interface AuthMiddlewareDeps {
   keys: KeyProviderService;
@@ -19,16 +19,29 @@ export interface AuthMiddlewareDeps {
  * is the idiomatic equivalent.
  */
 export function createAuthMiddleware(deps: AuthMiddlewareDeps) {
-  return async function authMiddleware(req: Request, res: Response, next: NextFunction): Promise<void> {
+  return async function authMiddleware(
+    req: Request,
+    res: Response,
+    next: NextFunction,
+  ): Promise<void> {
     const header = req.headers["authorization"];
     if (!header?.startsWith("Bearer ")) {
-      res.status(401).json({ statusCode: 401, code: "UNAUTHORIZED", message: "missing bearer token" });
+      res
+        .status(401)
+        .json({
+          statusCode: 401,
+          code: "UNAUTHORIZED",
+          message: "missing bearer token",
+        });
       return;
     }
 
     try {
       req.auth = await verifyAccessToken(
-        { secret: deps.keys.secret, isDenylisted: (jti) => deps.sessions.isDenylisted(jti) },
+        {
+          secret: deps.keys.secret,
+          isDenylisted: (jti) => deps.sessions.isDenylisted(jti),
+        },
         header.slice("Bearer ".length),
       );
     } catch (err) {

package/registry/combos/{express-drizzle/shared/src → express-prisma/shared/src/middleware}/response-envelope.middleware.ts

@@ -36,10 +36,22 @@ export function responseEnvelope(): RequestHandler {
     const originalJson = res.json.bind(res);
     res.json = ((body: unknown) => {
       if (res.statusCode >= 400) {
-        const shaped = body && typeof body === "object" ? (body as Record<string, unknown>) : { message: body };
-        return originalJson({ success: false, statusCode: res.statusCode, ...shaped });
+        const shaped =
+          body && typeof body === "object"
+            ? (body as Record<string, unknown>)
+            : { message: body };
+        return originalJson({
+          success: false,
+          statusCode: res.statusCode,
+          ...shaped,
+        });
       }
-      return originalJson({ success: true, statusCode: res.statusCode, message: deriveMessage(req.method), data: body });
+      return originalJson({
+        success: true,
+        statusCode: res.statusCode,
+        message: deriveMessage(req.method),
+        data: body,
+      });
     }) as typeof res.json;
     next();
   };

package/registry/combos/express-prisma/shared/src/{oauth.repository.ts → repositories/oauth.repository.ts}

@@ -1,22 +1,32 @@
 import type { OAuthStoreDeps } from "@/lib/auth/core/oauth.js";
-import { PrismaClient } from "../generated/prisma/client.js";
-import { HttpError } from "./http-error.js";
-import { toId } from "./id.helper.js";
+import { PrismaClient } from "../../generated/prisma/client.js";
+import { HttpError } from "../http-error.js";
+import { toId } from "../id.helper.js";
 
 // Plain class, no DI container — constructed directly with a PrismaClient in
 // create-auth-app.ts. Identical Prisma queries to the reference combo.
 export class OAuthRepository implements OAuthStoreDeps {
   constructor(private readonly prisma: PrismaClient) {}
 
-  async findAccountByProvider(provider: string, providerAccountId: string): Promise<{ userId: string } | null> {
+  async findAccountByProvider(
+    provider: string,
+    providerAccountId: string,
+  ): Promise<{ userId: string } | null> {
     const row = await this.prisma.oAuthAccount.findUnique({
       where: { provider_providerAccountId: { provider, providerAccountId } },
     });
     return row ? { userId: row.userId.toString() } : null;
   }
 
-  async linkAccount(input: { userId: string; provider: string; providerAccountId: string; email?: string }): Promise<void> {
-    await this.prisma.oAuthAccount.create({ data: { ...input, userId: toId(input.userId) } });
+  async linkAccount(input: {
+    userId: string;
+    provider: string;
+    providerAccountId: string;
+    email?: string;
+  }): Promise<void> {
+    await this.prisma.oAuthAccount.create({
+      data: { ...input, userId: toId(input.userId) },
+    });
   }
 
   async findUserByVerifiedEmail(email: string): Promise<{ id: string } | null> {
@@ -25,9 +35,17 @@ export class OAuthRepository implements OAuthStoreDeps {
   }
 
   /** OAuth-only signup: no password is ever set, which is why `User.passwordHash` is nullable. */
-  async createUserFromOAuth(input: { email?: string }): Promise<{ id: string }> {
-    if (!input.email) throw new HttpError(400, "OAuth provider did not return an email address");
-    const row = await this.prisma.user.create({ data: { email: input.email, passwordHash: null } });
+  async createUserFromOAuth(input: {
+    email?: string;
+  }): Promise<{ id: string }> {
+    if (!input.email)
+      throw new HttpError(
+        400,
+        "OAuth provider did not return an email address",
+      );
+    const row = await this.prisma.user.create({
+      data: { email: input.email, passwordHash: null },
+    });
     return { id: row.id.toString() };
   }
 }

package/registry/combos/express-prisma/shared/src/repositories/password-reset.repository.ts

@@ -0,0 +1,55 @@
+import type { PasswordResetStoreDeps } from "@/lib/auth/core/password-reset.js";
+import { PrismaClient } from "../../generated/prisma/client.js";
+import { toId } from "../id.helper.js";
+
+// Plain class, no DI container — constructed directly with a PrismaClient in
+// create-auth-app.ts. Identical Prisma queries to the reference combo.
+export class PasswordResetRepository implements PasswordResetStoreDeps {
+  constructor(private readonly prisma: PrismaClient) {}
+
+  async saveResetToken(input: {
+    userId: string;
+    tokenHash: string;
+    expiresAt: string;
+  }): Promise<void> {
+    await this.prisma.passwordResetToken.create({
+      data: {
+        userId: toId(input.userId),
+        tokenHash: input.tokenHash,
+        expiresAt: new Date(input.expiresAt),
+      },
+    });
+  }
+
+  async findValidResetToken(
+    tokenHash: string,
+  ): Promise<{
+    userId: string;
+    expiresAt: string;
+    consumedAt: string | null;
+  } | null> {
+    const row = await this.prisma.passwordResetToken.findUnique({
+      where: { tokenHash },
+    });
+    if (!row) return null;
+    return {
+      userId: row.userId.toString(),
+      expiresAt: row.expiresAt.toISOString(),
+      consumedAt: row.consumedAt?.toISOString() ?? null,
+    };
+  }
+
+  async consumeResetToken(tokenHash: string): Promise<void> {
+    await this.prisma.passwordResetToken.update({
+      where: { tokenHash },
+      data: { consumedAt: new Date() },
+    });
+  }
+
+  async setPasswordHash(userId: string, passwordHash: string): Promise<void> {
+    await this.prisma.user.update({
+      where: { id: toId(userId) },
+      data: { passwordHash },
+    });
+  }
+}

package/registry/combos/express-prisma/shared/src/{session.repository.ts → repositories/session.repository.ts}

@@ -1,10 +1,14 @@
 import { randomUUID } from "node:crypto";
 import type { SessionStoreDeps } from "@/lib/auth/core/session-policy.js";
-import type { AuditEvent, Revoker, SessionRecord } from "@/lib/auth/core/types.js";
-import { PrismaClient } from "../generated/prisma/client.js";
-import type { AuthConfig } from "./auth.config.js";
+import type {
+  AuditEvent,
+  Revoker,
+  SessionRecord,
+} from "@/lib/auth/core/types.js";
+import { PrismaClient } from "../../generated/prisma/client.js";
+import type { AuthConfig } from "../auth.config.js";
 import { AuditLogRepository } from "./audit-log.repository.js";
-import { toId, toIdOrNull } from "./id.helper.js";
+import { toId, toIdOrNull } from "../id.helper.js";
 
 function toSessionRecord(row: {
   id: bigint;
@@ -64,7 +68,9 @@ export class SessionRepository implements SessionStoreDeps {
   }
 
   async findSession(id: string): Promise<SessionRecord | null> {
-    const row = await this.prisma.session.findUnique({ where: { id: toId(id) } });
+    const row = await this.prisma.session.findUnique({
+      where: { id: toId(id) },
+    });
     return row ? toSessionRecord(row) : null;
   }
 
@@ -92,7 +98,12 @@ export class SessionRepository implements SessionStoreDeps {
    * `createdBy` is the user themselves. A session is only ever created by the person logging in,
    * so recording it costs nothing and leaves the column meaningful rather than always null.
    */
-  async createSession(input: { userId: string; userAgent?: string; ip?: string; provider?: string }): Promise<SessionRecord> {
+  async createSession(input: {
+    userId: string;
+    userAgent?: string;
+    ip?: string;
+    provider?: string;
+  }): Promise<SessionRecord> {
     const userIdBig = toId(input.userId);
     const row = await this.prisma.session.create({
       data: {
@@ -116,9 +127,17 @@ export class SessionRepository implements SessionStoreDeps {
     });
   }
 
-  async revokeAllByUserExcept(userId: string, keepSessionId: string, revoker?: Revoker): Promise<void> {
+  async revokeAllByUserExcept(
+    userId: string,
+    keepSessionId: string,
+    revoker?: Revoker,
+  ): Promise<void> {
     await this.prisma.session.updateMany({
-      where: { userId: toId(userId), id: { not: toId(keepSessionId) }, revokedAt: null },
+      where: {
+        userId: toId(userId),
+        id: { not: toId(keepSessionId) },
+        revokedAt: null,
+      },
       data: { ...revocationFields(revoker), sessionVersion: { increment: 1 } },
     });
   }
@@ -132,7 +151,9 @@ export class SessionRepository implements SessionStoreDeps {
   }
 
   async isDenylisted(jti: string): Promise<boolean> {
-    const row = await this.prisma.denylistedAccessToken.findUnique({ where: { jti } });
+    const row = await this.prisma.denylistedAccessToken.findUnique({
+      where: { jti },
+    });
     if (!row) return false;
     if (row.expiresAt.getTime() < Date.now()) return false; // expired; a cleanup job reaps these, see Phase 6
     return true;

package/registry/combos/express-prisma/shared/src/{two-factor.repository.ts → repositories/two-factor.repository.ts}

@@ -1,5 +1,5 @@
 import { verifyBackupCode } from "@/lib/auth/core/two-factor.js";
-import { PrismaClient } from "../generated/prisma/client.js";
+import { PrismaClient } from "../../generated/prisma/client.js";
 
 // Plain class, no DI container — constructed directly with a PrismaClient in
 // create-auth-app.ts. Identical Prisma queries to the reference combo.
@@ -12,15 +12,22 @@ export class TwoFactorRepository {
   /** Replaces any prior set — re-confirming enrollment invalidates old backup codes. */
   async saveBackupCodes(userId: bigint, hashes: string[]): Promise<void> {
     await this.prisma.twoFactorBackupCode.deleteMany({ where: { userId } });
-    await this.prisma.twoFactorBackupCode.createMany({ data: hashes.map((codeHash) => ({ userId, codeHash })) });
+    await this.prisma.twoFactorBackupCode.createMany({
+      data: hashes.map((codeHash) => ({ userId, codeHash })),
+    });
   }
 
   async consumeBackupCode(userId: bigint, code: string): Promise<boolean> {
-    const unused = await this.prisma.twoFactorBackupCode.findMany({ where: { userId, usedAt: null } });
+    const unused = await this.prisma.twoFactorBackupCode.findMany({
+      where: { userId, usedAt: null },
+    });
     const match = unused.find((row) => verifyBackupCode(code, row.codeHash));
     if (!match) return false;
 
-    await this.prisma.twoFactorBackupCode.update({ where: { id: match.id }, data: { usedAt: new Date() } });
+    await this.prisma.twoFactorBackupCode.update({
+      where: { id: match.id },
+      data: { usedAt: new Date() },
+    });
     return true;
   }
 

package/registry/combos/express-prisma/shared/src/request-context.ts

@@ -20,7 +20,7 @@
 // `declare module "express"`.
 import type { AccessTokenClaims } from "@/lib/auth/core/types.js";
 import type { AppAbility } from "./ability.js";
-import type { AuthzContext } from "./authz.middleware.js";
+import type { AuthzContext } from "./middleware/authz.middleware.js";
 
 declare global {
   // Express's own declaration-merging style for augmenting its Request type requires a