@simple-auth-kit/cli 1.4.3 → 1.5.1

package/registry/combos/express-prisma/variants/base/src/rbac.defaults.ts

@@ -42,40 +42,65 @@ export interface PermissionSeed {
  * evaluate.
  */
 export const PERMISSION_CATALOG = {
-  "users:read": { displayName: "List users", description: "GET /auth/admin/users, GET /auth/admin/users/:userId", group: "Users", order: 1 },
-  "users:block": { displayName: "Block and unblock users", description: "POST /auth/admin/users/:userId/block, .../unblock", group: "Users", order: 2 },
+  "users:read": {
+    displayName: "List users",
+    description: "GET /auth/admin/users, GET /auth/admin/users/:userId",
+    group: "Users",
+    order: 1,
+  },
+  "users:block": {
+    displayName: "Block and unblock users",
+    description: "POST /auth/admin/users/:userId/block, .../unblock",
+    group: "Users",
+    order: 2,
+  },
   "users:manage": {
     displayName: "Edit and delete users",
-    description: "Edit a user's profile or delete their account — PATCH /auth/admin/users/:userId, DELETE /auth/admin/users/:userId",
+    description:
+      "Edit a user's profile or delete their account — PATCH /auth/admin/users/:userId, DELETE /auth/admin/users/:userId",
     group: "Users",
     order: 3,
   },
   "roles:manage": {
     displayName: "Define roles",
-    description: "Create, edit, or delete roles and say what they carry — POST/PATCH/DELETE /auth/admin/roles(/:roleId), POST /auth/admin/roles/:roleId/permissions",
+    description:
+      "Create, edit, or delete roles and say what they carry — POST/PATCH/DELETE /auth/admin/roles(/:roleId), POST /auth/admin/roles/:roleId/permissions",
     group: "Roles",
     order: 1,
   },
   "roles:assign": {
     displayName: "Assign roles",
-    description: "Assign and revoke a user's roles — POST /auth/admin/users/:userId/roles, .../roles/:roleSlug/revoke",
+    description:
+      "Assign and revoke a user's roles — POST /auth/admin/users/:userId/roles, .../roles/:roleSlug/revoke",
     group: "Roles",
     order: 2,
   },
-  "permissions:read": { displayName: "Read the permission catalog", description: "GET /auth/admin/permissions", group: "Permissions", order: 1 },
+  "permissions:read": {
+    displayName: "Read the permission catalog",
+    description: "GET /auth/admin/permissions",
+    group: "Permissions",
+    order: 1,
+  },
   "permissions:define": {
     displayName: "Define permissions",
-    description: "Create a permission, rename it, or deactivate it — POST /auth/admin/permissions. The authority that defines all the others.",
+    description:
+      "Create a permission, rename it, or deactivate it — POST /auth/admin/permissions. The authority that defines all the others.",
     group: "Permissions",
     order: 2,
   },
   "permissions:grant": {
     displayName: "Grant permissions directly",
-    description: "Grant and revoke a permission straight to a user, bypassing roles — POST /auth/admin/users/:userId/permissions, .../permissions/:slug/revoke",
+    description:
+      "Grant and revoke a permission straight to a user, bypassing roles — POST /auth/admin/users/:userId/permissions, .../permissions/:slug/revoke",
     group: "Permissions",
     order: 3,
   },
-  "audit-log:read": { displayName: "Read the audit log", description: "GET /auth/admin/audit-log", group: "Audit", order: 1 },
+  "audit-log:read": {
+    displayName: "Read the audit log",
+    description: "GET /auth/admin/audit-log",
+    group: "Audit",
+    order: 1,
+  },
 } as const satisfies Record<string, PermissionSeed>;
 
 /**
@@ -87,10 +112,14 @@ export const PERMISSION_CATALOG = {
  */
 export type PermissionSlug = keyof typeof PERMISSION_CATALOG;
 
-export const PERMISSION_SLUGS = Object.keys(PERMISSION_CATALOG) as PermissionSlug[];
+export const PERMISSION_SLUGS = Object.keys(
+  PERMISSION_CATALOG,
+) as PermissionSlug[];
 
 /** Groups, in the order an admin console should render them. Derived from the catalog so it cannot drift from it. */
-export const PERMISSION_GROUP_ORDER: string[] = [...new Set(PERMISSION_SLUGS.map((slug) => PERMISSION_CATALOG[slug].group))];
+export const PERMISSION_GROUP_ORDER: string[] = [
+  ...new Set(PERMISSION_SLUGS.map((slug) => PERMISSION_CATALOG[slug].group)),
+];
 
 /** The display metadata a seeded role carries, plus what it starts out granting. */
 export interface RoleSeed {
@@ -125,7 +154,8 @@ export const DEFAULT_ROLES: readonly RoleSeed[] = [
   {
     slug: "superadmin",
     displayName: "Super Admin",
-    description: "Carries every permission in the catalog — same authority as admin, held by the seeded super_admin account (see SEED_SUPERADMIN_* in seed.ts).",
+    description:
+      "Carries every permission in the catalog — same authority as admin, held by the seeded super_admin account (see SEED_SUPERADMIN_* in seed.ts).",
     isDefault: false,
     order: 1,
     permissions: PERMISSION_SLUGS,
@@ -147,7 +177,10 @@ export const SEED_ADMIN_ROLES: string[] = ["admin", "member"];
 export const SEED_SUPERADMIN_ROLES: string[] = ["superadmin", "member"];
 
 /** Anything that can write the catalog tables: the PrismaClient, or a `$transaction` client. */
-export type RbacWriter = Pick<PrismaClient, "permission" | "role" | "permissionRole">;
+export type RbacWriter = Pick<
+  PrismaClient,
+  "permission" | "role" | "permissionRole"
+>;
 
 /**
  * Writes the starting catalog and roles above into `db`, which may be a transaction client — so a
@@ -166,12 +199,17 @@ export async function provisionDefaultRoles(db: RbacWriter): Promise<void> {
       displayName: PERMISSION_CATALOG[slug].displayName,
       description: PERMISSION_CATALOG[slug].description,
       group: PERMISSION_CATALOG[slug].group,
-      groupOrder: PERMISSION_GROUP_ORDER.indexOf(PERMISSION_CATALOG[slug].group),
+      groupOrder: PERMISSION_GROUP_ORDER.indexOf(
+        PERMISSION_CATALOG[slug].group,
+      ),
       order: PERMISSION_CATALOG[slug].order,
     })),
     skipDuplicates: true,
   });
-  const permissions = await db.permission.findMany({ where: { slug: { in: PERMISSION_SLUGS } }, select: { id: true, slug: true } });
+  const permissions = await db.permission.findMany({
+    where: { slug: { in: PERMISSION_SLUGS } },
+    select: { id: true, slug: true },
+  });
   const permissionId = new Map(permissions.map((p) => [p.slug, p.id]));
 
   await db.role.createMany({
@@ -185,11 +223,21 @@ export async function provisionDefaultRoles(db: RbacWriter): Promise<void> {
     })),
     skipDuplicates: true,
   });
-  const roles = await db.role.findMany({ where: { slug: { in: DEFAULT_ROLES.map((r) => r.slug) } }, select: { id: true, slug: true } });
+  const roles = await db.role.findMany({
+    where: { slug: { in: DEFAULT_ROLES.map((r) => r.slug) } },
+    select: { id: true, slug: true },
+  });
   const seedBySlug = new Map(DEFAULT_ROLES.map((role) => [role.slug, role]));
 
   const rolePermissions = roles.flatMap((role) =>
-    (seedBySlug.get(role.slug)?.permissions ?? []).map((slug) => ({ roleId: role.id, permissionId: permissionId.get(slug)! })),
+    (seedBySlug.get(role.slug)?.permissions ?? []).map((slug) => ({
+      roleId: role.id,
+      permissionId: permissionId.get(slug)!,
+    })),
   );
-  if (rolePermissions.length) await db.permissionRole.createMany({ data: rolePermissions, skipDuplicates: true });
+  if (rolePermissions.length)
+    await db.permissionRole.createMany({
+      data: rolePermissions,
+      skipDuplicates: true,
+    });
 }

package/registry/combos/express-prisma/variants/base/src/{audit-log.repository.ts → repositories/audit-log.repository.ts}

@@ -1,7 +1,12 @@
 import type { AuditEvent } from "@/lib/auth/core/types.js";
-import { Prisma, PrismaClient } from "../generated/prisma/client.js";
-import { buildPageMeta, normalizeLimit, normalizePage, type Paginated } from "./pagination.js";
-import { toIdOrNull, toIdOrUndefined } from "./id.helper.js";
+import { Prisma, PrismaClient } from "../../generated/prisma/client.js";
+import {
+  buildPageMeta,
+  normalizeLimit,
+  normalizePage,
+  type Paginated,
+} from "../pagination.js";
+import { toIdOrNull, toIdOrUndefined } from "../id.helper.js";
 
 export interface AuditLogEntry {
   id: string;
@@ -43,7 +48,10 @@ export function toAuditLogEntry(row: AuditLogRow): AuditLogEntry {
 /** "role_assigned" -> "Role assigned". Derived rather than passed in, so core never has to carry display text. */
 export function humanizeAction(action: string): string {
   const words = action.split("_");
-  return [words[0].charAt(0).toUpperCase() + words[0].slice(1), ...words.slice(1)].join(" ");
+  return [
+    words[0].charAt(0).toUpperCase() + words[0].slice(1),
+    ...words.slice(1),
+  ].join(" ");
 }
 
 // Plain class, no DI container — constructed directly with a PrismaClient in
@@ -51,7 +59,10 @@ export function humanizeAction(action: string): string {
 export class AuditLogRepository {
   constructor(private readonly prisma: PrismaClient) {}
 
-  async append(event: AuditEvent, opts: { remarks?: string } = {}): Promise<void> {
+  async append(
+    event: AuditEvent,
+    opts: { remarks?: string } = {},
+  ): Promise<void> {
     await this.prisma.auditLog.create({
       data: {
         action: event.type,

package/registry/combos/express-prisma/variants/base/src/{rbac.repository.ts → repositories/rbac.repository.ts}

@@ -1,9 +1,14 @@
 import { resolvePermissions } from "@/lib/auth/core/rbac.js";
-import { Prisma, PrismaClient } from "../generated/prisma/client.js";
-import { HttpError } from "./http-error.js";
-import { buildPageMeta, normalizeLimit, normalizePage, type Paginated } from "./pagination.js";
-import { PermissionCache } from "./permission-cache.js";
-import { toId, toIdOrNull } from "./id.helper.js";
+import { Prisma, PrismaClient } from "../../generated/prisma/client.js";
+import { HttpError } from "../http-error.js";
+import {
+  buildPageMeta,
+  normalizeLimit,
+  normalizePage,
+  type Paginated,
+} from "../pagination.js";
+import { PermissionCache } from "../permission-cache.js";
+import { toId, toIdOrNull } from "../id.helper.js";
 
 export interface UserSummary {
   id: string;
@@ -34,10 +39,14 @@ export interface UserListFilter {
 
 export type UserListResult = Paginated<UserSummary>;
 
-const USER_ROLES_INCLUDE = { roles: { select: { role: { select: { slug: true } } } } } as const;
+const USER_ROLES_INCLUDE = {
+  roles: { select: { role: { select: { slug: true } } } },
+} as const;
 
 /** A `User` row as `findUnique`/`findMany` return it with its roles joined in. */
-export type UserRow = Prisma.UserGetPayload<{ include: typeof USER_ROLES_INCLUDE }>;
+export type UserRow = Prisma.UserGetPayload<{
+  include: typeof USER_ROLES_INCLUDE;
+}>;
 
 /**
  * Shapes a raw row into the wire DTO — bigint id to string, `Date` to ISO, the roles relation
@@ -112,7 +121,14 @@ const PERMISSION_SELECT = {
   isActive: true,
 } as const;
 
-const ROLE_SELECT = { id: true, slug: true, name: true, displayName: true, isDefault: true, isActive: true } as const;
+const ROLE_SELECT = {
+  id: true,
+  slug: true,
+  name: true,
+  displayName: true,
+  isDefault: true,
+  isActive: true,
+} as const;
 
 export class RbacRepository {
   constructor(
@@ -141,7 +157,9 @@ export class RbacRepository {
    * `isActive: false` on a role or a permission takes it out of the answer here, which is what
    * makes deactivating either one enforcement-changing without unpicking any grant.
    */
-  async resolveAuthzContext(userId: string): Promise<{ roles: string[]; permissions: string[] }> {
+  async resolveAuthzContext(
+    userId: string,
+  ): Promise<{ roles: string[]; permissions: string[] }> {
     const user = await this.prisma.user.findUnique({
       where: { id: toId(userId), isDeleted: false },
       select: {
@@ -151,17 +169,25 @@ export class RbacRepository {
             role: {
               select: {
                 slug: true,
-                permissions: { where: { permission: { isActive: true, isDeleted: false } }, select: { permission: { select: { slug: true } } } },
+                permissions: {
+                  where: { permission: { isActive: true, isDeleted: false } },
+                  select: { permission: { select: { slug: true } } },
+                },
               },
             },
           },
         },
-        permissions: { where: { permission: { isActive: true, isDeleted: false } }, select: { permission: { select: { slug: true } } } },
+        permissions: {
+          where: { permission: { isActive: true, isDeleted: false } },
+          select: { permission: { select: { slug: true } } },
+        },
       },
     });
     if (!user) return { roles: [], permissions: [] };
 
-    const rolePermissions = user.roles.flatMap((roleUser) => roleUser.role.permissions.map((pr) => pr.permission.slug));
+    const rolePermissions = user.roles.flatMap((roleUser) =>
+      roleUser.role.permissions.map((pr) => pr.permission.slug),
+    );
     const directPermissions = user.permissions.map((pu) => pu.permission.slug);
 
     return {
@@ -180,7 +206,9 @@ export class RbacRepository {
     const limit = normalizeLimit(filter.limit);
     const where = {
       isDeleted: false,
-      email: filter.search ? { contains: filter.search, mode: "insensitive" as const } : undefined,
+      email: filter.search
+        ? { contains: filter.search, mode: "insensitive" as const }
+        : undefined,
     };
 
     const [rows, total] = await this.prisma.$transaction([
@@ -223,7 +251,9 @@ export class RbacRepository {
     },
     actorUserId: string | null,
   ): Promise<UserSummary> {
-    const existing = await this.prisma.user.findUnique({ where: { email: input.email } });
+    const existing = await this.prisma.user.findUnique({
+      where: { email: input.email },
+    });
     if (existing) throw new HttpError(409, "email already registered");
 
     const user = await this.prisma.user.create({
@@ -240,9 +270,15 @@ export class RbacRepository {
     });
 
     if (input.roles && input.roles.length > 0) {
-      const roles = await this.prisma.role.findMany({ where: { slug: { in: input.roles }, isActive: true, isDeleted: false }, select: { id: true } });
+      const roles = await this.prisma.role.findMany({
+        where: { slug: { in: input.roles }, isActive: true, isDeleted: false },
+        select: { id: true },
+      });
       if (roles.length > 0) {
-        await this.prisma.roleUser.createMany({ data: roles.map((role) => ({ userId: user.id, roleId: role.id })), skipDuplicates: true });
+        await this.prisma.roleUser.createMany({
+          data: roles.map((role) => ({ userId: user.id, roleId: role.id })),
+          skipDuplicates: true,
+        });
         await this.cache.invalidateSubject(user.id.toString());
       }
     } else {
@@ -256,37 +292,70 @@ export class RbacRepository {
   // uniqueness/re-verification concerns a general "edit profile" screen shouldn't have to handle.
   async updateUser(
     userId: string,
-    input: { firstName?: string | null; lastName?: string | null; displayName?: string | null; phone?: string | null; username?: string | null; photo?: string | null },
+    input: {
+      firstName?: string | null;
+      lastName?: string | null;
+      displayName?: string | null;
+      phone?: string | null;
+      username?: string | null;
+      photo?: string | null;
+    },
     actorUserId: string | null,
   ): Promise<UserSummary> {
     const userIdBig = toId(userId);
-    const existing = await this.prisma.user.findUnique({ where: { id: userIdBig, isDeleted: false }, select: { id: true } });
+    const existing = await this.prisma.user.findUnique({
+      where: { id: userIdBig, isDeleted: false },
+      select: { id: true },
+    });
     if (!existing) throw new HttpError(404, `user "${userId}" not found`);
-    await this.prisma.user.update({ where: { id: userIdBig }, data: { ...input, updatedBy: toIdOrNull(actorUserId) } });
+    await this.prisma.user.update({
+      where: { id: userIdBig },
+      data: { ...input, updatedBy: toIdOrNull(actorUserId) },
+    });
     return this.getUser(userId);
   }
 
   // Soft-delete, matching every other table's `isDeleted`/`deletedAt`/`deletedBy`/`deletedReason`
   // pattern — the row survives for audit purposes, it just stops appearing in listings and can
   // no longer authenticate (mirrors how `block` already disables login without removing the row).
-  async deleteUser(userId: string, actorUserId: string | null, reason?: string): Promise<void> {
+  async deleteUser(
+    userId: string,
+    actorUserId: string | null,
+    reason?: string,
+  ): Promise<void> {
     const userIdBig = toId(userId);
-    const existing = await this.prisma.user.findUnique({ where: { id: userIdBig, isDeleted: false }, select: { id: true } });
+    const existing = await this.prisma.user.findUnique({
+      where: { id: userIdBig, isDeleted: false },
+      select: { id: true },
+    });
     if (!existing) throw new HttpError(404, `user "${userId}" not found`);
     await this.prisma.user.update({
       where: { id: userIdBig },
-      data: { isDeleted: true, deletedAt: new Date(), deletedBy: toIdOrNull(actorUserId), deletedReason: reason ?? null },
+      data: {
+        isDeleted: true,
+        deletedAt: new Date(),
+        deletedBy: toIdOrNull(actorUserId),
+        deletedReason: reason ?? null,
+      },
     });
     await this.cache.invalidateSubject(userId);
   }
 
   async updateRole(
     roleId: string,
-    input: { name?: string; displayName?: string; description?: string | null; isActive?: boolean },
+    input: {
+      name?: string;
+      displayName?: string;
+      description?: string | null;
+      isActive?: boolean;
+    },
     actorUserId: string | null,
   ): Promise<RoleSummary> {
     const roleIdBig = toId(roleId);
-    const existing = await this.prisma.role.findUnique({ where: { id: roleIdBig, isDeleted: false }, select: { id: true } });
+    const existing = await this.prisma.role.findUnique({
+      where: { id: roleIdBig, isDeleted: false },
+      select: { id: true },
+    });
     if (!existing) throw new HttpError(404, "role not found");
     const role = await this.prisma.role.update({
       where: { id: roleIdBig },
@@ -301,13 +370,25 @@ export class RbacRepository {
   // Soft-delete. The `role_user`/`permission_role` rows pointing at it are left in place — a
   // deleted role simply stops being returned by `listRoles`/`resolveAuthzContext`, rather than
   // cascading a delete that would silently strip a user's other roles' foreign keys.
-  async deleteRole(roleId: string, actorUserId: string | null, reason?: string): Promise<void> {
+  async deleteRole(
+    roleId: string,
+    actorUserId: string | null,
+    reason?: string,
+  ): Promise<void> {
     const roleIdBig = toId(roleId);
-    const existing = await this.prisma.role.findUnique({ where: { id: roleIdBig, isDeleted: false }, select: { id: true } });
+    const existing = await this.prisma.role.findUnique({
+      where: { id: roleIdBig, isDeleted: false },
+      select: { id: true },
+    });
     if (!existing) throw new HttpError(404, "role not found");
     await this.prisma.role.update({
       where: { id: roleIdBig },
-      data: { isDeleted: true, deletedAt: new Date(), deletedBy: toIdOrNull(actorUserId), deletedReason: reason ?? null },
+      data: {
+        isDeleted: true,
+        deletedAt: new Date(),
+        deletedBy: toIdOrNull(actorUserId),
+        deletedReason: reason ?? null,
+      },
     });
     await this.cache.invalidatePolicy();
   }
@@ -319,7 +400,12 @@ export class RbacRepository {
     const rows = await this.prisma.permission.findMany({
       where: { isDeleted: false },
       select: PERMISSION_SELECT,
-      orderBy: [{ groupOrder: "asc" }, { group: "asc" }, { order: "asc" }, { slug: "asc" }],
+      orderBy: [
+        { groupOrder: "asc" },
+        { group: "asc" },
+        { order: "asc" },
+        { slug: "asc" },
+      ],
     });
     return rows.map((row) => ({ ...row, id: row.id.toString() }));
   }
@@ -333,7 +419,10 @@ export class RbacRepository {
    * Upserted on `slug`, which stays the stable identifier grants and revocations use, so renaming
    * `name`/`displayName` never breaks a grant.
    */
-  async upsertPermission(input: PermissionInput, actorUserId: string | null): Promise<PermissionSummary> {
+  async upsertPermission(
+    input: PermissionInput,
+    actorUserId: string | null,
+  ): Promise<PermissionSummary> {
     const shared = {
       name: input.name,
       displayName: input.displayName,
@@ -365,12 +454,21 @@ export class RbacRepository {
   }
 
   async listRoles(): Promise<RoleSummary[]> {
-    const rows = await this.prisma.role.findMany({ where: { isDeleted: false }, select: ROLE_SELECT, orderBy: [{ order: "asc" }, { slug: "asc" }] });
+    const rows = await this.prisma.role.findMany({
+      where: { isDeleted: false },
+      select: ROLE_SELECT,
+      orderBy: [{ order: "asc" }, { slug: "asc" }],
+    });
     return rows.map((row) => ({ ...row, id: row.id.toString() }));
   }
 
   async createRole(
-    input: { slug: string; name?: string; displayName?: string; description?: string | null },
+    input: {
+      slug: string;
+      name?: string;
+      displayName?: string;
+      description?: string | null;
+    },
     actorUserId: string | null,
   ): Promise<RoleSummary> {
     const role = await this.prisma.role.create({
@@ -393,14 +491,23 @@ export class RbacRepository {
    * closed-catalog property the routes always had — `@CheckAbility` only accepts slugs from
    * `rbac.defaults.ts`, so an invented slug cannot gate anything shipped by this library.
    */
-  async attachPermissionToRole(roleId: string, permissionSlug: string, actorUserId: string | null): Promise<void> {
+  async attachPermissionToRole(
+    roleId: string,
+    permissionSlug: string,
+    actorUserId: string | null,
+  ): Promise<void> {
     const roleIdBig = toId(roleId);
-    const role = await this.prisma.role.findUnique({ where: { id: roleIdBig, isDeleted: false }, select: { id: true } });
+    const role = await this.prisma.role.findUnique({
+      where: { id: roleIdBig, isDeleted: false },
+      select: { id: true },
+    });
     if (!role) throw new HttpError(404, "role not found");
 
     const permission = await this.ensurePermission(permissionSlug, actorUserId);
     await this.prisma.permissionRole.upsert({
-      where: { permissionId_roleId: { permissionId: permission.id, roleId: roleIdBig } },
+      where: {
+        permissionId_roleId: { permissionId: permission.id, roleId: roleIdBig },
+      },
       create: { permissionId: permission.id, roleId: roleIdBig },
       update: {},
     });
@@ -409,10 +516,16 @@ export class RbacRepository {
 
   async assignRoleToUser(userId: string, roleSlug: string): Promise<void> {
     const userIdBig = toId(userId);
-    const role = await this.prisma.role.findUnique({ where: { slug: roleSlug }, select: { id: true } });
+    const role = await this.prisma.role.findUnique({
+      where: { slug: roleSlug },
+      select: { id: true },
+    });
     if (!role) throw new HttpError(404, `role "${roleSlug}" not found`);
 
-    await this.prisma.user.findUniqueOrThrow({ where: { id: userIdBig }, select: { id: true } });
+    await this.prisma.user.findUniqueOrThrow({
+      where: { id: userIdBig },
+      select: { id: true },
+    });
     await this.prisma.roleUser.upsert({
       where: { userId_roleId: { userId: userIdBig, roleId: role.id } },
       create: { userId: userIdBig, roleId: role.id },
@@ -422,9 +535,14 @@ export class RbacRepository {
   }
 
   async revokeRoleFromUser(userId: string, roleSlug: string): Promise<void> {
-    const role = await this.prisma.role.findUnique({ where: { slug: roleSlug }, select: { id: true } });
+    const role = await this.prisma.role.findUnique({
+      where: { slug: roleSlug },
+      select: { id: true },
+    });
     if (!role) return;
-    await this.prisma.roleUser.deleteMany({ where: { userId: toId(userId), roleId: role.id } });
+    await this.prisma.roleUser.deleteMany({
+      where: { userId: toId(userId), roleId: role.id },
+    });
     await this.cache.invalidateSubject(userId);
   }
 
@@ -437,9 +555,15 @@ export class RbacRepository {
    * Prisma lookup, so there's no string to convert from.
    */
   async assignDefaultRoles(userId: bigint): Promise<void> {
-    const defaults = await this.prisma.role.findMany({ where: { isDefault: true, isActive: true, isDeleted: false }, select: { id: true } });
+    const defaults = await this.prisma.role.findMany({
+      where: { isDefault: true, isActive: true, isDeleted: false },
+      select: { id: true },
+    });
     if (!defaults.length) return;
-    await this.prisma.roleUser.createMany({ data: defaults.map((role) => ({ userId, roleId: role.id })), skipDuplicates: true });
+    await this.prisma.roleUser.createMany({
+      data: defaults.map((role) => ({ userId, roleId: role.id })),
+      skipDuplicates: true,
+    });
     await this.cache.invalidateSubject(userId.toString());
   }
 
@@ -447,21 +571,35 @@ export class RbacRepository {
     return (await this.prisma.roleUser.count({ where: { userId } })) > 0;
   }
 
-  async grantPermissionToUser(userId: string, permissionSlug: string, actorUserId: string | null): Promise<void> {
+  async grantPermissionToUser(
+    userId: string,
+    permissionSlug: string,
+    actorUserId: string | null,
+  ): Promise<void> {
     const userIdBig = toId(userId);
     const permission = await this.ensurePermission(permissionSlug, actorUserId);
     await this.prisma.permissionUser.upsert({
-      where: { userId_permissionId: { userId: userIdBig, permissionId: permission.id } },
+      where: {
+        userId_permissionId: { userId: userIdBig, permissionId: permission.id },
+      },
       create: { userId: userIdBig, permissionId: permission.id },
       update: {},
     });
     await this.cache.invalidateSubject(userId);
   }
 
-  async revokePermissionFromUser(userId: string, permissionSlug: string): Promise<void> {
-    const permission = await this.prisma.permission.findUnique({ where: { slug: permissionSlug }, select: { id: true } });
+  async revokePermissionFromUser(
+    userId: string,
+    permissionSlug: string,
+  ): Promise<void> {
+    const permission = await this.prisma.permission.findUnique({
+      where: { slug: permissionSlug },
+      select: { id: true },
+    });
     if (!permission) return;
-    await this.prisma.permissionUser.deleteMany({ where: { userId: toId(userId), permissionId: permission.id } });
+    await this.prisma.permissionUser.deleteMany({
+      where: { userId: toId(userId), permissionId: permission.id },
+    });
     await this.cache.invalidateSubject(userId);
   }
 
@@ -471,12 +609,25 @@ export class RbacRepository {
   }
 
   /** Creates the row for a slug granted before anyone defined it; leaves an existing definition alone. */
-  private async ensurePermission(slug: string, actorUserId: string | null): Promise<{ id: bigint }> {
-    const existing = await this.prisma.permission.findUnique({ where: { slug }, select: { id: true } });
+  private async ensurePermission(
+    slug: string,
+    actorUserId: string | null,
+  ): Promise<{ id: bigint }> {
+    const existing = await this.prisma.permission.findUnique({
+      where: { slug },
+      select: { id: true },
+    });
     return (
       existing ??
       (await this.prisma.permission.create({
-        data: { slug, name: slug, displayName: slug, group: "Custom", createdBy: toIdOrNull(actorUserId), updatedBy: toIdOrNull(actorUserId) },
+        data: {
+          slug,
+          name: slug,
+          displayName: slug,
+          group: "Custom",
+          createdBy: toIdOrNull(actorUserId),
+          updatedBy: toIdOrNull(actorUserId),
+        },
         select: { id: true },
       }))
     );