@simple-auth-kit/cli 1.4.3 → 1.5.1

package/registry/combos/nestjs-drizzle/shared/src/{auth.controller.ts → controllers/auth.controller.ts}

@@ -22,11 +22,11 @@ import {
   ApiTags,
 } from "@nestjs/swagger";
 import type { Request } from "express";
-import { AUTH_CONFIG, AuthConfig } from "./auth.config.js";
-import { AuthGuard } from "./auth.guard.js";
-import { AuthService } from "./auth.service.js";
-import { AuthzGuard } from "./authz.guard.js";
-import { Authenticated, Public } from "./route-tiers.js";
+import { AUTH_CONFIG, AuthConfig } from "../auth.config.js";
+import { AuthGuard } from "../guards/auth.guard.js";
+import { AuthService } from "../services/auth.service.js";
+import { AuthzGuard } from "../guards/authz.guard.js";
+import { Authenticated, Public } from "../route-tiers.js";
 import {
   AuthTokensDto,
   ChangePasswordDto,
@@ -46,7 +46,7 @@ import {
   SignupDto,
   TwoFactorCodeDto,
   UpdateUserDto,
-} from "./dto/auth.dto.js";
+} from "../dto/auth.dto.js";
 
 function requireString(value: unknown, field: string): string {
   if (typeof value !== "string" || value.length === 0)

package/registry/combos/nestjs-drizzle/shared/src/{auth-core-error.filter.ts → filters/auth-core-error.filter.ts}

@@ -1,4 +1,10 @@
-import { ArgumentsHost, Catch, ExceptionFilter, HttpException, HttpStatus } from "@nestjs/common";
+import {
+  ArgumentsHost,
+  Catch,
+  ExceptionFilter,
+  HttpException,
+  HttpStatus,
+} from "@nestjs/common";
 import { AuthCoreError } from "@/lib/auth/core/types.js";
 
 /**
@@ -14,19 +20,37 @@ export class AuthCoreErrorFilter implements ExceptionFilter {
     const res = host.switchToHttp().getResponse();
 
     if (exception instanceof AuthCoreError) {
-      res.status(HttpStatus.UNAUTHORIZED).json({ success: false, statusCode: HttpStatus.UNAUTHORIZED, code: exception.code, message: exception.message });
+      res
+        .status(HttpStatus.UNAUTHORIZED)
+        .json({
+          success: false,
+          statusCode: HttpStatus.UNAUTHORIZED,
+          code: exception.code,
+          message: exception.message,
+        });
       return;
     }
 
     if (exception instanceof HttpException) {
       const status = exception.getStatus();
       const body = exception.getResponse();
-      const shaped = typeof body === "string" ? { message: body } : (body as Record<string, unknown>);
-      res.status(status).json({ success: false, statusCode: status, ...shaped });
+      const shaped =
+        typeof body === "string"
+          ? { message: body }
+          : (body as Record<string, unknown>);
+      res
+        .status(status)
+        .json({ success: false, statusCode: status, ...shaped });
       return;
     }
 
     // Anything not thrown deliberately — don't leak internals in the response.
-    res.status(HttpStatus.INTERNAL_SERVER_ERROR).json({ success: false, statusCode: HttpStatus.INTERNAL_SERVER_ERROR, message: "internal server error" });
+    res
+      .status(HttpStatus.INTERNAL_SERVER_ERROR)
+      .json({
+        success: false,
+        statusCode: HttpStatus.INTERNAL_SERVER_ERROR,
+        message: "internal server error",
+      });
   }
 }

package/registry/combos/nestjs-drizzle/shared/src/{ability.guard.ts → guards/ability.guard.ts}

@@ -1,7 +1,13 @@
-import { CanActivate, ExecutionContext, ForbiddenException, Inject, Injectable } from "@nestjs/common";
+import {
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  Inject,
+  Injectable,
+} from "@nestjs/common";
 import { Reflector } from "@nestjs/core";
-import { ABILITY_SUBJECT } from "./ability.js";
-import { CHECK_ABILITY_KEY } from "./route-tiers.js";
+import { ABILITY_SUBJECT } from "../ability.js";
+import { CHECK_ABILITY_KEY } from "../route-tiers.js";
 
 /**
  * The authorization boundary for tier-3 routes. This is the *only* thing standing between a
@@ -30,16 +36,23 @@ export class AbilityGuard implements CanActivate {
   constructor(@Inject(Reflector) private readonly reflector: Reflector) {}
 
   canActivate(context: ExecutionContext): boolean {
-    const required = this.reflector.getAllAndOverride<string[] | undefined>(CHECK_ABILITY_KEY, [context.getHandler(), context.getClass()]);
+    const required = this.reflector.getAllAndOverride<string[] | undefined>(
+      CHECK_ABILITY_KEY,
+      [context.getHandler(), context.getClass()],
+    );
     if (!required?.length) {
-      throw new Error(`${context.getClass().name}.${context.getHandler().name} is guarded by AbilityGuard but declares no @CheckAbility`);
+      throw new Error(
+        `${context.getClass().name}.${context.getHandler().name} is guarded by AbilityGuard but declares no @CheckAbility`,
+      );
     }
 
     const ability = context.switchToHttp().getRequest().ability;
-    if (!ability) throw new ForbiddenException("no authorization context for this request");
+    if (!ability)
+      throw new ForbiddenException("no authorization context for this request");
 
     for (const permission of required) {
-      if (!ability.can(permission, ABILITY_SUBJECT)) throw new ForbiddenException(`missing permission: ${permission}`);
+      if (!ability.can(permission, ABILITY_SUBJECT))
+        throw new ForbiddenException(`missing permission: ${permission}`);
     }
     return true;
   }

package/registry/combos/nestjs-drizzle/shared/src/{auth.guard.ts → guards/auth.guard.ts}

@@ -1,8 +1,14 @@
-import { CanActivate, ExecutionContext, Inject, Injectable, UnauthorizedException } from "@nestjs/common";
+import {
+  CanActivate,
+  ExecutionContext,
+  Inject,
+  Injectable,
+  UnauthorizedException,
+} from "@nestjs/common";
 import { verifyAccessToken } from "@/lib/auth/core/token-service.js";
-import { KeyProviderService } from "./key-provider.js";
-import "./request-context.js";
-import { SessionRepository } from "./session.repository.js";
+import { KeyProviderService } from "../key-provider.js";
+import "../request-context.js";
+import { SessionRepository } from "../repositories/session.repository.js";
 
 /**
  * Authentication only — proves who the caller is and populates `req.auth`. Authorization
@@ -19,15 +25,21 @@ export class AuthGuard implements CanActivate {
   async canActivate(context: ExecutionContext): Promise<boolean> {
     const req = context.switchToHttp().getRequest();
     const header: string | undefined = req.headers["authorization"];
-    if (!header?.startsWith("Bearer ")) throw new UnauthorizedException("missing bearer token");
+    if (!header?.startsWith("Bearer "))
+      throw new UnauthorizedException("missing bearer token");
 
     try {
       req.auth = await verifyAccessToken(
-        { secret: this.keys.secret, isDenylisted: (jti) => this.sessions.isDenylisted(jti) },
+        {
+          secret: this.keys.secret,
+          isDenylisted: (jti) => this.sessions.isDenylisted(jti),
+        },
         header.slice("Bearer ".length),
       );
     } catch (err) {
-      throw new UnauthorizedException(err instanceof Error ? err.message : "invalid access token");
+      throw new UnauthorizedException(
+        err instanceof Error ? err.message : "invalid access token",
+      );
     }
     return true;
   }

package/registry/combos/{nestjs-prisma/shared/src → nestjs-drizzle/shared/src/interceptors}/response.interceptor.ts

@@ -1,4 +1,9 @@
-import { CallHandler, ExecutionContext, Injectable, NestInterceptor } from "@nestjs/common";
+import {
+  CallHandler,
+  ExecutionContext,
+  Injectable,
+  NestInterceptor,
+} from "@nestjs/common";
 import { Observable, map } from "rxjs";
 import type { Request, Response } from "express";
 
@@ -32,7 +37,10 @@ function deriveMessage(method: string): string {
 
 @Injectable()
 export class ResponseInterceptor<T> implements NestInterceptor<T, Envelope<T>> {
-  intercept(context: ExecutionContext, next: CallHandler<T>): Observable<Envelope<T>> {
+  intercept(
+    context: ExecutionContext,
+    next: CallHandler<T>,
+  ): Observable<Envelope<T>> {
     const http = context.switchToHttp();
     const req = http.getRequest<Request>();
     const res = http.getResponse<Response>();

package/registry/combos/nestjs-drizzle/shared/src/repositories/oauth.repository.ts

@@ -0,0 +1,63 @@
+import { BadRequestException, Inject, Injectable } from "@nestjs/common";
+import { and, eq } from "drizzle-orm";
+import type { OAuthStoreDeps } from "@/lib/auth/core/oauth.js";
+import { DRIZZLE_DB, type Database } from "../db.js";
+import { oauthAccounts, users } from "../schema.js";
+import { toId } from "../id.helper.js";
+
+@Injectable()
+export class OAuthRepository implements OAuthStoreDeps {
+  constructor(@Inject(DRIZZLE_DB) private readonly db: Database) {}
+
+  async findAccountByProvider(
+    provider: string,
+    providerAccountId: string,
+  ): Promise<{ userId: string } | null> {
+    const [row] = await this.db
+      .select()
+      .from(oauthAccounts)
+      .where(
+        and(
+          eq(oauthAccounts.provider, provider),
+          eq(oauthAccounts.providerAccountId, providerAccountId),
+        ),
+      )
+      .limit(1);
+    return row ? { userId: row.userId.toString() } : null;
+  }
+
+  async linkAccount(input: {
+    userId: string;
+    provider: string;
+    providerAccountId: string;
+    email?: string;
+  }): Promise<void> {
+    await this.db
+      .insert(oauthAccounts)
+      .values({ ...input, userId: toId(input.userId) });
+  }
+
+  async findUserByVerifiedEmail(email: string): Promise<{ id: string } | null> {
+    const [row] = await this.db
+      .select()
+      .from(users)
+      .where(eq(users.email, email))
+      .limit(1);
+    return row ? { id: row.id.toString() } : null;
+  }
+
+  /** OAuth-only signup: no password is ever set, which is why `User.passwordHash` is nullable. */
+  async createUserFromOAuth(input: {
+    email?: string;
+  }): Promise<{ id: string }> {
+    if (!input.email)
+      throw new BadRequestException(
+        "OAuth provider did not return an email address",
+      );
+    const [row] = await this.db
+      .insert(users)
+      .values({ email: input.email, passwordHash: null })
+      .returning();
+    return { id: row.id.toString() };
+  }
+}

package/registry/combos/nestjs-drizzle/shared/src/repositories/password-reset.repository.ts

@@ -0,0 +1,59 @@
+import { Inject, Injectable } from "@nestjs/common";
+import { eq } from "drizzle-orm";
+import type { PasswordResetStoreDeps } from "@/lib/auth/core/password-reset.js";
+import { DRIZZLE_DB, type Database } from "../db.js";
+import { passwordResetTokens, users } from "../schema.js";
+import { toId } from "../id.helper.js";
+
+@Injectable()
+export class PasswordResetRepository implements PasswordResetStoreDeps {
+  constructor(@Inject(DRIZZLE_DB) private readonly db: Database) {}
+
+  async saveResetToken(input: {
+    userId: string;
+    tokenHash: string;
+    expiresAt: string;
+  }): Promise<void> {
+    await this.db
+      .insert(passwordResetTokens)
+      .values({
+        userId: toId(input.userId),
+        tokenHash: input.tokenHash,
+        expiresAt: new Date(input.expiresAt),
+      });
+  }
+
+  async findValidResetToken(
+    tokenHash: string,
+  ): Promise<{
+    userId: string;
+    expiresAt: string;
+    consumedAt: string | null;
+  } | null> {
+    const [row] = await this.db
+      .select()
+      .from(passwordResetTokens)
+      .where(eq(passwordResetTokens.tokenHash, tokenHash))
+      .limit(1);
+    if (!row) return null;
+    return {
+      userId: row.userId.toString(),
+      expiresAt: row.expiresAt.toISOString(),
+      consumedAt: row.consumedAt?.toISOString() ?? null,
+    };
+  }
+
+  async consumeResetToken(tokenHash: string): Promise<void> {
+    await this.db
+      .update(passwordResetTokens)
+      .set({ consumedAt: new Date() })
+      .where(eq(passwordResetTokens.tokenHash, tokenHash));
+  }
+
+  async setPasswordHash(userId: string, passwordHash: string): Promise<void> {
+    await this.db
+      .update(users)
+      .set({ passwordHash })
+      .where(eq(users.id, toId(userId)));
+  }
+}

package/registry/combos/nestjs-drizzle/shared/src/{session.repository.ts → repositories/session.repository.ts}

@@ -2,12 +2,16 @@ import { randomUUID } from "node:crypto";
 import { Inject, Injectable } from "@nestjs/common";
 import { and, eq, isNull, ne, sql } from "drizzle-orm";
 import type { SessionStoreDeps } from "@/lib/auth/core/session-policy.js";
-import type { AuditEvent, Revoker, SessionRecord } from "@/lib/auth/core/types.js";
+import type {
+  AuditEvent,
+  Revoker,
+  SessionRecord,
+} from "@/lib/auth/core/types.js";
 import { AuditLogRepository } from "./audit-log.repository.js";
-import { AUTH_CONFIG, AuthConfig } from "./auth.config.js";
-import { DRIZZLE_DB, type Database } from "./db.js";
-import { denylistedAccessTokens, sessions } from "./schema.js";
-import { toId, toIdOrNull } from "./id.helper.js";
+import { AUTH_CONFIG, AuthConfig } from "../auth.config.js";
+import { DRIZZLE_DB, type Database } from "../db.js";
+import { denylistedAccessTokens, sessions } from "../schema.js";
+import { toId, toIdOrNull } from "../id.helper.js";
 
 function toSessionRecord(row: typeof sessions.$inferSelect): SessionRecord {
   return {
@@ -55,7 +59,11 @@ export class SessionRepository implements SessionStoreDeps {
   }
 
   async findSession(id: string): Promise<SessionRecord | null> {
-    const [row] = await this.db.select().from(sessions).where(eq(sessions.id, toId(id))).limit(1);
+    const [row] = await this.db
+      .select()
+      .from(sessions)
+      .where(eq(sessions.id, toId(id)))
+      .limit(1);
     return row ? toSessionRecord(row) : null;
   }
 
@@ -83,7 +91,12 @@ export class SessionRepository implements SessionStoreDeps {
    * `createdBy` is the user themselves. A session is only ever created by the person logging in,
    * so recording it costs nothing and leaves the column meaningful rather than always null.
    */
-  async createSession(input: { userId: string; userAgent?: string; ip?: string; provider?: string }): Promise<SessionRecord> {
+  async createSession(input: {
+    userId: string;
+    userAgent?: string;
+    ip?: string;
+    provider?: string;
+  }): Promise<SessionRecord> {
     const userIdBig = toId(input.userId);
     const [row] = await this.db
       .insert(sessions)
@@ -104,15 +117,33 @@ export class SessionRepository implements SessionStoreDeps {
   async revokeAllByUser(userId: string, revoker?: Revoker): Promise<void> {
     await this.db
       .update(sessions)
-      .set({ ...revocationFields(revoker), sessionVersion: sql`${sessions.sessionVersion} + 1` })
-      .where(and(eq(sessions.userId, toId(userId)), isNull(sessions.revokedAt)));
+      .set({
+        ...revocationFields(revoker),
+        sessionVersion: sql`${sessions.sessionVersion} + 1`,
+      })
+      .where(
+        and(eq(sessions.userId, toId(userId)), isNull(sessions.revokedAt)),
+      );
   }
 
-  async revokeAllByUserExcept(userId: string, keepSessionId: string, revoker?: Revoker): Promise<void> {
+  async revokeAllByUserExcept(
+    userId: string,
+    keepSessionId: string,
+    revoker?: Revoker,
+  ): Promise<void> {
     await this.db
       .update(sessions)
-      .set({ ...revocationFields(revoker), sessionVersion: sql`${sessions.sessionVersion} + 1` })
-      .where(and(eq(sessions.userId, toId(userId)), ne(sessions.id, toId(keepSessionId)), isNull(sessions.revokedAt)));
+      .set({
+        ...revocationFields(revoker),
+        sessionVersion: sql`${sessions.sessionVersion} + 1`,
+      })
+      .where(
+        and(
+          eq(sessions.userId, toId(userId)),
+          ne(sessions.id, toId(keepSessionId)),
+          isNull(sessions.revokedAt),
+        ),
+      );
   }
 
   async denylistJti(jti: string, ttlSeconds: number): Promise<void> {
@@ -120,11 +151,18 @@ export class SessionRepository implements SessionStoreDeps {
     await this.db
       .insert(denylistedAccessTokens)
       .values({ jti, expiresAt })
-      .onConflictDoUpdate({ target: denylistedAccessTokens.jti, set: { expiresAt } });
+      .onConflictDoUpdate({
+        target: denylistedAccessTokens.jti,
+        set: { expiresAt },
+      });
   }
 
   async isDenylisted(jti: string): Promise<boolean> {
-    const [row] = await this.db.select().from(denylistedAccessTokens).where(eq(denylistedAccessTokens.jti, jti)).limit(1);
+    const [row] = await this.db
+      .select()
+      .from(denylistedAccessTokens)
+      .where(eq(denylistedAccessTokens.jti, jti))
+      .limit(1);
     if (!row) return false;
     if (row.expiresAt.getTime() < Date.now()) return false; // expired; a cleanup job reaps these, see Phase 6
     return true;

package/registry/combos/nestjs-drizzle/shared/src/{two-factor.repository.ts → repositories/two-factor.repository.ts}

@@ -1,8 +1,8 @@
 import { Inject, Injectable } from "@nestjs/common";
 import { and, eq, isNull } from "drizzle-orm";
 import { verifyBackupCode } from "@/lib/auth/core/two-factor.js";
-import { DRIZZLE_DB, type Database } from "./db.js";
-import { twoFactorBackupCodes } from "./schema.js";
+import { DRIZZLE_DB, type Database } from "../db.js";
+import { twoFactorBackupCodes } from "../schema.js";
 
 // Takes bigint directly, not string: every caller already has the user row's id in hand from
 // its own database lookup, so there's nothing to parse here.
@@ -12,24 +12,38 @@ export class TwoFactorRepository {
 
   /** Replaces any prior set — re-confirming enrollment invalidates old backup codes. */
   async saveBackupCodes(userId: bigint, hashes: string[]): Promise<void> {
-    await this.db.delete(twoFactorBackupCodes).where(eq(twoFactorBackupCodes.userId, userId));
+    await this.db
+      .delete(twoFactorBackupCodes)
+      .where(eq(twoFactorBackupCodes.userId, userId));
     if (hashes.length === 0) return;
-    await this.db.insert(twoFactorBackupCodes).values(hashes.map((codeHash) => ({ userId, codeHash })));
+    await this.db
+      .insert(twoFactorBackupCodes)
+      .values(hashes.map((codeHash) => ({ userId, codeHash })));
   }
 
   async consumeBackupCode(userId: bigint, code: string): Promise<boolean> {
     const unused = await this.db
       .select()
       .from(twoFactorBackupCodes)
-      .where(and(eq(twoFactorBackupCodes.userId, userId), isNull(twoFactorBackupCodes.usedAt)));
+      .where(
+        and(
+          eq(twoFactorBackupCodes.userId, userId),
+          isNull(twoFactorBackupCodes.usedAt),
+        ),
+      );
     const match = unused.find((row) => verifyBackupCode(code, row.codeHash));
     if (!match) return false;
 
-    await this.db.update(twoFactorBackupCodes).set({ usedAt: new Date() }).where(eq(twoFactorBackupCodes.id, match.id));
+    await this.db
+      .update(twoFactorBackupCodes)
+      .set({ usedAt: new Date() })
+      .where(eq(twoFactorBackupCodes.id, match.id));
     return true;
   }
 
   async clearBackupCodes(userId: bigint): Promise<void> {
-    await this.db.delete(twoFactorBackupCodes).where(eq(twoFactorBackupCodes.userId, userId));
+    await this.db
+      .delete(twoFactorBackupCodes)
+      .where(eq(twoFactorBackupCodes.userId, userId));
   }
 }

package/registry/combos/nestjs-drizzle/shared/src/request-context.ts

@@ -14,7 +14,7 @@
 // for its side effect installs the Express `Request` augmentation.
 import type { AccessTokenClaims } from "@/lib/auth/core/types.js";
 import type { AppAbility } from "./ability.js";
-import type { AuthzContext } from "./authz.guard.js";
+import type { AuthzContext } from "./guards/authz.guard.js";
 
 declare module "express" {
   interface Request {