@simple-auth-kit/cli 1.4.3 → 1.5.1

package/registry.json

@@ -39,7 +39,7 @@
         "Add \"@/prisma/*\": [\"./generated/prisma/*\"] to your tsconfig.json's compilerOptions.paths — the copied source imports the generated Prisma client via this alias, since prisma.config.ts/prisma/ (and the client it generates) install at the project root regardless of where --path put everything else",
         "Run: npx prisma generate",
         "Run: npx prisma migrate deploy",
-        "Seed RBAC: add \"seed\": \"tsx src/lib/auth/src/seed.ts\" to your package.json scripts (adjust the path if you installed elsewhere), then run: npm run seed — it is idempotent, and seeds the permission catalog and the default admin/member roles. Nothing is authorized until it has run at least once.",
+        "Seed RBAC: add \"seed\": \"tsx src/lib/auth/seed.ts\" to your package.json scripts (adjust the path if you installed elsewhere), then run: npm run seed — it is idempotent, and seeds the permission catalog and the default admin/member roles. Nothing is authorized until it has run at least once.",
         "Optional: set SEED_ADMIN_EMAIL and SEED_ADMIN_PASSWORD before seeding to also create an initial admin user. Without them the seeder skips the admin rather than inventing a password.",
         "Import AuthModule.forRoot({...}) into your root app module",
         "Optional: wire SwaggerModule.setup('docs', app, document) in your main.ts to serve the OpenAPI spec this combo's controller is already decorated for — see examples/nestjs-prisma-app/src/main.ts for a working example"
@@ -74,7 +74,7 @@
         "Set DATABASE_URL in .env (see .env.example)",
         "Set AUTH_JWT_SECRET in .env — a base64-encoded 256-bit (or longer) secret, e.g.: openssl rand -base64 32. The app refuses to start without it; there is no default and nothing is generated for you. Changing it invalidates every outstanding token.",
         "Run: npx drizzle-kit migrate — drizzle.config.ts installs at the project root, alongside drizzle/, so no cd is needed",
-        "Seed RBAC: add \"seed\": \"tsx src/lib/auth/src/seed.ts\" to your package.json scripts (adjust the path if you installed elsewhere), then run: npm run seed — it is idempotent, and seeds the permission catalog and the default admin/member roles. Nothing is authorized until it has run at least once.",
+        "Seed RBAC: add \"seed\": \"tsx src/lib/auth/seed.ts\" to your package.json scripts (adjust the path if you installed elsewhere), then run: npm run seed — it is idempotent, and seeds the permission catalog and the default admin/member roles. Nothing is authorized until it has run at least once.",
         "Optional: set SEED_ADMIN_EMAIL and SEED_ADMIN_PASSWORD before seeding to also create an initial admin user. Without them the seeder skips the admin rather than inventing a password.",
         "Import AuthModule.forRoot({...}) into your root app module",
         "Optional: wire SwaggerModule.setup('docs', app, document) in your main.ts to serve the OpenAPI spec this combo's controller is already decorated for — see examples/nestjs-drizzle-app/src/main.ts for a working example"
@@ -106,7 +106,7 @@
         "Add \"@/prisma/*\": [\"./generated/prisma/*\"] to your tsconfig.json's compilerOptions.paths — the copied source imports the generated Prisma client via this alias, since prisma.config.ts/prisma/ (and the client it generates) install at the project root regardless of where --path put everything else",
         "Run: npx prisma generate",
         "Run: npx prisma migrate deploy",
-        "Seed RBAC: add \"seed\": \"tsx src/lib/auth/src/seed.ts\" to your package.json scripts (adjust the path if you installed elsewhere), then run: npm run seed — it is idempotent, and seeds the permission catalog and the default admin/member roles. Nothing is authorized until it has run at least once.",
+        "Seed RBAC: add \"seed\": \"tsx src/lib/auth/seed.ts\" to your package.json scripts (adjust the path if you installed elsewhere), then run: npm run seed — it is idempotent, and seeds the permission catalog and the default admin/member roles. Nothing is authorized until it has run at least once.",
         "Optional: set SEED_ADMIN_EMAIL and SEED_ADMIN_PASSWORD before seeding to also create an initial admin user. Without them the seeder skips the admin rather than inventing a password.",
         "Call createAuthApp({...}) and mount or listen on the Express app it returns",
         "The OpenAPI spec this combo hand-authors is already served at /docs and /docs-json — see examples/express-prisma-app/src/main.ts for a working example"
@@ -136,7 +136,7 @@
         "Set DATABASE_URL in .env (see .env.example)",
         "Set AUTH_JWT_SECRET in .env — a base64-encoded 256-bit (or longer) secret, e.g.: openssl rand -base64 32. The app refuses to start without it; there is no default and nothing is generated for you. Changing it invalidates every outstanding token.",
         "Run: npx drizzle-kit migrate — drizzle.config.ts installs at the project root, alongside drizzle/, so no cd is needed",
-        "Seed RBAC: add \"seed\": \"tsx src/lib/auth/src/seed.ts\" to your package.json scripts (adjust the path if you installed elsewhere), then run: npm run seed — it is idempotent, and seeds the permission catalog and the default admin/member roles. Nothing is authorized until it has run at least once.",
+        "Seed RBAC: add \"seed\": \"tsx src/lib/auth/seed.ts\" to your package.json scripts (adjust the path if you installed elsewhere), then run: npm run seed — it is idempotent, and seeds the permission catalog and the default admin/member roles. Nothing is authorized until it has run at least once.",
         "Optional: set SEED_ADMIN_EMAIL and SEED_ADMIN_PASSWORD before seeding to also create an initial admin user. Without them the seeder skips the admin rather than inventing a password.",
         "Call createAuthApp({...}) and mount or listen on the Express app it returns",
         "The OpenAPI spec this combo hand-authors is already served at /docs and /docs-json — see examples/express-drizzle-app/src/main.ts for a working example"

package/simple-auth-kit.ts

@@ -445,24 +445,28 @@ function printPostInstallNotes(combo: ComboEntry, variant: string) {
  *
  * `generatedClientImport`: only Prisma has this — its schema's `generator { output }` is relative
  * to schema.prisma's own location, so moving prisma.config.ts/prisma/ to the project root also
- * moves the generated client. The registry source's `src/*.ts` files import it as
- * `"../generated/prisma/client.js"` — correct for the registry's own dev/typecheck loop (where
- * nothing has moved) — and installMerge rewrites that literal string in every copied file to
- * `@/prisma/client.js` instead of a computed relative path: the generated client always lands at
- * the project root regardless of how deep the importing file sits (unlike `@/lib/auth/core`,
- * whose depth actually varies with `--path`), so a fixed alias is both simpler and stable across
+ * moves the generated client. The registry source's `src/**\/*.ts` files import it with whatever
+ * relative depth is correct from their own location — `"../generated/prisma/client.js"` for a
+ * top-level file, `"../../generated/prisma/client.js"` for one nested a level deeper in
+ * controllers/services/repositories/etc — all correct for the registry's own dev/typecheck loop
+ * (where nothing has moved). installMerge rewrites *any* such relative import (matched by regex,
+ * not a fixed-depth literal string — a real bug here once: a plain string match only ever
+ * matched the top-level depth, leaving a stray leading "../" on every nested file's rewritten
+ * import) to the fixed alias `@/prisma/client.js`: the generated client always lands at the
+ * project root regardless of how deep the importing file sits (unlike `@/lib/auth/core`, whose
+ * depth actually varies with `--path`), so a fixed alias is both simpler and stable across
  * installs. The consumer adds `"@/prisma/*": ["./generated/prisma/*"]` to their tsconfig `paths`
  * once (see postInstall) — the CLI never writes tsconfig itself, same as `@/lib/auth`. Drizzle has
  * no equivalent generated artifact to redirect. */
 const ORM_LAYOUTS: {
   configFile: string;
   dataDir: string;
-  generatedClientImport?: string;
+  generatedClientImport?: RegExp;
 }[] = [
   {
     configFile: "prisma.config.ts",
     dataDir: "prisma",
-    generatedClientImport: "../generated/prisma/client.js",
+    generatedClientImport: /(?:\.\/)?(?:\.\.\/)+generated\/prisma\/client\.js/g,
   },
   { configFile: "drizzle.config.ts", dataDir: "drizzle" },
 ];
@@ -476,7 +480,7 @@ interface MergePlan {
   orm: (typeof ORM_LAYOUTS)[number] | null;
   skipFromShared: Set<string>;
   skipFromVariant: Set<string>;
-  extraRewrites: { from: string; to: string }[] | undefined;
+  extraRewrites: { from: string | RegExp; to: string }[] | undefined;
   config: SimpleAuthKitConfig;
   previous: Record<string, string>;
 }
@@ -588,17 +592,44 @@ async function runMergeCopy(
     plan.destRoot,
     result,
   );
+
+  // shared/src/ and variants/<variant>/src/ are the registry's own internal source layout
+  // (parallel to core/, prisma.config.ts, etc.) — copied flat into destRoot rather than
+  // preserving that extra "src" level, so a consumer who installed at the default
+  // "src/lib/auth" doesn't end up with a redundant "src/lib/auth/src/...". Order matters:
+  // shared fully applied (its own src/, then everything else in shared/), then the variant
+  // overlaid the same way, so a variant file with the same name still wins.
+  const skipShared = new Set([...plan.skipFromShared, "src"]);
+  const skipVariant = new Set([...plan.skipFromVariant, "src"]);
+  if (await pathExists(join(plan.sharedDir, "src"))) {
+    await copyDir(
+      join(plan.sharedDir, "src"),
+      plan.destRoot,
+      { ...copyOpts, neverCopy: plan.skipFromShared },
+      plan.destRoot,
+      result,
+    );
+  }
   await copyDir(
     plan.sharedDir,
     plan.destRoot,
-    { ...copyOpts, neverCopy: plan.skipFromShared },
+    { ...copyOpts, neverCopy: skipShared },
     plan.destRoot,
     result,
   );
+  if (await pathExists(join(plan.variantDir, "src"))) {
+    await copyDir(
+      join(plan.variantDir, "src"),
+      plan.destRoot,
+      { ...copyOpts, neverCopy: plan.skipFromVariant },
+      plan.destRoot,
+      result,
+    );
+  }
   await copyDir(
     plan.variantDir,
     plan.destRoot,
-    { ...copyOpts, neverCopy: plan.skipFromVariant },
+    { ...copyOpts, neverCopy: skipVariant },
     plan.destRoot,
     result,
   );

package/registry/combos/express-drizzle/shared/src/auth.router.ts

@@ -1,266 +0,0 @@
-import type { NextFunction, Request, RequestHandler, Response } from "express";
-import type { AuthConfig } from "./auth.config.js";
-import { AuthService } from "./auth.service.js";
-import { HttpError } from "./http-error.js";
-import { authenticated, createTieredRouter, publicRoute, type TierMiddleware } from "./route-tiers.js";
-import "./request-context.js";
-
-function requireString(value: unknown, field: string): string {
-  if (typeof value !== "string" || value.length === 0) throw new HttpError(400, `${field} is required`);
-  return value;
-}
-
-const optionalString = (value: unknown): string | undefined => (typeof value === "string" ? value : undefined);
-
-export interface AuthRouterDeps extends TierMiddleware {
-  auth: AuthService;
-  config: AuthConfig;
-}
-
-/**
- * Identity endpoints — everything that is about *a user*, never about a group of them.
- * Administration lives in admin.router.ts.
- *
- * Replaces the reference combo's `AuthController` (a Nest `@Controller`). Same endpoints, same
- * validation, same status codes — just an Express `Router()` instead of a decorated class, and
- * middleware passed in where the controller lists `@UseGuards(...)`. Every handler is wrapped in
- * try/catch + `next(err)` so a thrown `HttpError`/`AuthCoreError` reaches the error-handling
- * middleware mounted in create-auth-app.ts instead of leaking a bare 500.
- */
-export function createAuthRouter(deps: AuthRouterDeps): RequestHandler {
-  const { auth, config, authentication, authorization } = deps;
-  const router = createTieredRouter({ authentication, authorization });
-
-  router.route("post", "/signup", publicRoute(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const body = req.body as Record<string, unknown>;
-      const tokens = await auth.signup({
-        email: requireString(body.email, "email"),
-        password: requireString(body.password, "password"),
-        firstName: optionalString(body.firstName),
-        lastName: optionalString(body.lastName),
-        displayName: optionalString(body.displayName),
-        phone: optionalString(body.phone),
-        username: optionalString(body.username),
-        userAgent: req.headers["user-agent"],
-        ip: req.ip,
-      });
-      res.status(201).json(tokens);
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  router.route("post", "/login", publicRoute(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const body = req.body as Record<string, unknown>;
-      const result = await auth.login({
-        identifier: requireString(body.identifier, "identifier"),
-        password: requireString(body.password, "password"),
-        userAgent: req.headers["user-agent"],
-        ip: req.ip,
-      });
-      res.status(200).json(result);
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  router.route("post", "/login/2fa", publicRoute(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const body = req.body as Record<string, unknown>;
-      const tokens = await auth.loginTwoFactor({
-        challengeToken: requireString(body.challengeToken, "challengeToken"),
-        code: requireString(body.code, "code"),
-        userAgent: req.headers["user-agent"],
-        ip: req.ip,
-      });
-      res.status(200).json(tokens);
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  router.route("post", "/refresh", publicRoute(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const body = req.body as Record<string, unknown>;
-      const tokens = await auth.refresh(requireString(body.refreshToken, "refreshToken"));
-      res.status(200).json(tokens);
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  // `roles`/`permissions` are whatever applies to this request — see authz.middleware.ts for how
-  // they are resolved. A request that names no authorization scope gets empty arrays.
-  //
-  // `permissions` is the caller's whole authorization: `defineAbilitiesFor(permissions)` from
-  // ability.ts rebuilds, in the client, the identical CASL ability the server's own route check
-  // just answered with, so the UI cannot disagree with what the API will allow. The slugs go on
-  // the wire rather than a serialised ability, so the payload is something a human can read in a
-  // log — and it is the same `req.authz` the ability was built from, not a re-resolution.
-  router.route("get", "/me", authenticated(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const { sub, sessionId } = req.auth!;
-      const [{ twoFactorEnabled }, profile] = await Promise.all([auth.getTwoFactorStatus(sub), auth.getProfile(sub)]);
-      res.status(200).json({
-        sub,
-        sessionId,
-        roles: req.authz?.roles ?? [],
-        permissions: req.authz?.permissions ?? [],
-        twoFactorEnabled,
-        email: profile.email,
-        firstName: profile.firstName,
-        lastName: profile.lastName,
-        displayName: profile.displayName,
-        phone: profile.phone,
-        username: profile.username,
-        photo: profile.photo,
-      });
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  router.route("get", "/sessions", authenticated(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const sessions = await auth.listActiveSessions(req.auth!.sub);
-      res.status(200).json(sessions);
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  router.route("post", "/logout", authenticated(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const { sessionId, jti, sub } = req.auth!;
-      // Recorded so the row can later be told apart from a session an administrator ended —
-      // see `sessions.revoked_by`.
-      await auth.logout(sessionId, jti, config.accessTokenTtlSeconds, { userId: sub, ip: req.ip });
-      res.status(200).json({ ok: true });
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  router.route("post", "/logout-all", authenticated(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      await auth.logoutAll(req.auth!.sub, { userId: req.auth!.sub, ip: req.ip });
-      res.status(200).json({ ok: true });
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  router.route("post", "/logout-others", authenticated(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      await auth.logoutOthers(req.auth!.sub, req.auth!.sessionId, { userId: req.auth!.sub, ip: req.ip });
-      res.status(200).json({ ok: true });
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  router.route("post", "/password/change", authenticated(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const body = req.body as Record<string, unknown>;
-      await auth.changePassword(req.auth!.sub, req.auth!.sessionId, {
-        currentPassword: requireString(body.currentPassword, "currentPassword"),
-        newPassword: requireString(body.newPassword, "newPassword"),
-      });
-      res.status(200).json({ ok: true });
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  router.route("patch", "/me", authenticated(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const body = req.body as Record<string, unknown>;
-      const profile = await auth.updateProfile(req.auth!.sub, {
-        firstName: body.firstName === null ? null : optionalString(body.firstName),
-        lastName: body.lastName === null ? null : optionalString(body.lastName),
-        displayName: body.displayName === null ? null : optionalString(body.displayName),
-        phone: body.phone === null ? null : optionalString(body.phone),
-        username: body.username === null ? null : optionalString(body.username),
-        photo: body.photo === null ? null : optionalString(body.photo),
-      });
-      res.status(200).json(profile);
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  router.route("post", "/2fa/enroll", authenticated(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const result = await auth.enrollTwoFactor(req.auth!.sub);
-      res.status(200).json(result);
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  router.route("post", "/2fa/confirm", authenticated(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const body = req.body as Record<string, unknown>;
-      const result = await auth.confirmTwoFactor(req.auth!.sub, requireString(body.code, "code"));
-      res.status(200).json(result);
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  router.route("post", "/2fa/disable", authenticated(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const body = req.body as Record<string, unknown>;
-      await auth.disableTwoFactor(req.auth!.sub, requireString(body.code, "code"));
-      res.status(200).json({ ok: true });
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  router.route("post", "/password/forgot", publicRoute(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const body = req.body as Record<string, unknown>;
-      await auth.requestPasswordReset(requireString(body.email, "email"));
-      res.status(200).json({ ok: true }); // always 200 — never reveal whether the email exists
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  router.route("post", "/password/reset", publicRoute(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const body = req.body as Record<string, unknown>;
-      await auth.resetPassword(requireString(body.token, "token"), requireString(body.newPassword, "newPassword"));
-      res.status(200).json({ ok: true });
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  router.route("get", "/oauth/:provider/start", publicRoute(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const result = await auth.startOAuth(requireString(req.params.provider, "provider"));
-      res.status(200).json(result);
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  router.route("get", "/oauth/:provider/callback", publicRoute(), async (req: Request, res: Response, next: NextFunction) => {
-    try {
-      const tokens = await auth.completeOAuthCallback(
-        requireString(req.params.provider, "provider"),
-        requireString(req.query.code, "code"),
-        requireString(req.query.state, "state"),
-      );
-      res.status(200).json(tokens);
-    } catch (err) {
-      next(err);
-    }
-  });
-
-  return router.handler;
-}

package/registry/combos/express-drizzle/shared/src/password-reset.repository.ts

@@ -1,35 +0,0 @@
-import { eq } from "drizzle-orm";
-import type { NodePgDatabase } from "drizzle-orm/node-postgres";
-import type { PasswordResetStoreDeps } from "@/lib/auth/core/password-reset.js";
-import * as schema from "./schema.js";
-import { toId } from "./id.helper.js";
-
-/**
- * Plain class, no decorators — Drizzle-specific implementation of `PasswordResetStoreDeps`
- * (registry/core/password-reset.js), mirroring the reference combo's PasswordResetRepository.
- */
-export class PasswordResetRepository implements PasswordResetStoreDeps {
-  constructor(private readonly db: NodePgDatabase<typeof schema>) {}
-
-  async saveResetToken(input: { userId: string; tokenHash: string; expiresAt: string }): Promise<void> {
-    await this.db.insert(schema.passwordResetTokens).values({
-      userId: toId(input.userId),
-      tokenHash: input.tokenHash,
-      expiresAt: new Date(input.expiresAt),
-    });
-  }
-
-  async findValidResetToken(tokenHash: string): Promise<{ userId: string; expiresAt: string; consumedAt: string | null } | null> {
-    const [row] = await this.db.select().from(schema.passwordResetTokens).where(eq(schema.passwordResetTokens.tokenHash, tokenHash)).limit(1);
-    if (!row) return null;
-    return { userId: row.userId.toString(), expiresAt: row.expiresAt.toISOString(), consumedAt: row.consumedAt?.toISOString() ?? null };
-  }
-
-  async consumeResetToken(tokenHash: string): Promise<void> {
-    await this.db.update(schema.passwordResetTokens).set({ consumedAt: new Date() }).where(eq(schema.passwordResetTokens.tokenHash, tokenHash));
-  }
-
-  async setPasswordHash(userId: string, passwordHash: string): Promise<void> {
-    await this.db.update(schema.users).set({ passwordHash }).where(eq(schema.users.id, toId(userId)));
-  }
-}