@simple-auth-kit/cli 1.5.0 → 1.6.1

package/registry/combos/express-prisma/shared/src/{openapi-spec.ts → openapi/openapi-spec.ts}

@@ -18,7 +18,8 @@ export const openApiSpec: Record<string, unknown> = {
   openapi: "3.0.3",
   info: {
     title: "simple-auth-kit API",
-    description: "express-prisma combo — signup/login, sessions, TOTP 2FA, OAuth, password reset, RBAC.",
+    description:
+      "express-prisma combo — signup/login, sessions, TOTP 2FA, OAuth, password reset, RBAC.",
     version: "1.0",
   },
   servers: [{ url: "/" }],
@@ -38,18 +39,37 @@ export const openApiSpec: Record<string, unknown> = {
         properties: {
           email: { type: "string", example: "alice@example.com" },
           password: { type: "string", example: "correct-horse-battery-staple" },
-          firstName: { type: "string", description: "Unique across the deployment.", example: "Alice" },
-          lastName: { type: "string", description: "Unique across the deployment.", example: "Nguyen" },
+          firstName: {
+            type: "string",
+            description: "Unique across the deployment.",
+            example: "Alice",
+          },
+          lastName: {
+            type: "string",
+            description: "Unique across the deployment.",
+            example: "Nguyen",
+          },
           displayName: { type: "string", example: "Alice Nguyen" },
-          phone: { type: "string", description: "Unique across the deployment." },
-          username: { type: "string", description: "Unique across the deployment." },
+          phone: {
+            type: "string",
+            description: "Unique across the deployment.",
+          },
+          username: {
+            type: "string",
+            description: "Unique across the deployment.",
+          },
         },
       },
       LoginRequest: {
         type: "object",
         required: ["identifier", "password"],
         properties: {
-          identifier: { type: "string", description: "Email, username, or phone — whichever the account has set.", example: "alice@example.com" },
+          identifier: {
+            type: "string",
+            description:
+              "Email, username, or phone — whichever the account has set.",
+            example: "alice@example.com",
+          },
           password: { type: "string", example: "correct-horse-battery-staple" },
         },
       },
@@ -57,8 +77,16 @@ export const openApiSpec: Record<string, unknown> = {
         type: "object",
         required: ["challengeToken", "code"],
         properties: {
-          challengeToken: { type: "string", description: "Returned by POST /auth/login when the account has 2FA enabled" },
-          code: { type: "string", description: "6-digit TOTP code, or an unused backup code", example: "123456" },
+          challengeToken: {
+            type: "string",
+            description:
+              "Returned by POST /auth/login when the account has 2FA enabled",
+          },
+          code: {
+            type: "string",
+            description: "6-digit TOTP code, or an unused backup code",
+            example: "123456",
+          },
         },
       },
       RefreshRequest: {
@@ -86,7 +114,10 @@ export const openApiSpec: Record<string, unknown> = {
         type: "object",
         required: ["token", "newPassword"],
         properties: {
-          token: { type: "string", description: "Raw token from the sendPasswordResetEmail hook" },
+          token: {
+            type: "string",
+            description: "Raw token from the sendPasswordResetEmail hook",
+          },
           newPassword: { type: "string" },
         },
       },
@@ -126,7 +157,14 @@ export const openApiSpec: Record<string, unknown> = {
       },
       CurrentUser: {
         type: "object",
-        required: ["sub", "sessionId", "roles", "permissions", "twoFactorEnabled", "email"],
+        required: [
+          "sub",
+          "sessionId",
+          "roles",
+          "permissions",
+          "twoFactorEnabled",
+          "email",
+        ],
         properties: {
           sub: { type: "string", description: "User id" },
           sessionId: { type: "string" },
@@ -146,7 +184,12 @@ export const openApiSpec: Record<string, unknown> = {
           displayName: { type: "string", nullable: true },
           phone: { type: "string", nullable: true },
           username: { type: "string", nullable: true },
-          photo: { type: "string", nullable: true, description: "A data URI or an externally-hosted URL — stored as-is, never processed server-side." },
+          photo: {
+            type: "string",
+            nullable: true,
+            description:
+              "A data URI or an externally-hosted URL — stored as-is, never processed server-side.",
+          },
         },
       },
       SelfProfile: {
@@ -160,7 +203,12 @@ export const openApiSpec: Record<string, unknown> = {
           displayName: { type: "string", nullable: true },
           phone: { type: "string", nullable: true },
           username: { type: "string", nullable: true },
-          photo: { type: "string", nullable: true, description: "A data URI or an externally-hosted URL — stored as-is, never processed server-side." },
+          photo: {
+            type: "string",
+            nullable: true,
+            description:
+              "A data URI or an externally-hosted URL — stored as-is, never processed server-side.",
+          },
           createdAt: { type: "string", format: "date-time" },
         },
       },
@@ -186,21 +234,32 @@ export const openApiSpec: Record<string, unknown> = {
         required: ["secret", "provisioningUri"],
         properties: {
           secret: { type: "string", description: "Base32 TOTP secret" },
-          provisioningUri: { type: "string", description: "otpauth:// provisioning URI, render as a QR code" },
+          provisioningUri: {
+            type: "string",
+            description: "otpauth:// provisioning URI, render as a QR code",
+          },
         },
       },
       ConfirmTwoFactorResponse: {
         type: "object",
         required: ["backupCodes"],
         properties: {
-          backupCodes: { type: "array", items: { type: "string" }, description: "One-time recovery codes — shown once" },
+          backupCodes: {
+            type: "array",
+            items: { type: "string" },
+            description: "One-time recovery codes — shown once",
+          },
         },
       },
       OAuthStartResponse: {
         type: "object",
         required: ["url"],
         properties: {
-          url: { type: "string", description: "Redirect the user/webview to this URL to start the OAuth flow" },
+          url: {
+            type: "string",
+            description:
+              "Redirect the user/webview to this URL to start the OAuth flow",
+          },
         },
       },
       ErrorResponse: {
@@ -223,10 +282,21 @@ export const openApiSpec: Record<string, unknown> = {
         summary: "Create a user and issue a session",
         requestBody: {
           required: true,
-          content: { "application/json": { schema: { $ref: "#/components/schemas/SignupRequest" } } },
+          content: {
+            "application/json": {
+              schema: { $ref: "#/components/schemas/SignupRequest" },
+            },
+          },
         },
         responses: {
-          "201": { description: "Created", content: { "application/json": { schema: { $ref: "#/components/schemas/AuthTokens" } } } },
+          "201": {
+            description: "Created",
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/AuthTokens" },
+              },
+            },
+          },
           "400": errorResponse("Missing required field"),
           "409": errorResponse("Email already registered"),
         },
@@ -236,17 +306,27 @@ export const openApiSpec: Record<string, unknown> = {
       post: {
         tags: ["auth"],
         summary: "Log in with email, username, or phone + password",
-        description: "identifier is matched against email, username, and phone, in that order. Returns tokens directly, or a 2FA challenge if the account has 2FA enabled.",
+        description:
+          "identifier is matched against email, username, and phone, in that order. Returns tokens directly, or a 2FA challenge if the account has 2FA enabled.",
         requestBody: {
           required: true,
-          content: { "application/json": { schema: { $ref: "#/components/schemas/LoginRequest" } } },
+          content: {
+            "application/json": {
+              schema: { $ref: "#/components/schemas/LoginRequest" },
+            },
+          },
         },
         responses: {
           "200": {
             description: "OK",
             content: {
               "application/json": {
-                schema: { oneOf: [{ $ref: "#/components/schemas/AuthTokens" }, { $ref: "#/components/schemas/TwoFactorChallenge" }] },
+                schema: {
+                  oneOf: [
+                    { $ref: "#/components/schemas/AuthTokens" },
+                    { $ref: "#/components/schemas/TwoFactorChallenge" },
+                  ],
+                },
               },
             },
           },
@@ -262,10 +342,21 @@ export const openApiSpec: Record<string, unknown> = {
         summary: "Complete the 2FA challenge from POST /auth/login",
         requestBody: {
           required: true,
-          content: { "application/json": { schema: { $ref: "#/components/schemas/LoginTwoFactorRequest" } } },
+          content: {
+            "application/json": {
+              schema: { $ref: "#/components/schemas/LoginTwoFactorRequest" },
+            },
+          },
         },
         responses: {
-          "200": { description: "OK", content: { "application/json": { schema: { $ref: "#/components/schemas/AuthTokens" } } } },
+          "200": {
+            description: "OK",
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/AuthTokens" },
+              },
+            },
+          },
           "400": errorResponse("Missing required field"),
           "401": errorResponse("Invalid or expired challenge token / code"),
         },
@@ -277,10 +368,21 @@ export const openApiSpec: Record<string, unknown> = {
         summary: "Rotate a refresh token for a new access+refresh pair",
         requestBody: {
           required: true,
-          content: { "application/json": { schema: { $ref: "#/components/schemas/RefreshRequest" } } },
+          content: {
+            "application/json": {
+              schema: { $ref: "#/components/schemas/RefreshRequest" },
+            },
+          },
         },
         responses: {
-          "200": { description: "OK", content: { "application/json": { schema: { $ref: "#/components/schemas/RefreshResponse" } } } },
+          "200": {
+            description: "OK",
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/RefreshResponse" },
+              },
+            },
+          },
           "400": errorResponse("Missing required field"),
           "401": errorResponse("Stale/reused/invalid refresh token"),
         },
@@ -290,25 +392,45 @@ export const openApiSpec: Record<string, unknown> = {
       get: {
         tags: ["auth"],
         summary: "Current session's identity",
-        description: "`roles` and `permissions` are whatever applies to this request — see authz.middleware.ts for how they are resolved.",
+        description:
+          "`roles` and `permissions` are whatever applies to this request — see authz.middleware.ts for how they are resolved.",
         security: [{ bearerAuth: [] }],
         parameters: adminSpec.scopeParameters,
         responses: {
-          "200": { description: "OK", content: { "application/json": { schema: { $ref: "#/components/schemas/CurrentUser" } } } },
+          "200": {
+            description: "OK",
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/CurrentUser" },
+              },
+            },
+          },
           "401": errorResponse("Missing or invalid access token"),
         },
       },
       patch: {
         tags: ["auth"],
         summary: "Update the current user's own profile",
-        description: "Self-service — no admin permission required. Updates the caller's own row directly; unrelated to any workspace.",
+        description:
+          "Self-service — no admin permission required. Updates the caller's own row directly; unrelated to any workspace.",
         security: [{ bearerAuth: [] }],
         requestBody: {
           required: true,
-          content: { "application/json": { schema: { $ref: "#/components/schemas/UpdateUserRequest" } } },
+          content: {
+            "application/json": {
+              schema: { $ref: "#/components/schemas/UpdateUserRequest" },
+            },
+          },
         },
         responses: {
-          "200": { description: "OK", content: { "application/json": { schema: { $ref: "#/components/schemas/SelfProfile" } } } },
+          "200": {
+            description: "OK",
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/SelfProfile" },
+              },
+            },
+          },
           "401": errorResponse("Missing or invalid access token"),
         },
       },
@@ -321,7 +443,14 @@ export const openApiSpec: Record<string, unknown> = {
         responses: {
           "200": {
             description: "OK",
-            content: { "application/json": { schema: { type: "array", items: { $ref: "#/components/schemas/SessionSummary" } } } },
+            content: {
+              "application/json": {
+                schema: {
+                  type: "array",
+                  items: { $ref: "#/components/schemas/SessionSummary" },
+                },
+              },
+            },
           },
           "401": errorResponse("Missing or invalid access token"),
         },
@@ -333,7 +462,14 @@ export const openApiSpec: Record<string, unknown> = {
         summary: "Revoke the current session",
         security: [{ bearerAuth: [] }],
         responses: {
-          "200": { description: "OK", content: { "application/json": { schema: { $ref: "#/components/schemas/OkResponse" } } } },
+          "200": {
+            description: "OK",
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/OkResponse" },
+              },
+            },
+          },
           "401": errorResponse("Missing or invalid access token"),
         },
       },
@@ -344,7 +480,14 @@ export const openApiSpec: Record<string, unknown> = {
         summary: "Revoke every session for the current user",
         security: [{ bearerAuth: [] }],
         responses: {
-          "200": { description: "OK", content: { "application/json": { schema: { $ref: "#/components/schemas/OkResponse" } } } },
+          "200": {
+            description: "OK",
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/OkResponse" },
+              },
+            },
+          },
           "401": errorResponse("Missing or invalid access token"),
         },
       },
@@ -355,7 +498,14 @@ export const openApiSpec: Record<string, unknown> = {
         summary: "Revoke every session except the current one",
         security: [{ bearerAuth: [] }],
         responses: {
-          "200": { description: "OK", content: { "application/json": { schema: { $ref: "#/components/schemas/OkResponse" } } } },
+          "200": {
+            description: "OK",
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/OkResponse" },
+              },
+            },
+          },
           "401": errorResponse("Missing or invalid access token"),
         },
       },
@@ -364,16 +514,30 @@ export const openApiSpec: Record<string, unknown> = {
       post: {
         tags: ["auth"],
         summary: "Change the current user's password",
-        description: "Requires the current password. Revokes every other session for the user; the session making this call is left alone.",
+        description:
+          "Requires the current password. Revokes every other session for the user; the session making this call is left alone.",
         security: [{ bearerAuth: [] }],
         requestBody: {
           required: true,
-          content: { "application/json": { schema: { $ref: "#/components/schemas/ChangePasswordRequest" } } },
+          content: {
+            "application/json": {
+              schema: { $ref: "#/components/schemas/ChangePasswordRequest" },
+            },
+          },
         },
         responses: {
-          "200": { description: "OK", content: { "application/json": { schema: { $ref: "#/components/schemas/OkResponse" } } } },
+          "200": {
+            description: "OK",
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/OkResponse" },
+              },
+            },
+          },
           "400": errorResponse("Missing required field"),
-          "401": errorResponse("Missing/invalid access token, or wrong current password"),
+          "401": errorResponse(
+            "Missing/invalid access token, or wrong current password",
+          ),
         },
       },
     },
@@ -384,7 +548,16 @@ export const openApiSpec: Record<string, unknown> = {
         description: "Not active until confirmed via POST /auth/2fa/confirm.",
         security: [{ bearerAuth: [] }],
         responses: {
-          "200": { description: "OK", content: { "application/json": { schema: { $ref: "#/components/schemas/EnrollTwoFactorResponse" } } } },
+          "200": {
+            description: "OK",
+            content: {
+              "application/json": {
+                schema: {
+                  $ref: "#/components/schemas/EnrollTwoFactorResponse",
+                },
+              },
+            },
+          },
           "401": errorResponse("Missing or invalid access token"),
         },
       },
@@ -393,14 +566,28 @@ export const openApiSpec: Record<string, unknown> = {
       post: {
         tags: ["auth"],
         summary: "Confirm TOTP enrollment with a code",
-        description: "Enables 2FA and returns one-time backup codes, shown only here.",
+        description:
+          "Enables 2FA and returns one-time backup codes, shown only here.",
         security: [{ bearerAuth: [] }],
         requestBody: {
           required: true,
-          content: { "application/json": { schema: { $ref: "#/components/schemas/TwoFactorCodeRequest" } } },
+          content: {
+            "application/json": {
+              schema: { $ref: "#/components/schemas/TwoFactorCodeRequest" },
+            },
+          },
         },
         responses: {
-          "200": { description: "OK", content: { "application/json": { schema: { $ref: "#/components/schemas/ConfirmTwoFactorResponse" } } } },
+          "200": {
+            description: "OK",
+            content: {
+              "application/json": {
+                schema: {
+                  $ref: "#/components/schemas/ConfirmTwoFactorResponse",
+                },
+              },
+            },
+          },
           "400": errorResponse("call enrollTwoFactor first"),
           "401": errorResponse("Invalid two-factor code"),
         },
@@ -414,10 +601,21 @@ export const openApiSpec: Record<string, unknown> = {
         security: [{ bearerAuth: [] }],
         requestBody: {
           required: true,
-          content: { "application/json": { schema: { $ref: "#/components/schemas/TwoFactorCodeRequest" } } },
+          content: {
+            "application/json": {
+              schema: { $ref: "#/components/schemas/TwoFactorCodeRequest" },
+            },
+          },
         },
         responses: {
-          "200": { description: "OK", content: { "application/json": { schema: { $ref: "#/components/schemas/OkResponse" } } } },
+          "200": {
+            description: "OK",
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/OkResponse" },
+              },
+            },
+          },
           "400": errorResponse("Two-factor is not enabled"),
           "401": errorResponse("Invalid two-factor code"),
         },
@@ -427,13 +625,25 @@ export const openApiSpec: Record<string, unknown> = {
       post: {
         tags: ["auth"],
         summary: "Request a password reset",
-        description: "Always reports success, whether or not the email exists — avoids account enumeration.",
+        description:
+          "Always reports success, whether or not the email exists — avoids account enumeration.",
         requestBody: {
           required: true,
-          content: { "application/json": { schema: { $ref: "#/components/schemas/ForgotPasswordRequest" } } },
+          content: {
+            "application/json": {
+              schema: { $ref: "#/components/schemas/ForgotPasswordRequest" },
+            },
+          },
         },
         responses: {
-          "200": { description: "OK", content: { "application/json": { schema: { $ref: "#/components/schemas/OkResponse" } } } },
+          "200": {
+            description: "OK",
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/OkResponse" },
+              },
+            },
+          },
           "400": errorResponse("Missing required field"),
         },
       },
@@ -445,10 +655,21 @@ export const openApiSpec: Record<string, unknown> = {
         description: "Revokes every existing session for the user on success.",
         requestBody: {
           required: true,
-          content: { "application/json": { schema: { $ref: "#/components/schemas/ResetPasswordRequest" } } },
+          content: {
+            "application/json": {
+              schema: { $ref: "#/components/schemas/ResetPasswordRequest" },
+            },
+          },
         },
         responses: {
-          "200": { description: "OK", content: { "application/json": { schema: { $ref: "#/components/schemas/OkResponse" } } } },
+          "200": {
+            description: "OK",
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/OkResponse" },
+              },
+            },
+          },
           "400": errorResponse("Missing required field"),
           "401": errorResponse("Invalid or expired reset token"),
         },
@@ -458,9 +679,23 @@ export const openApiSpec: Record<string, unknown> = {
       get: {
         tags: ["auth"],
         summary: "Get the redirect URL to start an OAuth login",
-        parameters: [{ name: "provider", in: "path", required: true, schema: { type: "string", enum: ["google", "apple"] } }],
+        parameters: [
+          {
+            name: "provider",
+            in: "path",
+            required: true,
+            schema: { type: "string", enum: ["google", "apple"] },
+          },
+        ],
         responses: {
-          "200": { description: "OK", content: { "application/json": { schema: { $ref: "#/components/schemas/OAuthStartResponse" } } } },
+          "200": {
+            description: "OK",
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/OAuthStartResponse" },
+              },
+            },
+          },
           "400": errorResponse("Unknown or unconfigured OAuth provider"),
         },
       },
@@ -468,14 +703,37 @@ export const openApiSpec: Record<string, unknown> = {
     "/auth/oauth/{provider}/callback": {
       get: {
         tags: ["auth"],
-        summary: "OAuth provider callback — exchanges the code and completes login",
+        summary:
+          "OAuth provider callback — exchanges the code and completes login",
         parameters: [
-          { name: "provider", in: "path", required: true, schema: { type: "string", enum: ["google", "apple"] } },
-          { name: "code", in: "query", required: true, schema: { type: "string" } },
-          { name: "state", in: "query", required: true, schema: { type: "string" } },
+          {
+            name: "provider",
+            in: "path",
+            required: true,
+            schema: { type: "string", enum: ["google", "apple"] },
+          },
+          {
+            name: "code",
+            in: "query",
+            required: true,
+            schema: { type: "string" },
+          },
+          {
+            name: "state",
+            in: "query",
+            required: true,
+            schema: { type: "string" },
+          },
         ],
         responses: {
-          "200": { description: "OK", content: { "application/json": { schema: { $ref: "#/components/schemas/AuthTokens" } } } },
+          "200": {
+            description: "OK",
+            content: {
+              "application/json": {
+                schema: { $ref: "#/components/schemas/AuthTokens" },
+              },
+            },
+          },
           "400": errorResponse("Unknown or unconfigured OAuth provider"),
           "401": errorResponse("OAuth exchange failed"),
         },

package/registry/combos/express-prisma/shared/src/repositories/oauth.repository.ts

@@ -1,7 +1,7 @@
 import type { OAuthStoreDeps } from "@/lib/auth/core/oauth.js";
 import { PrismaClient } from "../../generated/prisma/client.js";
-import { HttpError } from "../http-error.js";
-import { toId } from "../id.helper.js";
+import { HttpError } from "../errors/http-error.js";
+import { toId } from "../helpers/id.helper.js";
 
 // Plain class, no DI container — constructed directly with a PrismaClient in
 // create-auth-app.ts. Identical Prisma queries to the reference combo.

package/registry/combos/express-prisma/shared/src/repositories/password-reset.repository.ts

@@ -1,6 +1,6 @@
 import type { PasswordResetStoreDeps } from "@/lib/auth/core/password-reset.js";
 import { PrismaClient } from "../../generated/prisma/client.js";
-import { toId } from "../id.helper.js";
+import { toId } from "../helpers/id.helper.js";
 
 // Plain class, no DI container — constructed directly with a PrismaClient in
 // create-auth-app.ts. Identical Prisma queries to the reference combo.
@@ -21,9 +21,7 @@ export class PasswordResetRepository implements PasswordResetStoreDeps {
     });
   }
 
-  async findValidResetToken(
-    tokenHash: string,
-  ): Promise<{
+  async findValidResetToken(tokenHash: string): Promise<{
     userId: string;
     expiresAt: string;
     consumedAt: string | null;

package/registry/combos/express-prisma/shared/src/repositories/session.repository.ts

@@ -6,9 +6,9 @@ import type {
   SessionRecord,
 } from "@/lib/auth/core/types.js";
 import { PrismaClient } from "../../generated/prisma/client.js";
-import type { AuthConfig } from "../auth.config.js";
+import type { AuthConfig } from "../config/auth.config.js";
 import { AuditLogRepository } from "./audit-log.repository.js";
-import { toId, toIdOrNull } from "../id.helper.js";
+import { toId, toIdOrNull } from "../helpers/id.helper.js";
 
 function toSessionRecord(row: {
   id: bigint;

package/registry/combos/express-prisma/shared/src/request-context.ts

@@ -19,7 +19,7 @@
 // the `Express` namespace, see @types/express-serve-static-core) rather than the reference's
 // `declare module "express"`.
 import type { AccessTokenClaims } from "@/lib/auth/core/types.js";
-import type { AppAbility } from "./ability.js";
+import type { AppAbility } from "./ability/ability.js";
 import type { AuthzContext } from "./middleware/authz.middleware.js";
 
 declare global {