@simple-auth-kit/cli 1.5.0 → 1.6.1

package/registry/combos/express-prisma/variants/base/src/repositories/audit-log.repository.ts

@@ -5,8 +5,8 @@ import {
   normalizeLimit,
   normalizePage,
   type Paginated,
-} from "../pagination.js";
-import { toIdOrNull, toIdOrUndefined } from "../id.helper.js";
+} from "../helpers/pagination.js";
+import { toIdOrNull, toIdOrUndefined } from "../helpers/id.helper.js";
 
 export interface AuditLogEntry {
   id: string;

package/registry/combos/express-prisma/variants/base/src/repositories/rbac.repository.ts

@@ -1,14 +1,14 @@
 import { resolvePermissions } from "@/lib/auth/core/rbac.js";
 import { Prisma, PrismaClient } from "../../generated/prisma/client.js";
-import { HttpError } from "../http-error.js";
+import { HttpError } from "../errors/http-error.js";
 import {
   buildPageMeta,
   normalizeLimit,
   normalizePage,
   type Paginated,
-} from "../pagination.js";
-import { PermissionCache } from "../permission-cache.js";
-import { toId, toIdOrNull } from "../id.helper.js";
+} from "../helpers/pagination.js";
+import { PermissionCache } from "../cache/permission-cache.js";
+import { toId, toIdOrNull } from "../helpers/id.helper.js";
 
 export interface UserSummary {
   id: string;

package/registry/combos/express-prisma/variants/base/src/routers/admin.router.ts

@@ -1,6 +1,6 @@
 import type { NextFunction, Request, RequestHandler, Response } from "express";
 import { AuthService } from "../services/auth.service.js";
-import { HttpError } from "../http-error.js";
+import { HttpError } from "../errors/http-error.js";
 import {
   ability,
   createTieredRouter,
@@ -54,15 +54,13 @@ export function createAdminRouter(deps: AdminRouterDeps): RequestHandler {
           string,
           string | undefined
         >;
-        res
-          .status(200)
-          .json(
-            await auth.listUsers({
-              search,
-              page: page ? Number(page) : undefined,
-              limit: limit ? Number(limit) : undefined,
-            }),
-          );
+        res.status(200).json(
+          await auth.listUsers({
+            search,
+            page: page ? Number(page) : undefined,
+            limit: limit ? Number(limit) : undefined,
+          }),
+        );
       } catch (err) {
         next(err);
       }
@@ -185,18 +183,16 @@ export function createAdminRouter(deps: AdminRouterDeps): RequestHandler {
       try {
         const { userId, action, since, until, page, limit } =
           req.query as Record<string, string | undefined>;
-        res
-          .status(200)
-          .json(
-            await auth.listAuditLog({
-              userId,
-              action,
-              since,
-              until,
-              page: page ? Number(page) : undefined,
-              limit: limit ? Number(limit) : undefined,
-            }),
-          );
+        res.status(200).json(
+          await auth.listAuditLog({
+            userId,
+            action,
+            since,
+            until,
+            page: page ? Number(page) : undefined,
+            limit: limit ? Number(limit) : undefined,
+          }),
+        );
       } catch (err) {
         next(err);
       }

package/registry/combos/express-prisma/variants/base/src/services/auth.service.ts

@@ -42,17 +42,17 @@ import {
   verifyTotpCode,
 } from "@/lib/auth/core/two-factor.js";
 import type { Revoker } from "@/lib/auth/core/types.js";
-import type { AuthConfig } from "../auth.config.js";
-import { HttpError } from "../http-error.js";
+import type { AuthConfig } from "../config/auth.config.js";
+import { HttpError } from "../errors/http-error.js";
 import {
   AuditLogEntry,
   AuditLogListFilter,
   AuditLogRepository,
   toAuditLogEntry,
 } from "../repositories/audit-log.repository.js";
-import type { Paginated } from "../pagination.js";
+import type { Paginated } from "../helpers/pagination.js";
 import { PrismaClient } from "../../generated/prisma/client.js";
-import { KeyProviderService } from "../key-provider.js";
+import { KeyProviderService } from "../config/key-provider.js";
 import { OAuthRepository } from "../repositories/oauth.repository.js";
 import { PasswordResetRepository } from "../repositories/password-reset.repository.js";
 import {
@@ -67,7 +67,7 @@ import {
 } from "../repositories/rbac.repository.js";
 import { SessionRepository } from "../repositories/session.repository.js";
 import { TwoFactorRepository } from "../repositories/two-factor.repository.js";
-import { toId, toIdOrNull } from "../id.helper.js";
+import { toId, toIdOrNull } from "../helpers/id.helper.js";
 
 export interface AuthTokens {
   accessToken: string;
@@ -454,9 +454,7 @@ export class AuthService {
     return { twoFactorEnabled: user.twoFactorEnabled };
   }
 
-  async listActiveSessions(
-    userId: string,
-  ): Promise<
+  async listActiveSessions(userId: string): Promise<
     Array<{
       id: string;
       createdAt: string;

package/registry/combos/express-prisma/variants/base/test/variant-hooks.ts

@@ -6,13 +6,25 @@
 import "dotenv/config";
 import { PrismaPg } from "@prisma/adapter-pg";
 import { PrismaClient } from "../generated/prisma/client.js";
-import { toId } from "../src/id.helper.js";
-import { provisionDefaultRoles, SEED_ADMIN_ROLES } from "../src/rbac.defaults.js";
-import { POLICY_VERSION_KEY } from "../src/permission-cache.js";
+import { toId } from "../src/helpers/id.helper.js";
+import {
+  provisionDefaultRoles,
+  SEED_ADMIN_ROLES,
+} from "../src/rbac.defaults.js";
+import { POLICY_VERSION_KEY } from "../src/cache/permission-cache.js";
 import { permissionCacheStore } from "./bootstrap.js";
-import { renewingToken, type AdminSession, type AuthTokens, type Principal, type ProofContext, type VariantHooks } from "./harness.js";
+import {
+  renewingToken,
+  type AdminSession,
+  type AuthTokens,
+  type Principal,
+  type ProofContext,
+  type VariantHooks,
+} from "./harness.js";
 
-const prisma = new PrismaClient({ adapter: new PrismaPg({ connectionString: process.env["DATABASE_URL"] }) });
+const prisma = new PrismaClient({
+  adapter: new PrismaPg({ connectionString: process.env["DATABASE_URL"] }),
+});
 
 /** Remembered by `makeAdmin` so `freshToken()` can mint a new one whenever a section needs it. */
 let adminCredentials: { identifier: string; password: string } | undefined;
@@ -20,30 +32,49 @@ let adminCredentials: { identifier: string; password: string } | undefined;
 export const hooks: VariantHooks = {
   variant: "base",
 
-  async makeAdmin(ctx: ProofContext, principal: Principal): Promise<AdminSession> {
+  async makeAdmin(
+    ctx: ProofContext,
+    principal: Principal,
+  ): Promise<AdminSession> {
     // The role slug on its own confers nothing — no guard checks for the string "admin". Authority
     // comes from the PermissionRole rows behind it, and in this variant the seeder is the only
     // thing that writes them, so the hook does what `npm run seed` does: calls the same
     // provisioning function, from the same definition the routes are typed against. Idempotent,
     // so it is safe against a database that has already been seeded.
     await provisionDefaultRoles(prisma);
-    const roles = await prisma.role.findMany({ where: { slug: { in: SEED_ADMIN_ROLES } }, select: { id: true } });
-    await prisma.roleUser.createMany({ data: roles.map((role) => ({ userId: toId(principal.userId), roleId: role.id })), skipDuplicates: true });
+    const roles = await prisma.role.findMany({
+      where: { slug: { in: SEED_ADMIN_ROLES } },
+      select: { id: true },
+    });
+    await prisma.roleUser.createMany({
+      data: roles.map((role) => ({
+        userId: toId(principal.userId),
+        roleId: role.id,
+      })),
+      skipDuplicates: true,
+    });
 
-    adminCredentials = { identifier: principal.email, password: principal.password };
+    adminCredentials = {
+      identifier: principal.email,
+      password: principal.password,
+    };
     // Those writes went straight to the database, behind the running app's back, so nothing
     // bumped a version counter and the caller's already-cached (empty) permissions would still be
     // served. Bumping the policy counter is exactly what an out-of-band writer is supposed to do —
     // see permission-cache.ts. Logging in would not have helped: nothing about authorization is
     // in the token.
     await permissionCacheStore.bump(POLICY_VERSION_KEY);
-    const login = await ctx.call("POST", "/auth/login", { body: { identifier: principal.email, password: principal.password } });
+    const login = await ctx.call("POST", "/auth/login", {
+      body: { identifier: principal.email, password: principal.password },
+    });
     const token = (login.body as AuthTokens).accessToken;
     ctx.assert(!!token, `the seeded admin can log in (got ${login.status})`);
     return {
       token,
       freshToken: renewingToken(async () => {
-        const res = await ctx.call("POST", "/auth/login", { body: adminCredentials! });
+        const res = await ctx.call("POST", "/auth/login", {
+          body: adminCredentials!,
+        });
         return (res.body as AuthTokens).accessToken;
       }),
     };
@@ -53,16 +84,37 @@ export const hooks: VariantHooks = {
     // Nothing to do: admin endpoints operate on the whole deployment.
   },
 
-  async proveVariantProperties(ctx: ProofContext, admin: AdminSession): Promise<void> {
-    const listed = await ctx.call("GET", "/auth/admin/users", { token: await admin.freshToken() });
-    ctx.assert(listed.status === 200, `admin can list every user in the deployment (got ${listed.status})`);
-    ctx.assert(Array.isArray(listed.body?.items) && listed.body.items.length > 0, "the user list is non-empty");
+  async proveVariantProperties(
+    ctx: ProofContext,
+    admin: AdminSession,
+  ): Promise<void> {
+    const listed = await ctx.call("GET", "/auth/admin/users", {
+      token: await admin.freshToken(),
+    });
+    ctx.assert(
+      listed.status === 200,
+      `admin can list every user in the deployment (got ${listed.status})`,
+    );
+    ctx.assert(
+      Array.isArray(listed.body?.items) && listed.body.items.length > 0,
+      "the user list is non-empty",
+    );
 
-    const workspaces = await ctx.call("GET", "/workspaces", { token: await admin.freshToken() });
-    ctx.assert(workspaces.status === 404, `no workspace endpoints exist in this variant (got ${workspaces.status})`);
+    const workspaces = await ctx.call("GET", "/workspaces", {
+      token: await admin.freshToken(),
+    });
+    ctx.assert(
+      workspaces.status === 404,
+      `no workspace endpoints exist in this variant (got ${workspaces.status})`,
+    );
 
-    const me = await ctx.call("GET", "/auth/me", { token: await admin.freshToken() });
-    ctx.assert(me.body?.roles?.includes("admin"), "roles are global: they apply to every request this user makes");
+    const me = await ctx.call("GET", "/auth/me", {
+      token: await admin.freshToken(),
+    });
+    ctx.assert(
+      me.body?.roles?.includes("admin"),
+      "roles are global: they apply to every request this user makes",
+    );
 
     // --- authorization is not in the token, so a change lands on the next *request* ---
     //
@@ -76,27 +128,58 @@ export const hooks: VariantHooks = {
     const email = ctx.uniqueEmail("immediate");
     const password = "immediate-pw-12345";
     const tokens = await ctx.signup(email, password);
-    const userId = (await ctx.call("GET", "/auth/me", { token: tokens.accessToken })).body.sub as string;
+    const userId = (
+      await ctx.call("GET", "/auth/me", { token: tokens.accessToken })
+    ).body.sub as string;
 
-    const beforeGrant = await ctx.call("GET", "/auth/admin/users", { token: tokens.accessToken });
-    ctx.assert(beforeGrant.status === 403, `a user with no grant is refused (got ${beforeGrant.status})`);
+    const beforeGrant = await ctx.call("GET", "/auth/admin/users", {
+      token: tokens.accessToken,
+    });
+    ctx.assert(
+      beforeGrant.status === 403,
+      `a user with no grant is refused (got ${beforeGrant.status})`,
+    );
 
-    const granted = await ctx.call("POST", `/auth/admin/users/${userId}/permissions`, { token: await admin.freshToken(), body: { permission: "users:read" } });
-    ctx.assert(granted.status === 200 || granted.status === 201, `admin can grant a permission directly (got ${granted.status})`);
+    const granted = await ctx.call(
+      "POST",
+      `/auth/admin/users/${userId}/permissions`,
+      { token: await admin.freshToken(), body: { permission: "users:read" } },
+    );
+    ctx.assert(
+      granted.status === 200 || granted.status === 201,
+      `admin can grant a permission directly (got ${granted.status})`,
+    );
 
-    const afterGrant = await ctx.call("GET", "/auth/admin/users", { token: tokens.accessToken });
-    ctx.assert(afterGrant.status === 200, `…and the grant is in effect on the very next request, on the token they already held (got ${afterGrant.status})`);
+    const afterGrant = await ctx.call("GET", "/auth/admin/users", {
+      token: tokens.accessToken,
+    });
+    ctx.assert(
+      afterGrant.status === 200,
+      `…and the grant is in effect on the very next request, on the token they already held (got ${afterGrant.status})`,
+    );
 
     // The status of this revoke used to be the one admin call in the whole run that was never
     // asserted, which is exactly why a token that had quietly expired surfaced as a confusing
     // failure of the *next* assertion instead of this one.
-    const revoked = await ctx.call("POST", `/auth/admin/users/${userId}/permissions/${encodeURIComponent("users:read")}/revoke`, {
-      token: await admin.freshToken(),
-    });
-    ctx.assert(revoked.status === 200 || revoked.status === 201, `admin can revoke the direct grant (got ${revoked.status})`);
+    const revoked = await ctx.call(
+      "POST",
+      `/auth/admin/users/${userId}/permissions/${encodeURIComponent("users:read")}/revoke`,
+      {
+        token: await admin.freshToken(),
+      },
+    );
+    ctx.assert(
+      revoked.status === 200 || revoked.status === 201,
+      `admin can revoke the direct grant (got ${revoked.status})`,
+    );
 
-    const afterRevoke = await ctx.call("GET", "/auth/admin/users", { token: tokens.accessToken });
-    ctx.assert(afterRevoke.status === 403, `and the revocation lands on the very next request too, on the same token (got ${afterRevoke.status})`);
+    const afterRevoke = await ctx.call("GET", "/auth/admin/users", {
+      token: tokens.accessToken,
+    });
+    ctx.assert(
+      afterRevoke.status === 403,
+      `and the revocation lands on the very next request too, on the same token (got ${afterRevoke.status})`,
+    );
 
     await proveTheCacheIsReal(ctx, admin, tokens.accessToken);
     await proveARawDatabaseEditChangesEnforcement(ctx, admin);
@@ -108,7 +191,11 @@ export const hooks: VariantHooks = {
  * app resolves through (`test/bootstrap.ts` hands it to `AuthModule.forRoot`), so "the second
  * request did not touch the database" is a measurement rather than a claim.
  */
-async function proveTheCacheIsReal(ctx: ProofContext, admin: AdminSession, token: string): Promise<void> {
+async function proveTheCacheIsReal(
+  ctx: ProofContext,
+  admin: AdminSession,
+  token: string,
+): Promise<void> {
   const N = 8;
   await ctx.call("GET", "/auth/me", { token }); // warm, so the measurement is of the steady state
   const before = { ...permissionCacheStore.stats };
@@ -120,16 +207,27 @@ async function proveTheCacheIsReal(ctx: ProofContext, admin: AdminSession, token
     `${N} identical authorized requests resolve permissions 0 further times — all ${N} were cache hits (misses +${after.misses - before.misses}, hits +${after.hits - before.hits})`,
   );
 
-  const userId = (await ctx.call("GET", "/auth/me", { token })).body.sub as string;
+  const userId = (await ctx.call("GET", "/auth/me", { token })).body
+    .sub as string;
   const beforeGrant = { ...permissionCacheStore.stats };
-  await ctx.call("POST", `/auth/admin/users/${userId}/permissions`, { token: await admin.freshToken(), body: { permission: "probe:cache" } });
+  await ctx.call("POST", `/auth/admin/users/${userId}/permissions`, {
+    token: await admin.freshToken(),
+    body: { permission: "probe:cache" },
+  });
   const afterGrantCall = await ctx.call("GET", "/auth/me", { token });
   ctx.assert(
     permissionCacheStore.stats.misses > beforeGrant.misses,
     "a grant bumps this user's version counter, so the next request misses the cache and re-resolves rather than serving a stale entry",
   );
-  ctx.assert((afterGrantCall.body?.permissions ?? []).includes("probe:cache"), "…and the freshly resolved answer contains the new permission");
-  await ctx.call("POST", `/auth/admin/users/${userId}/permissions/${encodeURIComponent("probe:cache")}/revoke`, { token: await admin.freshToken() });
+  ctx.assert(
+    (afterGrantCall.body?.permissions ?? []).includes("probe:cache"),
+    "…and the freshly resolved answer contains the new permission",
+  );
+  await ctx.call(
+    "POST",
+    `/auth/admin/users/${userId}/permissions/${encodeURIComponent("probe:cache")}/revoke`,
+    { token: await admin.freshToken() },
+  );
 }
 
 /**
@@ -137,23 +235,54 @@ async function proveTheCacheIsReal(ctx: ProofContext, admin: AdminSession, token
  * doing the writing — this rules out any possibility that it is also doing something in memory.
  * A `psql` session would look exactly like this.
  */
-async function proveARawDatabaseEditChangesEnforcement(ctx: ProofContext, admin: AdminSession): Promise<void> {
+async function proveARawDatabaseEditChangesEnforcement(
+  ctx: ProofContext,
+  admin: AdminSession,
+): Promise<void> {
   const email = ctx.uniqueEmail("rawedit");
   const tokens = await ctx.signup(email, "rawedit-pw-12345");
-  const userId = (await ctx.call("GET", "/auth/me", { token: tokens.accessToken })).body.sub as string;
-  await ctx.call("POST", `/auth/admin/users/${userId}/permissions`, { token: await admin.freshToken(), body: { permission: "audit-log:read" } });
-  ctx.assert((await ctx.call("GET", "/auth/admin/audit-log", { token: tokens.accessToken })).status === 200, "a direct grant opens the audit log");
+  const userId = (
+    await ctx.call("GET", "/auth/me", { token: tokens.accessToken })
+  ).body.sub as string;
+  await ctx.call("POST", `/auth/admin/users/${userId}/permissions`, {
+    token: await admin.freshToken(),
+    body: { permission: "audit-log:read" },
+  });
+  ctx.assert(
+    (
+      await ctx.call("GET", "/auth/admin/audit-log", {
+        token: tokens.accessToken,
+      })
+    ).status === 200,
+    "a direct grant opens the audit log",
+  );
 
   // Written straight to the table, with no code change and no redeploy. The bump that follows is
   // the out-of-band writer's half of the cache contract (permission-cache.ts) — without it the
   // edit would still land, but only once the cached entry expired.
-  await prisma.permission.update({ where: { slug: "audit-log:read" }, data: { isActive: false } });
+  await prisma.permission.update({
+    where: { slug: "audit-log:read" },
+    data: { isActive: false },
+  });
   await permissionCacheStore.bump(POLICY_VERSION_KEY);
-  const denied = await ctx.call("GET", "/auth/admin/audit-log", { token: tokens.accessToken });
-  ctx.assert(denied.status === 403, `a permission deactivated by a raw database write stops opening its route (got ${denied.status})`);
+  const denied = await ctx.call("GET", "/auth/admin/audit-log", {
+    token: tokens.accessToken,
+  });
+  ctx.assert(
+    denied.status === 403,
+    `a permission deactivated by a raw database write stops opening its route (got ${denied.status})`,
+  );
 
-  await prisma.permission.update({ where: { slug: "audit-log:read" }, data: { isActive: true } });
+  await prisma.permission.update({
+    where: { slug: "audit-log:read" },
+    data: { isActive: true },
+  });
   await permissionCacheStore.bump(POLICY_VERSION_KEY);
-  const restored = await ctx.call("GET", "/auth/admin/audit-log", { token: tokens.accessToken });
-  ctx.assert(restored.status === 200, `…and reactivating it in the database opens the route again (got ${restored.status})`);
+  const restored = await ctx.call("GET", "/auth/admin/audit-log", {
+    token: tokens.accessToken,
+  });
+  ctx.assert(
+    restored.status === 200,
+    `…and reactivating it in the database opens the route again (got ${restored.status})`,
+  );
 }

package/registry/combos/express-prisma/variants/workspaces/src/create-auth-app.ts

@@ -5,7 +5,7 @@ import type { RateLimitDeps } from "@/lib/auth/core/rate-limit.js";
 import { createAdminRouter } from "./routers/admin.router.js";
 import { AuditLogRepository } from "./repositories/audit-log.repository.js";
 import { authCoreErrorMiddleware } from "./middleware/auth-core-error.middleware.js";
-import { AuthConfig, defaultAuthConfig } from "./auth.config.js";
+import { AuthConfig, defaultAuthConfig } from "./config/auth.config.js";
 import { createAuthMiddleware } from "./middleware/auth.middleware.js";
 import { createAuthRouter } from "./routers/auth.router.js";
 import { AuthService } from "./services/auth.service.js";
@@ -14,15 +14,15 @@ import {
   createWorkspaceMiddleware,
 } from "./middleware/authz.middleware.js";
 import { PrismaClient } from "./../generated/prisma/client.js";
-import { KeyProviderService } from "./key-provider.js";
+import { KeyProviderService } from "./config/key-provider.js";
 import { OAuthRepository } from "./repositories/oauth.repository.js";
-import { openApiSpec } from "./openapi-spec.js";
+import { openApiSpec } from "./openapi/openapi-spec.js";
 import { PasswordResetRepository } from "./repositories/password-reset.repository.js";
 import {
   InMemoryPermissionCacheStore,
   PermissionCache,
-} from "./permission-cache.js";
-import { InMemoryRateLimitStore } from "./rate-limit.store.js";
+} from "./cache/permission-cache.js";
+import { InMemoryRateLimitStore } from "./cache/rate-limit.store.js";
 import { RbacRepository } from "./repositories/rbac.repository.js";
 import { responseEnvelope } from "./middleware/response-envelope.middleware.js";
 import { SessionRepository } from "./repositories/session.repository.js";

package/registry/combos/express-prisma/variants/workspaces/src/index.ts

@@ -0,0 +1,8 @@
+export * from "./create-auth-app.js";
+
+export * from "./route-tiers.js";
+
+export * from "./middleware/auth.middleware.js";
+export * from "./middleware/authz.middleware.js";
+
+export * from "./ability/ability.js";

package/registry/combos/express-prisma/variants/workspaces/src/middleware/authz.middleware.ts

@@ -1,7 +1,7 @@
 import type { NextFunction, Request, RequestHandler, Response } from "express";
-import { defineAbilitiesFor } from "../ability.js";
-import { HttpError } from "../http-error.js";
-import type { PermissionCache } from "../permission-cache.js";
+import { defineAbilitiesFor } from "../ability/ability.js";
+import { HttpError } from "../errors/http-error.js";
+import type { PermissionCache } from "../cache/permission-cache.js";
 import {
   memberCacheKey,
   type RbacRepository,