@simple-auth-kit/cli 1.5.0 → 1.6.1

package/registry/combos/nestjs-prisma/variants/base/test/variant-hooks.ts

@@ -3,13 +3,25 @@
 import "dotenv/config";
 import { PrismaPg } from "@prisma/adapter-pg";
 import { PrismaClient } from "../generated/prisma/client.js";
-import { toId } from "../src/id.helper.js";
-import { provisionDefaultRoles, SEED_ADMIN_ROLES } from "../src/rbac.defaults.js";
-import { POLICY_VERSION_KEY } from "../src/permission-cache.js";
+import { toId } from "../src/helpers/id.helper.js";
+import {
+  provisionDefaultRoles,
+  SEED_ADMIN_ROLES,
+} from "../src/rbac.defaults.js";
+import { POLICY_VERSION_KEY } from "../src/cache/permission-cache.js";
 import { permissionCacheStore } from "./bootstrap.js";
-import { renewingToken, type AdminSession, type AuthTokens, type Principal, type ProofContext, type VariantHooks } from "./harness.js";
+import {
+  renewingToken,
+  type AdminSession,
+  type AuthTokens,
+  type Principal,
+  type ProofContext,
+  type VariantHooks,
+} from "./harness.js";
 
-const prisma = new PrismaClient({ adapter: new PrismaPg({ connectionString: process.env["DATABASE_URL"] }) });
+const prisma = new PrismaClient({
+  adapter: new PrismaPg({ connectionString: process.env["DATABASE_URL"] }),
+});
 
 /** Remembered by `makeAdmin` so `freshToken()` can mint a new one whenever a section needs it. */
 let adminCredentials: { identifier: string; password: string } | undefined;
@@ -17,24 +29,43 @@ let adminCredentials: { identifier: string; password: string } | undefined;
 export const hooks: VariantHooks = {
   variant: "base",
 
-  async makeAdmin(ctx: ProofContext, principal: Principal): Promise<AdminSession> {
+  async makeAdmin(
+    ctx: ProofContext,
+    principal: Principal,
+  ): Promise<AdminSession> {
     // Calls the same provisioning function `npm run seed` does — idempotent, safe against an
     // already-seeded database.
     await provisionDefaultRoles(prisma);
-    const roles = await prisma.role.findMany({ where: { slug: { in: SEED_ADMIN_ROLES } }, select: { id: true } });
-    await prisma.roleUser.createMany({ data: roles.map((role) => ({ userId: toId(principal.userId), roleId: role.id })), skipDuplicates: true });
+    const roles = await prisma.role.findMany({
+      where: { slug: { in: SEED_ADMIN_ROLES } },
+      select: { id: true },
+    });
+    await prisma.roleUser.createMany({
+      data: roles.map((role) => ({
+        userId: toId(principal.userId),
+        roleId: role.id,
+      })),
+      skipDuplicates: true,
+    });
 
-    adminCredentials = { identifier: principal.email, password: principal.password };
+    adminCredentials = {
+      identifier: principal.email,
+      password: principal.password,
+    };
     // These writes went straight to the database, behind the app's back — bump the policy
     // counter ourselves so the cache doesn't keep serving a stale (empty) permission set.
     await permissionCacheStore.bump(POLICY_VERSION_KEY);
-    const login = await ctx.call("POST", "/auth/login", { body: { identifier: principal.email, password: principal.password } });
+    const login = await ctx.call("POST", "/auth/login", {
+      body: { identifier: principal.email, password: principal.password },
+    });
     const token = (login.body as AuthTokens).accessToken;
     ctx.assert(!!token, `the seeded admin can log in (got ${login.status})`);
     return {
       token,
       freshToken: renewingToken(async () => {
-        const res = await ctx.call("POST", "/auth/login", { body: adminCredentials! });
+        const res = await ctx.call("POST", "/auth/login", {
+          body: adminCredentials!,
+        });
         return (res.body as AuthTokens).accessToken;
       }),
     };
@@ -44,39 +75,91 @@ export const hooks: VariantHooks = {
     // Nothing to do: admin endpoints operate on the whole deployment.
   },
 
-  async proveVariantProperties(ctx: ProofContext, admin: AdminSession): Promise<void> {
-    const listed = await ctx.call("GET", "/auth/admin/users", { token: await admin.freshToken() });
-    ctx.assert(listed.status === 200, `admin can list every user in the deployment (got ${listed.status})`);
-    ctx.assert(Array.isArray(listed.body?.items) && listed.body.items.length > 0, "the user list is non-empty");
+  async proveVariantProperties(
+    ctx: ProofContext,
+    admin: AdminSession,
+  ): Promise<void> {
+    const listed = await ctx.call("GET", "/auth/admin/users", {
+      token: await admin.freshToken(),
+    });
+    ctx.assert(
+      listed.status === 200,
+      `admin can list every user in the deployment (got ${listed.status})`,
+    );
+    ctx.assert(
+      Array.isArray(listed.body?.items) && listed.body.items.length > 0,
+      "the user list is non-empty",
+    );
 
-    const workspaces = await ctx.call("GET", "/workspaces", { token: await admin.freshToken() });
-    ctx.assert(workspaces.status === 404, `no workspace endpoints exist in this variant (got ${workspaces.status})`);
+    const workspaces = await ctx.call("GET", "/workspaces", {
+      token: await admin.freshToken(),
+    });
+    ctx.assert(
+      workspaces.status === 404,
+      `no workspace endpoints exist in this variant (got ${workspaces.status})`,
+    );
 
-    const me = await ctx.call("GET", "/auth/me", { token: await admin.freshToken() });
-    ctx.assert(me.body?.roles?.includes("admin"), "roles are global: they apply to every request this user makes");
+    const me = await ctx.call("GET", "/auth/me", {
+      token: await admin.freshToken(),
+    });
+    ctx.assert(
+      me.body?.roles?.includes("admin"),
+      "roles are global: they apply to every request this user makes",
+    );
 
     // Authorization is not in the token, so a grant/revoke lands on the caller's next request.
     const email = ctx.uniqueEmail("immediate");
     const password = "immediate-pw-12345";
     const tokens = await ctx.signup(email, password);
-    const userId = (await ctx.call("GET", "/auth/me", { token: tokens.accessToken })).body.sub as string;
-
-    const beforeGrant = await ctx.call("GET", "/auth/admin/users", { token: tokens.accessToken });
-    ctx.assert(beforeGrant.status === 403, `a user with no grant is refused (got ${beforeGrant.status})`);
+    const userId = (
+      await ctx.call("GET", "/auth/me", { token: tokens.accessToken })
+    ).body.sub as string;
 
-    const granted = await ctx.call("POST", `/auth/admin/users/${userId}/permissions`, { token: await admin.freshToken(), body: { permission: "users:read" } });
-    ctx.assert(granted.status === 200 || granted.status === 201, `admin can grant a permission directly (got ${granted.status})`);
+    const beforeGrant = await ctx.call("GET", "/auth/admin/users", {
+      token: tokens.accessToken,
+    });
+    ctx.assert(
+      beforeGrant.status === 403,
+      `a user with no grant is refused (got ${beforeGrant.status})`,
+    );
 
-    const afterGrant = await ctx.call("GET", "/auth/admin/users", { token: tokens.accessToken });
-    ctx.assert(afterGrant.status === 200, `…and the grant is in effect on the very next request, on the token they already held (got ${afterGrant.status})`);
+    const granted = await ctx.call(
+      "POST",
+      `/auth/admin/users/${userId}/permissions`,
+      { token: await admin.freshToken(), body: { permission: "users:read" } },
+    );
+    ctx.assert(
+      granted.status === 200 || granted.status === 201,
+      `admin can grant a permission directly (got ${granted.status})`,
+    );
 
-    const revoked = await ctx.call("POST", `/auth/admin/users/${userId}/permissions/${encodeURIComponent("users:read")}/revoke`, {
-      token: await admin.freshToken(),
+    const afterGrant = await ctx.call("GET", "/auth/admin/users", {
+      token: tokens.accessToken,
     });
-    ctx.assert(revoked.status === 200 || revoked.status === 201, `admin can revoke the direct grant (got ${revoked.status})`);
+    ctx.assert(
+      afterGrant.status === 200,
+      `…and the grant is in effect on the very next request, on the token they already held (got ${afterGrant.status})`,
+    );
+
+    const revoked = await ctx.call(
+      "POST",
+      `/auth/admin/users/${userId}/permissions/${encodeURIComponent("users:read")}/revoke`,
+      {
+        token: await admin.freshToken(),
+      },
+    );
+    ctx.assert(
+      revoked.status === 200 || revoked.status === 201,
+      `admin can revoke the direct grant (got ${revoked.status})`,
+    );
 
-    const afterRevoke = await ctx.call("GET", "/auth/admin/users", { token: tokens.accessToken });
-    ctx.assert(afterRevoke.status === 403, `and the revocation lands on the very next request too, on the same token (got ${afterRevoke.status})`);
+    const afterRevoke = await ctx.call("GET", "/auth/admin/users", {
+      token: tokens.accessToken,
+    });
+    ctx.assert(
+      afterRevoke.status === 403,
+      `and the revocation lands on the very next request too, on the same token (got ${afterRevoke.status})`,
+    );
 
     await proveTheCacheIsReal(ctx, admin, tokens.accessToken);
     await proveARawDatabaseEditChangesEnforcement(ctx, admin);
@@ -85,7 +168,11 @@ export const hooks: VariantHooks = {
 
 // Reads the very store the app resolves through, so "the second request didn't touch the
 // database" is a measurement rather than a claim.
-async function proveTheCacheIsReal(ctx: ProofContext, admin: AdminSession, token: string): Promise<void> {
+async function proveTheCacheIsReal(
+  ctx: ProofContext,
+  admin: AdminSession,
+  token: string,
+): Promise<void> {
   const N = 8;
   await ctx.call("GET", "/auth/me", { token }); // warm, so the measurement is of the steady state
   const before = { ...permissionCacheStore.stats };
@@ -97,39 +184,81 @@ async function proveTheCacheIsReal(ctx: ProofContext, admin: AdminSession, token
     `${N} identical authorized requests resolve permissions 0 further times — all ${N} were cache hits (misses +${after.misses - before.misses}, hits +${after.hits - before.hits})`,
   );
 
-  const userId = (await ctx.call("GET", "/auth/me", { token })).body.sub as string;
+  const userId = (await ctx.call("GET", "/auth/me", { token })).body
+    .sub as string;
   const beforeGrant = { ...permissionCacheStore.stats };
-  await ctx.call("POST", `/auth/admin/users/${userId}/permissions`, { token: await admin.freshToken(), body: { permission: "probe:cache" } });
+  await ctx.call("POST", `/auth/admin/users/${userId}/permissions`, {
+    token: await admin.freshToken(),
+    body: { permission: "probe:cache" },
+  });
   const afterGrantCall = await ctx.call("GET", "/auth/me", { token });
   ctx.assert(
     permissionCacheStore.stats.misses > beforeGrant.misses,
     "a grant bumps this user's version counter, so the next request misses the cache and re-resolves rather than serving a stale entry",
   );
-  ctx.assert((afterGrantCall.body?.permissions ?? []).includes("probe:cache"), "…and the freshly resolved answer contains the new permission");
-  await ctx.call("POST", `/auth/admin/users/${userId}/permissions/${encodeURIComponent("probe:cache")}/revoke`, { token: await admin.freshToken() });
+  ctx.assert(
+    (afterGrantCall.body?.permissions ?? []).includes("probe:cache"),
+    "…and the freshly resolved answer contains the new permission",
+  );
+  await ctx.call(
+    "POST",
+    `/auth/admin/users/${userId}/permissions/${encodeURIComponent("probe:cache")}/revoke`,
+    { token: await admin.freshToken() },
+  );
 }
 
 // Writes the row directly rather than through the admin API, ruling out any in-memory side
 // channel — a `psql` session would look exactly like this.
-async function proveARawDatabaseEditChangesEnforcement(ctx: ProofContext, admin: AdminSession): Promise<void> {
+async function proveARawDatabaseEditChangesEnforcement(
+  ctx: ProofContext,
+  admin: AdminSession,
+): Promise<void> {
   const email = ctx.uniqueEmail("rawedit");
   const tokens = await ctx.signup(email, "rawedit-pw-12345");
-  const userId = (await ctx.call("GET", "/auth/me", { token: tokens.accessToken })).body.sub as string;
-  await ctx.call("POST", `/auth/admin/users/${userId}/permissions`, { token: await admin.freshToken(), body: { permission: "audit-log:read" } });
-  ctx.assert((await ctx.call("GET", "/auth/admin/audit-log", { token: tokens.accessToken })).status === 200, "a direct grant opens the audit log");
+  const userId = (
+    await ctx.call("GET", "/auth/me", { token: tokens.accessToken })
+  ).body.sub as string;
+  await ctx.call("POST", `/auth/admin/users/${userId}/permissions`, {
+    token: await admin.freshToken(),
+    body: { permission: "audit-log:read" },
+  });
+  ctx.assert(
+    (
+      await ctx.call("GET", "/auth/admin/audit-log", {
+        token: tokens.accessToken,
+      })
+    ).status === 200,
+    "a direct grant opens the audit log",
+  );
 
   // Written straight to the table, with no code change and no redeploy. The bump that follows is
   // the out-of-band writer's half of the cache contract (permission-cache.ts) — without it the
   // edit would still land, but only once the cached entry expired.
   // Written straight to the table; the bump is the out-of-band writer's half of the cache
   // contract (permission-cache.ts) — without it the edit would still land, only later.
-  await prisma.permission.update({ where: { slug: "audit-log:read" }, data: { isActive: false } });
+  await prisma.permission.update({
+    where: { slug: "audit-log:read" },
+    data: { isActive: false },
+  });
   await permissionCacheStore.bump(POLICY_VERSION_KEY);
-  const denied = await ctx.call("GET", "/auth/admin/audit-log", { token: tokens.accessToken });
-  ctx.assert(denied.status === 403, `a permission deactivated by a raw database write stops opening its route (got ${denied.status})`);
+  const denied = await ctx.call("GET", "/auth/admin/audit-log", {
+    token: tokens.accessToken,
+  });
+  ctx.assert(
+    denied.status === 403,
+    `a permission deactivated by a raw database write stops opening its route (got ${denied.status})`,
+  );
 
-  await prisma.permission.update({ where: { slug: "audit-log:read" }, data: { isActive: true } });
+  await prisma.permission.update({
+    where: { slug: "audit-log:read" },
+    data: { isActive: true },
+  });
   await permissionCacheStore.bump(POLICY_VERSION_KEY);
-  const restored = await ctx.call("GET", "/auth/admin/audit-log", { token: tokens.accessToken });
-  ctx.assert(restored.status === 200, `…and reactivating it in the database opens the route again (got ${restored.status})`);
+  const restored = await ctx.call("GET", "/auth/admin/audit-log", {
+    token: tokens.accessToken,
+  });
+  ctx.assert(
+    restored.status === 200,
+    `…and reactivating it in the database opens the route again (got ${restored.status})`,
+  );
 }

package/registry/combos/nestjs-prisma/variants/workspaces/src/auth.module.ts

@@ -1,11 +1,15 @@
 import { PrismaPg } from "@prisma/adapter-pg";
 import { DynamicModule, Module } from "@nestjs/common";
 import { APP_FILTER, APP_INTERCEPTOR } from "@nestjs/core";
-import { AbilityGuard } from "./guards/ability.guard.js";
+import { AbilityGuard } from "./ability/ability.guard.js";
 import { AdminController } from "./controllers/admin.controller.js";
 import { AuditLogRepository } from "./repositories/audit-log.repository.js";
 import { AuthCoreErrorFilter } from "./filters/auth-core-error.filter.js";
-import { AUTH_CONFIG, AuthConfig, defaultAuthConfig } from "./auth.config.js";
+import {
+  AUTH_CONFIG,
+  AuthConfig,
+  defaultAuthConfig,
+} from "./config/auth.config.js";
 import { AuthController } from "./controllers/auth.controller.js";
 import { AuthGuard } from "./guards/auth.guard.js";
 import { AuthService } from "./services/auth.service.js";
@@ -13,7 +17,7 @@ import { AuthzGuard, WorkspaceGuard } from "./guards/authz.guard.js";
 import { PrismaClient } from "./../generated/prisma/client.js";
 import { CountryRepository } from "./repositories/country.repository.js";
 import { CustomerRepository } from "./repositories/customer.repository.js";
-import { KeyProviderService } from "./key-provider.js";
+import { KeyProviderService } from "./config/key-provider.js";
 import { LanguageRepository } from "./repositories/language.repository.js";
 import { OAuthRepository } from "./repositories/oauth.repository.js";
 import { PasswordResetRepository } from "./repositories/password-reset.repository.js";
@@ -21,11 +25,11 @@ import {
   InMemoryPermissionCacheStore,
   PERMISSION_CACHE_STORE,
   PermissionCache,
-} from "./permission-cache.js";
+} from "./cache/permission-cache.js";
 import {
   InMemoryRateLimitStore,
   RATE_LIMIT_STORE,
-} from "./rate-limit.store.js";
+} from "./cache/rate-limit.store.js";
 import { RbacRepository } from "./repositories/rbac.repository.js";
 import { ResponseInterceptor } from "./interceptors/response.interceptor.js";
 import { assertEveryRouteDeclaresATier } from "./route-tiers.js";

package/registry/combos/nestjs-prisma/variants/workspaces/src/controllers/admin.controller.ts

@@ -25,7 +25,7 @@ import {
   ApiTags,
 } from "@nestjs/swagger";
 import type { Request } from "express";
-import { AbilityGuard } from "../guards/ability.guard.js";
+import { AbilityGuard } from "../ability/ability.guard.js";
 import { AuthGuard } from "../guards/auth.guard.js";
 import { AuthService } from "../services/auth.service.js";
 import { WORKSPACE_HEADER, WorkspaceGuard } from "../guards/authz.guard.js";

package/registry/combos/nestjs-prisma/variants/workspaces/src/controllers/workspace.controller.ts

@@ -22,7 +22,7 @@ import {
   ApiTags,
 } from "@nestjs/swagger";
 import type { Request } from "express";
-import { AbilityGuard } from "../guards/ability.guard.js";
+import { AbilityGuard } from "../ability/ability.guard.js";
 import { AuthGuard } from "../guards/auth.guard.js";
 import { WORKSPACE_HEADER, WorkspaceGuard } from "../guards/authz.guard.js";
 import { Authenticated, CheckAbility } from "../route-tiers.js";

package/registry/combos/nestjs-prisma/variants/workspaces/src/guards/authz.guard.ts

@@ -5,8 +5,8 @@ import {
   Inject,
   Injectable,
 } from "@nestjs/common";
-import { defineAbilitiesFor } from "../ability.js";
-import { PermissionCache } from "../permission-cache.js";
+import { defineAbilitiesFor } from "../ability/ability.js";
+import { PermissionCache } from "../cache/permission-cache.js";
 import {
   memberCacheKey,
   RbacRepository,

package/registry/combos/nestjs-prisma/variants/workspaces/src/index.ts

@@ -0,0 +1,9 @@
+export * from "./auth.module.js";
+
+export * from "./route-tiers.js";
+
+export * from "./guards/auth.guard.js";
+export * from "./guards/authz.guard.js";
+
+export * from "./ability/ability.js";
+export * from "./ability/ability.guard.js";

package/registry/combos/nestjs-prisma/variants/workspaces/src/repositories/audit-log.repository.ts

@@ -1,13 +1,13 @@
 import { Inject, Injectable } from "@nestjs/common";
 import type { AuditEvent } from "@/lib/auth/core/types.js";
 import { Prisma, PrismaClient } from "../../generated/prisma/client.js";
-import { toIdOrNull, toIdOrUndefined } from "../id.helper.js";
+import { toIdOrNull, toIdOrUndefined } from "../helpers/id.helper.js";
 import {
   buildPageMeta,
   normalizeLimit,
   normalizePage,
   type Paginated,
-} from "../pagination.js";
+} from "../helpers/pagination.js";
 
 export interface AuditLogEntry {
   id: string;

package/registry/combos/nestjs-prisma/variants/workspaces/src/repositories/country.repository.ts

@@ -5,13 +5,13 @@ import {
   NotFoundException,
 } from "@nestjs/common";
 import { Prisma, PrismaClient } from "../../generated/prisma/client.js";
-import { toId, toIdOrNull } from "../id.helper.js";
+import { toId, toIdOrNull } from "../helpers/id.helper.js";
 import {
   buildPageMeta,
   normalizeLimit,
   normalizePage,
   type Paginated,
-} from "../pagination.js";
+} from "../helpers/pagination.js";
 
 /** A `Country` row as `findUnique`/`findMany` return it. */
 export type CountryRow = Prisma.CountryGetPayload<object>;

package/registry/combos/nestjs-prisma/variants/workspaces/src/repositories/customer.repository.ts

@@ -5,13 +5,13 @@ import {
   NotFoundException,
 } from "@nestjs/common";
 import { Prisma, PrismaClient } from "../../generated/prisma/client.js";
-import { toId, toIdOrNull } from "../id.helper.js";
+import { toId, toIdOrNull } from "../helpers/id.helper.js";
 import {
   buildPageMeta,
   normalizeLimit,
   normalizePage,
   type Paginated,
-} from "../pagination.js";
+} from "../helpers/pagination.js";
 
 /** A `Customer` row as `findUnique`/`findMany` return it. */
 export type CustomerRow = Prisma.CustomerGetPayload<object>;
@@ -88,9 +88,10 @@ export interface CustomerInput {
   isActive?: boolean;
 }
 
-function toPrismaInput(
-  input: Partial<CustomerInput>,
-): Omit<Partial<CustomerInput>, "dob" | "joinedDate"> & {
+function toPrismaInput(input: Partial<CustomerInput>): Omit<
+  Partial<CustomerInput>,
+  "dob" | "joinedDate"
+> & {
   dob?: Date | null;
   joinedDate?: Date;
 } {

package/registry/combos/nestjs-prisma/variants/workspaces/src/repositories/language.repository.ts

@@ -5,13 +5,13 @@ import {
   NotFoundException,
 } from "@nestjs/common";
 import { Prisma, PrismaClient } from "../../generated/prisma/client.js";
-import { toId, toIdOrNull } from "../id.helper.js";
+import { toId, toIdOrNull } from "../helpers/id.helper.js";
 import {
   buildPageMeta,
   normalizeLimit,
   normalizePage,
   type Paginated,
-} from "../pagination.js";
+} from "../helpers/pagination.js";
 
 /** A `Language` row as `findUnique`/`findMany` return it. */
 export type LanguageRow = Prisma.LanguageGetPayload<object>;

package/registry/combos/nestjs-prisma/variants/workspaces/src/repositories/rbac.repository.ts

@@ -2,14 +2,14 @@ import { Inject, Injectable, NotFoundException } from "@nestjs/common";
 import { resolvePermissions } from "@/lib/auth/core/rbac.js";
 import { Prisma, PrismaClient } from "../../generated/prisma/client.js";
 import type { AuthzContext } from "../guards/authz.guard.js";
-import { PermissionCache } from "../permission-cache.js";
-import { toId, toIdOrNull } from "../id.helper.js";
+import { PermissionCache } from "../cache/permission-cache.js";
+import { toId, toIdOrNull } from "../helpers/id.helper.js";
 import {
   buildPageMeta,
   normalizeLimit,
   normalizePage,
   type Paginated,
-} from "../pagination.js";
+} from "../helpers/pagination.js";
 
 const MEMBER_INCLUDE = {
   user: true,

package/registry/combos/nestjs-prisma/variants/workspaces/src/repositories/workspace.repository.ts

@@ -10,7 +10,7 @@ import {
   WORKSPACE_CREATOR_ROLES,
 } from "../rbac.defaults.js";
 import { RbacRepository } from "./rbac.repository.js";
-import { toId } from "../id.helper.js";
+import { toId } from "../helpers/id.helper.js";
 
 export interface WorkspaceSummary {
   id: string;

package/registry/combos/nestjs-prisma/variants/workspaces/src/services/auth.service.ts

@@ -51,7 +51,7 @@ import {
   verifyTotpCode,
 } from "@/lib/auth/core/two-factor.js";
 import type { Revoker } from "@/lib/auth/core/types.js";
-import { AUTH_CONFIG, AuthConfig } from "../auth.config.js";
+import { AUTH_CONFIG, AuthConfig } from "../config/auth.config.js";
 import type { AuthzContext } from "../guards/authz.guard.js";
 import {
   AuditLogEntry,
@@ -59,12 +59,12 @@ import {
   AuditLogRepository,
   toAuditLogEntry,
 } from "../repositories/audit-log.repository.js";
-import type { Paginated } from "../pagination.js";
+import type { Paginated } from "../helpers/pagination.js";
 import { PrismaClient } from "../../generated/prisma/client.js";
-import { KeyProviderService } from "../key-provider.js";
+import { KeyProviderService } from "../config/key-provider.js";
 import { OAuthRepository } from "../repositories/oauth.repository.js";
 import { PasswordResetRepository } from "../repositories/password-reset.repository.js";
-import { RATE_LIMIT_STORE } from "../rate-limit.store.js";
+import { RATE_LIMIT_STORE } from "../cache/rate-limit.store.js";
 import {
   MemberListFilter,
   MemberListResult,
@@ -77,7 +77,7 @@ import {
 } from "../repositories/rbac.repository.js";
 import { SessionRepository } from "../repositories/session.repository.js";
 import { TwoFactorRepository } from "../repositories/two-factor.repository.js";
-import { toId, toIdOrNull } from "../id.helper.js";
+import { toId, toIdOrNull } from "../helpers/id.helper.js";
 
 export interface AuthTokens {
   accessToken: string;
@@ -476,9 +476,7 @@ export class AuthService {
     return { twoFactorEnabled: user.twoFactorEnabled };
   }
 
-  async listActiveSessions(
-    userId: string,
-  ): Promise<
+  async listActiveSessions(userId: string): Promise<
     Array<{
       id: string;
       createdAt: string;