@simple-auth-kit/cli 1.5.0 → 1.6.1

package/registry/combos/express-drizzle/variants/base/src/rbac.defaults.ts

@@ -22,7 +22,7 @@
 // Callers: `src/seed.ts` (`npm run seed`, the only bootstrap in this variant) and
 // `variants/base/test/variant-hooks.ts`.
 import { inArray } from "drizzle-orm";
-import type { Database } from "./db.js";
+import type { Database } from "./config/db.js";
 import { permissionRole, permissions, roles } from "./schema.js";
 
 /** The display metadata a seeded permission carries. `group`/`order` exist so an admin console can render a stable matrix. */
@@ -44,40 +44,65 @@ export interface PermissionSeed {
  * evaluate.
  */
 export const PERMISSION_CATALOG = {
-  "users:read": { displayName: "List users", description: "GET /auth/admin/users", group: "Users", order: 1 },
-  "users:block": { displayName: "Block and unblock users", description: "POST /auth/admin/users/:userId/block, .../unblock", group: "Users", order: 2 },
+  "users:read": {
+    displayName: "List users",
+    description: "GET /auth/admin/users",
+    group: "Users",
+    order: 1,
+  },
+  "users:block": {
+    displayName: "Block and unblock users",
+    description: "POST /auth/admin/users/:userId/block, .../unblock",
+    group: "Users",
+    order: 2,
+  },
   "users:manage": {
     displayName: "Edit and delete users",
-    description: "Edit a user's profile or delete their account — PATCH /auth/admin/users/:userId, DELETE /auth/admin/users/:userId",
+    description:
+      "Edit a user's profile or delete their account — PATCH /auth/admin/users/:userId, DELETE /auth/admin/users/:userId",
     group: "Users",
     order: 3,
   },
   "roles:manage": {
     displayName: "Define roles",
-    description: "Create, edit, or delete roles and say what they carry — POST/PATCH/DELETE /auth/admin/roles(/:roleId), POST /auth/admin/roles/:roleId/permissions",
+    description:
+      "Create, edit, or delete roles and say what they carry — POST/PATCH/DELETE /auth/admin/roles(/:roleId), POST /auth/admin/roles/:roleId/permissions",
     group: "Roles",
     order: 1,
   },
   "roles:assign": {
     displayName: "Assign roles",
-    description: "Assign and revoke a user's roles — POST /auth/admin/users/:userId/roles, .../roles/:roleSlug/revoke",
+    description:
+      "Assign and revoke a user's roles — POST /auth/admin/users/:userId/roles, .../roles/:roleSlug/revoke",
     group: "Roles",
     order: 2,
   },
-  "permissions:read": { displayName: "Read the permission catalog", description: "GET /auth/admin/permissions", group: "Permissions", order: 1 },
+  "permissions:read": {
+    displayName: "Read the permission catalog",
+    description: "GET /auth/admin/permissions",
+    group: "Permissions",
+    order: 1,
+  },
   "permissions:define": {
     displayName: "Define permissions",
-    description: "Create a permission, rename it, or deactivate it — POST /auth/admin/permissions. The authority that defines all the others.",
+    description:
+      "Create a permission, rename it, or deactivate it — POST /auth/admin/permissions. The authority that defines all the others.",
     group: "Permissions",
     order: 2,
   },
   "permissions:grant": {
     displayName: "Grant permissions directly",
-    description: "Grant and revoke a permission straight to a user, bypassing roles — POST /auth/admin/users/:userId/permissions, .../permissions/:slug/revoke",
+    description:
+      "Grant and revoke a permission straight to a user, bypassing roles — POST /auth/admin/users/:userId/permissions, .../permissions/:slug/revoke",
     group: "Permissions",
     order: 3,
   },
-  "audit-log:read": { displayName: "Read the audit log", description: "GET /auth/admin/audit-log", group: "Audit", order: 1 },
+  "audit-log:read": {
+    displayName: "Read the audit log",
+    description: "GET /auth/admin/audit-log",
+    group: "Audit",
+    order: 1,
+  },
 } as const satisfies Record<string, PermissionSeed>;
 
 /**
@@ -89,10 +114,14 @@ export const PERMISSION_CATALOG = {
  */
 export type PermissionSlug = keyof typeof PERMISSION_CATALOG;
 
-export const PERMISSION_SLUGS = Object.keys(PERMISSION_CATALOG) as PermissionSlug[];
+export const PERMISSION_SLUGS = Object.keys(
+  PERMISSION_CATALOG,
+) as PermissionSlug[];
 
 /** Groups, in the order an admin console should render them. Derived from the catalog so it cannot drift from it. */
-export const PERMISSION_GROUP_ORDER: string[] = [...new Set(PERMISSION_SLUGS.map((slug) => PERMISSION_CATALOG[slug].group))];
+export const PERMISSION_GROUP_ORDER: string[] = [
+  ...new Set(PERMISSION_SLUGS.map((slug) => PERMISSION_CATALOG[slug].group)),
+];
 
 /** The display metadata a seeded role carries, plus what it starts out granting. */
 export interface RoleSeed {
@@ -127,7 +156,8 @@ export const DEFAULT_ROLES: readonly RoleSeed[] = [
   {
     slug: "superadmin",
     displayName: "Super Admin",
-    description: "Carries every permission in the catalog — same authority as admin, held by the seeded super_admin account (see SEED_SUPERADMIN_* in seed.ts).",
+    description:
+      "Carries every permission in the catalog — same authority as admin, held by the seeded super_admin account (see SEED_SUPERADMIN_* in seed.ts).",
     isDefault: false,
     order: 1,
     permissions: PERMISSION_SLUGS,
@@ -177,12 +207,17 @@ export async function provisionDefaultRoles(db: RbacWriter): Promise<void> {
         displayName: PERMISSION_CATALOG[slug].displayName,
         description: PERMISSION_CATALOG[slug].description,
         group: PERMISSION_CATALOG[slug].group,
-        groupOrder: PERMISSION_GROUP_ORDER.indexOf(PERMISSION_CATALOG[slug].group),
+        groupOrder: PERMISSION_GROUP_ORDER.indexOf(
+          PERMISSION_CATALOG[slug].group,
+        ),
         order: PERMISSION_CATALOG[slug].order,
       })),
     )
     .onConflictDoNothing({ target: permissions.slug });
-  const permissionRows = await db.select({ id: permissions.id, slug: permissions.slug }).from(permissions).where(inArray(permissions.slug, PERMISSION_SLUGS));
+  const permissionRows = await db
+    .select({ id: permissions.id, slug: permissions.slug })
+    .from(permissions)
+    .where(inArray(permissions.slug, PERMISSION_SLUGS));
   const permissionId = new Map(permissionRows.map((p) => [p.slug, p.id]));
 
   await db
@@ -210,9 +245,17 @@ export async function provisionDefaultRoles(db: RbacWriter): Promise<void> {
   const seedBySlug = new Map(DEFAULT_ROLES.map((role) => [role.slug, role]));
 
   const pairs = roleRows.flatMap((role) =>
-    (seedBySlug.get(role.slug)?.permissions ?? []).map((slug) => ({ roleId: role.id, permissionId: permissionId.get(slug)! })),
+    (seedBySlug.get(role.slug)?.permissions ?? []).map((slug) => ({
+      roleId: role.id,
+      permissionId: permissionId.get(slug)!,
+    })),
   );
   if (pairs.length) {
-    await db.insert(permissionRole).values(pairs).onConflictDoNothing({ target: [permissionRole.permissionId, permissionRole.roleId] });
+    await db
+      .insert(permissionRole)
+      .values(pairs)
+      .onConflictDoNothing({
+        target: [permissionRole.permissionId, permissionRole.roleId],
+      });
   }
 }

package/registry/combos/express-drizzle/variants/base/src/repositories/audit-log.repository.ts

@@ -6,9 +6,9 @@ import {
   normalizeLimit,
   normalizePage,
   type Paginated,
-} from "../pagination.js";
+} from "../helpers/pagination.js";
 import * as schema from "../schema.js";
-import { toIdOrNull, toIdOrUndefined } from "../id.helper.js";
+import { toIdOrNull, toIdOrUndefined } from "../helpers/id.helper.js";
 
 export interface AuditLogEntry {
   id: string;

package/registry/combos/express-drizzle/variants/base/src/repositories/rbac.repository.ts

@@ -9,14 +9,14 @@ import {
   type SQL,
 } from "drizzle-orm";
 import { resolvePermissions } from "@/lib/auth/core/rbac.js";
-import type { Database } from "../db.js";
+import type { Database } from "../config/db.js";
 import {
   buildPageMeta,
   normalizeLimit,
   normalizePage,
   type Paginated,
-} from "../pagination.js";
-import { PermissionCache } from "../permission-cache.js";
+} from "../helpers/pagination.js";
+import { PermissionCache } from "../cache/permission-cache.js";
 import {
   permissionRole,
   permissionUser,
@@ -25,8 +25,8 @@ import {
   roles,
   users,
 } from "../schema.js";
-import { HttpError } from "../http-error.js";
-import { toId, toIdOrNull } from "../id.helper.js";
+import { HttpError } from "../errors/http-error.js";
+import { toId, toIdOrNull } from "../helpers/id.helper.js";
 
 /**
  * Every column the `users` table has, except the two secrets (`passwordHash`, `twoFactorSecret`

package/registry/combos/express-drizzle/variants/base/src/routers/admin.router.ts

@@ -1,6 +1,6 @@
 import type { NextFunction, Request, RequestHandler, Response } from "express";
 import { AuthService } from "../services/auth.service.js";
-import { HttpError } from "../http-error.js";
+import { HttpError } from "../errors/http-error.js";
 import {
   ability,
   createTieredRouter,
@@ -54,15 +54,13 @@ export function createAdminRouter(deps: AdminRouterDeps): RequestHandler {
           string,
           string | undefined
         >;
-        res
-          .status(200)
-          .json(
-            await auth.listUsers({
-              search,
-              page: page ? Number(page) : undefined,
-              limit: limit ? Number(limit) : undefined,
-            }),
-          );
+        res.status(200).json(
+          await auth.listUsers({
+            search,
+            page: page ? Number(page) : undefined,
+            limit: limit ? Number(limit) : undefined,
+          }),
+        );
       } catch (err) {
         next(err);
       }
@@ -179,18 +177,16 @@ export function createAdminRouter(deps: AdminRouterDeps): RequestHandler {
       try {
         const { userId, action, since, until, page, limit } =
           req.query as Record<string, string | undefined>;
-        res
-          .status(200)
-          .json(
-            await auth.listAuditLog({
-              userId,
-              action,
-              since,
-              until,
-              page: page ? Number(page) : undefined,
-              limit: limit ? Number(limit) : undefined,
-            }),
-          );
+        res.status(200).json(
+          await auth.listAuditLog({
+            userId,
+            action,
+            since,
+            until,
+            page: page ? Number(page) : undefined,
+            limit: limit ? Number(limit) : undefined,
+          }),
+        );
       } catch (err) {
         next(err);
       }

package/registry/combos/express-drizzle/variants/base/src/seed.ts

@@ -24,14 +24,23 @@ import { eq, inArray, notInArray } from "drizzle-orm";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { Pool } from "pg";
 import { hashPassword } from "@/lib/auth/core/crypto.js";
-import type { Database } from "./db.js";
-import { DEFAULT_ROLES, PERMISSION_SLUGS, SEED_ADMIN_ROLES, SEED_SUPERADMIN_ROLES, provisionDefaultRoles } from "./rbac.defaults.js";
+import type { Database } from "./config/db.js";
+import {
+  DEFAULT_ROLES,
+  PERMISSION_SLUGS,
+  SEED_ADMIN_ROLES,
+  SEED_SUPERADMIN_ROLES,
+  provisionDefaultRoles,
+} from "./rbac.defaults.js";
 import * as schema from "./schema.js";
 import { permissions, roleUser, roles, users } from "./schema.js";
 
 function requireEnv(name: string): string {
   const value = process.env[name];
-  if (!value) throw new Error(`${name} is not set — the seeder cannot reach the database without it`);
+  if (!value)
+    throw new Error(
+      `${name} is not set — the seeder cannot reach the database without it`,
+    );
   return value;
 }
 
@@ -39,7 +48,10 @@ function requireEnv(name: string): string {
 async function seedRbacDefaults(db: Database): Promise<void> {
   await provisionDefaultRoles(db);
   console.log(`permissions: ${PERMISSION_SLUGS.length} slug(s) in the catalog`);
-  for (const role of DEFAULT_ROLES) console.log(`role "${role.slug}": ${role.permissions.length} permission(s)${role.isDefault ? " (signup default)" : ""}`);
+  for (const role of DEFAULT_ROLES)
+    console.log(
+      `role "${role.slug}": ${role.permissions.length} permission(s)${role.isDefault ? " (signup default)" : ""}`,
+    );
 
   // Slugs that exist in the database but not in this build's catalog. They are not an error —
   // `POST /auth/admin/permissions` exists so a deployment can define its own, and a grant can
@@ -49,9 +61,18 @@ async function seedRbacDefaults(db: Database): Promise<void> {
     .select({ slug: permissions.slug })
     .from(permissions)
     .where(notInArray(permissions.slug, PERMISSION_SLUGS));
-  if (unknown.length) console.log(`permissions: ${unknown.length} slug(s) outside this build's catalog (no route names them): ${unknown.map((r) => r.slug).join(", ")}`);
-  const inactive = await db.select({ slug: permissions.slug }).from(permissions).where(eq(permissions.isActive, false));
-  if (inactive.length) console.log(`permissions: ${inactive.length} deactivated, granting nothing: ${inactive.map((r) => r.slug).join(", ")}`);
+  if (unknown.length)
+    console.log(
+      `permissions: ${unknown.length} slug(s) outside this build's catalog (no route names them): ${unknown.map((r) => r.slug).join(", ")}`,
+    );
+  const inactive = await db
+    .select({ slug: permissions.slug })
+    .from(permissions)
+    .where(eq(permissions.isActive, false));
+  if (inactive.length)
+    console.log(
+      `permissions: ${inactive.length} deactivated, granting nothing: ${inactive.map((r) => r.slug).join(", ")}`,
+    );
 }
 
 /** Roles are global here, so administrative authority is a property of the user row itself. */
@@ -59,15 +80,32 @@ async function seedAdminUser(db: Database): Promise<void> {
   const email = process.env["SEED_ADMIN_EMAIL"];
   const password = process.env["SEED_ADMIN_PASSWORD"];
   if (!email || !password) {
-    console.log("admin: skipped — set SEED_ADMIN_EMAIL and SEED_ADMIN_PASSWORD to create one (there is no default password)");
+    console.log(
+      "admin: skipped — set SEED_ADMIN_EMAIL and SEED_ADMIN_PASSWORD to create one (there is no default password)",
+    );
     return;
   }
 
   // Their password may have been changed since; rewriting it here would silently reset it.
-  const [existing] = await db.select({ id: users.id }).from(users).where(eq(users.email, email)).limit(1);
+  const [existing] = await db
+    .select({ id: users.id })
+    .from(users)
+    .where(eq(users.email, email))
+    .limit(1);
   // Hashed by the same function signup uses, so the seeded admin can actually log in.
-  const user = existing ?? (await db.insert(users).values({ email, passwordHash: await hashPassword(password) }).returning({ id: users.id }))[0];
-  console.log(existing ? `admin: ${email} already exists — password left unchanged` : `admin: created ${email}`);
+  const user =
+    existing ??
+    (
+      await db
+        .insert(users)
+        .values({ email, passwordHash: await hashPassword(password) })
+        .returning({ id: users.id })
+    )[0];
+  console.log(
+    existing
+      ? `admin: ${email} already exists — password left unchanged`
+      : `admin: created ${email}`,
+  );
 
   const adminRoles = await db
     .select({ id: roles.id, slug: roles.slug })
@@ -87,16 +125,33 @@ async function seedSuperAdminUser(db: Database): Promise<void> {
   const email = process.env["SEED_SUPERADMIN_EMAIL"];
   const password = process.env["SEED_SUPERADMIN_PASSWORD"];
   if (!email || !password) {
-    console.log("super admin: skipped — set SEED_SUPERADMIN_EMAIL and SEED_SUPERADMIN_PASSWORD to create one (there is no default password)");
+    console.log(
+      "super admin: skipped — set SEED_SUPERADMIN_EMAIL and SEED_SUPERADMIN_PASSWORD to create one (there is no default password)",
+    );
     return;
   }
   const username = process.env["SEED_SUPERADMIN_USERNAME"] || undefined;
 
   // Their password may have been changed since; rewriting it here would silently reset it.
-  const [existing] = await db.select({ id: users.id }).from(users).where(eq(users.email, email)).limit(1);
+  const [existing] = await db
+    .select({ id: users.id })
+    .from(users)
+    .where(eq(users.email, email))
+    .limit(1);
   // Hashed by the same function signup uses, so the seeded super admin can actually log in.
-  const user = existing ?? (await db.insert(users).values({ email, username, passwordHash: await hashPassword(password) }).returning({ id: users.id }))[0];
-  console.log(existing ? `super admin: ${email} already exists — password left unchanged` : `super admin: created ${email}${username ? ` (username ${username})` : ""}`);
+  const user =
+    existing ??
+    (
+      await db
+        .insert(users)
+        .values({ email, username, passwordHash: await hashPassword(password) })
+        .returning({ id: users.id })
+    )[0];
+  console.log(
+    existing
+      ? `super admin: ${email} already exists — password left unchanged`
+      : `super admin: created ${email}${username ? ` (username ${username})` : ""}`,
+  );
 
   const superAdminRoles = await db
     .select({ id: roles.id, slug: roles.slug })
@@ -105,10 +160,14 @@ async function seedSuperAdminUser(db: Database): Promise<void> {
   if (superAdminRoles.length) {
     await db
       .insert(roleUser)
-      .values(superAdminRoles.map((role) => ({ userId: user.id, roleId: role.id })))
+      .values(
+        superAdminRoles.map((role) => ({ userId: user.id, roleId: role.id })),
+      )
       .onConflictDoNothing({ target: [roleUser.userId, roleUser.roleId] });
   }
-  console.log(`super admin: holds roles ${superAdminRoles.map((r) => r.slug).join(", ")}`);
+  console.log(
+    `super admin: holds roles ${superAdminRoles.map((r) => r.slug).join(", ")}`,
+  );
 }
 
 async function main(): Promise<void> {

package/registry/combos/express-drizzle/variants/base/src/services/auth.service.ts

@@ -42,17 +42,17 @@ import {
   generateTotpSecret,
   verifyTotpCode,
 } from "@/lib/auth/core/two-factor.js";
-import type { AuthConfig } from "../auth.config.js";
-import { HttpError } from "../http-error.js";
+import type { AuthConfig } from "../config/auth.config.js";
+import { HttpError } from "../errors/http-error.js";
 import {
   AuditLogEntry,
   AuditLogListFilter,
   AuditLogRepository,
   toAuditLogEntry,
 } from "../repositories/audit-log.repository.js";
-import type { Paginated } from "../pagination.js";
-import type { Database } from "../db.js";
-import { KeyProviderService } from "../key-provider.js";
+import type { Paginated } from "../helpers/pagination.js";
+import type { Database } from "../config/db.js";
+import { KeyProviderService } from "../config/key-provider.js";
 import { OAuthRepository } from "../repositories/oauth.repository.js";
 import { PasswordResetRepository } from "../repositories/password-reset.repository.js";
 import type { Revoker } from "@/lib/auth/core/types.js";
@@ -69,7 +69,7 @@ import {
 import { sessions, users } from "../schema.js";
 import { SessionRepository } from "../repositories/session.repository.js";
 import { TwoFactorRepository } from "../repositories/two-factor.repository.js";
-import { toId, toIdOrNull } from "../id.helper.js";
+import { toId, toIdOrNull } from "../helpers/id.helper.js";
 
 export interface AuthTokens {
   accessToken: string;
@@ -472,9 +472,7 @@ export class AuthService {
     return { twoFactorEnabled: user.twoFactorEnabled };
   }
 
-  async listActiveSessions(
-    userId: string,
-  ): Promise<
+  async listActiveSessions(userId: string): Promise<
     Array<{
       id: string;
       createdAt: string;