@simple-auth-kit/cli 1.5.1 → 1.6.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@simple-auth-kit/cli",
-  "version": "1.5.1",
+  "version": "1.6.1",
   "license": "MIT",
   "description": "simple-auth-kit add <combo> — copies registry source (backend combos, admin consoles, mobile apps) into a consumer repo, shadcn-CLI-style. Nothing is ever installed as a runtime dependency of the consumer.",
   "bin": {

package/registry/combos/express-drizzle/shared/src/{ability.ts → ability/ability.ts}

@@ -17,7 +17,11 @@
 // database, no `(action, subject)` pairing to get wrong, and no conditions — which in turn means
 // there is no such thing as a rule the route guard can only *partially* evaluate. What a slug
 // means is decided entirely by which routes name it.
-import { AbilityBuilder, createMongoAbility, type MongoAbility } from "@casl/ability";
+import {
+  AbilityBuilder,
+  createMongoAbility,
+  type MongoAbility,
+} from "@casl/ability";
 
 /**
  * The subject every rule is written against. CASL needs one; this model does not use subjects, so
@@ -37,7 +41,9 @@ export type AppAbility = MongoAbility<[string, typeof ABILITY_SUBJECT]>;
  * answer for "we could not resolve any permissions", and the same answer as "this user genuinely
  * has none". There is no default-allow branch anywhere in this file.
  */
-export function defineAbilitiesFor(permissions: readonly string[] = []): AppAbility {
+export function defineAbilitiesFor(
+  permissions: readonly string[] = [],
+): AppAbility {
   const { can, build } = new AbilityBuilder<AppAbility>(createMongoAbility);
   for (const permission of permissions) can(permission, ABILITY_SUBJECT);
   return build();

package/registry/combos/express-drizzle/shared/src/{permission-cache.ts → cache/permission-cache.ts}

@@ -35,7 +35,7 @@
 // reads this cache — so blocking a user or revoking a session cannot be defeated by a warm entry.
 // Negative results are not cached either: "not a member of this workspace" is re-read every time,
 // so being added to a workspace is effective immediately rather than after a TTL.
-import type { AuthConfig } from "./auth.config.js";
+import type { AuthConfig } from "../config/auth.config.js";
 
 /** Every key this library writes starts here, so a shared Redis can be separated by prefix. */
 export const CACHE_NAMESPACE = "simpleauthkit:authz";
@@ -66,7 +66,10 @@ export interface PermissionCacheStore {
  */
 export class InMemoryPermissionCacheStore implements PermissionCacheStore {
   readonly stats = { hits: 0, misses: 0, writes: 0 };
-  private readonly entries = new Map<string, { value: string; expiresAt: number }>();
+  private readonly entries = new Map<
+    string,
+    { value: string; expiresAt: number }
+  >();
 
   async get(key: string): Promise<string | undefined> {
     const entry = this.entries.get(key);
@@ -99,10 +102,14 @@ export class InMemoryPermissionCacheStore implements PermissionCacheStore {
 
   async bump(key: string): Promise<number> {
     const entry = this.entries.get(key);
-    const next = Number(entry && entry.expiresAt > Date.now() ? entry.value : 0) + 1;
+    const next =
+      Number(entry && entry.expiresAt > Date.now() ? entry.value : 0) + 1;
     // Version counters outlive entries on purpose: a counter that expired back to 0 would make
     // every superseded entry reachable again.
-    this.entries.set(key, { value: String(next), expiresAt: Number.MAX_SAFE_INTEGER });
+    this.entries.set(key, {
+      value: String(next),
+      expiresAt: Number.MAX_SAFE_INTEGER,
+    });
     return next;
   }
 }
@@ -114,8 +121,10 @@ export class InMemoryPermissionCacheStore implements PermissionCacheStore {
  * write is picked up when the entry expires (`permissionCacheTtlSeconds`), not immediately.
  */
 export const POLICY_VERSION_KEY = `${CACHE_NAMESPACE}:policy-version`;
-export const subjectVersionKey = (subject: string) => `${CACHE_NAMESPACE}:subject-version:${subject}`;
-const entryKey = (subject: string, policy: string, subjectVersion: string) => `${CACHE_NAMESPACE}:entry:${subject}:p${policy}:s${subjectVersion}`;
+export const subjectVersionKey = (subject: string) =>
+  `${CACHE_NAMESPACE}:subject-version:${subject}`;
+const entryKey = (subject: string, policy: string, subjectVersion: string) =>
+  `${CACHE_NAMESPACE}:entry:${subject}:p${policy}:s${subjectVersion}`;
 
 /**
  * Reads through to the database, once per (principal, policy version, subject version).
@@ -144,11 +153,17 @@ export class PermissionCache {
    * @param subject the identity these permissions belong to — the cache key's principal
    * @param load    resolves from the database on a miss. Returning `null` is not cached.
    */
-  async resolve<T>(subject: string, load: () => Promise<T | null>): Promise<T | null> {
+  async resolve<T>(
+    subject: string,
+    load: () => Promise<T | null>,
+  ): Promise<T | null> {
     const ttl = this.config.permissionCacheTtlSeconds;
     if (ttl <= 0) return load(); // caching off; the semantics are identical, only the cost differs
 
-    const [policy = "0", version = "0"] = await this.store.getMany([POLICY_VERSION_KEY, subjectVersionKey(subject)]);
+    const [policy = "0", version = "0"] = await this.store.getMany([
+      POLICY_VERSION_KEY,
+      subjectVersionKey(subject),
+    ]);
     const key = entryKey(subject, policy, version);
 
     const cached = await this.store.get(key);
@@ -160,7 +175,8 @@ export class PermissionCache {
     const pending = (async () => {
       const resolved = await load();
       // A negative result is not written: see the module comment. Only a real answer is cached.
-      if (resolved !== null) await this.store.set(key, JSON.stringify(resolved), ttl);
+      if (resolved !== null)
+        await this.store.set(key, JSON.stringify(resolved), ttl);
       return resolved;
     })();
 

package/registry/combos/express-drizzle/shared/src/{rate-limit.store.ts → cache/rate-limit.store.ts}

@@ -9,7 +9,10 @@ import type { RateLimitDeps } from "@/lib/auth/core/rate-limit.js";
  * constructed directly instead of registered as an injectable provider.
  */
 export class InMemoryRateLimitStore implements RateLimitDeps {
-  private readonly windows = new Map<string, { count: number; resetAt: number }>();
+  private readonly windows = new Map<
+    string,
+    { count: number; resetAt: number }
+  >();
 
   async increment(key: string, windowMs: number): Promise<number> {
     const now = Date.now();

package/registry/combos/{express-prisma/shared/src → express-drizzle/shared/src/config}/auth.config.ts

@@ -1,5 +1,5 @@
 import type { RateLimitDeps } from "@/lib/auth/core/rate-limit.js";
-import type { PermissionCacheStore } from "./permission-cache.js";
+import type { PermissionCacheStore } from "../cache/permission-cache.js";
 
 export interface GoogleOAuthCredentials {
   clientId: string;

package/registry/combos/express-drizzle/shared/src/{db.ts → config/db.ts}

@@ -7,6 +7,6 @@
 // Express has no DI container, so `createAuthApp` (see create-auth-app.ts) just builds the
 // database and passes it to each class's constructor directly.
 import type { NodePgDatabase } from "drizzle-orm/node-postgres";
-import type * as schema from "./schema.js";
+import type * as schema from "../schema.js";
 
 export type Database = NodePgDatabase<typeof schema>;

package/registry/combos/express-drizzle/shared/src/{key-provider.ts → config/key-provider.ts}

@@ -9,11 +9,15 @@ const MIN_SECRET_BYTES = 32; // 256 bits, HS256's own minimum
 function loadSecret(): Uint8Array {
   const raw = process.env[ENV_VAR];
   if (!raw) {
-    throw new Error(`${ENV_VAR} is not set. Generate one and set it before starting the app — e.g.: openssl rand -base64 32`);
+    throw new Error(
+      `${ENV_VAR} is not set. Generate one and set it before starting the app — e.g.: openssl rand -base64 32`,
+    );
   }
   const secret = Buffer.from(raw, "base64");
   if (secret.length < MIN_SECRET_BYTES) {
-    throw new Error(`${ENV_VAR} decodes to ${secret.length} bytes — needs at least ${MIN_SECRET_BYTES} (256 bits) for HS256.`);
+    throw new Error(
+      `${ENV_VAR} decodes to ${secret.length} bytes — needs at least ${MIN_SECRET_BYTES} (256 bits) for HS256.`,
+    );
   }
   return secret;
 }

package/registry/combos/express-drizzle/shared/src/{id.helper.ts → helpers/id.helper.ts}

@@ -11,12 +11,16 @@ export function toId(value: string | number | bigint): bigint {
   }
 }
 
-export function toIdOrUndefined(value: string | number | bigint | null | undefined): bigint | undefined {
+export function toIdOrUndefined(
+  value: string | number | bigint | null | undefined,
+): bigint | undefined {
   if (value === null || value === undefined || value === "") return undefined;
   return toId(value);
 }
 
-export function toIdOrNull(value: string | number | bigint | null | undefined): bigint | null {
+export function toIdOrNull(
+  value: string | number | bigint | null | undefined,
+): bigint | null {
   if (value === null || value === undefined || value === "") return null;
   return toId(value);
 }

package/registry/combos/{nestjs-drizzle/shared/src → express-drizzle/shared/src/helpers}/pagination.ts

@@ -21,10 +21,24 @@ export function normalizePage(page: number | undefined): number {
 }
 
 export function normalizeLimit(limit: number | undefined): number {
-  return Math.min(limit && limit > 0 ? Math.floor(limit) : DEFAULT_PAGE_SIZE, MAX_PAGE_SIZE);
+  return Math.min(
+    limit && limit > 0 ? Math.floor(limit) : DEFAULT_PAGE_SIZE,
+    MAX_PAGE_SIZE,
+  );
 }
 
-export function buildPageMeta(page: number, limit: number, total: number): PageMeta {
+export function buildPageMeta(
+  page: number,
+  limit: number,
+  total: number,
+): PageMeta {
   const pageCount = Math.ceil(total / limit);
-  return { page, limit, total, pageCount, hasPreviousPage: page > 1, hasNextPage: page < pageCount };
+  return {
+    page,
+    limit,
+    total,
+    pageCount,
+    hasPreviousPage: page > 1,
+    hasNextPage: page < pageCount,
+  };
 }

package/registry/combos/express-drizzle/shared/src/middleware/auth-core-error.middleware.ts

@@ -1,6 +1,6 @@
 import type { NextFunction, Request, Response } from "express";
 import { AuthCoreError } from "@/lib/auth/core/types.js";
-import { HttpError } from "../http-error.js";
+import { HttpError } from "../errors/http-error.js";
 
 /**
  * Replaces the reference combo's `AuthCoreErrorFilter` (a Nest global `@Catch` exception
@@ -30,13 +30,11 @@ export function authCoreErrorMiddleware(
   }
 
   if (err instanceof HttpError) {
-    res
-      .status(err.statusCode)
-      .json({
-        statusCode: err.statusCode,
-        code: err.name,
-        message: err.message,
-      });
+    res.status(err.statusCode).json({
+      statusCode: err.statusCode,
+      code: err.name,
+      message: err.message,
+    });
     return;
   }
 

package/registry/combos/express-drizzle/shared/src/middleware/auth.middleware.ts

@@ -1,6 +1,6 @@
 import type { NextFunction, Request, Response } from "express";
 import { verifyAccessToken } from "@/lib/auth/core/token-service.js";
-import { KeyProviderService } from "../key-provider.js";
+import { KeyProviderService } from "../config/key-provider.js";
 import "../request-context.js";
 import { SessionRepository } from "../repositories/session.repository.js";
 
@@ -24,13 +24,11 @@ export function createAuthMiddleware(
   ): Promise<void> {
     const header = req.headers["authorization"];
     if (!header?.startsWith("Bearer ")) {
-      res
-        .status(401)
-        .json({
-          statusCode: 401,
-          code: "UNAUTHORIZED",
-          message: "missing bearer token",
-        });
+      res.status(401).json({
+        statusCode: 401,
+        code: "UNAUTHORIZED",
+        message: "missing bearer token",
+      });
       return;
     }
 

package/registry/combos/{express-prisma/shared/src → express-drizzle/shared/src/openapi}/openapi-fragment.ts

@@ -4,7 +4,7 @@
 // routes plus the fragment `openapi-admin.ts` contributes, and both of those import from here,
 // so nothing imports in a circle. (`rbac.defaults.ts` below is a leaf too — it imports only a
 // Prisma type — so naming the permission catalog here keeps that property.)
-import type { PermissionSlug } from "./rbac.defaults.js";
+import type { PermissionSlug } from "../rbac.defaults.js";
 
 /** One module's contribution to the assembled OpenAPI document — see openapi-spec.ts. */
 export interface OpenApiFragment {
@@ -23,7 +23,11 @@ export interface OpenApiFragment {
 export function errorResponse(description: string): Record<string, unknown> {
   return {
     description,
-    content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } },
+    content: {
+      "application/json": {
+        schema: { $ref: "#/components/schemas/ErrorResponse" },
+      },
+    },
   };
 }
 
@@ -44,6 +48,11 @@ export function requiresPermission(permission: PermissionSlug): string {
  * self-checks, and anything about the scope the request named, where this deployment has one
  * narrower than itself.
  */
-export function missingPermission(permission: PermissionSlug, ...alsoWhen: string[]): Record<string, unknown> {
-  return errorResponse([`Missing the \`${permission}\` permission`, ...alsoWhen].join(", or "));
+export function missingPermission(
+  permission: PermissionSlug,
+  ...alsoWhen: string[]
+): Record<string, unknown> {
+  return errorResponse(
+    [`Missing the \`${permission}\` permission`, ...alsoWhen].join(", or "),
+  );
 }