@simple-auth-kit/cli 1.5.1 → 1.6.1

package/registry/combos/express-drizzle/shared/src/route-tiers.ts

@@ -28,7 +28,7 @@
 //     a permission nothing can ever grant.
 import { Router } from "express";
 import type { NextFunction, Request, RequestHandler, Response } from "express";
-import { ABILITY_SUBJECT } from "./ability.js";
+import { ABILITY_SUBJECT } from "./ability/ability.js";
 import { PERMISSION_CATALOG, type PermissionSlug } from "./rbac.defaults.js";
 import "./request-context.js";
 
@@ -39,7 +39,10 @@ export type TieredMethod = "get" | "post" | "put" | "patch" | "delete";
  * What a route declares about itself. There is deliberately no fourth shape and no default: the
  * union is closed, so adding a route means picking one of these three.
  */
-export type RouteTier = { kind: "public" } | { kind: "authenticated" } | { kind: "ability"; abilities: PermissionSlug[] };
+export type RouteTier =
+  | { kind: "public" }
+  | { kind: "authenticated" }
+  | { kind: "ability"; abilities: PermissionSlug[] };
 
 /** Tier 1: reachable with no token at all. Carries no middleware, which is exactly why it has to be said out loud. */
 export const publicRoute = (): RouteTier => ({ kind: "public" });
@@ -57,7 +60,10 @@ export const authenticated = (): RouteTier => ({ kind: "authenticated" });
  * hold the slug is entirely a matter of rows.
  */
 export const ability = (...abilities: PermissionSlug[]): RouteTier => {
-  if (!abilities.length) throw new Error("ability() names no permission — use authenticated() if any logged-in caller may call the route");
+  if (!abilities.length)
+    throw new Error(
+      "ability() names no permission — use authenticated() if any logged-in caller may call the route",
+    );
   for (const slug of abilities) assertInCatalog(slug);
   return { kind: "ability", abilities };
 };
@@ -72,15 +78,31 @@ export const ability = (...abilities: PermissionSlug[]): RouteTier => {
  * incapable of disagreeing.
  */
 export function requireAbility(abilities: PermissionSlug[]): RequestHandler {
-  return function abilityMiddleware(req: Request, res: Response, next: NextFunction): void {
+  return function abilityMiddleware(
+    req: Request,
+    res: Response,
+    next: NextFunction,
+  ): void {
     // No ability at all means the authz middleware resolved nothing — fail closed.
     if (!req.ability) {
-      res.status(403).json({ statusCode: 403, code: "FORBIDDEN", message: "no authorization context for this request" });
+      res
+        .status(403)
+        .json({
+          statusCode: 403,
+          code: "FORBIDDEN",
+          message: "no authorization context for this request",
+        });
       return;
     }
     for (const slug of abilities) {
       if (!req.ability.can(slug, ABILITY_SUBJECT)) {
-        res.status(403).json({ statusCode: 403, code: "FORBIDDEN", message: `missing permission: ${slug}` });
+        res
+          .status(403)
+          .json({
+            statusCode: 403,
+            code: "FORBIDDEN",
+            message: `missing permission: ${slug}`,
+          });
         return;
       }
     }
@@ -95,7 +117,12 @@ export interface TieredRouter {
    * adds a route without one, and the middleware the tier implies is always inserted immediately
    * before `handler` — the two cannot come apart.
    */
-  route(method: TieredMethod, path: string, tier: RouteTier, ...handlers: RequestHandler[]): void;
+  route(
+    method: TieredMethod,
+    path: string,
+    tier: RouteTier,
+    ...handlers: RequestHandler[]
+  ): void;
   /**
    * The composed middleware, for `app.use(...)`. Deliberately typed as `RequestHandler` and not
    * as `Router`, even though that is what it is at runtime: the `.get`/`.post`/… methods are
@@ -123,26 +150,40 @@ export function createTieredRouter(middleware: TierMiddleware): TieredRouter {
   const router = Router();
 
   return {
-    route(method: TieredMethod, path: string, tier: RouteTier, ...handlers: RequestHandler[]): void {
+    route(
+      method: TieredMethod,
+      path: string,
+      tier: RouteTier,
+      ...handlers: RequestHandler[]
+    ): void {
       router[method](path, ...tierMiddleware(tier, middleware), ...handlers);
     },
     handler: router,
   };
 }
 
-function tierMiddleware(tier: RouteTier, middleware: TierMiddleware): RequestHandler[] {
+function tierMiddleware(
+  tier: RouteTier,
+  middleware: TierMiddleware,
+): RequestHandler[] {
   switch (tier.kind) {
     case "public":
       return [];
     case "authenticated":
       return [middleware.authentication, middleware.authorization];
     case "ability":
-      return [middleware.authentication, middleware.authorization, requireAbility(tier.abilities)];
+      return [
+        middleware.authentication,
+        middleware.authorization,
+        requireAbility(tier.abilities),
+      ];
   }
 }
 
 function assertInCatalog(slug: string): void {
   if (!Object.prototype.hasOwnProperty.call(PERMISSION_CATALOG, slug)) {
-    throw new Error(`"${slug}" is not in PERMISSION_CATALOG — add it to rbac.defaults.ts (the seeder provisions exactly that catalog)`);
+    throw new Error(
+      `"${slug}" is not in PERMISSION_CATALOG — add it to rbac.defaults.ts (the seeder provisions exactly that catalog)`,
+    );
   }
 }

package/registry/combos/express-drizzle/shared/src/routers/auth.router.ts

@@ -1,7 +1,7 @@
 import type { NextFunction, Request, RequestHandler, Response } from "express";
-import type { AuthConfig } from "../auth.config.js";
+import type { AuthConfig } from "../config/auth.config.js";
 import { AuthService } from "../services/auth.service.js";
-import { HttpError } from "../http-error.js";
+import { HttpError } from "../errors/http-error.js";
 import {
   authenticated,
   createTieredRouter,

package/registry/combos/express-drizzle/test/bootstrap.ts

@@ -1,7 +1,7 @@
 import "dotenv/config";
 import type { Server } from "node:http";
 import { createAuthApp } from "../src/create-auth-app.js";
-import { InMemoryPermissionCacheStore } from "../src/permission-cache.js";
+import { InMemoryPermissionCacheStore } from "../src/cache/permission-cache.js";
 
 // No mailer is wired up for the proof, so this stands in for one — prove-cycle.ts reads the
 // raw token back out of here the same way a test inbox would, to exercise the reset flow.
@@ -14,7 +14,9 @@ export const capturedResetTokens = new Map<string, string>();
  */
 export const permissionCacheStore = new InMemoryPermissionCacheStore();
 
-export async function bootstrap(port: number): Promise<{ close: () => Promise<void> }> {
+export async function bootstrap(
+  port: number,
+): Promise<{ close: () => Promise<void> }> {
   const app = createAuthApp({
     // Was 2 seconds, "so the proof can exercise expiry-adjacent paths quickly" — except no
     // assertion in the proof waits for an access token to expire, so it bought nothing and