chore(deps): bump @bymax-one/nest-auth to ^1.0.11

.github/workflows/mutation-nightly.yml

@@ -44,6 +44,12 @@ jobs:
       - name: Generate Prisma client
         working-directory: apps/api
         run: pnpm prisma:generate
+        # Prisma 7 resolves `env('DATABASE_URL')` in prisma.config.ts at CLI
+        # load time, so `prisma generate` fails without it even though it
+        # never connects to the database. A placeholder is enough — this
+        # mirrors the same step in ci.yml.
+        env:
+          DATABASE_URL: postgresql://postgres:postgres@localhost:5432/ci_placeholder
 
       # `--incremental false` overrides the config so we get a true cold
       # baseline — no cache, no incremental file is consulted.

.github/workflows/mutation.yml

@@ -107,6 +107,12 @@ jobs:
       - name: Generate Prisma client
         working-directory: apps/api
         run: pnpm prisma:generate
+        # Prisma 7 resolves `env('DATABASE_URL')` in prisma.config.ts at CLI
+        # load time, so `prisma generate` fails without it even though it
+        # never connects to the database. A placeholder is enough — this
+        # mirrors the same step in ci.yml.
+        env:
+          DATABASE_URL: postgresql://postgres:postgres@localhost:5432/ci_placeholder
 
       # Restore the incremental cache. Try the PR branch's own cache first,
       # then fall back to main's so the first run on a new PR still benefits

.vscode/extensions.json

@@ -0,0 +1,8 @@
+{
+  "recommendations": [
+    "dbaeumer.vscode-eslint",
+    "esbenp.prettier-vscode",
+    "bradlc.vscode-tailwindcss",
+    "editorconfig.editorconfig"
+  ]
+}

.vscode/settings.json

@@ -1,4 +1,43 @@
 {
+  // Formatting model (conflict-free) for this pnpm monorepo
+  // (apps/api = NestJS 11, apps/web = Next.js 16 + React 19 + Tailwind):
+  // - Prettier (esbenp.prettier-vscode, reads .prettierrc.mjs) owns formatting.
+  // - ESLint 10 flat config (eslint.config.mjs) auto-fixes lint + import order on
+  //   save; eslint-config-prettier disables stylistic ESLint rules so the two
+  //   never fight.
+  // - Indentation / EOL / final-newline / trailing-whitespace come from
+  //   .editorconfig (install EditorConfig.EditorConfig) — not duplicated here.
+  // - Per-language formatters stop VS Code's built-in formatters from clashing,
+  //   covering React/TSX and CSS (Tailwind).
+  "editor.defaultFormatter": "esbenp.prettier-vscode",
+  "editor.formatOnSave": true,
+  "editor.codeActionsOnSave": {
+    "source.fixAll.eslint": "explicit"
+  },
+  "editor.rulers": [100],
+
+  "[typescript]": { "editor.defaultFormatter": "esbenp.prettier-vscode" },
+  "[typescriptreact]": { "editor.defaultFormatter": "esbenp.prettier-vscode" },
+  "[javascript]": { "editor.defaultFormatter": "esbenp.prettier-vscode" },
+  "[javascriptreact]": { "editor.defaultFormatter": "esbenp.prettier-vscode" },
+  "[json]": { "editor.defaultFormatter": "esbenp.prettier-vscode" },
+  "[jsonc]": { "editor.defaultFormatter": "esbenp.prettier-vscode" },
+  "[css]": { "editor.defaultFormatter": "esbenp.prettier-vscode" },
+  "[yaml]": { "editor.defaultFormatter": "esbenp.prettier-vscode" },
+  "[markdown]": { "editor.defaultFormatter": "esbenp.prettier-vscode" },
+
+  // ESLint 10 flat config; "auto" working directories resolve each workspace package.
+  "eslint.useFlatConfig": true,
+  "eslint.workingDirectories": [{ "mode": "auto" }],
+
   "typescript.tsdk": "node_modules/typescript/lib",
-  "typescript.enablePromptUseWorkspaceTsdk": true
+  "typescript.enablePromptUseWorkspaceTsdk": true,
+
+  "search.exclude": {
+    "**/dist": true,
+    "**/coverage": true,
+    "**/.stryker-tmp": true,
+    "**/.next": true,
+    "**/pnpm-lock.yaml": true
+  }
 }

apps/api/package.json

@@ -42,7 +42,7 @@
     "prisma:studio": "prisma studio"
   },
   "dependencies": {
-    "@bymax-one/nest-auth": "^1.0.10",
+    "@bymax-one/nest-auth": "^1.0.11",
     "@nestjs/common": "^11.1.19",
     "@nestjs/config": "^4.0.4",
     "@nestjs/core": "^11.1.19",

apps/api/src/users/users.service.spec.ts

@@ -398,11 +398,17 @@ describe('UsersService', () => {
        * Scenario: the requested user does not exist in the caller's tenant (either
        * a wrong id or a cross-tenant probe). The service must return 404 rather
        * than leaking cross-tenant existence via a 403.
-       * Rule: findById returns NotFoundException (not ForbiddenException) on miss.
+       * Rule: findById returns NotFoundException (not ForbiddenException) on miss,
+       * and the 404 message names the requested id verbatim so the client can tell
+       * which lookup failed.
        */
       findById.mockResolvedValue(null);
 
-      await expect(service.findById('missing-user', 'acme')).rejects.toThrow(NotFoundException);
+      // Assert the type and the verbatim message against a single rejected
+      // promise so the lookup runs exactly once.
+      const lookup = service.findById('missing-user', 'acme');
+      await expect(lookup).rejects.toThrow(NotFoundException);
+      await expect(lookup).rejects.toThrow("User 'missing-user' not found");
     });
 
     it('calls the repository with the correct id and tenantId', async () => {

apps/web/package.json

@@ -36,7 +36,7 @@
     "mutation:dry-run": "stryker run --dryRunOnly"
   },
   "dependencies": {
-    "@bymax-one/nest-auth": "^1.0.10",
+    "@bymax-one/nest-auth": "^1.0.11",
     "@hookform/resolvers": "^5.2.2",
     "@radix-ui/react-avatar": "^1.1.11",
     "@radix-ui/react-dialog": "^1.1.15",

package.json

@@ -76,7 +76,7 @@
     "onlyBuiltDependencies": []
   },
   "devDependencies": {
-    "@bymax-one/nest-auth": "^1.0.10",
+    "@bymax-one/nest-auth": "^1.0.11",
     "@commitlint/cli": "^20.5.0",
     "@commitlint/config-conventional": "^20.5.0",
     "@eslint/js": "^10.0.1",