@appxdigital/appx-core 0.1.120 → 0.1.121-beta.11

package/dist/config/generate-controllers.js

@@ -34,10 +34,12 @@ const modulesOutputPath = path.join(process.cwd(), 'src/modules');
  * @param folder
  */
 const genericControllerTemplate = (model, folder) => `
-import { Controller } from '@nestjs/common';
+import { Body, Controller, Param, Post, Put } from '@nestjs/common';
 import { ${model}Service } from './${folder}.service';
 import { ${model} } from '@prisma/client';
-import { CoreController } from '@appxdigital/appx-core';
+import { CoreController, Permission } from '@appxdigital/appx-core';
+import { Create${model}Dto } from './dto/create-${folder}.dto';
+import { Update${model}Dto } from './dto/update-${folder}.dto';
 
 @Controller('${model.toLowerCase()}s')
 export class ${model}Controller extends CoreController<${model}> {
@@ -48,6 +50,21 @@ export class ${model}Controller extends CoreController<${model}> {
   static get entityName(): string {
     return '${model}';
   }
+
+  // Overridden so the @Body() type is a concrete DTO — this is what lets
+  // ValidationPipe (whitelist) strip unknown fields.
+  // Custom validation goes in the DTO subclass, not here.
+  @Post()
+  @Permission('create')
+  async create(@Body() data: Create${model}Dto) {
+    return super.create(data as any);
+  }
+
+  @Put(':id')
+  @Permission('updateMany')
+  async update(@Param('id') id: string, @Body() data: Update${model}Dto) {
+    return super.update(id, data as any);
+  }
 }
 `;
 /**

package/dist/config/generate-dtos.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=generate-dtos.d.ts.map

package/dist/config/generate-dtos.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate-dtos.d.ts","sourceRoot":"","sources":["../../src/config/generate-dtos.ts"],"names":[],"mappings":""}

package/dist/config/generate-dtos.js

@@ -0,0 +1,285 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const path = __importStar(require("path"));
+const utils_1 = require("./utils");
+/**
+ * DTO generator.
+ *
+ * Generated CRUD controllers type `@Body()` as a generic, so NestJS's
+ * ValidationPipe has no concrete class to validate against and unknown fields
+ * are accepted. This generator emits a class-validator DTO per model+action so
+ * the controller can type its body concretely.
+ *
+ * Two-file, schema-is-source-of-truth model:
+ *   - `src/generated/dto/<model>/create-<model>.generated.dto.ts` — the base
+ *     class, derived from the Prisma schema, ALWAYS overwritten (gitignored).
+ *   - `src/modules/<model>/dto/create-<model>.dto.ts` — a hand-owned subclass,
+ *     generated ONCE, where the developer adds custom validation. Never
+ *     overwritten. The controller imports this subclass.
+ *
+ * A scalar field is writable (appears in the DTO) unless it is:
+ *   - the primary key (`@id`),
+ *   - a server-managed timestamp (`@default(now())` or `@updatedAt`),
+ *   - annotated `/// @NoWrite`, or
+ *   - annotated `/// @Role(none)` (readable by nobody ⇒ not CRUD-writable).
+ *
+ * Nested relation writes (CREATE DTOs only — `updateMany` takes scalar data):
+ *   Each relation gets a nested-write member exposing ONLY the operators the
+ *   data-access proxy authorizes: `create` (validated against the related
+ *   model's writable scalars) and `connect` (validated against the related
+ *   model's unique fields). Other operators (`set`/`disconnect`/`update`/…) are
+ *   deliberately NOT emitted, so the whitelist pipe rejects them. The proxy
+ *   enforces the matching ABAC rule for each (`create` rule / `connect` rule).
+ */
+const cwd = process.cwd();
+// Read the consumer's generated Prisma client for the DMMF (authoritative
+// field metadata incl. `documentation`, which carries /// @Role / @NoWrite).
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const { Prisma } = require(path.join(cwd, 'node_modules', '@prisma/client'));
+const generatedDtoRoot = path.join(cwd, 'src/generated/dto');
+const modulesRoot = path.join(cwd, 'src/modules');
+const modelsByName = {};
+for (const m of Prisma.dmmf.datamodel.models)
+    modelsByName[m.name] = m;
+function isNoWrite(doc) {
+    if (!doc)
+        return false;
+    if (/@NoWrite\b/i.test(doc))
+        return true;
+    // @Role(none): readable by nobody ⇒ treat as not CRUD-writable.
+    const roleMatch = doc.match(/@Role\((.*?)\)/);
+    if (roleMatch) {
+        const roles = roleMatch[1].split(',').map((r) => r.trim().toLowerCase());
+        if (roles.includes('none'))
+            return true;
+    }
+    return false;
+}
+function isServerManagedTimestamp(field) {
+    if (field.isUpdatedAt)
+        return true;
+    const def = field.default;
+    return !!def && typeof def === 'object' && def.name === 'now';
+}
+/** Decision for a scalar/enum field: base validator, TS type, optional enum arg. */
+function mapField(field) {
+    if (field.kind === 'enum') {
+        return { validator: 'IsEnum', tsType: field.type, enumArg: field.type };
+    }
+    switch (field.type) {
+        case 'String':
+            return { validator: 'IsString', tsType: 'string' };
+        case 'Boolean':
+            return { validator: 'IsBoolean', tsType: 'boolean' };
+        case 'Int':
+        case 'BigInt':
+            return { validator: 'IsInt', tsType: 'number' };
+        case 'Float':
+        case 'Decimal':
+            return { validator: 'IsNumber', tsType: 'number' };
+        case 'DateTime':
+            return { validator: 'IsDateString', tsType: 'string' };
+        default:
+            // Json, Bytes, and anything unrecognised: keep the field (so it isn't
+            // stripped by whitelist) without a strict type validator.
+            return { validator: 'Allow', tsType: 'any' };
+    }
+}
+function writableFields(model, omit = []) {
+    return model.fields.filter((f) => {
+        if (f.kind === 'object')
+            return false; // relation navigation
+        if (f.isId)
+            return false;
+        if (isServerManagedTimestamp(f))
+            return false;
+        if (isNoWrite(f.documentation))
+            return false;
+        if (omit.includes(f.name))
+            return false;
+        return true;
+    });
+}
+/** id + unique scalar fields (for a connect-by DTO). */
+function connectFields(model) {
+    return model.fields.filter((f) => f.kind !== 'object' && (f.isId || f.isUnique));
+}
+/** The scalar FK column(s) the parent sets automatically — omit from a nested create. */
+function backFkColumns(relatedModel, relationName) {
+    const inverse = relatedModel.fields.find((f) => f.kind === 'object' && f.relationName === relationName && (f.relationFromFields || []).length > 0);
+    return inverse ? inverse.relationFromFields || [] : [];
+}
+/** Renders class-body lines for a set of scalar/enum fields; collects imports. */
+function renderScalarLines(fields, mode, validatorImports, enumImports) {
+    const lines = [];
+    for (const field of fields) {
+        const m = mapField(field);
+        validatorImports.add(m.validator);
+        if (m.enumArg)
+            enumImports.add(m.enumArg);
+        // update / connect: everything optional. create: optional if not required or defaulted.
+        const optional = mode !== 'create' || !field.isRequired || field.hasDefaultValue;
+        const isList = field.isList;
+        const tsType = isList ? `${m.tsType}[]` : m.tsType;
+        let validatorDecorator;
+        if (m.validator === 'Allow') {
+            validatorDecorator = '@Allow()';
+        }
+        else {
+            const args = [];
+            if (m.enumArg)
+                args.push(m.enumArg);
+            if (isList)
+                args.push('{ each: true }');
+            validatorDecorator = `@${m.validator}(${args.join(', ')})`;
+        }
+        const decoratorLines = [];
+        if (optional) {
+            validatorImports.add('IsOptional');
+            decoratorLines.push('    @IsOptional()');
+        }
+        if (isList && m.validator !== 'Allow') {
+            validatorImports.add('IsArray');
+            decoratorLines.push('    @IsArray()');
+        }
+        decoratorLines.push(`    ${validatorDecorator}`);
+        lines.push(decoratorLines.join('\n'));
+        lines.push(`    ${field.name}${optional ? '?' : '!'}: ${tsType};`);
+        lines.push('');
+    }
+    return lines;
+}
+function renderClass(className, bodyLines) {
+    return `export class ${className} {\n` + (bodyLines.length ? bodyLines.join('\n') : '') + `}\n`;
+}
+/**
+ * For a model's CREATE DTO, render the nested-write classes for each relation
+ * plus the property lines to add to the parent class. Nested create classes are
+ * scalars-only (no deeper relations) so there are no circular imports.
+ */
+function renderRelationNestedWrites(model, validatorImports, enumImports, transformerImports) {
+    const classes = [];
+    const parentLines = [];
+    const relations = model.fields.filter((f) => f.kind === 'object');
+    for (const rel of relations) {
+        const related = modelsByName[rel.type];
+        if (!related)
+            continue;
+        const relCap = rel.name.charAt(0).toUpperCase() + rel.name.slice(1);
+        const createCls = `${model.name}${relCap}CreateNestedDto`;
+        const connectCls = `${model.name}${relCap}ConnectNestedDto`;
+        const writeCls = `${model.name}${relCap}NestedWriteDto`;
+        // create: related writable scalars minus the back-reference FK.
+        const omit = backFkColumns(related, rel.relationName);
+        classes.push(renderClass(createCls, renderScalarLines(writableFields(related, omit), 'create', validatorImports, enumImports)));
+        // connect: related unique fields (all optional).
+        const conn = connectFields(related);
+        classes.push(renderClass(connectCls, renderScalarLines(conn, 'connect', validatorImports, enumImports)));
+        // nested-write: create? / connect? only.
+        transformerImports.add('Type');
+        validatorImports.add('IsOptional');
+        validatorImports.add('ValidateNested');
+        const eachArg = rel.isList ? '{ each: true }' : '';
+        const arrSuffix = rel.isList ? '[]' : '';
+        if (rel.isList)
+            validatorImports.add('IsArray');
+        const opLines = [];
+        for (const [op, cls] of [['create', createCls], ['connect', connectCls]]) {
+            if (rel.isList)
+                opLines.push('    @IsArray()');
+            opLines.push('    @IsOptional()');
+            opLines.push(`    @ValidateNested(${eachArg})`);
+            opLines.push(`    @Type(() => ${cls})`);
+            opLines.push(`    ${op}?: ${cls}${arrSuffix};`);
+            opLines.push('');
+        }
+        classes.push(renderClass(writeCls, opLines));
+        // property on the parent CREATE DTO.
+        parentLines.push('    @IsOptional()');
+        parentLines.push('    @ValidateNested()');
+        parentLines.push(`    @Type(() => ${writeCls})`);
+        parentLines.push(`    ${rel.name}?: ${writeCls};`);
+        parentLines.push('');
+    }
+    return { classes, parentLines };
+}
+/** Renders a base DTO file (nested relation writes on create only). */
+function renderBaseDto(className, model, mode) {
+    const validatorImports = new Set();
+    const enumImports = new Set();
+    const transformerImports = new Set();
+    const scalarLines = renderScalarLines(writableFields(model), mode, validatorImports, enumImports);
+    let nested = { classes: [], parentLines: [] };
+    if (mode === 'create') {
+        nested = renderRelationNestedWrites(model, validatorImports, enumImports, transformerImports);
+    }
+    const parentClass = renderClass(className, [...scalarLines, ...nested.parentLines]);
+    const importLines = [];
+    if (validatorImports.size > 0) {
+        importLines.push(`import { ${[...validatorImports].sort().join(', ')} } from 'class-validator';`);
+    }
+    if (transformerImports.size > 0) {
+        importLines.push(`import { ${[...transformerImports].sort().join(', ')} } from 'class-transformer';`);
+    }
+    if (enumImports.size > 0) {
+        importLines.push(`import { ${[...enumImports].sort().join(', ')} } from '@prisma/client';`);
+    }
+    return (utils_1.GENERATED_BANNER +
+        '\n' +
+        (importLines.length ? importLines.join('\n') + '\n\n' : '') +
+        // nested classes first (referenced by @Type in the parent).
+        (nested.classes.length ? nested.classes.join('\n') + '\n' : '') +
+        parentClass);
+}
+/** Renders the hand-owned subclass (generated once, then customizable). */
+function renderSubclassDto(subclass, baseClass, importPath) {
+    return (`import { ${baseClass} } from '${importPath}';\n\n` +
+        `/**\n` +
+        ` * Hand-owned DTO for the CRUD endpoint. Add custom class-validator rules\n` +
+        ` * here; this file is generated once and never overwritten by \`appx generate\`.\n` +
+        ` * The base class is regenerated from the Prisma schema.\n` +
+        ` */\n` +
+        `export class ${subclass} extends ${baseClass} {}\n`);
+}
+for (const model of Prisma.dmmf.datamodel.models) {
+    const modelName = model.name; // Pascal, e.g. ProjectMember
+    const folder = (0, utils_1.pascalToKebabCase)(modelName); // kebab, e.g. project-member
+    if (utils_1.IGNORE_FOLDERS.includes(folder))
+        continue;
+    for (const mode of ['create', 'update']) {
+        const capMode = mode.charAt(0).toUpperCase() + mode.slice(1);
+        const baseClass = `${capMode}${modelName}GeneratedDto`;
+        const subclass = `${capMode}${modelName}Dto`;
+        // Base (overwritten, gitignored).
+        const basePath = path.join(generatedDtoRoot, folder, `${mode}-${folder}.generated.dto.ts`);
+        (0, utils_1.writeGeneratedFile)(basePath, renderBaseDto(baseClass, model, mode));
+        // Subclass (once, hand-owned, committed).
+        const subPath = path.join(modulesRoot, folder, 'dto', `${mode}-${folder}.dto.ts`);
+        const importPath = `../../../generated/dto/${folder}/${mode}-${folder}.generated.dto`;
+        (0, utils_1.createFileIfNotExists)(subPath, renderSubclassDto(subclass, baseClass, importPath));
+    }
+}
+console.log('DTOs generated.');

package/dist/config/utils.d.ts

@@ -1,4 +1,18 @@
 export declare const kebabToPascalCase: (str: string) => string;
+export declare const pascalToKebabCase: (str: string) => string;
 export declare const createFileIfNotExists: (filePath: string, content: string) => void;
+/**
+ * Banner stamped on every fully-generated file. These files live under
+ * `src/generated/` (gitignored) and are OVERWRITTEN on every `appx generate`.
+ * Never hand-edit them — customize the hand-owned subclass under
+ * `src/modules/<model>/dto/` instead.
+ */
+export declare const GENERATED_BANNER: string;
+/**
+ * Writes a fully-generated file, always overwriting. Use only for artifacts
+ * under `src/generated/` that carry {@link GENERATED_BANNER}. Creates parent
+ * directories as needed.
+ */
+export declare const writeGeneratedFile: (filePath: string, content: string) => void;
 export declare const IGNORE_FOLDERS: string[];
 //# sourceMappingURL=utils.d.ts.map

package/dist/config/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/config/utils.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,iBAAiB,QAAS,MAAM,WAK5C,CAAC;AAEF,eAAO,MAAM,qBAAqB,aAAc,MAAM,WAAW,MAAM,SAQtE,CAAC;AAEF,eAAO,MAAM,cAAc,UAK1B,CAAC"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/config/utils.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,iBAAiB,QAAS,MAAM,WAK5C,CAAC;AAEF,eAAO,MAAM,iBAAiB,QAAS,MAAM,WAK5C,CAAC;AAEF,eAAO,MAAM,qBAAqB,aAAc,MAAM,WAAW,MAAM,SAStE,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,QAGoD,CAAC;AAElF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,aAAc,MAAM,WAAW,MAAM,SAInE,CAAC;AAEF,eAAO,MAAM,cAAc,UAS1B,CAAC"}

package/dist/config/utils.js

@@ -23,8 +23,9 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.IGNORE_FOLDERS = exports.createFileIfNotExists = exports.kebabToPascalCase = void 0;
+exports.IGNORE_FOLDERS = exports.writeGeneratedFile = exports.GENERATED_BANNER = exports.createFileIfNotExists = exports.pascalToKebabCase = exports.kebabToPascalCase = void 0;
 const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
 const kebabToPascalCase = (str) => {
     return str
         .split("-")
@@ -32,9 +33,17 @@ const kebabToPascalCase = (str) => {
         .join("");
 };
 exports.kebabToPascalCase = kebabToPascalCase;
+const pascalToKebabCase = (str) => {
+    return str
+        .replace(/([a-z0-9])([A-Z])/g, '$1-$2')
+        .replace(/([A-Z]+)([A-Z][a-z])/g, '$1-$2')
+        .toLowerCase();
+};
+exports.pascalToKebabCase = pascalToKebabCase;
 const createFileIfNotExists = (filePath, content) => {
     console.log(`Creating ${filePath}...`);
     if (!fs.existsSync(filePath)) {
+        fs.mkdirSync(path.dirname(filePath), { recursive: true });
         fs.writeFileSync(filePath, content);
         console.log(`${filePath} created.`);
     }
@@ -43,9 +52,33 @@ const createFileIfNotExists = (filePath, content) => {
     }
 };
 exports.createFileIfNotExists = createFileIfNotExists;
+/**
+ * Banner stamped on every fully-generated file. These files live under
+ * `src/generated/` (gitignored) and are OVERWRITTEN on every `appx generate`.
+ * Never hand-edit them — customize the hand-owned subclass under
+ * `src/modules/<model>/dto/` instead.
+ */
+exports.GENERATED_BANNER = '// @Generated by appx-core — do not edit.\n' +
+    '// Regenerated by `appx generate`; lives under src/generated (gitignored).\n' +
+    '// To customize, edit the hand-owned subclass in src/modules/<model>/dto.\n';
+/**
+ * Writes a fully-generated file, always overwriting. Use only for artifacts
+ * under `src/generated/` that carry {@link GENERATED_BANNER}. Creates parent
+ * directories as needed.
+ */
+const writeGeneratedFile = (filePath, content) => {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, content);
+    console.log(`Generated ${filePath}`);
+};
+exports.writeGeneratedFile = writeGeneratedFile;
 exports.IGNORE_FOLDERS = [
     'prisma',
     'schema.gql',
     'session',
-    'user-refresh-token'
+    'user-refresh-token',
+    // Generated DTOs live under src/generated/dto/. The model generators scan
+    // src/generated's top-level dirs as model names, so this must be skipped or
+    // they emit a bogus `dto` module.
+    'dto',
 ];

package/dist/index.d.ts

@@ -22,6 +22,8 @@ export * from './common/interfaces/storage-service.interface';
 export * from './modules/file/file-upload.controller';
 export * from './modules/file/file-upload.service';
 export * from './common/decorators/permission.decorator';
+export * from './common/setup/setup-core-security';
+export * from './common/setup/core-config';
 export * from './common/interceptors/file.interceptor';
 export * from './modules/auth/authenticated.guard';
 export * from './modules/auth/jwt-auth.guard';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sCAAsC,CAAC;AACrD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uCAAuC,CAAC;AACtD,cAAc,yBAAyB,CAAC;AACxC,cAAc,0CAA0C,CAAC;AACzD,cAAc,wCAAwC,CAAC;AACvD,cAAc,iCAAiC,CAAC;AAChD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,oBAAoB,CAAC;AACnC,cAAc,mCAAmC,CAAC;AAClD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,wCAAwC,CAAC;AACvD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qCAAqC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sCAAsC,CAAC;AACrD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uCAAuC,CAAC;AACtD,cAAc,yBAAyB,CAAC;AACxC,cAAc,0CAA0C,CAAC;AACzD,cAAc,wCAAwC,CAAC;AACvD,cAAc,iCAAiC,CAAC;AAChD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,oBAAoB,CAAC;AACnC,cAAc,mCAAmC,CAAC;AAClD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,wCAAwC,CAAC;AACvD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,oCAAoC,CAAC;AACnD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qCAAqC,CAAC"}

package/dist/index.js

@@ -38,6 +38,8 @@ __exportStar(require("./common/interfaces/storage-service.interface"), exports);
 __exportStar(require("./modules/file/file-upload.controller"), exports);
 __exportStar(require("./modules/file/file-upload.service"), exports);
 __exportStar(require("./common/decorators/permission.decorator"), exports);
+__exportStar(require("./common/setup/setup-core-security"), exports);
+__exportStar(require("./common/setup/core-config"), exports);
 __exportStar(require("./common/interceptors/file.interceptor"), exports);
 __exportStar(require("./modules/auth/authenticated.guard"), exports);
 __exportStar(require("./modules/auth/jwt-auth.guard"), exports);

package/dist/modules/auth/auth.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.controller.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.controller.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,WAAW,EAAC,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAC,WAAW,EAAC,MAAM,oBAAoB,CAAC;AAG/C,OAAO,EAAC,OAAO,EAAE,QAAQ,EAAC,MAAM,SAAS,CAAC;AAI1C,qBACa,cAAc;IACX,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW;gBAAxB,WAAW,EAAE,WAAW;IAGjD,QAAQ,CAAS,WAAW,EAAE,WAAW;;;;IAMzC,KAAK,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ;IAW/C,MAAM,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBhE,EAAE,CAAQ,GAAG,EAAE,OAAO;;;IAQtB,iBAAiB,CAAQ,GAAG,EAAE,OAAO;;;IAOrC,gBAAgB,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ;IAK1D,cAAc,CAAkB,MAAM,EAAE,MAAM,EAAS,GAAG,EAAE,OAAO;;;IAUnE,oBAAoB,CACF,SAAS,EAAE,MAAM,EAC9B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ;IAgBlB,QAAQ,CAAQ,GAAG,EAAE,OAAO;;;;;IAM5B,aAAa,CAAQ,GAAG,EAAE,OAAO;;;;IAOjC,SAAS,CAAQ,GAAG,EAAE,OAAO;;;CAQtC"}
+{"version":3,"file":"auth.controller.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.controller.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,WAAW,EAAC,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAC,WAAW,EAAC,MAAM,oBAAoB,CAAC;AAG/C,OAAO,EAAC,OAAO,EAAE,QAAQ,EAAC,MAAM,SAAS,CAAC;AAI1C,qBACa,cAAc;IACX,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW;gBAAxB,WAAW,EAAE,WAAW;IAGjD,QAAQ,CAAS,WAAW,EAAE,WAAW;;;;IAMzC,KAAK,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ;IAW/C,MAAM,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBhE,EAAE,CAAQ,GAAG,EAAE,OAAO;;;IAQtB,iBAAiB,CAAQ,GAAG,EAAE,OAAO;;;IAOrC,gBAAgB,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ;IAM1D,cAAc,CAAkB,MAAM,EAAE,MAAM,EAAS,GAAG,EAAE,OAAO;;;IAanE,oBAAoB,CACF,SAAS,EAAE,MAAM,EAC9B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ;IAgBlB,QAAQ,CAAQ,GAAG,EAAE,OAAO;;;;;IAM5B,aAAa,CAAQ,GAAG,EAAE,OAAO;;;;IAOjC,SAAS,CAAQ,GAAG,EAAE,OAAO;;;CAQtC"}

package/dist/modules/auth/auth.controller.js

@@ -64,7 +64,9 @@ let AuthController = exports.AuthController = class AuthController {
         return this.authService.closeAllUserSessions(req, res);
     }
     async getAllSessions(userId, req) {
-        //TODO - Implement a more dynamic way to handle role access
+        // AuthenticatedGuard gates authentication explicitly; the role check
+        // below is the authorization step. De-hardcoding 'ADMIN' into the
+        // permissions system is deferred (see ROADMAP / ).
         if (req.user?.role !== 'ADMIN') {
             throw new common_1.ForbiddenException('Access denied.');
         }
@@ -72,7 +74,7 @@ let AuthController = exports.AuthController = class AuthController {
         return { sessions };
     }
     async closeSpecificSession(sessionId, req, res) {
-        //TODO - Implement a more dynamic way to handle role access
+        // See getAllSessions: AuthenticatedGuard = authn, role check = authz.
         if (req.user?.role !== 'ADMIN') {
             throw new common_1.ForbiddenException('Access denied.');
         }
@@ -151,6 +153,7 @@ __decorate([
     __metadata("design:returntype", Promise)
 ], AuthController.prototype, "closeAllSessions", null);
 __decorate([
+    (0, common_1.UseGuards)(authenticated_guard_1.AuthenticatedGuard),
     (0, common_1.Get)('sessions/:userId'),
     __param(0, (0, common_1.Param)('userId')),
     __param(1, (0, common_1.Req)()),
@@ -159,6 +162,7 @@ __decorate([
     __metadata("design:returntype", Promise)
 ], AuthController.prototype, "getAllSessions", null);
 __decorate([
+    (0, common_1.UseGuards)(authenticated_guard_1.AuthenticatedGuard),
     (0, common_1.Post)('sessions/:sessionId/close'),
     __param(0, (0, common_1.Param)('sessionId')),
     __param(1, (0, common_1.Req)()),

package/dist/modules/auth/auth.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,WAAW,EAAC,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAC,WAAW,EAAC,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAC,aAAa,EAAC,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAC,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAC,OAAO,EAAE,QAAQ,EAAC,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAC,UAAU,EAAC,MAAM,aAAa,CAAC;AAKvC,qBACa,WAAW;IAIhB,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW;IAC3C,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,aAAa;IACxC,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU;IACzC,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,aAAa;IANnD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;gBAGpB,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,aAAa,EACrB,UAAU,EAAE,UAAU,EACtB,aAAa,EAAE,aAAa;IAK7C,QAAQ,CAAC,WAAW,EAAE,WAAW;;;;IA2BjC,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,GAAG,CAAA;KAAC,CAAC;IA8B1D,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBlD,YAAY,CACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GACtB,OAAO,CAAC,GAAG,CAAC;IAuBT,cAAc,CAAC,GAAG,EAAE,OAAO;IAW3B,iBAAiB,CAAC,GAAG,EAAE,OAAO;IAW9B,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ;IA0BhD,mBAAmB,CAAC,MAAM,EAAE,MAAM;IAMlC,oBAAoB,CAAC,SAAS,EAAE,MAAM;IAOtC,kBAAkB,CAAC,OAAO,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;YActC,cAAc;IAkCtB,aAAa,CAAC,yBAAyB,EAAE,GAAG,GAAG,OAAO,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAC,CAAC;IA4B3G,OAAO,CAAC,WAAW;IAUb,QAAQ,CAAC,iBAAiB,EAAE,GAAG,GAAG,OAAO,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,GAAG,CAAA;KAAC,CAAC;IAcnG,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAUlE"}
+{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,WAAW,EAAC,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAC,WAAW,EAAC,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAC,aAAa,EAAC,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAC,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAC,OAAO,EAAE,QAAQ,EAAC,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAC,UAAU,EAAiB,MAAM,aAAa,CAAC;AAKvD,qBACa,WAAW;IAIhB,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW;IAC3C,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,aAAa;IACxC,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU;IACzC,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,aAAa;IANnD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;gBAGpB,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,aAAa,EACrB,UAAU,EAAE,UAAU,EACtB,aAAa,EAAE,aAAa;IAK7C,QAAQ,CAAC,WAAW,EAAE,WAAW;;;;IA2BjC,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,GAAG,CAAA;KAAC,CAAC;IA8B1D,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBlD,YAAY,CACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GACtB,OAAO,CAAC,GAAG,CAAC;IAuBT,cAAc,CAAC,GAAG,EAAE,OAAO;IAW3B,iBAAiB,CAAC,GAAG,EAAE,OAAO;IAW9B,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ;IA0BhD,mBAAmB,CAAC,MAAM,EAAE,MAAM;IAMlC,oBAAoB,CAAC,SAAS,EAAE,MAAM;IAOtC,kBAAkB,CAAC,OAAO,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;YActC,cAAc;IAkCtB,aAAa,CAAC,yBAAyB,EAAE,GAAG,GAAG,OAAO,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAC,CAAC;IA4B3G,OAAO,CAAC,WAAW;IAUb,QAAQ,CAAC,iBAAiB,EAAE,GAAG,GAAG,OAAO,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,GAAG,CAAA;KAAC,CAAC;IAcnG,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAUlE"}

package/dist/modules/core/core.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core.controller.d.ts","sourceRoot":"","sources":["../../../src/modules/core/core.controller.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,WAAW,EAAC,MAAM,gBAAgB,CAAC;AAI3C,OAAO,EAAC,kBAAkB,EAAC,MAAM,yCAAyC,CAAC;AAQ3E,8BACsB,cAAc,CAAC,CAAC;IAM9B,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IAL9C,MAAM,KAAK,UAAU,IAAI,MAAM,CAE9B;IAED,SAAS,aACc,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IAK9C,SAAS,CAAC,QAAQ,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;IAIrD,OAAO;IAMP,OAAO,CAAc,EAAE,EAAE,MAAM;IAM/B,MAAM,CAAS,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAC;IAoBtD,MAAM,CAAc,EAAE,EAAE,MAAM,EAAU,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAoBxD,MAAM,CAAc,EAAE,EAAE,MAAM;CAGvC"}
+{"version":3,"file":"core.controller.d.ts","sourceRoot":"","sources":["../../../src/modules/core/core.controller.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,WAAW,EAAC,MAAM,gBAAgB,CAAC;AAI3C,OAAO,EAAC,kBAAkB,EAAC,MAAM,yCAAyC,CAAC;AAS3E,8BACsB,cAAc,CAAC,CAAC;IAM9B,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IAL9C,MAAM,KAAK,UAAU,IAAI,MAAM,CAE9B;IAED,SAAS,aACc,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IAK9C,SAAS,CAAC,QAAQ,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;IAIrD,OAAO;IAMP,OAAO,CAAc,EAAE,EAAE,MAAM;IAM/B,MAAM,CAAS,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAC;IAuBtD,MAAM,CAAc,EAAE,EAAE,MAAM,EAAU,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAsBxD,MAAM,CAAc,EAAE,EAAE,MAAM;CAGvC"}

package/dist/modules/core/core.controller.js

@@ -39,10 +39,15 @@ let CoreController = exports.CoreController = CoreController_1 = class CoreContr
         const model = this.constructor.entityName;
         const rolePermissions = this.permissionsService.getPermissionsConfig()[model]?.[role];
         const actionPermission = rolePermissions?.['create'];
-        if (typeof actionPermission !== 'string' &&
-            actionPermission?.setUserIdField) {
-            const userIdField = actionPermission.setUserIdField;
-            data[userIdField] = user.id;
+        if (typeof actionPermission !== 'string' && actionPermission) {
+            // Strip restricted fields first, then force the server-owned user id
+            // (so setUserIdField cannot be clobbered by a restricted-field strip).
+            for (const field of (actionPermission.restrictedFields ?? [])) {
+                delete data[field];
+            }
+            if (actionPermission.setUserIdField) {
+                data[actionPermission.setUserIdField] = user.id;
+            }
         }
         return this.service.create(data);
     }
@@ -51,7 +56,9 @@ let CoreController = exports.CoreController = CoreController_1 = class CoreContr
         const role = user?.role || 'GUEST';
         const model = this.constructor.entityName;
         const rolePermissions = this.permissionsService.getPermissionsConfig()[model]?.[role];
-        const actionPermission = rolePermissions?.['update'];
+        // The action key is 'updateMany' (matches @Permission('updateMany') and
+        // the proxy) — reading 'update' here meant restrictedFields never applied.
+        const actionPermission = rolePermissions?.['updateMany'];
         let restrictedFields = [];
         if (typeof actionPermission !== 'string' && actionPermission?.restrictedFields) {
             restrictedFields = actionPermission.restrictedFields;

package/dist/modules/user/user.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.service.d.ts","sourceRoot":"","sources":["../../../src/modules/user/user.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,aAAa,EAAC,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAC,eAAe,EAAC,MAAM,wCAAwC,CAAC;AACvE,OAAO,EAAC,WAAW,EAAC,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAAC,IAAI,EAAC,MAAM,gBAAgB,CAAC;AAEpC,qBACa,WAAY,SAAQ,WAAW,CAAC,IAAI,CAAC;IAClC,SAAS,CAAC,MAAM,EAAE,aAAa;gBAArB,MAAM,EAAE,aAAa;IAIrC,UAAU,CAAC,eAAe,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAM3D,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAUpD,WAAW,CAAC,KAAK,EAAE,MAAM;CAYlC"}
+{"version":3,"file":"user.service.d.ts","sourceRoot":"","sources":["../../../src/modules/user/user.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,aAAa,EAAC,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAC,eAAe,EAAC,MAAM,wCAAwC,CAAC;AACvE,OAAO,EAAC,WAAW,EAAC,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAAC,IAAI,EAAC,MAAM,gBAAgB,CAAC;AAEpC,qBACa,WAAY,SAAQ,WAAW,CAAC,IAAI,CAAC;IAClC,SAAS,CAAC,MAAM,EAAE,aAAa;gBAArB,MAAM,EAAE,aAAa;IAIrC,UAAU,CAAC,eAAe,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAY3D,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAUpD,WAAW,CAAC,KAAK,EAAE,MAAM;CAYlC"}

package/dist/modules/user/user.service.js

@@ -19,9 +19,13 @@ let UserService = exports.UserService = class UserService extends core_service_1
         this.prisma = prisma;
     }
     async createUser(createUserInput) {
-        return this.prisma.user.create({
-            data: createUserInput,
-        });
+        // Registration is an unauthenticated framework flow (role GUEST has no
+        // create permission). Its input is already constrained by RegisterDto,
+        // so bypass access filtering — otherwise the create default-deny would
+        // reject sign-up.
+        return this.prisma.user.create({ data: createUserInput }, 
+        // @ts-ignore — options arg is accepted by the proxy delegate
+        { BYPASS_FILTERING: true });
     }
     async findByField(field, value) {
         const where = {