@aurorajs.dev/catalyst-cli 1.1.3 → 2.0.0

package/dist/templates/backend/packages/iam/src/@app/iam/tenant/application/create/iam-create-tenant.handler.spec.ts

@@ -0,0 +1,195 @@
+import type { Mock } from 'vitest';
+import { IamAccount, IamCreateTenantInput } from '@api/graphql.js';
+import { IamPermissions } from '@app/iam/shared/index.js';
+import { EventEmitter2 } from '@nestjs/event-emitter';
+import { Test, TestingModule } from '@nestjs/testing';
+import { IamFindTenantByIdService } from '../find/iam-find-tenant-by-id.service.js';
+import { IamGetTenantsService } from '../get/iam-get-tenants.service.js';
+import { IamCreateTenantHandler } from './iam-create-tenant.handler.js';
+import { IamCreateTenantService } from './iam-create-tenant.service.js';
+
+const TENANT_ID = 'a1111111-a111-4111-8111-111111111111';
+const PARENT_HELD = '11111111-1111-4111-8111-111111111111';
+const PARENT_NOT_HELD = '22222222-2222-4222-8222-222222222222';
+const ACCOUNT_ID = 'c1111111-c111-4111-8111-111111111111';
+const CALLER_ID = 'd0000000-0000-4000-8000-000000000000';
+
+const buildPayload = (overrides: Partial<IamCreateTenantInput> = {}): IamCreateTenantInput => ({
+  id: TENANT_ID,
+  name: 'New tenant',
+  isActive: true,
+  ...overrides,
+});
+
+const buildCaller = (overrides: Partial<IamAccount> = {}): IamAccount =>
+  ({
+    id: CALLER_ID,
+    dPermissions: { all: ['p1'] },
+    dTenants: [],
+    ...overrides,
+  }) as unknown as IamAccount;
+
+describe('IamCreateTenantHandler — tenant-scope escalation guard', () => {
+  let handler: IamCreateTenantHandler;
+  let createService: { main: Mock };
+  let findByIdService: { main: Mock };
+  let getTenantsService: { main: Mock };
+  let eventEmitter: { emit: Mock };
+
+  beforeEach(async () => {
+    createService = { main: vi.fn().mockResolvedValue(undefined) };
+    findByIdService = { main: vi.fn().mockResolvedValue(buildPayload()) };
+    getTenantsService = { main: vi.fn().mockResolvedValue([]) };
+    eventEmitter = { emit: vi.fn() };
+
+    const module: TestingModule = await Test.createTestingModule({
+      providers: [
+        IamCreateTenantHandler,
+        { provide: EventEmitter2, useValue: eventEmitter },
+        { provide: IamCreateTenantService, useValue: createService },
+        { provide: IamFindTenantByIdService, useValue: findByIdService },
+        { provide: IamGetTenantsService, useValue: getTenantsService },
+      ],
+    }).compile();
+
+    handler = module.get<IamCreateTenantHandler>(IamCreateTenantHandler);
+  });
+
+  it('rejects a caller without SUDO creating a root tenant (no parent) with accountIds', async () => {
+    const payload = buildPayload({ accountIds: [ACCOUNT_ID] });
+    const caller = buildCaller();
+
+    await expect(handler.main(payload, caller)).rejects.toMatchObject({
+      response: { statusCode: 401, translation: 'iam.error.insufficientTenantScope' },
+    });
+    expect(createService.main).not.toHaveBeenCalled();
+  });
+
+  it('rejects a caller without SUDO creating a tenant with accountIds under a parent they do not hold', async () => {
+    const payload = buildPayload({ parentId: PARENT_NOT_HELD, accountIds: [ACCOUNT_ID] });
+    const caller = buildCaller({ dTenants: [PARENT_HELD] });
+
+    await expect(handler.main(payload, caller)).rejects.toMatchObject({
+      response: { statusCode: 401, translation: 'iam.error.insufficientTenantScope' },
+    });
+    expect(createService.main).not.toHaveBeenCalled();
+  });
+
+  it('allows a caller without SUDO creating a tenant with accountIds under a parent they hold', async () => {
+    const payload = buildPayload({ parentId: PARENT_HELD, accountIds: [ACCOUNT_ID] });
+    const caller = buildCaller({ dTenants: [PARENT_HELD] });
+
+    await expect(handler.main(payload, caller)).resolves.toBeDefined();
+    expect(createService.main).toHaveBeenCalledTimes(1);
+  });
+
+  it('allows a SUDO caller to create a root tenant with accountIds', async () => {
+    const payload = buildPayload({ accountIds: [ACCOUNT_ID] });
+    const caller = buildCaller({ dPermissions: { all: [IamPermissions.SUDO] } });
+
+    await expect(handler.main(payload, caller)).resolves.toBeDefined();
+    expect(createService.main).toHaveBeenCalledTimes(1);
+  });
+
+  it('does not fire the guard on a create with no accountIds, regardless of caller scope', async () => {
+    const payload = buildPayload({ parentId: PARENT_NOT_HELD });
+    const caller = buildCaller({ dTenants: [] });
+
+    await expect(handler.main(payload, caller)).resolves.toBeDefined();
+    expect(createService.main).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe('IamCreateTenantHandler — orphan-adoption integrity guard', () => {
+  let handler: IamCreateTenantHandler;
+  let createService: { main: Mock };
+  let findByIdService: { main: Mock };
+  let getTenantsService: { main: Mock };
+  let eventEmitter: { emit: Mock };
+
+  beforeEach(async () => {
+    createService = { main: vi.fn().mockResolvedValue(undefined) };
+    findByIdService = { main: vi.fn().mockResolvedValue(buildPayload()) };
+    getTenantsService = { main: vi.fn().mockResolvedValue([]) };
+    eventEmitter = { emit: vi.fn() };
+
+    const module: TestingModule = await Test.createTestingModule({
+      providers: [
+        IamCreateTenantHandler,
+        { provide: EventEmitter2, useValue: eventEmitter },
+        { provide: IamCreateTenantService, useValue: createService },
+        { provide: IamFindTenantByIdService, useValue: findByIdService },
+        { provide: IamGetTenantsService, useValue: getTenantsService },
+      ],
+    }).compile();
+
+    handler = module.get<IamCreateTenantHandler>(IamCreateTenantHandler);
+  });
+
+  it('rejects a tenant id already referenced as the parentId of an existing tenant', async () => {
+    const payload = buildPayload();
+    getTenantsService.main.mockResolvedValueOnce([{ id: 'existing-child', parentId: TENANT_ID }]);
+
+    await expect(handler.main(payload, buildCaller())).rejects.toMatchObject({
+      response: { statusCode: 409, translation: 'iam.error.tenantIdReusedAsParent' },
+    });
+    expect(createService.main).not.toHaveBeenCalled();
+  });
+
+  it('runs the integrity check with no currentAccount at all', async () => {
+    const payload = buildPayload();
+    getTenantsService.main.mockResolvedValueOnce([{ id: 'existing-child', parentId: TENANT_ID }]);
+
+    await expect(handler.main(payload, undefined)).rejects.toMatchObject({
+      response: { statusCode: 409, translation: 'iam.error.tenantIdReusedAsParent' },
+    });
+    expect(createService.main).not.toHaveBeenCalled();
+  });
+
+  it('allows a SUDO caller to recreate a tenant that adopts orphaned children, regardless of scope', async () => {
+    const payload = buildPayload();
+    const caller = buildCaller({ dPermissions: { all: [IamPermissions.SUDO] }, dTenants: [] });
+    getTenantsService.main.mockResolvedValueOnce([{ id: 'existing-child', parentId: TENANT_ID }]);
+
+    await expect(handler.main(payload, caller)).resolves.toBeDefined();
+    expect(createService.main).toHaveBeenCalledTimes(1);
+  });
+
+  it('allows a non-SUDO caller who holds the whole orphaned subtree to recreate the parent', async () => {
+    const payload = buildPayload();
+    const caller = buildCaller({ dTenants: ['existing-child', 'existing-grandchild'] });
+    // First call: direct children of the recreated id (the orphan check itself).
+    getTenantsService.main.mockResolvedValueOnce([{ id: 'existing-child', parentId: TENANT_ID }]);
+    // Second call: the whole tenant table, to walk the orphaned child's own descendants.
+    getTenantsService.main.mockResolvedValueOnce([
+      { id: 'existing-child', parentId: TENANT_ID },
+      { id: 'existing-grandchild', parentId: 'existing-child' },
+    ]);
+
+    await expect(handler.main(payload, caller)).resolves.toBeDefined();
+    expect(createService.main).toHaveBeenCalledTimes(1);
+  });
+
+  it('rejects a non-SUDO caller who holds the orphaned child but not its own descendant', async () => {
+    const payload = buildPayload();
+    const caller = buildCaller({ dTenants: ['existing-child'] });
+    getTenantsService.main.mockResolvedValueOnce([{ id: 'existing-child', parentId: TENANT_ID }]);
+    getTenantsService.main.mockResolvedValueOnce([
+      { id: 'existing-child', parentId: TENANT_ID },
+      { id: 'existing-grandchild', parentId: 'existing-child' },
+    ]);
+
+    await expect(handler.main(payload, caller)).rejects.toMatchObject({
+      response: { statusCode: 409, translation: 'iam.error.tenantIdReusedAsParent' },
+    });
+    expect(createService.main).not.toHaveBeenCalled();
+  });
+
+  it('allows creating a tenant with a fresh id not referenced as any parentId', async () => {
+    const payload = buildPayload();
+    getTenantsService.main.mockResolvedValueOnce([]);
+
+    await expect(handler.main(payload, buildCaller())).resolves.toBeDefined();
+    expect(createService.main).toHaveBeenCalledTimes(1);
+  });
+});

package/dist/templates/backend/packages/iam/src/@app/iam/tenant/application/create/iam-create-tenant.handler.ts

@@ -2,11 +2,14 @@
  * @aurora-catalyst-generated
  * @source cliter/iam/tenant.aurora.yaml
  */
-import { IamCreateTenantInput, IamTenant } from '@api/graphql';
-import { IamCreateTenantService, IamFindTenantByIdService } from '@app/iam/tenant';
-import { IamTenantFieldSchema } from '@app/iam/tenant/domain';
-import { ApplySchema, EmitEvent, HandlerMeta } from '@aurorajs.dev/core-back';
-import { Injectable } from '@nestjs/common';
+import { IamAccount, IamCreateTenantInput, IamTenant } from '@api/graphql.js';
+import { IamPermissions, iamResolveAccountTenants } from '@app/iam/shared/index.js';
+import { IamCreateTenantService } from '@app/iam/tenant/application/create/iam-create-tenant.service.js';
+import { IamFindTenantByIdService } from '@app/iam/tenant/application/find/iam-find-tenant-by-id.service.js';
+import { IamGetTenantsService } from '@app/iam/tenant/application/get/iam-get-tenants.service.js';
+import { IamTenantFieldSchema } from '@app/iam/tenant/domain/index.js';
+import { ApplySchema, Arr, EmitEvent, HandlerMeta } from '@aurorajs.dev/core-back';
+import { ConflictException, Injectable } from '@nestjs/common';
 import { EventEmitter2 } from '@nestjs/event-emitter';
 
 @Injectable()
@@ -15,11 +18,86 @@ export class IamCreateTenantHandler {
     private readonly eventEmitter: EventEmitter2,
     private readonly createService: IamCreateTenantService,
     private readonly findByIdService: IamFindTenantByIdService,
+    private readonly getTenantsService: IamGetTenantsService,
   ) {}
 
   @EmitEvent('iam.tenant.created')
-  @ApplySchema(IamTenantFieldSchema)
-  async main(payload: IamCreateTenantInput, handlerMeta?: HandlerMeta): Promise<IamTenant> {
+  @ApplySchema({ schema: IamTenantFieldSchema, operation: 'create' })
+  async main(
+    payload: IamCreateTenantInput,
+    currentAccount?: IamAccount,
+    handlerMeta?: HandlerMeta,
+  ): Promise<IamTenant> {
+    // #region orphan-adoption integrity guard
+    // Deleting a tenant does not touch its children's parentId (no FK on iam_tenant.parent_id —
+    // see iam-delete-tenant-by-id.handler.ts). Recreating a tenant with the SAME id as a deleted
+    // one would silently adopt those orphaned children: the account loader rebuilds dTenants from
+    // the live parentId links at token issuance, so every account expanding the new parent gains
+    // them.
+    //
+    // A flat, unconditional rejection also blocks two LEGITIMATE cases: creating a child before
+    // its parent (legal today — no FK enforces ordering), and recreating a tenant that was
+    // deleted while its children survived. So this is a SCOPE decision, not a blanket ban: a
+    // caller who already holds the whole would-be-adopted subtree is reorganising a hierarchy it
+    // owns, and may proceed. SUDO is exempt. With NO caller account at all (the BPP tenant-writer
+    // path calls this handler that way) there is nobody to hold the subtree, so it stays a flat
+    // reject — never a silent adoption.
+    const orphanedChildren = await this.getTenantsService.main({
+      where: { parentId: { eq: payload.id } },
+    });
+
+    if (orphanedChildren.length > 0) {
+      const callerPermissions = (currentAccount?.dPermissions as { all?: string[] })?.all ?? [];
+      const isSudo = callerPermissions.includes(IamPermissions.SUDO);
+
+      if (!isSudo) {
+        const callerTenants = (currentAccount?.dTenants as string[]) ?? [];
+
+        // The whole tenant table is needed to walk each orphaned child's own descendants —
+        // holding the child alone is not enough; the caller must hold everything the recreated
+        // parent would adopt, subtree included.
+        const allTenants = currentAccount ? await this.getTenantsService.main() : [];
+        const adoptedSubtree = iamResolveAccountTenants(
+          orphanedChildren.map((child) => child.id),
+          allTenants,
+          true,
+        );
+
+        if (!currentAccount || !Arr.contained(adoptedSubtree, callerTenants)) {
+          throw new ConflictException({
+            statusCode: 409,
+            message: `Tenant id ${payload.id} is already referenced as the parent of an existing tenant`,
+            translation: 'iam.error.tenantIdReusedAsParent',
+            placeholders: { id: payload.id },
+          });
+        }
+      }
+    }
+    // #endregion
+
+    // #region tenant-scope escalation guard
+    // Rule 1 (create side): the tenant does not exist yet, so the caller must hold its PARENT.
+    // A root tenant (no parent) may only receive accountIds from a SUDO caller — mirrors
+    // iam-update-account-by-id.handler.ts's shape.
+    if (Array.isArray(payload.accountIds) && payload.accountIds.length > 0) {
+      const callerPermissions = (currentAccount?.dPermissions as { all?: string[] })?.all ?? [];
+      const isSudo = callerPermissions.includes(IamPermissions.SUDO);
+
+      if (!isSudo) {
+        const callerTenants = (currentAccount?.dTenants as string[]) ?? [];
+        const holdsParent = Boolean(payload.parentId) && callerTenants.includes(payload.parentId);
+
+        if (!holdsParent) {
+          throw new ConflictException({
+            statusCode: 401,
+            message: 'Insufficient permissions to assign accounts to this tenant',
+            translation: 'iam.error.insufficientTenantScope',
+          });
+        }
+      }
+    }
+    // #endregion
+
     await this.createService.main(payload, handlerMeta);
 
     return await this.findByIdService.main(payload.id, {}, handlerMeta);

package/dist/templates/backend/packages/iam/src/@app/iam/tenant/application/create/iam-create-tenant.service.ts

@@ -2,8 +2,8 @@
  * @aurora-catalyst-generated
  * @source cliter/iam/tenant.aurora.yaml
  */
-import { IamCreateTenantInput } from '@api/graphql';
-import { IamDrizzleTenantRepository } from '@app/iam/tenant';
+import { IamCreateTenantInput } from '@api/graphql.js';
+import { IamDrizzleTenantRepository } from '@app/iam/tenant/infrastructure/drizzle/iam-drizzle-tenant.repository.js';
 import { HandlerMeta } from '@aurorajs.dev/core-back';
 import { Injectable } from '@nestjs/common';
 

package/dist/templates/backend/packages/iam/src/@app/iam/tenant/application/create/iam-create-tenants.handler.spec.ts

@@ -0,0 +1,98 @@
+import type { Mock } from 'vitest';
+import { IamAccount, IamCreateTenantInput } from '@api/graphql.js';
+import { IamPermissions } from '@app/iam/shared/index.js';
+import { EventEmitter2 } from '@nestjs/event-emitter';
+import { Test, TestingModule } from '@nestjs/testing';
+import { IamGetTenantsService } from '../get/iam-get-tenants.service.js';
+import { IamCreateTenantsHandler } from './iam-create-tenants.handler.js';
+import { IamCreateTenantsService } from './iam-create-tenants.service.js';
+
+const TENANT_ID_1 = 'a1111111-a111-4111-8111-111111111111';
+const TENANT_ID_2 = 'b2222222-b222-4222-8222-222222222222';
+const CALLER_ID = 'd0000000-0000-4000-8000-000000000000';
+
+const buildPayload = (overrides: Partial<IamCreateTenantInput>[] = []): IamCreateTenantInput[] => [
+  { id: TENANT_ID_1, name: 'Tenant 1', isActive: true, ...overrides[0] },
+  { id: TENANT_ID_2, name: 'Tenant 2', isActive: true, ...overrides[1] },
+];
+
+const buildCaller = (overrides: Partial<IamAccount> = {}): IamAccount =>
+  ({
+    id: CALLER_ID,
+    dPermissions: { all: ['p1'] },
+    dTenants: [],
+    ...overrides,
+  }) as unknown as IamAccount;
+
+describe('IamCreateTenantsHandler — orphan-adoption integrity guard (bulk)', () => {
+  let handler: IamCreateTenantsHandler;
+  let createService: { main: Mock };
+  let getTenantsService: { main: Mock };
+  let eventEmitter: { emit: Mock };
+
+  beforeEach(async () => {
+    createService = { main: vi.fn().mockResolvedValue(undefined) };
+    getTenantsService = { main: vi.fn().mockResolvedValue([]) };
+    eventEmitter = { emit: vi.fn() };
+
+    const module: TestingModule = await Test.createTestingModule({
+      providers: [
+        IamCreateTenantsHandler,
+        { provide: EventEmitter2, useValue: eventEmitter },
+        { provide: IamCreateTenantsService, useValue: createService },
+        { provide: IamGetTenantsService, useValue: getTenantsService },
+      ],
+    }).compile();
+
+    handler = module.get<IamCreateTenantsHandler>(IamCreateTenantsHandler);
+  });
+
+  it('rejects the whole batch when one id is already referenced as the parentId of an existing tenant', async () => {
+    const payload = buildPayload();
+    getTenantsService.main.mockResolvedValueOnce([{ id: 'existing-child', parentId: TENANT_ID_2 }]);
+
+    await expect(handler.main(payload)).rejects.toMatchObject({
+      response: { statusCode: 409, translation: 'iam.error.tenantIdReusedAsParent' },
+    });
+    expect(createService.main).not.toHaveBeenCalled();
+  });
+
+  it('allows a batch of ids none of which are referenced as any parentId', async () => {
+    const payload = buildPayload();
+    getTenantsService.main.mockResolvedValueOnce([]);
+
+    await expect(handler.main(payload)).resolves.toBe(true);
+    expect(createService.main).toHaveBeenCalledTimes(1);
+  });
+
+  it('allows a SUDO caller to recreate a batch that adopts orphaned children, regardless of scope', async () => {
+    const payload = buildPayload();
+    const caller = buildCaller({ dPermissions: { all: [IamPermissions.SUDO] } });
+    getTenantsService.main.mockResolvedValueOnce([{ id: 'existing-child', parentId: TENANT_ID_2 }]);
+
+    await expect(handler.main(payload, caller)).resolves.toBe(true);
+    expect(createService.main).toHaveBeenCalledTimes(1);
+  });
+
+  it('allows a non-SUDO caller who holds the whole orphaned subtree to recreate the batch', async () => {
+    const payload = buildPayload();
+    const caller = buildCaller({ dTenants: ['existing-child'] });
+    getTenantsService.main.mockResolvedValueOnce([{ id: 'existing-child', parentId: TENANT_ID_2 }]);
+    getTenantsService.main.mockResolvedValueOnce([{ id: 'existing-child', parentId: TENANT_ID_2 }]);
+
+    await expect(handler.main(payload, caller)).resolves.toBe(true);
+    expect(createService.main).toHaveBeenCalledTimes(1);
+  });
+
+  it('rejects a non-SUDO caller who does not hold the orphaned subtree', async () => {
+    const payload = buildPayload();
+    const caller = buildCaller({ dTenants: [] });
+    getTenantsService.main.mockResolvedValueOnce([{ id: 'existing-child', parentId: TENANT_ID_2 }]);
+    getTenantsService.main.mockResolvedValueOnce([{ id: 'existing-child', parentId: TENANT_ID_2 }]);
+
+    await expect(handler.main(payload, caller)).rejects.toMatchObject({
+      response: { statusCode: 409, translation: 'iam.error.tenantIdReusedAsParent' },
+    });
+    expect(createService.main).not.toHaveBeenCalled();
+  });
+});

package/dist/templates/backend/packages/iam/src/@app/iam/tenant/application/create/iam-create-tenants.handler.ts

@@ -2,11 +2,13 @@
  * @aurora-catalyst-generated
  * @source cliter/iam/tenant.aurora.yaml
  */
-import { IamCreateTenantInput } from '@api/graphql';
-import { IamCreateTenantsService } from '@app/iam/tenant';
-import { IamTenantFieldSchema } from '@app/iam/tenant/domain';
-import { ApplySchema, EmitEvent, HandlerMeta } from '@aurorajs.dev/core-back';
-import { Injectable } from '@nestjs/common';
+import { IamAccount, IamCreateTenantInput } from '@api/graphql.js';
+import { IamPermissions, iamResolveAccountTenants } from '@app/iam/shared/index.js';
+import { IamCreateTenantsService } from '@app/iam/tenant/application/create/iam-create-tenants.service.js';
+import { IamGetTenantsService } from '@app/iam/tenant/application/get/iam-get-tenants.service.js';
+import { IamTenantFieldSchema } from '@app/iam/tenant/domain/index.js';
+import { ApplySchema, Arr, EmitEvent, HandlerMeta } from '@aurorajs.dev/core-back';
+import { ConflictException, Injectable } from '@nestjs/common';
 import { EventEmitter2 } from '@nestjs/event-emitter';
 
 @Injectable()
@@ -14,11 +16,55 @@ export class IamCreateTenantsHandler {
   constructor(
     private readonly eventEmitter: EventEmitter2,
     private readonly createService: IamCreateTenantsService,
+    private readonly getTenantsService: IamGetTenantsService,
   ) {}
 
   @EmitEvent('iam.tenant.created', { returnInputPayload: true })
-  @ApplySchema(IamTenantFieldSchema)
-  async main(payload: IamCreateTenantInput[], handlerMeta?: HandlerMeta): Promise<boolean> {
+  @ApplySchema({ schema: IamTenantFieldSchema, operation: 'create' })
+  async main(
+    payload: IamCreateTenantInput[],
+    currentAccount?: IamAccount,
+    handlerMeta?: HandlerMeta,
+  ): Promise<boolean> {
+    // #region orphan-adoption integrity guard (bulk)
+    // Same scope decision as the single-row create guard — see iam-create-tenant.handler.ts.
+    // Checked as one query against the whole incoming id set; any match rejects the WHOLE batch
+    // unless the caller holds every adopted subtree, mirroring the bulk tenant-account guard's
+    // "nothing persisted" shape.
+    const incomingIds = payload.map((item) => item.id).filter((id): id is string => Boolean(id));
+    const orphanedChildren =
+      incomingIds.length > 0
+        ? await this.getTenantsService.main({ where: { parentId: { in: incomingIds } } })
+        : [];
+
+    if (orphanedChildren.length > 0) {
+      const callerPermissions = (currentAccount?.dPermissions as { all?: string[] })?.all ?? [];
+      const isSudo = callerPermissions.includes(IamPermissions.SUDO);
+
+      if (!isSudo) {
+        const callerTenants = (currentAccount?.dTenants as string[]) ?? [];
+        const allTenants = currentAccount ? await this.getTenantsService.main() : [];
+        const adoptedSubtree = iamResolveAccountTenants(
+          orphanedChildren.map((child) => child.id),
+          allTenants,
+          true,
+        );
+
+        if (!currentAccount || !Arr.contained(adoptedSubtree, callerTenants)) {
+          const reusedIds = [...new Set(orphanedChildren.map((child) => child.parentId))].join(
+            ', ',
+          );
+          throw new ConflictException({
+            statusCode: 409,
+            message: `Tenant id(s) ${reusedIds} are already referenced as the parent of an existing tenant`,
+            translation: 'iam.error.tenantIdReusedAsParent',
+            placeholders: { id: reusedIds },
+          });
+        }
+      }
+    }
+    // #endregion
+
     await this.createService.main(payload, handlerMeta);
 
     return true;

package/dist/templates/backend/packages/iam/src/@app/iam/tenant/application/create/iam-create-tenants.service.ts

@@ -2,8 +2,8 @@
  * @aurora-catalyst-generated
  * @source cliter/iam/tenant.aurora.yaml
  */
-import { IamCreateTenantInput } from '@api/graphql';
-import { IamDrizzleTenantRepository } from '@app/iam/tenant';
+import { IamCreateTenantInput } from '@api/graphql.js';
+import { IamDrizzleTenantRepository } from '@app/iam/tenant/infrastructure/drizzle/iam-drizzle-tenant.repository.js';
 import { HandlerMeta } from '@aurorajs.dev/core-back';
 import { Injectable } from '@nestjs/common';
 

package/dist/templates/backend/packages/iam/src/@app/iam/tenant/application/delete/iam-delete-tenant-by-id.handler.ts

@@ -2,9 +2,10 @@
  * @aurora-catalyst-generated
  * @source cliter/iam/tenant.aurora.yaml
  */
-import { IamTenant } from '@api/graphql';
-import { IamDeleteTenantByIdService, IamFindTenantByIdService } from '@app/iam/tenant';
-import { IamTenantFieldSchema } from '@app/iam/tenant/domain';
+import { IamTenant } from '@api/graphql.js';
+import { IamDeleteTenantByIdService } from '@app/iam/tenant/application/delete/iam-delete-tenant-by-id.service.js';
+import { IamFindTenantByIdService } from '@app/iam/tenant/application/find/iam-find-tenant-by-id.service.js';
+import { IamTenantFieldSchema } from '@app/iam/tenant/domain/index.js';
 import { EmitEvent, Format, HandlerMeta, QueryStatement } from '@aurorajs.dev/core-back';
 import { Injectable, NotFoundException } from '@nestjs/common';
 import { EventEmitter2 } from '@nestjs/event-emitter';

package/dist/templates/backend/packages/iam/src/@app/iam/tenant/application/delete/iam-delete-tenant-by-id.service.ts

@@ -2,7 +2,7 @@
  * @aurora-catalyst-generated
  * @source cliter/iam/tenant.aurora.yaml
  */
-import { IamDrizzleTenantRepository } from '@app/iam/tenant';
+import { IamDrizzleTenantRepository } from '@app/iam/tenant/infrastructure/drizzle/iam-drizzle-tenant.repository.js';
 import { HandlerMeta, QueryStatement } from '@aurorajs.dev/core-back';
 import { Injectable } from '@nestjs/common';
 

package/dist/templates/backend/packages/iam/src/@app/iam/tenant/application/delete/iam-delete-tenants.handler.ts

@@ -2,9 +2,10 @@
  * @aurora-catalyst-generated
  * @source cliter/iam/tenant.aurora.yaml
  */
-import { IamTenant } from '@api/graphql';
-import { IamDeleteTenantsService, IamGetTenantsService } from '@app/iam/tenant';
-import { IamTenantFieldSchema } from '@app/iam/tenant/domain';
+import { IamTenant } from '@api/graphql.js';
+import { IamDeleteTenantsService } from '@app/iam/tenant/application/delete/iam-delete-tenants.service.js';
+import { IamGetTenantsService } from '@app/iam/tenant/application/get/iam-get-tenants.service.js';
+import { IamTenantFieldSchema } from '@app/iam/tenant/domain/index.js';
 import { EmitEvent, Format, HandlerMeta, QueryStatement } from '@aurorajs.dev/core-back';
 import { Injectable } from '@nestjs/common';
 import { EventEmitter2 } from '@nestjs/event-emitter';

package/dist/templates/backend/packages/iam/src/@app/iam/tenant/application/delete/iam-delete-tenants.service.ts

@@ -2,7 +2,7 @@
  * @aurora-catalyst-generated
  * @source cliter/iam/tenant.aurora.yaml
  */
-import { IamDrizzleTenantRepository } from '@app/iam/tenant';
+import { IamDrizzleTenantRepository } from '@app/iam/tenant/infrastructure/drizzle/iam-drizzle-tenant.repository.js';
 import { HandlerMeta, QueryStatement } from '@aurorajs.dev/core-back';
 import { Injectable } from '@nestjs/common';
 

package/dist/templates/backend/packages/iam/src/@app/iam/tenant/application/find/iam-find-tenant-by-id.handler.ts

@@ -2,9 +2,9 @@
  * @aurora-catalyst-generated
  * @source cliter/iam/tenant.aurora.yaml
  */
-import { IamTenant } from '@api/graphql';
-import { IamFindTenantByIdService } from '@app/iam/tenant';
-import { IamTenantFieldSchema } from '@app/iam/tenant/domain';
+import { IamTenant } from '@api/graphql.js';
+import { IamFindTenantByIdService } from '@app/iam/tenant/application/find/iam-find-tenant-by-id.service.js';
+import { IamTenantFieldSchema } from '@app/iam/tenant/domain/index.js';
 import { Format, HandlerMeta, QueryStatement } from '@aurorajs.dev/core-back';
 import { Injectable, NotFoundException } from '@nestjs/common';
 

package/dist/templates/backend/packages/iam/src/@app/iam/tenant/application/find/iam-find-tenant-by-id.service.ts

@@ -2,8 +2,8 @@
  * @aurora-catalyst-generated
  * @source cliter/iam/tenant.aurora.yaml
  */
-import { IamTenant } from '@api/graphql';
-import { IamDrizzleTenantRepository } from '@app/iam/tenant';
+import { IamTenant } from '@api/graphql.js';
+import { IamDrizzleTenantRepository } from '@app/iam/tenant/infrastructure/drizzle/iam-drizzle-tenant.repository.js';
 import { HandlerMeta, QueryStatement } from '@aurorajs.dev/core-back';
 import { Injectable } from '@nestjs/common';
 
@@ -16,9 +16,11 @@ export class IamFindTenantByIdService {
     constraint?: QueryStatement,
     handlerMeta?: HandlerMeta,
   ): Promise<IamTenant> {
-    return await this.repository.findById(id, {
+    const tenant = await this.repository.findById(id, {
       constraint,
       handlerMeta,
     });
+
+    return tenant;
   }
 }

package/dist/templates/backend/packages/iam/src/@app/iam/tenant/application/find/iam-find-tenant.handler.ts

@@ -2,9 +2,9 @@
  * @aurora-catalyst-generated
  * @source cliter/iam/tenant.aurora.yaml
  */
-import { IamTenant } from '@api/graphql';
-import { IamFindTenantService } from '@app/iam/tenant';
-import { IamTenantFieldSchema } from '@app/iam/tenant/domain';
+import { IamTenant } from '@api/graphql.js';
+import { IamFindTenantService } from '@app/iam/tenant/application/find/iam-find-tenant.service.js';
+import { IamTenantFieldSchema } from '@app/iam/tenant/domain/index.js';
 import { Format, HandlerMeta, QueryStatement } from '@aurorajs.dev/core-back';
 import { Injectable, NotFoundException } from '@nestjs/common';
 

package/dist/templates/backend/packages/iam/src/@app/iam/tenant/application/find/iam-find-tenant.service.ts

@@ -2,8 +2,8 @@
  * @aurora-catalyst-generated
  * @source cliter/iam/tenant.aurora.yaml
  */
-import { IamTenant } from '@api/graphql';
-import { IamDrizzleTenantRepository } from '@app/iam/tenant';
+import { IamTenant } from '@api/graphql.js';
+import { IamDrizzleTenantRepository } from '@app/iam/tenant/infrastructure/drizzle/iam-drizzle-tenant.repository.js';
 import { HandlerMeta, QueryStatement } from '@aurorajs.dev/core-back';
 import { Injectable } from '@nestjs/common';
 
@@ -16,10 +16,12 @@ export class IamFindTenantService {
     constraint?: QueryStatement,
     handlerMeta?: HandlerMeta,
   ): Promise<IamTenant> {
-    return await this.repository.find({
+    const tenant = await this.repository.find({
       queryStatement,
       constraint,
       handlerMeta,
     });
+
+    return tenant;
   }
 }

package/dist/templates/backend/packages/iam/src/@app/iam/tenant/application/get/iam-get-tenants.handler.ts

@@ -2,9 +2,9 @@
  * @aurora-catalyst-generated
  * @source cliter/iam/tenant.aurora.yaml
  */
-import { IamTenant } from '@api/graphql';
-import { IamGetTenantsService } from '@app/iam/tenant';
-import { IamTenantFieldSchema } from '@app/iam/tenant/domain';
+import { IamTenant } from '@api/graphql.js';
+import { IamGetTenantsService } from '@app/iam/tenant/application/get/iam-get-tenants.service.js';
+import { IamTenantFieldSchema } from '@app/iam/tenant/domain/index.js';
 import { Format, HandlerMeta, QueryStatement } from '@aurorajs.dev/core-back';
 import { Injectable } from '@nestjs/common';