@bi-analytics/arness-back 0.0.0-stage → 0.3.0

package/harness/skills/nest-base/templates/config/configuration.spec.ts

@@ -0,0 +1,85 @@
+// Plantilla del harness → src/config/configuration.spec.ts
+import { buildConfiguration, type Env } from './configuration';
+
+const base: Env = {
+  DATABASES: 'MAIN',
+  DB_MAIN_HOST: 'localhost',
+  DB_MAIN_NAME: 'analytics',
+  DB_MAIN_USER: 'readonly_user',
+  DB_MAIN_PASSWORD: 'change-me',
+  ACCESS_TOKEN: 'example123',
+  JWT_ACCESS_SECRET: 'access-secret',
+  JWT_REFRESH_SECRET: 'refresh-secret',
+  CORS_ORIGINS: 'http://localhost:4200',
+};
+
+describe('buildConfiguration', () => {
+  it('groups variables by topic and applies non-sensitive defaults', () => {
+    const config = buildConfiguration(base);
+    expect(config.app).toEqual({ nodeEnv: 'development', port: 3000, trustProxyHops: 0 });
+    expect(config.logging).toEqual({ level: 'info', format: 'json' });
+    expect(config.databases.MAIN).toEqual({
+      host: 'localhost',
+      port: 5432,
+      name: 'analytics',
+      user: 'readonly_user',
+      password: 'change-me',
+      ssl: false,
+      poolMax: 10,
+      statementTimeoutMs: 30000,
+    });
+    expect(config.cache.enabled).toBe(false);
+    expect(config.auth.jwt.accessExpiresIn).toBe('15m');
+    expect(config.cors).toEqual({ origins: ['http://localhost:4200'], maxAgeSeconds: 600 });
+    expect(config.monitor).toEqual({ enabled: false, sessionExpiresIn: '15m' });
+  });
+
+  it('converts numbers, booleans and one block per database', () => {
+    const config = buildConfiguration({
+      ...base,
+      PORT: '8080',
+      DATABASES: 'MAIN, reports',
+      DB_MAIN_SSL: 'true',
+      DB_REPORTS_HOST: 'replica',
+      DB_REPORTS_PORT: '6432',
+      DB_REPORTS_NAME: 'reports',
+      DB_REPORTS_USER: 'ro',
+      DB_REPORTS_PASSWORD: 'x',
+      CACHE_ENABLED: 'true',
+      REDIS_URL: 'redis://localhost:6379',
+    });
+    expect(config.app.port).toBe(8080);
+    expect(config.databases.MAIN.ssl).toBe(true);
+    expect(config.databases.REPORTS.port).toBe(6432);
+    expect(config.cache).toMatchObject({ enabled: true, redisUrl: 'redis://localhost:6379' });
+  });
+
+  it.each(['ACCESS_TOKEN', 'JWT_ACCESS_SECRET', 'JWT_REFRESH_SECRET', 'DB_MAIN_PASSWORD'])(
+    'fails without the secret %s and does not print any value',
+    (name) => {
+      const env = { ...base, [name]: '' };
+      expect(() => buildConfiguration(env)).toThrow(`${name} is required`);
+    },
+  );
+
+  it('requires REDIS_URL only when the cache is enabled', () => {
+    expect(() => buildConfiguration({ ...base, CACHE_ENABLED: 'true' })).toThrow(
+      'REDIS_URL is required',
+    );
+  });
+
+  it('does not allow pretty logs in production', () => {
+    expect(() =>
+      buildConfiguration({ ...base, NODE_ENV: 'production', LOG_FORMAT: 'pretty' }),
+    ).toThrow('not allowed');
+  });
+
+  it.each([
+    ['PORT', 'abc', /integer/],
+    ['MONITOR_ENABLED', 'yes', /true or false/],
+    ['LOG_FORMAT', 'xml', /json or pretty/],
+    ['HTTP_TRUST_PROXY_HOPS', '11', /between 0 and 10/],
+  ])('rejects %s=%p', (name, value, message) => {
+    expect(() => buildConfiguration({ ...base, [name]: value })).toThrow(message);
+  });
+});

package/harness/skills/nest-base/templates/config/configuration.ts

@@ -0,0 +1,137 @@
+// Plantilla del harness → src/config/configuration.ts (AGENTS.md §14, harness/reference/configuracion.md).
+// Single place in the project that reads process.env. The rest of the code receives AppConfig
+// through ConfigService<AppConfig, true>. Variables are validated at startup (env validation in
+// src/config/); this file only groups them and converts their types.
+import { type LogFormat, parseLogFormat } from '../common/logging/logger-options';
+import { type AuthConfig, parseAuthConfig } from './auth';
+import { parseCorsMaxAge, parseCorsOrigins } from './cors';
+
+export type Env = Record<string, string | undefined>;
+
+export interface DatabaseConfig {
+  host: string;
+  port: number;
+  name: string;
+  user: string;
+  password: string;
+  ssl: boolean;
+  poolMax: number;
+  statementTimeoutMs: number;
+}
+
+export interface AppConfig {
+  app: { nodeEnv: string; port: number; trustProxyHops: number };
+  logging: { level: string; format: LogFormat };
+  databases: Record<string, DatabaseConfig>;
+  cache: {
+    enabled: boolean;
+    redisUrl: string | undefined;
+    defaultTtlSeconds: number;
+    keyPrefix: string;
+    opTimeoutMs: number;
+  };
+  auth: AuthConfig;
+  cors: { origins: string[]; maxAgeSeconds: number };
+  monitor: { enabled: boolean; sessionExpiresIn: string };
+}
+
+/** Required variable. The error names the variable, never its value. Secrets have no default. */
+export function required(env: Env, name: string): string {
+  const value = env[name];
+  if (value === undefined || value.trim() === '') {
+    throw new Error(`${name} is required`);
+  }
+  return value;
+}
+
+/** Optional text variable with a non-sensitive default. */
+export function text(env: Env, name: string, fallback: string): string {
+  const value = env[name];
+  return value === undefined || value.trim() === '' ? fallback : value.trim();
+}
+
+export function int(env: Env, name: string, fallback: number): number {
+  const raw = env[name];
+  if (raw === undefined || raw.trim() === '') return fallback;
+  const value = Number(raw);
+  if (!Number.isInteger(value)) {
+    throw new Error(`${name} must be an integer`);
+  }
+  return value;
+}
+
+export function bool(env: Env, name: string, fallback: boolean): boolean {
+  const raw = env[name]?.trim().toLowerCase();
+  if (raw === undefined || raw === '') return fallback;
+  if (raw === 'true') return true;
+  if (raw === 'false') return false;
+  throw new Error(`${name} must be true or false`);
+}
+
+/** DATABASES=MAIN,REPORTS → one block per name, read from DB_<NAME>_*. */
+export function parseDatabases(env: Env): Record<string, DatabaseConfig> {
+  const names = required(env, 'DATABASES')
+    .split(',')
+    .map((name) => name.trim().toUpperCase())
+    .filter(Boolean);
+  return Object.fromEntries(
+    names.map((name): [string, DatabaseConfig] => {
+      const key = (part: string): string => `DB_${name}_${part}`;
+      return [
+        name,
+        {
+          host: required(env, key('HOST')),
+          port: int(env, key('PORT'), 5432),
+          name: required(env, key('NAME')),
+          user: required(env, key('USER')),
+          password: required(env, key('PASSWORD')),
+          ssl: bool(env, key('SSL'), false),
+          poolMax: int(env, key('POOL_MAX'), 10),
+          statementTimeoutMs: int(env, key('STATEMENT_TIMEOUT_MS'), 30000),
+        },
+      ];
+    }),
+  );
+}
+
+/** Proxies in front of the app (Azure App Service, gateway): 0 = connect directly, use the socket IP. */
+export function trustProxyHops(env: Env): number {
+  const hops = int(env, 'HTTP_TRUST_PROXY_HOPS', 0);
+  if (hops < 0 || hops > 10) {
+    throw new Error('HTTP_TRUST_PROXY_HOPS must be an integer between 0 and 10');
+  }
+  return hops;
+}
+
+/** Pure: builds the configuration from an env object (tests pass their own). */
+export function buildConfiguration(env: Env): AppConfig {
+  const cacheEnabled = bool(env, 'CACHE_ENABLED', false);
+  const nodeEnv = text(env, 'NODE_ENV', 'development');
+  return {
+    app: { nodeEnv, port: int(env, 'PORT', 3000), trustProxyHops: trustProxyHops(env) },
+    logging: {
+      level: text(env, 'LOG_LEVEL', 'info'),
+      format: parseLogFormat(env.LOG_FORMAT, nodeEnv),
+    },
+    databases: parseDatabases(env),
+    cache: {
+      enabled: cacheEnabled,
+      redisUrl: cacheEnabled ? required(env, 'REDIS_URL') : env.REDIS_URL,
+      defaultTtlSeconds: int(env, 'CACHE_DEFAULT_TTL_SECONDS', 300),
+      keyPrefix: text(env, 'CACHE_KEY_PREFIX', 'arness'),
+      opTimeoutMs: int(env, 'CACHE_OP_TIMEOUT_MS', 200),
+    },
+    auth: parseAuthConfig(env),
+    cors: {
+      origins: parseCorsOrigins(env.CORS_ORIGINS),
+      maxAgeSeconds: parseCorsMaxAge(env.CORS_MAX_AGE_SECONDS),
+    },
+    monitor: {
+      enabled: bool(env, 'MONITOR_ENABLED', false),
+      sessionExpiresIn: text(env, 'MONITOR_SESSION_EXPIRES_IN', '15m'),
+    },
+  };
+}
+
+/** Factory for ConfigModule.forRoot({ load: [configuration] }). */
+export default (): AppConfig => buildConfiguration(process.env);

package/harness/skills/nest-base/templates/cors/cors.spec.ts

@@ -0,0 +1,53 @@
+// Plantilla del harness → src/config/cors.spec.ts
+import { buildCorsOptions, parseCorsMaxAge, parseCorsOrigins } from './cors';
+
+describe('parseCorsOrigins', () => {
+  it('returns normalized, unique origins', () => {
+    expect(
+      parseCorsOrigins(' https://app.example.com ,http://localhost:4200,https://app.example.com/'),
+    ).toEqual(['https://app.example.com', 'http://localhost:4200']);
+  });
+
+  it.each([
+    ['', /required/],
+    [undefined, /required/],
+    ['*', /wildcards/],
+    ['https://*.example.com', /wildcards/],
+    ['not-a-url', /invalid origin/],
+    ['https://app.example.com/path', /origins only/],
+    ['http://app.example.com', /https/],
+  ])('rejects %p', (raw, message) => {
+    expect(() => parseCorsOrigins(raw)).toThrow(message);
+  });
+});
+
+describe('parseCorsMaxAge', () => {
+  it('defaults to 600 and validates the range', () => {
+    expect(parseCorsMaxAge(undefined)).toBe(600);
+    expect(parseCorsMaxAge('120')).toBe(120);
+    expect(() => parseCorsMaxAge('-1')).toThrow();
+    expect(() => parseCorsMaxAge('abc')).toThrow();
+  });
+});
+
+describe('buildCorsOptions', () => {
+  const options = buildCorsOptions(['https://app.example.com'], 600);
+  const decide = (origin: string | undefined): boolean | undefined => {
+    let result: boolean | undefined;
+    (
+      options.origin as (
+        o: string | undefined,
+        cb: (e: Error | null, allow?: boolean) => void,
+      ) => void
+    )(origin, (_err, allow) => (result = allow));
+    return result;
+  };
+
+  it('allows only origins in the allowlist and never uses credentials', () => {
+    expect(decide('https://app.example.com')).toBe(true);
+    expect(decide('https://evil.example.com')).toBe(false);
+    expect(decide(undefined)).toBe(false);
+    expect(options.credentials).toBe(false);
+    expect(options.methods).toEqual(['GET', 'POST', 'OPTIONS']);
+  });
+});

package/harness/skills/nest-base/templates/cors/cors.ts

@@ -0,0 +1,75 @@
+// Plantilla del harness → src/config/cors.ts (AGENTS.md §9, harness/reference/contrato-http.md "CORS").
+import type { CorsOptions } from '@nestjs/common/interfaces/external/cors-options.interface';
+
+export const CORS_METHODS = ['GET', 'POST', 'OPTIONS'];
+export const CORS_ALLOWED_HEADERS = ['Authorization', 'Content-Type', 'X-Request-Id'];
+export const CORS_EXPOSED_HEADERS = ['X-Cache', 'X-Request-Id'];
+export const CORS_DEFAULT_MAX_AGE_SECONDS = 600;
+
+const LOCAL_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]']);
+
+/**
+ * Parses CORS_ORIGINS (comma separated) into exact origins.
+ * Throws on an empty list, wildcards, values that are not an origin, or http:// outside localhost.
+ */
+export function parseCorsOrigins(raw: string | undefined): string[] {
+  const items = (raw ?? '')
+    .split(',')
+    .map((item) => item.trim())
+    .filter(Boolean);
+  if (items.length === 0) {
+    throw new Error('CORS_ORIGINS is required: list the allowed origins separated by commas');
+  }
+  return [
+    ...new Set(
+      items.map((item) => {
+        if (item.includes('*')) {
+          throw new Error(`CORS_ORIGINS does not accept wildcards: ${item}`);
+        }
+        let url: URL;
+        try {
+          url = new URL(item);
+        } catch {
+          throw new Error(`CORS_ORIGINS has an invalid origin: ${item}`);
+        }
+        if (url.origin === 'null' || url.origin !== item.replace(/\/$/, '')) {
+          throw new Error(`CORS_ORIGINS must contain origins only (scheme://host[:port]): ${item}`);
+        }
+        if (
+          url.protocol !== 'https:' &&
+          !(url.protocol === 'http:' && LOCAL_HOSTS.has(url.hostname))
+        ) {
+          throw new Error(`CORS_ORIGINS requires https:// except for localhost: ${item}`);
+        }
+        return url.origin;
+      }),
+    ),
+  ];
+}
+
+/** Parses CORS_MAX_AGE_SECONDS; defaults to 600 seconds. */
+export function parseCorsMaxAge(raw: string | undefined): number {
+  if (raw === undefined || raw.trim() === '') return CORS_DEFAULT_MAX_AGE_SECONDS;
+  const value = Number(raw);
+  if (!Number.isInteger(value) || value < 0 || value > 86400) {
+    throw new Error('CORS_MAX_AGE_SECONDS must be an integer between 0 and 86400');
+  }
+  return value;
+}
+
+/** Options for app.enableCors(): only origins in the allowlist get Access-Control-Allow-Origin. */
+export function buildCorsOptions(origins: readonly string[], maxAgeSeconds: number): CorsOptions {
+  const allowed = new Set(origins);
+  return {
+    origin: (
+      origin: string | undefined,
+      callback: (err: Error | null, allow?: boolean) => void,
+    ): void => callback(null, origin !== undefined && allowed.has(origin)),
+    methods: CORS_METHODS,
+    allowedHeaders: CORS_ALLOWED_HEADERS,
+    exposedHeaders: CORS_EXPOSED_HEADERS,
+    credentials: false,
+    maxAge: maxAgeSeconds,
+    optionsSuccessStatus: 204,
+  };
+}

package/harness/skills/nest-base/templates/docs/EVOLUTIVO.md

@@ -0,0 +1,27 @@
+<!-- Plantilla del harness → docs/EVOLUTIVO.md (AGENTS.md §12). Quita este comentario al copiarla. -->
+# Evolutivo
+
+Trazabilidad de lo que se ha entregado en el proyecto, en orden cronológico. Cada entrega agrega una entrada al final; las anteriores no se reescriben ni se borran.
+
+**Solo avance.** Aquí no van pendientes, bloqueos, stoppers ni riesgos: esos van en `docs/PENDIENTES.md`.
+
+Formato de cada entrada (lenguaje entendible para negocio):
+
+```markdown
+## AAAA-MM-DD HH:mm -0500 · <cliente>/<módulo>
+
+- **Responsable:** <nombre de quien hizo la entrega>.
+- **Entregado:** <qué se puede hacer ahora, en una o dos frases>.
+- **Detalle técnico:** <endpoint, conexión, widget o cambio de contrato>.
+- **Referencia:** <commit, PR o tag>.
+```
+
+- **Fecha y hora:** hora de Bogotá, Colombia (UTC-5), del momento en que se registra la entrega: `TZ=America/Bogota date '+%Y-%m-%d %H:%M %z'`.
+- **Responsable:** la persona que trabaja en ese momento, según `git config user.name`. Si está vacío, se le pregunta; nunca se pone el nombre de un agente.
+
+## AAAA-MM-DD HH:mm -0500 · Base del proyecto
+
+- **Responsable:** <git config user.name>.
+- **Entregado:** base del backend lista para agregar reportes: autenticación, salud del servicio y caché.
+- **Detalle técnico:** proyecto NestJS creado con la skill `nest-base` del harness.
+- **Referencia:** <commit inicial>.

package/harness/skills/nest-base/templates/docs/PENDIENTES.md

@@ -0,0 +1,20 @@
+<!-- Plantilla del harness → docs/PENDIENTES.md (AGENTS.md §12). Quita este comentario al copiarla. -->
+# Pendientes
+
+Pendientes, bloqueos, stoppers, recomendaciones, deuda técnica y advertencias de `./harness/init.sh` que no se corrigieron. Lo entregado va en `docs/EVOLUTIVO.md`.
+
+Cada ítem lleva fecha, contexto y tipo. Al resolverse, se mueve a **Resueltos** con la fecha de cierre (y, si fue una entrega, se registra en `docs/EVOLUTIVO.md`).
+
+Tipos: `pendiente` · `bloqueo` · `recomendación` · `deuda técnica` · `advertencia init.sh`.
+
+## Abiertos
+
+| Fecha | Contexto (cliente/módulo) | Tipo | Descripción | Responsable |
+|---|---|---|---|---|
+| | | | | |
+
+## Resueltos
+
+| Fecha | Cierre | Contexto | Tipo | Descripción |
+|---|---|---|---|---|
+| | | | | |

package/harness/skills/nest-base/templates/docs/TECNICO.md

@@ -0,0 +1,43 @@
+<!-- Plantilla del harness → docs/TECNICO.md (AGENTS.md §12). Quita este comentario al copiarla. -->
+# Documentación técnica
+
+Backend de analítica de **<cliente o producto>**: reportes de solo lectura sobre PostgreSQL. Las reglas de trabajo están en `AGENTS.md`; el contrato con frontend, en `FRONT.md`.
+
+## Arquitectura
+
+- NestJS por capas hexagonales por endpoint: controller → service (Cache-Aside) → repository (`pg`) → `*.sql.ts`.
+- Organización `src/modules/<cliente>/<modulo>/<endpoint>/`; lo transversal vive en `src/common/`.
+- Autenticación JWT (access + refresh) en todos los endpoints salvo `login`, `refresh` y `health`.
+- Caché Redis opcional: la API responde igual si Redis está caído o deshabilitado.
+
+## Módulos
+
+| Cliente | Módulo | Propósito | Conexión | README |
+|---|---|---|---|---|
+| | | | | |
+
+## Conexiones de base de datos
+
+Solo nombres lógicos y origen; **nunca** hosts, usuarios ni contraseñas.
+
+| Nombre (`DATABASES`) | Propósito | Esquemas o vistas principales |
+|---|---|---|
+| MAIN | | |
+
+## Configuración
+
+Variables por tema en `src/config/configuration.ts` y referencia completa en `harness/reference/configuracion.md`. Variables propias de este proyecto:
+
+| Variable | Para qué | Obligatoria |
+|---|---|---|
+| | | |
+
+## Despliegue
+
+- Imagen Docker (`Dockerfile`) y pipeline `azure-pipelines.yml`.
+- Entornos: <desarrollo, QA, producción> y sus URLs base.
+- `GET /health` reporta cada BD y la caché; `GET /monitor` solo donde `MONITOR_ENABLED=true`.
+
+## Decisiones
+
+Las decisiones del proyecto están en `harness/decisiones/` (índice en su `README.md`).

package/harness/skills/nest-base/templates/e2e/cors.e2e-spec.ts

@@ -0,0 +1,60 @@
+// Plantilla del harness → test/cors.e2e-spec.ts
+import { Controller, Get, INestApplication } from '@nestjs/common';
+import { Test } from '@nestjs/testing';
+import request from 'supertest';
+import { App } from 'supertest/types';
+import { buildCorsOptions } from '../src/config/cors';
+
+@Controller('probe')
+class ProbeController {
+  @Get()
+  get(): { data: string } {
+    return { data: 'ok' };
+  }
+}
+
+describe('CORS (e2e)', () => {
+  let app: INestApplication<App>;
+  const allowed = 'https://app.example.com';
+
+  beforeAll(async () => {
+    const moduleRef = await Test.createTestingModule({ controllers: [ProbeController] }).compile();
+    app = moduleRef.createNestApplication();
+    app.enableCors(buildCorsOptions([allowed], 600));
+    await app.init();
+  });
+
+  afterAll(async () => {
+    await app.close();
+  });
+
+  it('answers an allowed preflight with the CORS headers', async () => {
+    const res = await request(app.getHttpServer())
+      .options('/probe')
+      .set('Origin', allowed)
+      .set('Access-Control-Request-Method', 'GET')
+      .set('Access-Control-Request-Headers', 'Authorization');
+    expect(res.status).toBe(204);
+    expect(res.headers['access-control-allow-origin']).toBe(allowed);
+    expect(res.headers['access-control-allow-methods']).toBe('GET,POST,OPTIONS');
+    expect(res.headers['access-control-allow-headers']).toBe(
+      'Authorization,Content-Type,X-Request-Id',
+    );
+    expect(res.headers['access-control-max-age']).toBe('600');
+    expect(res.headers['access-control-allow-credentials']).toBeUndefined();
+  });
+
+  it('exposes X-Cache and X-Request-Id to allowed origins', async () => {
+    const res = await request(app.getHttpServer()).get('/probe').set('Origin', allowed);
+    expect(res.headers['access-control-allow-origin']).toBe(allowed);
+    expect(res.headers['access-control-expose-headers']).toBe('X-Cache,X-Request-Id');
+  });
+
+  it('does not allow an origin outside the allowlist', async () => {
+    const res = await request(app.getHttpServer())
+      .options('/probe')
+      .set('Origin', 'https://evil.example.com')
+      .set('Access-Control-Request-Method', 'GET');
+    expect(res.headers['access-control-allow-origin']).toBeUndefined();
+  });
+});

package/harness/skills/nest-base/templates/e2e/monitor.e2e-spec.ts

@@ -0,0 +1,151 @@
+// Plantilla del harness → test/monitor.e2e-spec.ts
+import { Controller, Get, INestApplication, ValidationPipe } from '@nestjs/common';
+import { ConfigModule } from '@nestjs/config';
+import { Test } from '@nestjs/testing';
+import request from 'supertest';
+import { App } from 'supertest/types';
+import { MonitorModule } from '../src/common/monitor/monitor.module';
+import { MONITOR_WIDGETS, MonitorWidget } from '../src/common/monitor/monitor-widget.interface';
+import { EndpointsTotalWidget } from '../src/common/monitor/widgets/endpoints-total.widget';
+import { SecurityModule } from '../src/common/security/security.module';
+
+@Controller('cartera')
+class CarteraController {
+  @Get('resumen')
+  summary(): void {}
+
+  @Get('detalle')
+  detail(): void {}
+}
+
+@Controller('health')
+class HealthController {
+  @Get()
+  check(): void {}
+}
+
+const brokenWidget: MonitorWidget = {
+  id: 'broken',
+  title: 'Widget roto',
+  order: 99,
+  collect: () => Promise.reject(new Error('connect ECONNREFUSED 10.0.0.5:5432')),
+};
+
+async function createApp(enabled: boolean): Promise<INestApplication<App>> {
+  const moduleRef = await Test.createTestingModule({
+    imports: [
+      ConfigModule.forRoot({
+        isGlobal: true,
+        ignoreEnvFile: true,
+        load: [
+          () => ({
+            MONITOR_ENABLED: String(enabled),
+            MONITOR_SESSION_EXPIRES_IN: '15m',
+            ACCESS_TOKEN: 'example123',
+            JWT_ACCESS_SECRET: 'e2e-access-secret-with-enough-length',
+            auth: { login: { maxAttempts: 3, windowSeconds: 60 } },
+          }),
+        ],
+      }),
+      SecurityModule,
+      MonitorModule,
+    ],
+    controllers: [CarteraController, HealthController],
+  })
+    .overrideProvider(MONITOR_WIDGETS)
+    .useFactory({
+      factory: (total: EndpointsTotalWidget) => [total, brokenWidget],
+      inject: [EndpointsTotalWidget],
+    })
+    .compile();
+  const app = moduleRef.createNestApplication<INestApplication<App>>();
+  app.useGlobalPipes(
+    new ValidationPipe({ whitelist: true, forbidNonWhitelisted: true, transform: true }),
+  );
+  await app.init();
+  return app;
+}
+
+describe('Monitor (e2e)', () => {
+  let app: INestApplication<App>;
+
+  beforeAll(async () => {
+    app = await createApp(true);
+  });
+
+  afterAll(async () => {
+    await app.close();
+  });
+
+  const login = (password: string): request.Test =>
+    request(app.getHttpServer()).post('/monitor/login').type('form').send({ password });
+
+  it('redirects to the login form without a session', async () => {
+    const res = await request(app.getHttpServer()).get('/monitor');
+    expect(res.status).toBe(303);
+    expect(res.headers.location).toBe('/monitor/login');
+  });
+
+  it('serves the login form with the security headers and no scripts', async () => {
+    const res = await request(app.getHttpServer()).get('/monitor/login');
+    expect(res.status).toBe(200);
+    expect(res.headers['content-type']).toMatch(/text\/html/);
+    expect(res.headers['content-security-policy']).toContain("default-src 'none'");
+    expect(res.headers['cache-control']).toBe('no-store');
+    expect(res.headers['x-frame-options']).toBe('DENY');
+    expect(res.text).not.toMatch(/<script/i);
+  });
+
+  it('rejects a wrong password with 401 and no cookie', async () => {
+    const res = await login('wrong');
+    expect(res.status).toBe(401);
+    expect(res.headers['set-cookie']).toBeUndefined();
+    expect(res.text).toContain('Contraseña incorrecta');
+  });
+
+  it('logs in, shows the endpoint count and isolates a failing widget', async () => {
+    const res = await login('example123');
+    expect(res.status).toBe(303);
+    expect(res.headers.location).toBe('/monitor');
+    const cookie = String(res.headers['set-cookie']);
+    expect(cookie).toMatch(
+      /arness_monitor=.+; Max-Age=900; Path=\/monitor; HttpOnly; Secure; SameSite=Strict/,
+    );
+
+    const page = await request(app.getHttpServer())
+      .get('/monitor')
+      .set('Cookie', cookie.split(';')[0]);
+    expect(page.status).toBe(200);
+    expect(page.text).toMatch(/data-widget="endpoints-total".*?>2</);
+    expect(page.text).toContain('No disponible');
+    expect(page.text).not.toContain('ECONNREFUSED');
+    expect(page.text).not.toMatch(/<script/i);
+  });
+
+  it('logout clears the cookie', async () => {
+    const res = await request(app.getHttpServer()).post('/monitor/logout');
+    expect(res.status).toBe(303);
+    expect(String(res.headers['set-cookie'])).toContain('arness_monitor=; Max-Age=0');
+  });
+
+  it('answers 429 with Retry-After after too many wrong passwords, even with the right one', async () => {
+    const limited = await createApp(true);
+    const attempt = (password: string): request.Test =>
+      request(limited.getHttpServer()).post('/monitor/login').type('form').send({ password });
+    for (let i = 0; i < 3; i += 1) expect((await attempt('wrong')).status).toBe(401);
+
+    const res = await attempt('example123');
+    expect(res.status).toBe(429);
+    expect(Number(res.headers['retry-after'])).toBeGreaterThan(0);
+    expect(res.headers['set-cookie']).toBeUndefined();
+    expect(res.text).toContain('Demasiados intentos');
+    await limited.close();
+  });
+
+  it('answers 404 when MONITOR_ENABLED=false', async () => {
+    const disabled = await createApp(false);
+    await request(disabled.getHttpServer()).get('/monitor').expect(404);
+    await request(disabled.getHttpServer()).get('/monitor/login').expect(404);
+    await disabled.close();
+  });
+});

package/harness/skills/nest-base/templates/editorconfig

@@ -0,0 +1,12 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_style = space
+indent_size = 2
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false