@discover-cloud/shared 1.0.1 → 1.0.3

package/dist/dtos/auth-service.dto.d.ts

@@ -0,0 +1,44 @@
+import { AccountStatus } from "../enums";
+export interface AccountDto {
+    id: string;
+    email: string;
+    isVerified: boolean;
+    status: AccountStatus;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export interface EmailVerificationDto {
+    id: string;
+    accountId: string;
+    token: string;
+    expiresAt: Date;
+    isUsed: boolean;
+    createdAt: Date;
+}
+export interface OAuthIdentityDto {
+    id: string;
+    accountId: string;
+    provider: string;
+    providerId: string;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export interface PasswordResetDto {
+    id: string;
+    accountId: string;
+    token: string;
+    expiresAt: Date;
+    isUsed: boolean;
+    createdAt: Date;
+}
+export interface SessionDto {
+    id: string;
+    accountId: string;
+    expiresAt: Date;
+    revokedAt: Date | null;
+    ipAddress: string | null;
+    userAgent: string | null;
+    device: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+}

package/dist/dtos/auth-service.dto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/dtos/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./user-service.dto";
+export * from "./auth-service.dto";
+export * from "./response.dto";

package/dist/dtos/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./user-service.dto"), exports);
+__exportStar(require("./auth-service.dto"), exports);
+__exportStar(require("./response.dto"), exports);

package/dist/dtos/response.dto.d.ts

@@ -0,0 +1,55 @@
+export interface ApiMeta {
+    requestId: string;
+    timestamp: string;
+}
+export interface ApiSuccessResponse<T> {
+    success: true;
+    data: T;
+    meta: ApiMeta;
+}
+export interface ApiErrorResponse {
+    success: false;
+    error: {
+        code: string;
+        message: string;
+        details?: unknown;
+    };
+    meta: ApiMeta;
+}
+/**
+ * Returned on login / token refresh.
+ * accessToken goes in the response body.
+ * refreshToken goes in an HttpOnly cookie — not in the body.
+ * Only include refreshToken here if your client explicitly needs it
+ * (e.g. mobile clients that can't use cookies).
+ */
+export interface TokensResponseDto {
+    accessToken: string;
+}
+/** Generic message — use for simple confirmations */
+export interface MessageResponseDto {
+    message: string;
+}
+/**
+ * Generic action confirmation — use when the client needs to know
+ * which action was performed (e.g. in a polling or event-driven context).
+ *
+ * action: machine-readable string, e.g. "account.suspended", "session.revoked"
+ * message: human-readable description
+ */
+export interface ActionResponseDto {
+    action: string;
+    message: string;
+}
+export interface PaginationMeta {
+    page: number;
+    pageSize: number;
+    totalItems: number;
+    totalPages: number;
+    hasNext: boolean;
+    hasPrev: boolean;
+}
+export interface PaginatedResponseDto<T> {
+    items: T[];
+    pagination: PaginationMeta;
+}

package/dist/dtos/response.dto.js

@@ -0,0 +1,6 @@
+"use strict";
+/* ====================================================================
+   RESPONSE DTOs
+   Shared HTTP response shapes used across all services.
+==================================================================== */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/dtos/user-service.dto.d.ts

@@ -0,0 +1,50 @@
+import { AccountStatus, OrganizationRole, MembershipStatus, OrganizationStatus, Theme, Currency } from "../enums";
+export interface UserDto {
+    id: string;
+    email: string;
+    status: AccountStatus;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export interface UserProfileDto {
+    id: string;
+    userId: string;
+    displayName: string | null;
+    avatarUrl: string | null;
+    jobTitle: string | null;
+    bio: string | null;
+    timezone: string | null;
+    locale: string;
+    country: string | null;
+    pronouns: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export interface UserPreferencesDto {
+    id: string;
+    userId: string;
+    theme: Theme;
+    language: string;
+    currency: Currency;
+    emailAlerts: boolean;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export interface OrganizationDto {
+    id: string;
+    name: string;
+    slug: string;
+    status: OrganizationStatus;
+    createdAt: Date;
+    updatedAt: Date;
+    deletedAt: Date | null;
+}
+export interface OrganizationMemberDto {
+    id: string;
+    userId: string;
+    organizationId: string;
+    role: OrganizationRole;
+    status: MembershipStatus;
+    createdAt: Date;
+    updatedAt: Date;
+}

package/dist/dtos/user-service.dto.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 export * from "./enums";
 export * from "./errors";
-export * from "./dto";
+export * from "./dtos";
 export * from "./authorization";
 export * from "./utils";
 export * from "./middleware";

package/dist/index.js

@@ -16,7 +16,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./enums"), exports);
 __exportStar(require("./errors"), exports);
-__exportStar(require("./dto"), exports);
+__exportStar(require("./dtos"), exports);
 __exportStar(require("./authorization"), exports);
 __exportStar(require("./utils"), exports);
 __exportStar(require("./middleware"), exports);

package/dist/middleware/error-handler.middleware.d.ts

@@ -5,18 +5,11 @@ import { Request, Response, NextFunction } from "express";
  * Centralized error handler for all Express services.
  *
  * Handles in order:
- *   1. ZodError        → 400 with flattened validation details
- *   2. AppError        → mapped statusCode + code (BadRequestError, NotFoundError, etc.)
- *   3. Unknown         → 500 Internal Server Error
+ *   1. ZodError  → 400 with flattened validation details
+ *   2. AppError  → mapped statusCode + code
+ *   3. Unknown   → 500 Internal Server Error (internals never leaked)
  *
  * Every response includes requestId for traceability.
- *
- * Fix vs original:
- *   - Replaced unsafe duck-type cast `(err as { statusCode? })` with
- *     proper `instanceof AppError` check. Duck-typing any error with a
- *     statusCode property as an AppError is a bug vector.
- *   - req.id included in every error response
- *   - Stack trace logged only in non-production environments
  */
 export declare class GlobalErrorHandler {
     static handle(err: unknown, req: Request, res: Response, _next: NextFunction): void;

package/dist/middleware/error-handler.middleware.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GlobalErrorHandler = void 0;
 const zod_1 = require("zod");
-const app_error_1 = require("../errors/app-error");
+const errors_1 = require("../errors");
 const utils_1 = require("../utils");
 /**
  * GLOBAL ERROR HANDLER
@@ -10,43 +10,33 @@ const utils_1 = require("../utils");
  * Centralized error handler for all Express services.
  *
  * Handles in order:
- *   1. ZodError        → 400 with flattened validation details
- *   2. AppError        → mapped statusCode + code (BadRequestError, NotFoundError, etc.)
- *   3. Unknown         → 500 Internal Server Error
+ *   1. ZodError  → 400 with flattened validation details
+ *   2. AppError  → mapped statusCode + code
+ *   3. Unknown   → 500 Internal Server Error (internals never leaked)
  *
  * Every response includes requestId for traceability.
- *
- * Fix vs original:
- *   - Replaced unsafe duck-type cast `(err as { statusCode? })` with
- *     proper `instanceof AppError` check. Duck-typing any error with a
- *     statusCode property as an AppError is a bug vector.
- *   - req.id included in every error response
- *   - Stack trace logged only in non-production environments
  */
 class GlobalErrorHandler {
     static handle(err, req, res, _next) {
-        const requestId = req.id;
-        // Always log — replace with your pino/winston logger in production
         if (process.env.NODE_ENV !== "production") {
-            console.error(`[req ${requestId}]`, err);
+            console.error(`[req ${req.id}]`, err);
         }
         else {
-            // In production, log without the stack trace in the response
-            console.error(`[req ${requestId}]`, err instanceof Error ? err.message : err);
+            console.error(`[req ${req.id}]`, err instanceof Error ? err.message : err);
         }
         // 1. Zod validation errors
         if (err instanceof zod_1.ZodError) {
-            (0, utils_1.failure)(res, "Validation failed", "VALIDATION_ERROR", 400, err.flatten((issue) => issue.message));
+            (0, utils_1.failure)(res, req, "Validation failed", "VALIDATION_ERROR", 400, err.flatten() // default flatten — preserves fieldErrors + formErrors + codes
+            );
             return;
         }
-        // 2. Known AppError subclasses (BadRequestError, NotFoundError, etc.)
-        //    instanceof check — safe, no duck-typing
-        if (err instanceof app_error_1.AppError) {
-            (0, utils_1.failure)(res, err.message, err.code, err.statusCode, err.details);
+        // 2. Known AppError subclasses — instanceof, never duck-typing
+        if (err instanceof errors_1.AppError) {
+            (0, utils_1.failure)(res, req, err.message, err.code, err.statusCode, err.details);
             return;
         }
-        // 3. Unhandled / unexpected errors — never leak internals
-        (0, utils_1.failure)(res, "Internal Server Error", "INTERNAL_SERVER_ERROR", 500);
+        // 3. Unexpected errors — never leak internals to the client
+        (0, utils_1.failure)(res, req, "Internal Server Error", "INTERNAL_SERVER_ERROR", 500);
     }
 }
 exports.GlobalErrorHandler = GlobalErrorHandler;

package/dist/types/express.types.d.ts

@@ -15,7 +15,6 @@
  *   perms never touch the JWT — they live in the permission cache and are
  *   resolved into req.accessContext by RequireAuthMiddleware on every request.
  */
-import "express-serve-static-core";
 import { JWTPayload } from "jose";
 import { AccountRole } from "../enums";
 import { GlobalPermission } from "../enums";

package/dist/types/express.types.js

@@ -21,7 +21,6 @@ exports.isHumanPayload = isHumanPayload;
 exports.isMachinePayload = isMachinePayload;
 exports.isHumanContext = isHumanContext;
 exports.isMachineContext = isMachineContext;
-require("express-serve-static-core");
 /* ====================================================================
    4. TYPE GUARDS
 

package/dist/utils/index.d.ts

@@ -1 +1,2 @@
-export * from "./response";
+export * from "./response.utils";
+export * from "./logger.utils";

package/dist/utils/index.js

@@ -14,4 +14,5 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./response"), exports);
+__exportStar(require("./response.utils"), exports);
+__exportStar(require("./logger.utils"), exports);

package/dist/utils/logger.utils.d.ts

@@ -0,0 +1,51 @@
+/**
+ * LOGGER INTERFACE  (@discover-cloud/shared)
+ * ────────────────────────────────────────────
+ * A minimal logger contract shared code can depend on.
+ * Each service injects its own implementation (pino, winston, console).
+ *
+ * Shared code (RequireAuthMiddleware, PermissionCacheService, etc.)
+ * accepts this interface — it never imports a concrete logger directly.
+ *
+ * ─── Usage in shared classes ────────────────────────────────────────
+ *   class RequireAuthMiddleware {
+ *     constructor(
+ *       private readonly verifier: InternalJwtVerifier,
+ *       private readonly logger:   ILogger = noopLogger,
+ *     ) {}
+ *   }
+ *
+ * ─── Wiring in each service ─────────────────────────────────────────
+ *   // auth-service / composition root:
+ *   import pino from "pino";
+ *   const pinoLogger = pino({ level: "info" });
+ *
+ *   const requireAuth = new RequireAuthMiddleware(jwtVerifier, pinoLogger);
+ *
+ * ─── noopLogger ─────────────────────────────────────────────────────
+ *   The default when no logger is injected — silently drops all logs.
+ *   Safe for tests and library consumers that don't want log noise.
+ */
+export interface ILogger {
+    debug(obj: object, msg?: string): void;
+    debug(msg: string): void;
+    info(obj: object, msg?: string): void;
+    info(msg: string): void;
+    warn(obj: object, msg?: string): void;
+    warn(msg: string): void;
+    error(obj: object, msg?: string): void;
+    error(msg: string): void;
+}
+/**
+ * noopLogger
+ * Silent default — used when no logger is injected.
+ * Satisfies ILogger without importing any logging library.
+ */
+export declare const noopLogger: ILogger;
+/**
+ * consoleLogger
+ * Thin console wrapper — useful for local dev and simple services
+ * that don't need structured logging.
+ * Pass this when you want logs without wiring up pino/winston.
+ */
+export declare const consoleLogger: ILogger;

package/dist/utils/logger.utils.js

@@ -0,0 +1,62 @@
+"use strict";
+/**
+ * LOGGER INTERFACE  (@discover-cloud/shared)
+ * ────────────────────────────────────────────
+ * A minimal logger contract shared code can depend on.
+ * Each service injects its own implementation (pino, winston, console).
+ *
+ * Shared code (RequireAuthMiddleware, PermissionCacheService, etc.)
+ * accepts this interface — it never imports a concrete logger directly.
+ *
+ * ─── Usage in shared classes ────────────────────────────────────────
+ *   class RequireAuthMiddleware {
+ *     constructor(
+ *       private readonly verifier: InternalJwtVerifier,
+ *       private readonly logger:   ILogger = noopLogger,
+ *     ) {}
+ *   }
+ *
+ * ─── Wiring in each service ─────────────────────────────────────────
+ *   // auth-service / composition root:
+ *   import pino from "pino";
+ *   const pinoLogger = pino({ level: "info" });
+ *
+ *   const requireAuth = new RequireAuthMiddleware(jwtVerifier, pinoLogger);
+ *
+ * ─── noopLogger ─────────────────────────────────────────────────────
+ *   The default when no logger is injected — silently drops all logs.
+ *   Safe for tests and library consumers that don't want log noise.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.consoleLogger = exports.noopLogger = void 0;
+/**
+ * noopLogger
+ * Silent default — used when no logger is injected.
+ * Satisfies ILogger without importing any logging library.
+ */
+exports.noopLogger = {
+    debug: () => { },
+    info: () => { },
+    warn: () => { },
+    error: () => { },
+};
+/**
+ * consoleLogger
+ * Thin console wrapper — useful for local dev and simple services
+ * that don't need structured logging.
+ * Pass this when you want logs without wiring up pino/winston.
+ */
+exports.consoleLogger = {
+    debug: (objOrMsg, msg) => {
+        console.debug(msg ?? objOrMsg, typeof objOrMsg === "object" ? objOrMsg : "");
+    },
+    info: (objOrMsg, msg) => {
+        console.info(msg ?? objOrMsg, typeof objOrMsg === "object" ? objOrMsg : "");
+    },
+    warn: (objOrMsg, msg) => {
+        console.warn(msg ?? objOrMsg, typeof objOrMsg === "object" ? objOrMsg : "");
+    },
+    error: (objOrMsg, msg) => {
+        console.error(msg ?? objOrMsg, typeof objOrMsg === "object" ? objOrMsg : "");
+    },
+};

package/dist/utils/response.utils.d.ts

@@ -0,0 +1,12 @@
+import { Response, Request } from "express";
+/**
+ * RESPONSE HELPERS
+ * ─────────────────
+ * Typed wrappers around res.json() that enforce the ApiSuccessResponse
+ * and ApiErrorResponse envelope shapes.
+ *
+ * Both require req explicitly — avoids the res.req cast anti-pattern
+ * and makes the dependency clear at the call site.
+ */
+export declare const success: <T>(res: Response, req: Request, data: T, statusCode?: number) => void;
+export declare const failure: (res: Response, req: Request, message: string, code: string, statusCode?: number, details?: unknown) => void;

package/dist/utils/response.utils.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.failure = exports.success = void 0;
+const crypto_1 = require("crypto");
+/**
+ * RESPONSE HELPERS
+ * ─────────────────
+ * Typed wrappers around res.json() that enforce the ApiSuccessResponse
+ * and ApiErrorResponse envelope shapes.
+ *
+ * Both require req explicitly — avoids the res.req cast anti-pattern
+ * and makes the dependency clear at the call site.
+ */
+const success = (res, req, data, statusCode = 200) => {
+    const response = {
+        success: true,
+        data,
+        meta: {
+            requestId: req.id ?? (0, crypto_1.randomUUID)(), // randomUUID fallback — "unknown" breaks log search
+            timestamp: new Date().toISOString(),
+        },
+    };
+    res.status(statusCode).json(response);
+};
+exports.success = success;
+const failure = (res, req, message, code, statusCode = 400, details) => {
+    const response = {
+        success: false,
+        error: {
+            code,
+            message,
+            // Omit details entirely when not provided — avoids "details": null noise
+            ...(details !== undefined ? { details } : {}),
+        },
+        meta: {
+            requestId: req.id ?? (0, crypto_1.randomUUID)(),
+            timestamp: new Date().toISOString(),
+        },
+    };
+    res.status(statusCode).json(response);
+};
+exports.failure = failure;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@discover-cloud/shared",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "private": false,
   "type": "commonjs",
   "main": "dist/index.js",