@dumanarge/xssrv-shared-lib 1.0.0

package/CHANGELOG.md

@@ -0,0 +1,19 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.0.0] - 2025-02-22
+
+### Added
+
+- **Tracing**: OpenTelemetry bootstrap with OTLP gRPC exporter and `@Span()` decorator
+- **Logging**: Pino structured logging with automatic traceId injection and sensitive field redaction
+- **Health**: Kubernetes liveness/readiness probes with Redis and RabbitMQ health indicators
+- **Outbox**: Transactional outbox pattern with RabbitMQ event publisher and background worker
+- **Auth**: Multi-tenant isolation via Prisma middleware, NestJS guard, and gRPC metadata extraction
+- **Audit**: Tamper-proof audit interceptor for HTTP and gRPC mutations (KVKK compliant)
+- **Config**: Consul KV-based feature flags with rollout percentage and tenant targeting
+- **Shutdown**: Graceful shutdown with prioritized hook system and per-hook timeout

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DumanArge / Oguzhan Karahan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,224 @@
+# @dumanarge/xssrv-shared-lib
+
+Shared infrastructure library for **DumanArge IoT Platform** NestJS microservices.
+
+Provides production-ready modules for tracing, structured logging, health checks, transactional outbox pattern, multi-tenant isolation, audit trails, feature flags, and graceful shutdown.
+
+## Installation
+
+```bash
+npm install @dumanarge/xssrv-shared-lib
+```
+
+### Peer Dependencies
+
+This library uses peer dependencies to avoid version conflicts. Install the modules you need:
+
+```bash
+# Core (required)
+npm install @nestjs/common @nestjs/core rxjs reflect-metadata
+
+# Tracing (for OpenTelemetry support)
+npm install @opentelemetry/sdk-node @opentelemetry/auto-instrumentations-node \
+  @opentelemetry/exporter-trace-otlp-grpc @opentelemetry/exporter-metrics-otlp-grpc \
+  @opentelemetry/resources @opentelemetry/sdk-metrics
+
+# Logging
+npm install nestjs-pino pino pino-http
+
+# Health checks
+npm install @nestjs/terminus
+
+# Outbox & Tenant isolation
+npm install @prisma/client
+
+# Feature flags
+npm install @nestjs/config
+
+# Redis health indicator
+npm install ioredis
+```
+
+## Modules
+
+### Tracing (OpenTelemetry)
+
+Bootstrap tracing before your NestJS app starts:
+
+```typescript
+// main.ts — must be the FIRST import
+import '@dumanarge/xssrv-shared-lib/tracing';
+
+import { NestFactory } from '@nestjs/core';
+import { AppModule } from './app.module';
+```
+
+Use the `@Span()` decorator for custom business logic tracing:
+
+```typescript
+import { Span } from '@dumanarge/xssrv-shared-lib';
+
+@Injectable()
+export class DeviceService {
+  @Span('device.provision')
+  async provisionDevice(dto: CreateDeviceDto) {
+    // Automatically traced with OpenTelemetry
+  }
+}
+```
+
+**Environment variables:**
+
+| Variable | Default | Description |
+|---|---|---|
+| `SERVICE_NAME` | `unknown-service` | OTel service name |
+| `SERVICE_VERSION` | `1.0.0` | OTel service version |
+| `OTEL_EXPORTER_OTLP_ENDPOINT` | `http://localhost:4317` | OTel Collector endpoint |
+| `OTEL_DEBUG` | `false` | Enable OTel debug logging |
+
+---
+
+### Logging (Pino + OTel)
+
+```typescript
+import { LoggingModule } from '@dumanarge/xssrv-shared-lib';
+
+@Module({
+  imports: [LoggingModule],
+})
+export class AppModule {}
+```
+
+Features: JSON structured logs, automatic `traceId`/`spanId` injection, request correlation via `X-Request-Id`, sensitive field redaction, health endpoint filtering.
+
+---
+
+### Health Checks
+
+```typescript
+import { HealthModule } from '@dumanarge/xssrv-shared-lib';
+
+@Module({
+  imports: [HealthModule],
+})
+export class AppModule {}
+```
+
+Exposes `GET /health/live` (liveness) and `GET /health/ready` (readiness) endpoints for Kubernetes probes.
+
+Custom health indicators included: `RedisHealthIndicator`, `RabbitMQHealthIndicator`.
+
+---
+
+### Multi-Tenant Isolation
+
+```typescript
+import {
+  TenantMiddleware,
+  TenantGuard,
+  TenantContext,
+  createPrismaTenantMiddleware,
+} from '@dumanarge/xssrv-shared-lib';
+
+// In AppModule
+export class AppModule implements NestModule {
+  configure(consumer: MiddlewareConsumer) {
+    consumer.apply(TenantMiddleware).forRoutes('*');
+  }
+}
+
+// In service — automatic tenant scoping for Prisma
+prisma.$use(createPrismaTenantMiddleware(() => tenantContext.tenantId));
+```
+
+---
+
+### Outbox Pattern
+
+Guaranteed event delivery via transactional outbox:
+
+```typescript
+import { OutboxRepository, RabbitMQEventPublisher, OutboxWorker } from '@dumanarge/xssrv-shared-lib';
+
+// Write event in the same DB transaction as business data
+await prisma.$transaction(async (tx) => {
+  await tx.tenant.create({ data: tenantData });
+  await outboxRepo.createInTransaction(tx, {
+    aggregateType: 'tenant',
+    aggregateId: tenant.id,
+    eventType: 'tenant.created',
+    payload: tenantData,
+  });
+});
+```
+
+---
+
+### Audit Interceptor
+
+Tamper-proof audit trail for all mutation operations (POST/PUT/PATCH/DELETE):
+
+```typescript
+import { AuditInterceptor } from '@dumanarge/xssrv-shared-lib';
+
+@Module({
+  providers: [
+    { provide: APP_INTERCEPTOR, useClass: AuditInterceptor },
+  ],
+})
+export class AppModule {}
+```
+
+---
+
+### Feature Flags
+
+Dynamic feature toggles via Consul KV with local cache fallback:
+
+```typescript
+import { FeatureFlagService } from '@dumanarge/xssrv-shared-lib';
+
+const isEnabled = await featureFlags.isEnabled('device_twin_enabled', tenantId);
+const config = await featureFlags.getConfig('batch_signal_processing');
+```
+
+---
+
+### Graceful Shutdown
+
+```typescript
+import { GracefulShutdownModule, enableGracefulShutdown } from '@dumanarge/xssrv-shared-lib';
+
+// In AppModule
+@Module({
+  imports: [GracefulShutdownModule],
+})
+export class AppModule {}
+
+// In main.ts
+const app = await NestFactory.create(AppModule);
+enableGracefulShutdown(app);
+```
+
+## Sub-path Imports
+
+You can import individual modules directly to minimize bundle:
+
+```typescript
+import '@dumanarge/xssrv-shared-lib/tracing';
+import { LoggingModule } from '@dumanarge/xssrv-shared-lib/logging';
+import { HealthModule } from '@dumanarge/xssrv-shared-lib/health';
+import { OutboxRepository } from '@dumanarge/xssrv-shared-lib/outbox';
+import { TenantMiddleware } from '@dumanarge/xssrv-shared-lib/auth';
+import { GracefulShutdownModule } from '@dumanarge/xssrv-shared-lib/config';
+```
+
+## Requirements
+
+- Node.js >= 20
+- NestJS >= 11
+- TypeScript >= 5.7
+
+## License
+
+[MIT](./LICENSE)

package/dist/auth/audit.interceptor.d.ts

@@ -0,0 +1,32 @@
+import { NestInterceptor, ExecutionContext, CallHandler } from '@nestjs/common';
+import { Observable } from 'rxjs';
+export interface AuditEntry {
+    id?: string;
+    serviceName: string;
+    action: string;
+    resource: string;
+    resourceId?: string;
+    tenantId?: string;
+    userId?: string;
+    requestBody?: any;
+    responseStatus: number;
+    responseBody?: any;
+    ipAddress?: string;
+    userAgent?: string;
+    duration: number;
+    timestamp: Date;
+    metadata?: Record<string, any>;
+}
+export declare class AuditInterceptor implements NestInterceptor {
+    private readonly outboxRepository?;
+    private readonly logger;
+    private readonly serviceName;
+    private readonly auditableMethods;
+    constructor(outboxRepository?: any);
+    intercept(context: ExecutionContext, next: CallHandler): Observable<any>;
+    private handleHttp;
+    private handleGrpc;
+    private saveAuditEntry;
+    private extractResourceId;
+    private sanitizeBody;
+}

package/dist/auth/audit.interceptor.js

@@ -0,0 +1,147 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var AuditInterceptor_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuditInterceptor = void 0;
+const common_1 = require("@nestjs/common");
+const rxjs_1 = require("rxjs");
+let AuditInterceptor = AuditInterceptor_1 = class AuditInterceptor {
+    outboxRepository;
+    logger = new common_1.Logger(AuditInterceptor_1.name);
+    serviceName;
+    auditableMethods = ['POST', 'PUT', 'PATCH', 'DELETE'];
+    constructor(outboxRepository) {
+        this.outboxRepository = outboxRepository;
+        this.serviceName = process.env.SERVICE_NAME || 'unknown';
+    }
+    intercept(context, next) {
+        const contextType = context.getType();
+        if (contextType === 'http') {
+            return this.handleHttp(context, next);
+        }
+        else if (contextType === 'rpc') {
+            return this.handleGrpc(context, next);
+        }
+        return next.handle();
+    }
+    handleHttp(context, next) {
+        const request = context.switchToHttp().getRequest();
+        const { method, url, body, headers, ip } = request;
+        if (!this.auditableMethods.includes(method)) {
+            return next.handle();
+        }
+        const startTime = Date.now();
+        const tenantId = headers['x-tenant-id'];
+        const userId = headers['x-user-id'];
+        return next.handle().pipe((0, rxjs_1.tap)(async (responseBody) => {
+            const duration = Date.now() - startTime;
+            const response = context.switchToHttp().getResponse();
+            await this.saveAuditEntry({
+                serviceName: this.serviceName,
+                action: method,
+                resource: url,
+                resourceId: this.extractResourceId(url),
+                tenantId,
+                userId,
+                requestBody: this.sanitizeBody(body),
+                responseStatus: response.statusCode,
+                responseBody: this.sanitizeBody(responseBody),
+                ipAddress: ip,
+                userAgent: headers['user-agent'],
+                duration,
+                timestamp: new Date(),
+            });
+        }), (0, rxjs_1.catchError)((error) => {
+            const duration = Date.now() - startTime;
+            this.saveAuditEntry({
+                serviceName: this.serviceName,
+                action: method,
+                resource: url,
+                resourceId: this.extractResourceId(url),
+                tenantId,
+                userId,
+                requestBody: this.sanitizeBody(body),
+                responseStatus: error.status || 500,
+                responseBody: { error: error.message },
+                ipAddress: ip,
+                userAgent: headers['user-agent'],
+                duration,
+                timestamp: new Date(),
+                metadata: { errorStack: error.stack },
+            }).catch(() => { });
+            throw error;
+        }));
+    }
+    handleGrpc(context, next) {
+        const startTime = Date.now();
+        const rpcContext = context.switchToRpc();
+        const handler = context.getHandler();
+        const className = context.getClass().name;
+        const methodName = `${className}.${handler.name}`;
+        return next.handle().pipe((0, rxjs_1.tap)(async () => {
+            const duration = Date.now() - startTime;
+            await this.saveAuditEntry({
+                serviceName: this.serviceName,
+                action: 'gRPC',
+                resource: methodName,
+                responseStatus: 0,
+                duration,
+                timestamp: new Date(),
+            });
+        }));
+    }
+    async saveAuditEntry(entry) {
+        try {
+            if (this.outboxRepository) {
+                await this.outboxRepository.createInTransaction(this.outboxRepository.prisma, {
+                    aggregateType: 'audit',
+                    aggregateId: entry.resourceId || 'system',
+                    eventType: 'audit.entry',
+                    payload: entry,
+                    metadata: { serviceName: this.serviceName },
+                });
+            }
+            else {
+                this.logger.log({ audit: true, ...entry });
+            }
+        }
+        catch (error) {
+            this.logger.error(`Failed to save audit entry: ${error.message}`);
+        }
+    }
+    extractResourceId(url) {
+        const uuidRegex = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i;
+        const match = url.match(uuidRegex);
+        return match?.[0];
+    }
+    sanitizeBody(body) {
+        if (!body)
+            return undefined;
+        const sanitized = { ...body };
+        const sensitiveFields = ['password', 'secret', 'token', 'apiKey', 'creditCard'];
+        for (const field of sensitiveFields) {
+            if (sanitized[field]) {
+                sanitized[field] = '[REDACTED]';
+            }
+        }
+        return sanitized;
+    }
+};
+exports.AuditInterceptor = AuditInterceptor;
+exports.AuditInterceptor = AuditInterceptor = AuditInterceptor_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Optional)()),
+    __metadata("design:paramtypes", [Object])
+], AuditInterceptor);
+//# sourceMappingURL=audit.interceptor.js.map

package/dist/auth/audit.interceptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.interceptor.js","sourceRoot":"","sources":["../../src/auth/audit.interceptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAUA,2CAOwB;AACxB,+BAAmD;AAsB5C,IAAM,gBAAgB,wBAAtB,MAAM,gBAAgB;IAKc;IAJxB,MAAM,GAAG,IAAI,eAAM,CAAC,kBAAgB,CAAC,IAAI,CAAC,CAAC;IAC3C,WAAW,CAAS;IACpB,gBAAgB,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAEvE,YAAyC,gBAAsB;QAAtB,qBAAgB,GAAhB,gBAAgB,CAAM;QAC7D,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,SAAS,CAAC;IAC3D,CAAC;IAED,SAAS,CAAC,OAAyB,EAAE,IAAiB;QACpD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QAEtC,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;aAAM,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IAEO,UAAU,CAAC,OAAyB,EAAE,IAAiB;QAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC;QAGnD,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;QAEpC,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CACvB,IAAA,UAAG,EAAC,KAAK,EAAE,YAAY,EAAE,EAAE;YACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAC;YAEtD,MAAM,IAAI,CAAC,cAAc,CAAC;gBACxB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,GAAG;gBACb,UAAU,EAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC;gBACvC,QAAQ;gBACR,MAAM;gBACN,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;gBACpC,cAAc,EAAE,QAAQ,CAAC,UAAU;gBACnC,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC;gBAC7C,SAAS,EAAE,EAAE;gBACb,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC;gBAChC,QAAQ;gBACR,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAC,CAAC;QACL,CAAC,CAAC,EACF,IAAA,iBAAU,EAAC,CAAC,KAAK,EAAE,EAAE;YACnB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAExC,IAAI,CAAC,cAAc,CAAC;gBAClB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,GAAG;gBACb,UAAU,EAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC;gBACvC,QAAQ;gBACR,MAAM;gBACN,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;gBACpC,cAAc,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG;gBACnC,YAAY,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE;gBACtC,SAAS,EAAE,EAAE;gBACb,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC;gBAChC,QAAQ;gBACR,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,QAAQ,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,EAAE;aACtC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAEnB,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,OAAyB,EAAE,IAAiB;QAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC;QAC1C,MAAM,UAAU,GAAG,GAAG,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QAElD,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CACvB,IAAA,UAAG,EAAC,KAAK,IAAI,EAAE;YACb,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACxC,MAAM,IAAI,CAAC,cAAc,CAAC;gBACxB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,UAAU;gBACpB,cAAc,EAAE,CAAC;gBACjB,QAAQ;gBACR,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAC,CAAC;QACL,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,KAAiB;QAC5C,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC1B,MAAM,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,CAC7C,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAC5B;oBACE,aAAa,EAAE,OAAO;oBACtB,WAAW,EAAE,KAAK,CAAC,UAAU,IAAI,QAAQ;oBACzC,SAAS,EAAE,aAAa;oBACxB,OAAO,EAAE,KAAK;oBACd,QAAQ,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;iBAC5C,CACF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBAEN,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAAgC,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,GAAW;QACnC,MAAM,SAAS,GAAG,+DAA+D,CAAC;QAClF,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACnC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAEO,YAAY,CAAC,IAAS;QAC5B,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QAC9B,MAAM,eAAe,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QAChF,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YACpC,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,SAAS,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC;YAClC,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF,CAAA;AA7IY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;IAME,WAAA,IAAA,iBAAQ,GAAE,CAAA;;GALZ,gBAAgB,CA6I5B"}

package/dist/auth/tenant.middleware.d.ts

@@ -0,0 +1,28 @@
+import { NestMiddleware, CanActivate, ExecutionContext } from '@nestjs/common';
+import { Request, Response, NextFunction } from 'express';
+export declare class TenantContext {
+    private _tenantId;
+    private _userId;
+    private _roles;
+    get tenantId(): string;
+    get userId(): string | null;
+    get roles(): string[];
+    set(tenantId: string, userId: string | null, roles: string[]): void;
+    isSuperAdmin(): boolean;
+    hasRole(role: string): boolean;
+}
+export declare class TenantMiddleware implements NestMiddleware {
+    private readonly tenantContext;
+    private readonly logger;
+    constructor(tenantContext: TenantContext);
+    use(req: Request, _res: Response, next: NextFunction): void;
+}
+export declare class TenantGuard implements CanActivate {
+    canActivate(context: ExecutionContext): boolean;
+}
+export declare function createPrismaTenantMiddleware(getTenantId: () => string): (params: any, next: (params: any) => Promise<any>) => Promise<any>;
+export declare function extractTenantFromGrpcMetadata(metadata: any): {
+    tenantId: string;
+    userId: string | null;
+    roles: string[];
+};

package/dist/auth/tenant.middleware.js

@@ -0,0 +1,129 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var TenantMiddleware_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TenantGuard = exports.TenantMiddleware = exports.TenantContext = void 0;
+exports.createPrismaTenantMiddleware = createPrismaTenantMiddleware;
+exports.extractTenantFromGrpcMetadata = extractTenantFromGrpcMetadata;
+const common_1 = require("@nestjs/common");
+let TenantContext = class TenantContext {
+    _tenantId = null;
+    _userId = null;
+    _roles = [];
+    get tenantId() {
+        if (!this._tenantId) {
+            throw new common_1.ForbiddenException('Tenant context not initialized');
+        }
+        return this._tenantId;
+    }
+    get userId() {
+        return this._userId;
+    }
+    get roles() {
+        return this._roles;
+    }
+    set(tenantId, userId, roles) {
+        this._tenantId = tenantId;
+        this._userId = userId;
+        this._roles = roles;
+    }
+    isSuperAdmin() {
+        return this._roles.includes('super_admin');
+    }
+    hasRole(role) {
+        return this._roles.includes(role);
+    }
+};
+exports.TenantContext = TenantContext;
+exports.TenantContext = TenantContext = __decorate([
+    (0, common_1.Injectable)({ scope: common_1.Scope.REQUEST })
+], TenantContext);
+let TenantMiddleware = TenantMiddleware_1 = class TenantMiddleware {
+    tenantContext;
+    logger = new common_1.Logger(TenantMiddleware_1.name);
+    constructor(tenantContext) {
+        this.tenantContext = tenantContext;
+    }
+    use(req, _res, next) {
+        const tenantId = req.headers['x-tenant-id'];
+        const userId = req.headers['x-user-id'];
+        const roles = req.headers['x-roles']?.split(',') || [];
+        if (tenantId) {
+            this.tenantContext.set(tenantId, userId, roles);
+        }
+        next();
+    }
+};
+exports.TenantMiddleware = TenantMiddleware;
+exports.TenantMiddleware = TenantMiddleware = TenantMiddleware_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [TenantContext])
+], TenantMiddleware);
+let TenantGuard = class TenantGuard {
+    canActivate(context) {
+        const request = context.switchToHttp().getRequest();
+        const tenantId = request.headers['x-tenant-id'];
+        if (!tenantId) {
+            throw new common_1.ForbiddenException('Missing tenant context');
+        }
+        return true;
+    }
+};
+exports.TenantGuard = TenantGuard;
+exports.TenantGuard = TenantGuard = __decorate([
+    (0, common_1.Injectable)()
+], TenantGuard);
+function createPrismaTenantMiddleware(getTenantId) {
+    return async (params, next) => {
+        const tenantModels = [
+            'Tenant', 'User', 'Role', 'Permission', 'Space', 'Zone',
+            'Device', 'Subscription', 'Scenario', 'Notification',
+        ];
+        if (!tenantModels.includes(params.model || '')) {
+            return next(params);
+        }
+        const tenantId = getTenantId();
+        const readActions = ['findUnique', 'findFirst', 'findMany', 'count', 'aggregate', 'groupBy'];
+        if (readActions.includes(params.action)) {
+            params.args = params.args || {};
+            params.args.where = {
+                ...params.args.where,
+                tenantId,
+            };
+        }
+        if (params.action === 'create') {
+            params.args = params.args || {};
+            params.args.data = {
+                ...params.args.data,
+                tenantId,
+            };
+        }
+        const writeActions = ['update', 'updateMany', 'delete', 'deleteMany', 'upsert'];
+        if (writeActions.includes(params.action)) {
+            params.args = params.args || {};
+            if (params.args.where) {
+                params.args.where = {
+                    ...params.args.where,
+                    tenantId,
+                };
+            }
+        }
+        return next(params);
+    };
+}
+function extractTenantFromGrpcMetadata(metadata) {
+    return {
+        tenantId: metadata.get('x-tenant-id')?.[0] || '',
+        userId: metadata.get('x-user-id')?.[0] || null,
+        roles: (metadata.get('x-roles')?.[0] || '').split(',').filter(Boolean),
+    };
+}
+//# sourceMappingURL=tenant.middleware.js.map

package/dist/auth/tenant.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.middleware.js","sourceRoot":"","sources":["../../src/auth/tenant.middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAuGA,oEA+CC;AAGD,sEAUC;AA1JD,2CASwB;AAMjB,IAAM,aAAa,GAAnB,MAAM,aAAa;IAChB,SAAS,GAAkB,IAAI,CAAC;IAChC,OAAO,GAAkB,IAAI,CAAC;IAC9B,MAAM,GAAa,EAAE,CAAC;IAE9B,IAAI,QAAQ;QACV,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,2BAAkB,CAAC,gCAAgC,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,GAAG,CAAC,QAAgB,EAAE,MAAqB,EAAE,KAAe;QAC1D,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,CAAC,IAAY;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;CACF,CAAA;AAjCY,sCAAa;wBAAb,aAAa;IADzB,IAAA,mBAAU,EAAC,EAAE,KAAK,EAAE,cAAK,CAAC,OAAO,EAAE,CAAC;GACxB,aAAa,CAiCzB;AAIM,IAAM,gBAAgB,wBAAtB,MAAM,gBAAgB;IAGE;IAFZ,MAAM,GAAG,IAAI,eAAM,CAAC,kBAAgB,CAAC,IAAI,CAAC,CAAC;IAE5D,YAA6B,aAA4B;QAA5B,kBAAa,GAAb,aAAa,CAAe;IAAG,CAAC;IAE7D,GAAG,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB;QAElD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAW,CAAC;QACtD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAW,CAAC;QAClD,MAAM,KAAK,GAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAY,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAEnE,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC;CACF,CAAA;AAjBY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;qCAIiC,aAAa;GAH9C,gBAAgB,CAiB5B;AAIM,IAAM,WAAW,GAAjB,MAAM,WAAW;IACtB,WAAW,CAAC,OAAyB;QACnC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAEhD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,2BAAkB,CAAC,wBAAwB,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAXY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;GACA,WAAW,CAWvB;AAUD,SAAgB,4BAA4B,CAAC,WAAyB;IACpE,OAAO,KAAK,EAAE,MAAW,EAAE,IAAmC,EAAE,EAAE;QAEhE,MAAM,YAAY,GAAG;YACnB,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM;YACvD,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,cAAc;SACrD,CAAC;QAEF,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;QAED,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;QAG/B,MAAM,WAAW,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QAC7F,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG;gBAClB,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK;gBACpB,QAAQ;aACT,CAAC;QACJ,CAAC;QAGD,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG;gBACjB,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI;gBACnB,QAAQ;aACT,CAAC;QACJ,CAAC;QAGD,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;QAChF,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YAChC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACtB,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG;oBAClB,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK;oBACpB,QAAQ;iBACT,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC,CAAC;AACJ,CAAC;AAGD,SAAgB,6BAA6B,CAAC,QAAa;IAKzD,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;QAChD,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI;QAC9C,KAAK,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;KACvE,CAAC;AACJ,CAAC"}

package/dist/config/feature-flags.d.ts

@@ -0,0 +1,26 @@
+import { OnModuleInit, OnModuleDestroy } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+export interface FeatureFlag {
+    value: boolean;
+    description?: string;
+    rollout?: number;
+    tenants?: string | string[];
+    config?: Record<string, any>;
+}
+export declare class FeatureFlagService implements OnModuleInit, OnModuleDestroy {
+    private readonly config;
+    private readonly logger;
+    private readonly flags;
+    private pollTimer;
+    private readonly POLL_INTERVAL;
+    private readonly KV_PREFIX;
+    constructor(config: ConfigService);
+    onModuleInit(): Promise<void>;
+    onModuleDestroy(): void;
+    isEnabled(flagName: string, tenantId?: string): Promise<boolean>;
+    getConfig<T = Record<string, any>>(flagName: string): Promise<T | null>;
+    getAllFlags(): Map<string, FeatureFlag>;
+    private loadFlags;
+    private loadDefaults;
+    private simpleHash;
+}