@dunx/create-app 0.3.1 → 0.5.0

package/templates/features/database/ledger.service.ts

@@ -0,0 +1,257 @@
+import { Logger } from '@dunx/core';
+import type { OnInit, OnShutdown } from '@dunx/core';
+import {
+  DbConnection,
+  runSeeds,
+  SqliteConnection,
+  SyncDatabase,
+  transaction,
+  transactionSync,
+  type SeedReport,
+} from '@dunx/infra/db';
+import { count, desc, eq, sql, sum } from 'drizzle-orm';
+import * as schema from './schema.js';
+import { ledger, type Entry } from './schema.js';
+
+export class Ledger implements OnInit, OnShutdown {
+  /**
+   * `SyncDatabase` is drizzle's `BunSQLiteDatabase` under a name that says the
+   * connection was opened in synchronous mode - which is what makes
+   * `transactionSync` below reachable. `@dunx/transform` records the bare type name
+   * (a real runtime class, so a usable token) and ignores the type argument, so the
+   * schema types survive injection. `DbConnection` is the lifecycle and the driver
+   * underneath; drizzle has neither.
+   */
+  constructor(
+    private readonly db: SyncDatabase<typeof schema>,
+    private readonly connection: DbConnection,
+    private readonly logger: Logger,
+  ) {}
+
+  /**
+   * Standing in for a migration rather than replacing one: schema changes are
+   * `drizzle-kit generate` plus drizzle-orm/bun-sqlite/migrator, which own the
+   * SQL, the journal and the snapshot folder. A `:memory:` database has nowhere
+   * to keep any of that, so the table is created here - and at `onInit`, so the
+   * routes below have somewhere to write before the first request arrives.
+   */
+  async onInit(): Promise<void> {
+    this.db.run(sql`CREATE TABLE IF NOT EXISTS ledger (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      memo TEXT NOT NULL,
+      amount INTEGER NOT NULL
+    )`);
+    await runSeeds(this.db, { dir: `${import.meta.dir}/seeds` });
+  }
+
+  list(limit: number): readonly Entry[] {
+    return this.db
+      .select()
+      .from(ledger)
+      .orderBy(desc(ledger.id))
+      .limit(limit)
+      .all();
+  }
+
+  find(id: number): Entry | undefined {
+    return this.db.select().from(ledger).where(eq(ledger.id, id)).get();
+  }
+
+  /** `.returning()` hands back the row the database actually wrote. */
+  add(memo: string, amount: number): Entry {
+    return this.db.insert(ledger).values({ memo, amount }).returning().get();
+  }
+
+  remove(id: number): boolean {
+    const gone = this.db
+      .delete(ledger)
+      .where(eq(ledger.id, id))
+      .returning()
+      .all();
+    return gone.length > 0;
+  }
+
+  balance(): number {
+    return (
+      this.db
+        .select({ total: sum(ledger.amount).mapWith(Number) })
+        .from(ledger)
+        .get()?.total ?? 0
+    );
+  }
+
+  rows(): number {
+    return this.db.select({ n: count() }).from(ledger).get()?.n ?? 0;
+  }
+
+  /**
+   * Both legs or neither. `transaction()` from `@dunx/infra/db`, not
+   * `db.transaction()`: drizzle's own on bun-sqlite delegates to `bun:sqlite`'s
+   * synchronous `transaction()`, which commits as soon as the callback returns its
+   * promise - so everything after the first `await` would run in autocommit. That
+   * is what makes the rollback below possible at all.
+   */
+  transfer(
+    from: string,
+    to: string,
+    amount: number,
+    fail = false,
+  ): Promise<number> {
+    return transaction(this.db, async (tx) => {
+      tx.insert(ledger).values({ memo: from, amount: -amount }).run();
+      await Bun.sleep(1);
+      if (fail) throw new Error('transfer failed after the first leg');
+      tx.insert(ledger).values({ memo: to, amount }).run();
+      return (
+        tx
+          .select({ total: sum(ledger.amount).mapWith(Number) })
+          .from(ledger)
+          .get()?.total ?? 0
+      );
+    });
+  }
+
+  /**
+   * The same two legs, with nothing to await. `transactionSync` is drizzle's own
+   * `db.transaction()` - correct here precisely because the callback cannot return
+   * a promise, which is the case its early commit breaks. The return type is
+   * `number`, not `Promise<number>`, so a controller calling this needs no `async`
+   * and the request never yields.
+   */
+  transferSync(from: string, to: string, amount: number, fail = false): number {
+    return transactionSync(this.db, (tx) => {
+      tx.insert(ledger).values({ memo: from, amount: -amount }).run();
+      if (fail) throw new Error('transfer failed after the first leg');
+      tx.insert(ledger).values({ memo: to, amount }).run();
+      return (
+        tx
+          .select({ total: sum(ledger.amount).mapWith(Number) })
+          .from(ledger)
+          .get()?.total ?? 0
+      );
+    });
+  }
+
+  async demonstrate(): Promise<void> {
+    const { db, logger } = this;
+    logger.info(
+      `backend=${this.connection.backend} dialect=${this.connection.dialect}, ` +
+        'table "ledger" created at onInit',
+    );
+
+    // The escape hatch. `raw` is `unknown` on the base - the abstract class cannot
+    // promise either driver - and `instanceof` is what restores the concrete type.
+    if (this.connection instanceof SqliteConnection) {
+      logger.info(`raw driver -> bun:sqlite ${this.connection.raw.filename}`);
+    }
+
+    logger.info(
+      `insert -> ${JSON.stringify(this.add('opening balance', 100))}`,
+    );
+    this.add('coffee', -3);
+
+    const rows = db
+      .select({ memo: ledger.memo, amount: ledger.amount })
+      .from(ledger)
+      .orderBy(ledger.id)
+      .all();
+    logger.info(`select -> ${JSON.stringify(rows)}`);
+
+    // `.get()` is `undefined` when there is no row - never `null`.
+    const missing = db
+      .select()
+      .from(ledger)
+      .where(eq(ledger.memo, 'not in the book'))
+      .get();
+    logger.info(
+      `get() with no match -> ${missing === undefined ? 'undefined' : JSON.stringify(missing)}`,
+    );
+
+    await this.commits();
+    await this.rollsBack();
+    this.rollsBackSynchronously();
+    await this.seeds();
+  }
+
+  /**
+   * The same rollback with no promise anywhere - `transactionSync` throws where
+   * `transaction` rejects, so the recovery is `try`/`catch` rather than `.catch()`.
+   */
+  private rollsBackSynchronously(): void {
+    const before = this.rows();
+    try {
+      transactionSync(this.db, (tx) => {
+        tx.insert(ledger).values({ memo: 'discarded', amount: 999 }).run();
+        throw new Error('rolled back on purpose, synchronously');
+      });
+    } catch (error) {
+      this.logger.info(`sync transaction threw: ${(error as Error).message}`);
+    }
+    this.logger.info(
+      `rolled back sync transaction -> still ${before} rows, no promise allocated`,
+    );
+  }
+
+  /** The `await` inside is what proves the transaction is not autocommitting. */
+  private async commits(): Promise<void> {
+    const balance = await transaction(this.db, async (tx) => {
+      tx.insert(ledger).values({ memo: 'refund', amount: 12 }).run();
+      await Bun.sleep(1);
+      return tx
+        .select({ total: sum(ledger.amount).mapWith(Number) })
+        .from(ledger)
+        .get()?.total;
+    });
+    this.logger.info(
+      `committed transaction -> ${this.rows()} rows, balance ${balance}`,
+    );
+  }
+
+  /** Rolls back on throw, and the throw propagates rather than being swallowed. */
+  private async rollsBack(): Promise<void> {
+    const before = this.rows();
+    await transaction(this.db, async (tx) => {
+      tx.insert(ledger).values({ memo: 'discarded', amount: 999 }).run();
+      await Bun.sleep(1);
+      throw new Error('rolled back on purpose');
+    }).catch((error: unknown) =>
+      this.logger.info(`transaction threw: ${(error as Error).message}`),
+    );
+    this.logger.info(
+      `rolled back transaction -> still ${before} rows, ` +
+        '"discarded" never landed',
+    );
+  }
+
+  /**
+   * Seed *data*, which is the half `drizzle-kit` has no concept of. Numbered files
+   * in `seeds/`, each applied once and recorded in `dunx_seeds` - so this reports
+   * them journaled rather than applied, `onInit` having already run them.
+   */
+  private async seeds(): Promise<void> {
+    const dir = `${import.meta.dir}/seeds`;
+    this.report('runSeeds after onInit', await runSeeds(this.db, { dir }));
+    this.logger.info(
+      `seeded ledger -> ${this.rows()} rows, applied once despite two runs`,
+    );
+  }
+
+  private report(label: string, report: SeedReport): void {
+    this.logger.info(
+      `${label} -> applied ${JSON.stringify(report.applied)}, ` +
+        `journaled ${JSON.stringify(report.journaled)}, ` +
+        `skipped ${JSON.stringify(report.skipped)}`,
+    );
+  }
+
+  /**
+   * `close()` is idempotent, so `DbConnection.onShutdown` finding it already closed
+   * is fine. What this makes observable is the *order*: core drains in reverse
+   * construction order, so every service holding the connection has already run by
+   * the time this prints.
+   */
+  async onShutdown(): Promise<void> {
+    await this.connection.close();
+    this.logger.info('database closed');
+  }
+}

package/templates/features/database/schema.ts

@@ -0,0 +1,27 @@
+import { integer, sqliteTable, text } from 'drizzle-orm/sqlite-core';
+
+// better-auth's `user`/`session`/`account`/`verification`, re-exported so they are
+// part of the one schema object. That is what lets `drizzleDatabase(connection)` in
+// auth.module.ts pass no schema of its own - the adapter reads `db._.fullSchema`.
+export * from './auth.schema.js';
+
+/**
+ * One schema module, because there is one connection and one drizzle handle.
+ * `typeof schema` is what flows into `BunSQLiteDatabase<typeof schema>` at every
+ * injection site, so a table added here is visible to every repository without
+ * anything being registered anywhere.
+ */
+export const ledger = sqliteTable('ledger', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  memo: text('memo').notNull(),
+  amount: integer('amount').notNull(),
+});
+
+export const users = sqliteTable('users', {
+  id: integer('id').primaryKey({ autoIncrement: true }),
+  name: text('name').notNull().unique(),
+});
+
+/** Inferred, not restated: a column change here reaches the services that use it. */
+export type Entry = typeof ledger.$inferSelect;
+export type User = typeof users.$inferSelect;

package/templates/features/database/seeds/0001_ledger.seeder.ts

@@ -0,0 +1,12 @@
+import type { BunSQLiteDatabase } from 'drizzle-orm/bun-sqlite';
+import * as schema from '../schema.js';
+import { ledger } from '../schema.js';
+
+/**
+ * The handle is already inside a transaction that also writes the journal row, so a
+ * throw in here leaves neither the data nor the record - and the file is retried on
+ * the next boot.
+ */
+export function seed(db: BunSQLiteDatabase<typeof schema>): void {
+  db.insert(ledger).values({ memo: 'seeded: audit fee', amount: -7 }).run();
+}

package/templates/features/database/seeds/0002_production_audit.seeder.ts

@@ -0,0 +1,13 @@
+import type { BunSQLiteDatabase } from 'drizzle-orm/bun-sqlite';
+import * as schema from '../schema.js';
+import { ledger } from '../schema.js';
+
+/**
+ * A seed that belongs in one environment. A refused seed is *not* journaled, so it
+ * still runs the first time it reaches somewhere it does belong.
+ */
+export const when = (env: string): boolean => env === 'production';
+
+export function seed(db: BunSQLiteDatabase<typeof schema>): void {
+  db.insert(ledger).values({ memo: 'seeded: opening audit', amount: 0 }).run();
+}

package/templates/features/docs/docs.demo.ts

@@ -0,0 +1,130 @@
+import { Logger } from '@dunx/core';
+import type { HttpApp } from '@dunx/http';
+import {
+  danglingRefs,
+  OpenApiExplorer,
+  type OpenApiDocument,
+} from '@dunx/openapi';
+
+const documentAt = async (
+  url: string,
+  path = 'api/openapi.json',
+): Promise<[Response, OpenApiDocument]> => {
+  const response = await fetch(new URL(path, url));
+  return [response, (await response.json()) as OpenApiDocument];
+};
+
+export class DocsDemo {
+  constructor(private readonly logger: Logger) {}
+
+  /**
+   * The document is served by a controller in the same graph, so it goes through the
+   * same middleware and the same CORS as everything else - and describes the paths
+   * the app really mounted, `setGlobalPrefix('api')` included.
+   */
+  async demonstrate(app: HttpApp, url: string): Promise<void> {
+    const { logger } = this;
+    const [response, document] = await documentAt(url);
+
+    logger.info(
+      `GET /api/openapi.json -> ${response.status} openapi ${document.openapi}, ` +
+        `${Object.keys(document.paths).length} paths`,
+    );
+    logger.info(`paths: ${JSON.stringify(Object.keys(document.paths))}`);
+    logger.info(
+      `components/schemas: ${JSON.stringify(Object.keys(document.components.schemas))}`,
+    );
+
+    // `.meta({ id: 'CreateUser' })` on the zod schema is what named this ref, and
+    // the $defs entry it referenced (`Tag`) came along with it.
+    const create = document.paths['/api/users']?.post;
+    logger.info(
+      `POST /api/users requestBody -> ` +
+        JSON.stringify(
+          create?.requestBody?.content['application/json']?.schema,
+        ),
+    );
+    logger.info(
+      `POST /api/users 400 -> ` +
+        JSON.stringify(create?.responses['400']?.content?.['application/json']),
+    );
+    // `options.response` is the same contract as the request side, so a named
+    // response schema becomes a component and the operation $refs it. It is
+    // documentation only - nothing validates a response.
+    const one = document.paths['/api/users/{id}']?.get;
+    logger.info(
+      `GET /api/users/{id} responses -> ` +
+        JSON.stringify(
+          Object.fromEntries(
+            Object.entries(one?.responses ?? {}).map(([status, response]) => [
+              status,
+              response.content?.['application/json']?.schema,
+            ]),
+          ),
+        ),
+    );
+    const list = document.paths['/api/users']?.get;
+    logger.info(`GET /api/users query -> ${JSON.stringify(list?.parameters)}`);
+
+    // The check that matters: a $ref that resolves to nothing renders as an empty
+    // box in every viewer and reports no error at all.
+    logger.info(
+      `unresolved $refs: ${danglingRefs(document).length}, warnings: ` +
+        JSON.stringify(app.get(OpenApiExplorer).warnings),
+    );
+
+    const page = await fetch(new URL('api/docs', url));
+    const html = await page.text();
+    // Two inline scripts: the document as JSON, and the explorer bundle. What
+    // still has to hold is that nothing is *fetched* - so the check is on the
+    // markup, with both script bodies removed. Inside a <script> everything is
+    // text, and minified React's own string table contains `src=` and `<script`.
+    const shell = html.replace(/(<script[^>]*>)[\s\S]*?(<\/script>)/g, '$1$2');
+    const external =
+      /\ssrc=/.test(shell) ||
+      /<link\b/.test(shell) ||
+      /url\(\s*["']?(https?:)?\/\//.test(html) ||
+      html.includes('//cdn');
+    logger.info(
+      `GET /api/docs -> ${page.status} ${page.headers.get('content-type')}, ` +
+        `${html.length} bytes, ${(html.match(/<\/script>/g) ?? []).length} inline scripts, ` +
+        `external requests: ${external ? 'some' : 'none'}`,
+    );
+  }
+
+  /**
+   * The guarded app, whose `AuthGuard` is global. Security in the document comes from
+   * the same `@Public()` and `@Roles()` metadata the guards read at runtime - there
+   * is no second annotation for the documentation to disagree with.
+   */
+  async guarded(url: string): Promise<void> {
+    const { logger } = this;
+    const [, document] = await documentAt(url);
+
+    const rename = document.paths['/api/reports/{id}']?.patch;
+    logger.info(
+      `@Roles("editor") PATCH /api/reports/{id} -> security ` +
+        `${JSON.stringify(rename?.security)}, roles ` +
+        `${JSON.stringify(rename?.['x-required-roles'])}`,
+    );
+
+    const health = document.paths['/api/reports/health']?.get;
+    logger.info(
+      `@Public() GET /api/reports/health -> security ${JSON.stringify(health?.security)}`,
+    );
+
+    // The class-level @Roles('admin') is merged into every one of its routes, so it
+    // is documented on this one too - even though no RolesGuard reads it here. The
+    // document describes what the metadata declares; which guard enforces it is a
+    // separate decision, and one no generator can see.
+    const list = document.paths['/api/reports']?.get;
+    logger.info(
+      `class-level @Roles("admin") GET /api/reports -> security ` +
+        `${JSON.stringify(list?.security)}, roles ` +
+        `${JSON.stringify(list?.['x-required-roles'])}`,
+    );
+    logger.info(
+      `securitySchemes: ${JSON.stringify(document.components.securitySchemes)}`,
+    );
+  }
+}

package/templates/features/docs/docs.module.ts

@@ -0,0 +1,9 @@
+import { Module } from '@dunx/core';
+import { DocsDemo } from './docs.demo.js';
+
+/**
+ * Only the demonstration lives here. The document's own routes come from
+ * `OpenApiModule.forRoot()` in `main.ts`, which wraps the root module it documents.
+ */
+@Module({ providers: [DocsDemo] })
+export class DocsModule {}

package/templates/features/guards/auth.guard.ts

@@ -0,0 +1,66 @@
+import { Logger } from '@dunx/core';
+import type { BunRequest } from 'bun';
+import {
+  HttpError,
+  HttpStatusCode,
+  PUBLIC,
+  ROLES,
+  type Middleware,
+  type Next,
+  type RouteContext,
+} from '@dunx/http';
+
+/** `Authorization: Bearer <role>` - enough to demonstrate, short of a real token. */
+const roleOf = (req: BunRequest): string | undefined =>
+  req.headers.get('authorization')?.replace(/^Bearer\s+/i, '');
+
+/**
+ * Global middleware, so it sees every route. `ctx.get(PUBLIC)` is the only thing
+ * that can tell an opted-out route apart from one that needs credentials - which
+ * is what makes `@Public()` do something rather than decorate.
+ */
+export class AuthGuard implements Middleware {
+  constructor(private readonly logger: Logger) {}
+
+  handle(req: BunRequest, ctx: RouteContext, next: Next): Promise<Response> {
+    if (ctx.get(PUBLIC)) {
+      this.logger.info(
+        `AuthGuard: ${ctx.method} ${ctx.path} is @Public() - skipping`,
+      );
+      return next();
+    }
+    const role = roleOf(req);
+    if (role === undefined) {
+      throw new HttpError(HttpStatusCode.UNAUTHORIZED, 'No credentials');
+    }
+    this.logger.info(
+      `AuthGuard: ${ctx.controller}.${ctx.handler} authenticated as "${role}"`,
+    );
+    return next();
+  }
+}
+
+/**
+ * A guard is middleware that throws. Applied with `@UseGuards(RolesGuard)` at
+ * method scope, it reads whichever `@Roles` won - the method's, else the class's.
+ */
+export class RolesGuard implements Middleware {
+  constructor(private readonly logger: Logger) {}
+
+  handle(req: BunRequest, ctx: RouteContext, next: Next): Promise<Response> {
+    const required = ctx.get(ROLES);
+    if (!required) return next();
+
+    const role = roleOf(req);
+    this.logger.info(
+      `RolesGuard: ${ctx.handler} requires [${required.join(', ')}], caller is "${role ?? '-'}"`,
+    );
+    if (role === undefined || !required.includes(role)) {
+      throw new HttpError(
+        HttpStatusCode.FORBIDDEN,
+        `Requires one of: ${required.join(', ')}`,
+      );
+    }
+    return next();
+  }
+}

package/templates/features/guards/guards.demo.ts

@@ -0,0 +1,75 @@
+import { Logger } from '@dunx/core';
+
+interface Call {
+  readonly label: string;
+  readonly path: string;
+  readonly method?: string;
+  readonly role?: string;
+  readonly body?: unknown;
+}
+
+const CALLS: readonly Call[] = [
+  {
+    label: '@Public() GET /api/reports/health, no credentials',
+    path: 'api/reports/health',
+  },
+  { label: 'GET /api/reports, no credentials', path: 'api/reports' },
+  {
+    label: 'GET /api/reports as "viewer"',
+    path: 'api/reports',
+    role: 'viewer',
+  },
+  {
+    label: '@UseGuards(RolesGuard) POST /api/reports as "viewer"',
+    path: 'api/reports',
+    method: 'POST',
+    role: 'viewer',
+    body: { title: 'q2 revenue' },
+  },
+  {
+    label: 'POST /api/reports as "admin" (class-level @Roles)',
+    path: 'api/reports',
+    method: 'POST',
+    role: 'admin',
+    body: { title: 'q2 revenue' },
+  },
+  {
+    label:
+      'PATCH /api/reports/1 as "admin" (method-level @Roles("editor") won)',
+    path: 'api/reports/1',
+    method: 'PATCH',
+    role: 'admin',
+    body: { title: 'q1 revenue, restated' },
+  },
+  {
+    label: 'PATCH /api/reports/1 as "editor"',
+    path: 'api/reports/1',
+    method: 'PATCH',
+    role: 'editor',
+    body: { title: 'q1 revenue, restated' },
+  },
+];
+
+export class GuardsDemo {
+  constructor(private readonly logger: Logger) {}
+
+  async demonstrate(url: string): Promise<void> {
+    for (const call of CALLS) {
+      const response = await fetch(new URL(call.path, url), {
+        method: call.method ?? 'GET',
+        headers: {
+          ...(call.role === undefined
+            ? {}
+            : { authorization: `Bearer ${call.role}` }),
+          ...(call.body === undefined
+            ? {}
+            : { 'content-type': 'application/json' }),
+        },
+        ...(call.body === undefined ? {} : { body: JSON.stringify(call.body) }),
+      });
+      this.logger.info(
+        `${call.label} -> ${response.status} ${JSON.stringify(await response.json())}`,
+      );
+    }
+  }
+}

package/templates/features/guards/guards.module.ts

@@ -0,0 +1,16 @@
+import { Module } from '@dunx/core';
+import { AuthGuard, RolesGuard } from './auth.guard.js';
+import { GuardsDemo } from './guards.demo.js';
+import { ReportsController } from './reports.controller.js';
+import { ReportsService } from './reports.service.js';
+
+/**
+ * Part of the one app, not its own. `AuthGuard` is applied by
+ * `@UseGuards(AuthGuard)` on `ReportsController` rather than as global
+ * middleware, so it challenges `/api/reports` and nothing else.
+ */
+@Module({
+  controllers: [ReportsController],
+  providers: [ReportsService, AuthGuard, RolesGuard, GuardsDemo],
+})
+export class GuardsModule {}

package/templates/features/guards/reports.controller.ts

@@ -0,0 +1,60 @@
+import {
+  Controller,
+  Get,
+  Patch,
+  Post,
+  Public,
+  Roles,
+  UseGuards,
+  type Input,
+} from '@dunx/http';
+import { z } from 'zod';
+import { AuthGuard, RolesGuard } from './auth.guard.js';
+import { ReportsService } from './reports.service.js';
+
+const renameReport = {
+  params: z.object({ id: z.coerce.number().int() }),
+  body: z.object({ title: z.string().min(1) }),
+} as const;
+
+const createReport = { body: z.object({ title: z.string().min(1) }) } as const;
+
+// `@UseGuards(AuthGuard)` at class scope rather than as global middleware: every
+// other route in this app is meant to be reachable without credentials, and a
+// global guard would challenge all of them. `@Roles('admin')` is a class-level
+// default overridden per method below - metadata decides nothing until a guard
+// reads it.
+@Roles('admin')
+@UseGuards(AuthGuard)
+@Controller('reports')
+export class ReportsController {
+  constructor(private readonly reports: ReportsService) {}
+
+  // The class-level AuthGuard reads this and skips: no credentials needed.
+  @Public()
+  @Get('/health')
+  health(): { ok: true } {
+    return { ok: true };
+  }
+
+  // Authenticated, but no RolesGuard reads the class-level @Roles here.
+  @Get('/')
+  list(): readonly string[] {
+    return this.reports.titles();
+  }
+
+  // Method-scoped guard, reading the class-level @Roles('admin').
+  @UseGuards(RolesGuard)
+  @Post('/', createReport)
+  create(input: Input<typeof createReport>): readonly string[] {
+    return this.reports.add(input.body.title);
+  }
+
+  // A method-level @Roles wins over the class-level one.
+  @Roles('editor')
+  @UseGuards(RolesGuard)
+  @Patch('/:id', renameReport)
+  rename(input: Input<typeof renameReport>): readonly string[] {
+    return this.reports.rename(input.params.id, input.body.title);
+  }
+}