@flusys/nestjs-shared 1.1.0-beta → 1.2.0-rc.1

package/cjs/classes/api-controller.class.js

@@ -8,14 +8,16 @@ Object.defineProperty(exports, "createApiController", {
         return createApiController;
     }
 });
-const _decorators = require("@flusys/nestjs-shared/decorators");
-const _dtos = require("@flusys/nestjs-shared/dtos");
-const _guards = require("@flusys/nestjs-shared/guards");
-const _interceptors = require("@flusys/nestjs-shared/interceptors");
 const _common = require("@nestjs/common");
 const _swagger = require("@nestjs/swagger");
 const _classtransformer = require("class-transformer");
+const _messagekeys = require("../constants/message-keys");
+const _decorators = require("../decorators");
 const _apiresponsedecorator = require("../decorators/api-response.decorator");
+const _dtos = require("../dtos");
+const _exceptions = require("../exceptions");
+const _guards = require("../guards");
+const _interceptors = require("../interceptors");
 function _define_property(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
@@ -54,6 +56,24 @@ function _ts_param(paramIndex, decorator) {
     };
     return config;
 }
+/**
+ * Helper to check if endpoint is enabled
+ */ function isEndpointEnabled(endpoint, enabledEndpoints) {
+    if (!enabledEndpoints || enabledEndpoints === 'all') return true;
+    return enabledEndpoints.includes(endpoint);
+}
+/**
+ * Helper to conditionally exclude endpoint from Swagger if disabled
+ */ function createEndpointDecorators(security, endpoint, enabledEndpoints) {
+    const decorators = [];
+    // Add security decorators
+    decorators.push(createSecurityDecorators(security));
+    // Exclude from Swagger if endpoint is disabled
+    if (!isEndpointEnabled(endpoint, enabledEndpoints)) {
+        decorators.push((0, _swagger.ApiExcludeEndpoint)());
+    }
+    return (0, _common.applyDecorators)(...decorators);
+}
 /**
  * Creates security decorators based on configuration
  */ function createSecurityDecorators(security) {
@@ -72,11 +92,11 @@ function _ts_param(paramIndex, decorator) {
             // Apply PermissionGuard to check permissions from cache
             decorators.push((0, _common.UseGuards)(_guards.JwtAuthGuard, _guards.PermissionGuard));
             decorators.push((0, _swagger.ApiBearerAuth)());
-            // Check for complex nested condition first
-            if (security.condition) {
-                decorators.push((0, _decorators.RequirePermissionCondition)(security.condition));
+            // Check for complex logic first
+            if (security.logic) {
+                decorators.push((0, _decorators.RequirePermissionLogic)(security.logic));
             } else if (security.permissions && security.permissions.length > 0) {
-                if (security.operator === 'or') {
+                if (security.operator === 'OR') {
                     decorators.push((0, _decorators.RequireAnyPermission)(...security.permissions));
                 } else {
                     // AND is default and most secure
@@ -88,13 +108,24 @@ function _ts_param(paramIndex, decorator) {
     return (0, _common.applyDecorators)(...decorators);
 }
 function createApiController(createDtoClass, updateDtoClass, responseDtoClass, options = {}) {
+    const excludeExtraneousValues = options.excludeExtraneousValues ?? true;
+    function toDto(cls, input) {
+        return (0, _classtransformer.plainToInstance)(cls, input, {
+            excludeExtraneousValues
+        });
+    }
+    // Entity name for message keys (defaults to 'item')
+    const entityName = options.entityName ?? 'item';
     // Determine if security is global (applies to all) or per-endpoint
     const securityConfig = options.security;
     const endpointKeys = [
         'insert',
         'insertMany',
         'getById',
+        'getByIds',
         'getAll',
+        'bulkUpsert',
+        'getByFilter',
         'update',
         'updateMany',
         'delete'
@@ -104,34 +135,68 @@ function createApiController(createDtoClass, updateDtoClass, responseDtoClass, o
     // 2. It's an object with 'level' property but no endpoint keys
     const isGlobalSecurity = typeof securityConfig === 'string' || securityConfig && typeof securityConfig === 'object' && 'level' in securityConfig && !endpointKeys.some((key)=>key in securityConfig);
     // Normalize security config for each endpoint
+    // IMPORTANT: When per-endpoint security is specified, default to 'jwt' for unconfigured endpoints
+    // to prevent accidentally exposing endpoints without authentication
     const defaultSecurity = isGlobalSecurity ? normalizeSecurity(securityConfig) : {
-        level: 'public'
+        level: 'jwt'
     };
     const security = {
         insert: isGlobalSecurity ? defaultSecurity : normalizeSecurity(securityConfig?.insert),
         insertMany: isGlobalSecurity ? defaultSecurity : normalizeSecurity(securityConfig?.insertMany),
         getById: isGlobalSecurity ? defaultSecurity : normalizeSecurity(securityConfig?.getById),
+        getByIds: isGlobalSecurity ? defaultSecurity : normalizeSecurity(securityConfig?.getByIds),
         getAll: isGlobalSecurity ? defaultSecurity : normalizeSecurity(securityConfig?.getAll),
+        getByFilter: isGlobalSecurity ? defaultSecurity : normalizeSecurity(securityConfig?.getByFilter),
+        bulkUpsert: isGlobalSecurity ? defaultSecurity : normalizeSecurity(securityConfig?.bulkUpsert),
         update: isGlobalSecurity ? defaultSecurity : normalizeSecurity(securityConfig?.update),
         updateMany: isGlobalSecurity ? defaultSecurity : normalizeSecurity(securityConfig?.updateMany),
         delete: isGlobalSecurity ? defaultSecurity : normalizeSecurity(securityConfig?.delete)
     };
     let ApiController = class ApiController {
+        isEnabled(endpoint) {
+            if (this.enabledEndpoints === 'all') return true;
+            return Array.isArray(this.enabledEndpoints) && this.enabledEndpoints.includes(endpoint);
+        }
         async insert(addDto, user) {
+            if (!this.isEnabled('insert')) {
+                throw new _exceptions.BaseAppException({
+                    message: `Endpoint 'insert' is disabled`,
+                    messageKey: _messagekeys.ERROR_MESSAGES.ENDPOINT_DISABLED,
+                    messageVariables: {
+                        endpoint: 'insert'
+                    },
+                    status: _common.HttpStatus.FORBIDDEN
+                });
+            }
             const entity = await this.service.insert(addDto, user);
-            const data = (0, _classtransformer.plainToInstance)(responseDtoClass, entity);
+            const data = toDto(responseDtoClass, entity);
             return {
                 success: true,
-                message: 'Item created successfully',
+                message: `${entityName.charAt(0).toUpperCase() + entityName.slice(1)} created successfully`,
+                messageKey: `${entityName}.create.success`,
                 data
             };
         }
         async insertMany(addDto, user) {
+            if (!this.isEnabled('insertMany')) {
+                throw new _exceptions.BaseAppException({
+                    message: `Endpoint 'insertMany' is disabled`,
+                    messageKey: _messagekeys.ERROR_MESSAGES.ENDPOINT_DISABLED,
+                    messageVariables: {
+                        endpoint: 'insertMany'
+                    },
+                    status: _common.HttpStatus.FORBIDDEN
+                });
+            }
             const entities = await this.service.insertMany(addDto, user);
-            const data = entities.map((item)=>(0, _classtransformer.plainToInstance)(responseDtoClass, item));
+            const data = entities.map((item)=>toDto(responseDtoClass, item));
             return {
                 success: true,
-                message: `${data.length} items created successfully`,
+                message: `${data.length} ${entityName}s created successfully`,
+                messageKey: `${entityName}.create.many.success`,
+                messageVariables: {
+                    count: data.length
+                },
                 data,
                 meta: {
                     count: data.length,
@@ -141,29 +206,92 @@ function createApiController(createDtoClass, updateDtoClass, responseDtoClass, o
             };
         }
         async getById(id, body, user) {
+            if (!this.isEnabled('getById')) {
+                throw new _exceptions.BaseAppException({
+                    message: `Endpoint 'getById' is disabled`,
+                    messageKey: _messagekeys.ERROR_MESSAGES.ENDPOINT_DISABLED,
+                    messageVariables: {
+                        endpoint: 'getById'
+                    },
+                    status: _common.HttpStatus.FORBIDDEN
+                });
+            }
             const entity = await this.service.findById(id, user, body?.select);
-            const data = (0, _classtransformer.plainToInstance)(responseDtoClass, entity);
+            const data = toDto(responseDtoClass, entity);
             return {
                 success: true,
-                message: 'Item retrieved successfully',
+                message: `${entityName.charAt(0).toUpperCase() + entityName.slice(1)} retrieved successfully`,
+                messageKey: `${entityName}.get.success`,
                 data
             };
         }
+        async getByIds(body, user) {
+            if (!this.isEnabled('getByIds')) {
+                throw new _exceptions.BaseAppException({
+                    message: `Endpoint 'getByIds' is disabled`,
+                    messageKey: _messagekeys.ERROR_MESSAGES.ENDPOINT_DISABLED,
+                    messageVariables: {
+                        endpoint: 'getByIds'
+                    },
+                    status: _common.HttpStatus.FORBIDDEN
+                });
+            }
+            const entities = await this.service.findByIds(body.ids, user, body?.select);
+            const data = entities.map((item)=>toDto(responseDtoClass, item));
+            return {
+                success: true,
+                message: `${data.length} ${entityName}${data.length !== 1 ? 's' : ''} retrieved successfully`,
+                messageKey: `${entityName}.get.by.ids.success`,
+                data,
+                meta: {
+                    total: data.length,
+                    page: 0,
+                    pageSize: data.length,
+                    count: data.length,
+                    totalPages: 1
+                }
+            };
+        }
         async update(updateDto, user) {
+            if (!this.isEnabled('update')) {
+                throw new _exceptions.BaseAppException({
+                    message: `Endpoint 'update' is disabled`,
+                    messageKey: _messagekeys.ERROR_MESSAGES.ENDPOINT_DISABLED,
+                    messageVariables: {
+                        endpoint: 'update'
+                    },
+                    status: _common.HttpStatus.FORBIDDEN
+                });
+            }
             const entity = await this.service.update(updateDto, user);
-            const data = (0, _classtransformer.plainToInstance)(responseDtoClass, entity);
+            const data = toDto(responseDtoClass, entity);
             return {
                 success: true,
-                message: 'Item updated successfully',
+                message: `${entityName.charAt(0).toUpperCase() + entityName.slice(1)} updated successfully`,
+                messageKey: `${entityName}.update.success`,
                 data
             };
         }
         async updateMany(updateDtos, user) {
+            if (!this.isEnabled('updateMany')) {
+                throw new _exceptions.BaseAppException({
+                    message: `Endpoint 'updateMany' is disabled`,
+                    messageKey: _messagekeys.ERROR_MESSAGES.ENDPOINT_DISABLED,
+                    messageVariables: {
+                        endpoint: 'updateMany'
+                    },
+                    status: _common.HttpStatus.FORBIDDEN
+                });
+            }
             const entities = await this.service.updateMany(updateDtos, user);
-            const data = (0, _classtransformer.plainToInstance)(responseDtoClass, entities);
+            const data = entities.map((item)=>toDto(responseDtoClass, item));
             return {
                 success: true,
-                message: `${data.length} items updated successfully`,
+                message: `${data.length} ${entityName}s updated successfully`,
+                messageKey: `${entityName}.update.many.success`,
+                messageVariables: {
+                    count: data.length
+                },
                 data,
                 meta: {
                     count: data.length,
@@ -172,15 +300,93 @@ function createApiController(createDtoClass, updateDtoClass, responseDtoClass, o
                 }
             };
         }
+        async bulkUpsert(dtos, user) {
+            if (!this.isEnabled('bulkUpsert')) {
+                throw new _exceptions.BaseAppException({
+                    message: `Endpoint 'bulkUpsert' is disabled`,
+                    messageKey: _messagekeys.ERROR_MESSAGES.ENDPOINT_DISABLED,
+                    messageVariables: {
+                        endpoint: 'bulkUpsert'
+                    },
+                    status: _common.HttpStatus.FORBIDDEN
+                });
+            }
+            const toInsert = [];
+            const toUpdate = [];
+            for (const dto of dtos){
+                if ('id' in dto && dto.id) {
+                    toUpdate.push(dto);
+                } else {
+                    toInsert.push(dto);
+                }
+            }
+            const allEntities = await this.service.bulkUpsert(toInsert, toUpdate, user);
+            const data = allEntities.map((item)=>toDto(responseDtoClass, item));
+            return {
+                success: true,
+                message: `${data.length} ${entityName}s upserted successfully`,
+                messageKey: `${entityName}.upsert.many.success`,
+                messageVariables: {
+                    count: data.length
+                },
+                data,
+                meta: {
+                    count: data.length,
+                    total: dtos.length,
+                    failed: dtos.length - data.length
+                }
+            };
+        }
+        async getByFilter(filter, user) {
+            if (!this.isEnabled('getByFilter')) {
+                throw new _exceptions.BaseAppException({
+                    message: `Endpoint 'getByFilter' is disabled`,
+                    messageKey: _messagekeys.ERROR_MESSAGES.ENDPOINT_DISABLED,
+                    messageVariables: {
+                        endpoint: 'getByFilter'
+                    },
+                    status: _common.HttpStatus.FORBIDDEN
+                });
+            }
+            const result = await this.service.getAll('', {
+                filter,
+                pagination: {
+                    currentPage: 0,
+                    pageSize: 1
+                }
+            }, user);
+            if (!result.data || result.data.length === 0) {
+                throw new _exceptions.NotFoundException(entityName);
+            }
+            const entity = result.data[0];
+            const data = toDto(responseDtoClass, entity);
+            return {
+                success: true,
+                message: `${entityName.charAt(0).toUpperCase() + entityName.slice(1)} retrieved successfully`,
+                messageKey: `${entityName}.get.by.filter.success`,
+                data
+            };
+        }
         async getAll(filterAndPaginationDto, user, search) {
+            if (!this.isEnabled('getAll')) {
+                throw new _exceptions.BaseAppException({
+                    message: `Endpoint 'getAll' is disabled`,
+                    messageKey: _messagekeys.ERROR_MESSAGES.ENDPOINT_DISABLED,
+                    messageVariables: {
+                        endpoint: 'getAll'
+                    },
+                    status: _common.HttpStatus.FORBIDDEN
+                });
+            }
             const result = await this.service.getAll(search ?? '', filterAndPaginationDto, user);
-            const data = (0, _classtransformer.plainToInstance)(responseDtoClass, result.data);
+            const data = result.data.map((item)=>toDto(responseDtoClass, item));
             const page = filterAndPaginationDto.pagination?.currentPage ?? 0;
             const pageSize = filterAndPaginationDto.pagination?.pageSize ?? data.length;
             const totalPages = pageSize > 0 ? Math.ceil(result.total / pageSize) : 1;
             return {
                 success: true,
-                message: 'Data retrieved successfully',
+                message: `${entityName.charAt(0).toUpperCase() + entityName.slice(1)}s retrieved successfully`,
+                messageKey: `${entityName}.get.all.success`,
                 data,
                 meta: {
                     total: result.total,
@@ -193,21 +399,37 @@ function createApiController(createDtoClass, updateDtoClass, responseDtoClass, o
             };
         }
         async delete(deleteDto, user) {
+            if (!this.isEnabled('delete')) {
+                throw new _exceptions.BaseAppException({
+                    message: `Endpoint 'delete' is disabled`,
+                    messageKey: _messagekeys.ERROR_MESSAGES.ENDPOINT_DISABLED,
+                    messageVariables: {
+                        endpoint: 'delete'
+                    },
+                    status: _common.HttpStatus.FORBIDDEN
+                });
+            }
             await this.service.delete(deleteDto, user);
             const count = Array.isArray(deleteDto.id) ? deleteDto.id.length : 1;
-            const action = deleteDto.type === 'restore' ? 'restored' : 'deleted';
+            const action = deleteDto.type === 'restore' ? 'restore' : 'delete';
             return {
                 success: true,
-                message: `${count} item${count > 1 ? 's' : ''} ${action} successfully`
+                message: `${count} ${entityName}${count > 1 ? 's' : ''} ${action}d successfully`,
+                messageKey: `${entityName}.${action}.success`,
+                messageVariables: {
+                    count
+                }
             };
         }
         constructor(service){
             _define_property(this, "service", void 0);
+            _define_property(this, "enabledEndpoints", void 0);
             this.service = service;
+            this.enabledEndpoints = options.enabledEndpoints ?? 'all';
         }
     };
     _ts_decorate([
-        createSecurityDecorators(security.insert),
+        createEndpointDecorators(security.insert, 'insert', options.enabledEndpoints),
         (0, _common.Version)(_common.VERSION_NEUTRAL),
         (0, _common.Post)('insert'),
         (0, _common.HttpCode)(_common.HttpStatus.CREATED),
@@ -235,7 +457,7 @@ function createApiController(createDtoClass, updateDtoClass, responseDtoClass, o
         _ts_metadata("design:returntype", Promise)
     ], ApiController.prototype, "insert", null);
     _ts_decorate([
-        createSecurityDecorators(security.insertMany),
+        createEndpointDecorators(security.insertMany, 'insertMany', options.enabledEndpoints),
         (0, _common.Version)(_common.VERSION_NEUTRAL),
         (0, _common.Post)('insert-many'),
         (0, _common.HttpCode)(_common.HttpStatus.CREATED),
@@ -264,7 +486,7 @@ function createApiController(createDtoClass, updateDtoClass, responseDtoClass, o
         _ts_metadata("design:returntype", Promise)
     ], ApiController.prototype, "insertMany", null);
     _ts_decorate([
-        createSecurityDecorators(security.getById),
+        createEndpointDecorators(security.getById, 'getById', options.enabledEndpoints),
         (0, _common.Version)(_common.VERSION_NEUTRAL),
         (0, _common.Post)('get/:id'),
         (0, _common.HttpCode)(_common.HttpStatus.OK),
@@ -294,7 +516,29 @@ function createApiController(createDtoClass, updateDtoClass, responseDtoClass, o
         _ts_metadata("design:returntype", Promise)
     ], ApiController.prototype, "getById", null);
     _ts_decorate([
-        createSecurityDecorators(security.update),
+        createEndpointDecorators(security.getByIds, 'getByIds', options.enabledEndpoints),
+        (0, _common.Version)(_common.VERSION_NEUTRAL),
+        (0, _common.Post)('get-by-ids'),
+        (0, _common.HttpCode)(_common.HttpStatus.OK),
+        (0, _swagger.ApiOperation)({
+            summary: 'Get items by IDs',
+            description: 'Retrieves multiple items by their IDs. Optionally specify fields to select.'
+        }),
+        (0, _swagger.ApiBody)({
+            type: _dtos.GetByIdsDto
+        }),
+        (0, _apiresponsedecorator.ApiResponseDto)(responseDtoClass, true, 'list'),
+        _ts_param(0, (0, _common.Body)()),
+        _ts_param(1, (0, _decorators.CurrentUser)()),
+        _ts_metadata("design:type", Function),
+        _ts_metadata("design:paramtypes", [
+            typeof _dtos.GetByIdsDto === "undefined" ? Object : _dtos.GetByIdsDto,
+            Object
+        ]),
+        _ts_metadata("design:returntype", Promise)
+    ], ApiController.prototype, "getByIds", null);
+    _ts_decorate([
+        createEndpointDecorators(security.update, 'update', options.enabledEndpoints),
         (0, _common.Version)(_common.VERSION_NEUTRAL),
         (0, _common.Post)('update'),
         (0, _common.HttpCode)(_common.HttpStatus.OK),
@@ -317,7 +561,7 @@ function createApiController(createDtoClass, updateDtoClass, responseDtoClass, o
         _ts_metadata("design:returntype", Promise)
     ], ApiController.prototype, "update", null);
     _ts_decorate([
-        createSecurityDecorators(security.updateMany),
+        createEndpointDecorators(security.updateMany, 'updateMany', options.enabledEndpoints),
         (0, _common.Version)(_common.VERSION_NEUTRAL),
         (0, _common.Post)('update-many'),
         (0, _common.HttpCode)(_common.HttpStatus.OK),
@@ -341,22 +585,62 @@ function createApiController(createDtoClass, updateDtoClass, responseDtoClass, o
         _ts_metadata("design:returntype", Promise)
     ], ApiController.prototype, "updateMany", null);
     _ts_decorate([
-        createSecurityDecorators(security.getAll),
+        createEndpointDecorators(security.bulkUpsert, 'bulkUpsert', options.enabledEndpoints),
+        (0, _common.Version)(_common.VERSION_NEUTRAL),
+        (0, _common.Post)('bulk-upsert'),
+        (0, _common.HttpCode)(_common.HttpStatus.OK),
+        (0, _swagger.ApiOperation)({
+            summary: 'Create or update multiple items',
+            description: 'Bulk upsert: items without ID are created, items with ID are updated.'
+        }),
+        (0, _apiresponsedecorator.ApiResponseDto)(responseDtoClass, true, 'bulk'),
+        (0, _swagger.ApiBody)({
+            type: createDtoClass,
+            isArray: true
+        }),
+        (0, _common.UseInterceptors)(_interceptors.SetCreatedByOnBody, _interceptors.SetUpdateByOnBody, _interceptors.Slug),
+        _ts_param(0, (0, _common.Body)()),
+        _ts_param(1, (0, _decorators.CurrentUser)()),
+        _ts_metadata("design:type", Function),
+        _ts_metadata("design:paramtypes", [
+            Array,
+            Object
+        ]),
+        _ts_metadata("design:returntype", Promise)
+    ], ApiController.prototype, "bulkUpsert", null);
+    _ts_decorate([
+        createEndpointDecorators(security.getByFilter, 'getByFilter', options.enabledEndpoints),
+        (0, _common.Version)(_common.VERSION_NEUTRAL),
+        (0, _common.Post)('get-by-filter'),
+        (0, _common.HttpCode)(_common.HttpStatus.OK),
+        (0, _swagger.ApiOperation)({
+            summary: 'Get single item by filter',
+            description: 'Retrieves a single item matching the provided filter criteria. Returns first match if multiple exist.'
+        }),
+        (0, _swagger.ApiBody)({
+            schema: {
+                type: 'object',
+                description: 'Filter criteria'
+            }
+        }),
+        (0, _apiresponsedecorator.ApiResponseDto)(responseDtoClass),
+        _ts_param(0, (0, _common.Body)()),
+        _ts_param(1, (0, _decorators.CurrentUser)()),
+        _ts_metadata("design:type", Function),
+        _ts_metadata("design:paramtypes", [
+            typeof Record === "undefined" ? Object : Record,
+            Object
+        ]),
+        _ts_metadata("design:returntype", Promise)
+    ], ApiController.prototype, "getByFilter", null);
+    _ts_decorate([
+        createEndpointDecorators(security.getAll, 'getAll', options.enabledEndpoints),
         (0, _common.Version)(_common.VERSION_NEUTRAL),
         (0, _common.Post)('get-all'),
         (0, _common.HttpCode)(_common.HttpStatus.OK),
         (0, _swagger.ApiOperation)({
             summary: 'Get all items with filters and pagination',
-            description: `
-Retrieves items with support for:
-- **filter**: Apply field-based filters (e.g., \`{ "isActive": true }\`)
-- **pagination**: Control page and page size
-- **sort**: Order by any field (e.g., \`{ "createdAt": "DESC" }\`)
-- **select**: Choose specific fields to return
-- **withDeleted**: Include soft-deleted items
-- **extraKey**: Include additional relations
-- **q** (query param): Global text search
-      `
+            description: 'Supports filter, pagination, sort, select, withDeleted, and q (search) params'
         }),
         (0, _swagger.ApiQuery)({
             name: 'q',
@@ -379,21 +663,13 @@ Retrieves items with support for:
         _ts_metadata("design:returntype", Promise)
     ], ApiController.prototype, "getAll", null);
     _ts_decorate([
-        createSecurityDecorators(security.delete),
+        createEndpointDecorators(security.delete, 'delete', options.enabledEndpoints),
         (0, _common.Version)(_common.VERSION_NEUTRAL),
         (0, _common.Post)('delete'),
         (0, _common.HttpCode)(_common.HttpStatus.OK),
         (0, _swagger.ApiOperation)({
             summary: 'Delete, restore, or permanently remove items',
-            description: `
-Performs one of three actions:
-
-- **"delete"** (soft delete): Marks items as deleted but keeps in database
-- **"restore"**: Reverts soft-deleted items to active
-- **"permanent"**: Completely removes items from database
-
-Supports single ID or array of IDs for batch operations.
-      `
+            description: 'Types: delete (soft), restore, permanent. Supports batch IDs.'
         }),
         (0, _swagger.ApiResponse)({
             status: 200,