@flusys/nestjs-shared 8.1.5 → 9.0.1

package/fesm/470.js

@@ -1,4 +1,3 @@
-import * as __rspack_external_crypto from "crypto";
 import * as __rspack_external__nestjs_passport_18907953 from "@nestjs/passport";
 import * as __rspack_external_rxjs from "rxjs";
 import * as __rspack_external_rxjs_operators_2eaa0997 from "rxjs/operators";
@@ -49,10 +48,14 @@ __webpack_require__.d(__webpack_exports__, {
   XI: () => (/* reexport */ disabled_event_bus_class/* .DisabledEventBus */.X),
   V0: () => (/* reexport */ permissions/* .EMAIL_CONFIG_PERMISSIONS */.V0),
   z$: () => (/* reexport */ permissions/* .EMAIL_TEMPLATE_PERMISSIONS */.z$),
+  G0: () => (/* reexport */ permissions/* .ENTITY_BUILDER_ALL_DYNAMIC */.G0),
+  DP: () => (/* reexport */ permissions/* .ENTITY_DEFINITION_PERMISSIONS */.DP),
   Ub: () => (/* reexport */ permissions/* .EVENT_PERMISSIONS */.Ub),
   qS: () => (/* reexport */ event_bus_registry/* .EventBusRegistry */.q),
   Pm: () => (/* reexport */ event_transport_registry/* .EventTransportRegistry */.P),
+  kA: () => (/* reexport */ permissions/* .FIELD_DEFINITION_PERMISSIONS */.kA),
   S6: () => (/* reexport */ permissions/* .FILE_PERMISSIONS */.S6),
+  kd: () => (/* reexport */ permissions/* .FLOW_DEFINITION_PERMISSIONS */.kd),
   wM: () => (/* reexport */ permissions/* .FOLDER_PERMISSIONS */.wM),
   Wc: () => (/* reexport */ permissions/* .FORM_PERMISSIONS */.Wc),
   GT: () => (/* reexport */ permissions/* .FORM_RESULT_PERMISSIONS */.GT),
@@ -81,6 +84,8 @@ __webpack_require__.d(__webpack_exports__, {
   Zq: () => (/* reexport */ handle_custome_db/* .buildQuery */.Zq),
   RD: () => (/* reexport */ createApiController),
   Xv: () => (/* reexport */ winston_logger_class/* .createModuleLogger */.X),
+  aT: () => (/* reexport */ permissions/* .dynamicEntityPermission */.aT),
+  GH: () => (/* reexport */ permissions/* .dynamicEntityPermissionParent */.GH),
   Tj: () => (/* reexport */ handle_custome_db/* .getCastIntType */.Tj),
   pf: () => (/* reexport */ handle_custome_db/* .getJsonColumnType */.pf),
   KJ: () => (/* reexport */ winston_logger_class/* .instance */.K),
@@ -99,14 +104,16 @@ var message_keys = __webpack_require__(389);
 var src_decorators = __webpack_require__(523);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/decorators/api-response.decorator.ts
 var api_response_decorator = __webpack_require__(997);
-// EXTERNAL MODULE: ./projects/nestjs-shared/src/dtos/index.ts + 7 modules
-var src_dtos = __webpack_require__(980);
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/dtos/index.ts + 6 modules
+var src_dtos = __webpack_require__(746);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/exceptions/index.ts
 var exceptions = __webpack_require__(448);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/guards/index.ts + 4 modules
 var guards = __webpack_require__(510);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/interceptors/index.ts + 7 modules
 var interceptors = __webpack_require__(863);
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/pipes/index.ts + 1 modules
+var pipes = __webpack_require__(928);
 ;// CONCATENATED MODULE: ./projects/nestjs-shared/src/classes/api-controller.class.ts
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -141,6 +148,7 @@ function _ts_param(paramIndex, decorator) {
 
 
 
+
 /**
  * Helper to normalize security config
  */ function normalizeSecurity(config) {
@@ -212,6 +220,22 @@ function _ts_param(paramIndex, decorator) {
     }
     // Entity name for message keys (defaults to 'item')
     const entityName = options.entityName ?? 'item';
+    const insertBodyPipe = pipes/* .DtoBodyValidationPipe["for"] */.zT["for"](createDtoClass, [
+        'createdById'
+    ]);
+    const insertManyBodyPipe = pipes/* .DtoBodyValidationPipe["for"] */.zT["for"](createDtoClass, [
+        'createdById'
+    ], true);
+    const updateBodyPipe = pipes/* .DtoBodyValidationPipe["for"] */.zT["for"](updateDtoClass, [
+        'updatedById'
+    ]);
+    const updateManyBodyPipe = pipes/* .DtoBodyValidationPipe["for"] */.zT["for"](updateDtoClass, [
+        'updatedById'
+    ], true);
+    const bulkUpsertBodyPipe = new pipes/* .DtoBodyValidationPipe */.zT((item)=>item.id ? updateDtoClass : createDtoClass, [
+        'createdById',
+        'updatedById'
+    ], true);
     // Determine if security is global (applies to all) or per-endpoint
     const securityConfig = options.security;
     const endpointKeys = [
@@ -542,7 +566,7 @@ function _ts_param(paramIndex, decorator) {
             type: createDtoClass
         }),
         (0,common_.UseInterceptors)(interceptors/* .IdempotencyInterceptor */.Bw, interceptors/* .SetCreatedByOnBody */.VS, interceptors/* .Slug */.Mw),
-        _ts_param(0, (0,common_.Body)()),
+        _ts_param(0, (0,common_.Body)(insertBodyPipe)),
         _ts_param(1, (0,src_decorators/* .CurrentUser */.NO)()),
         _ts_metadata("design:type", Function),
         _ts_metadata("design:paramtypes", [
@@ -571,7 +595,7 @@ function _ts_param(paramIndex, decorator) {
             isArray: true
         }),
         (0,common_.UseInterceptors)(interceptors/* .IdempotencyInterceptor */.Bw, interceptors/* .SetCreatedByOnBody */.VS, interceptors/* .Slug */.Mw),
-        _ts_param(0, (0,common_.Body)()),
+        _ts_param(0, (0,common_.Body)(insertManyBodyPipe)),
         _ts_param(1, (0,src_decorators/* .CurrentUser */.NO)()),
         _ts_metadata("design:type", Function),
         _ts_metadata("design:paramtypes", [
@@ -646,7 +670,7 @@ function _ts_param(paramIndex, decorator) {
             type: updateDtoClass
         }),
         (0,common_.UseInterceptors)(interceptors/* .SetUpdateByOnBody */._x, interceptors/* .Slug */.Mw),
-        _ts_param(0, (0,common_.Body)()),
+        _ts_param(0, (0,common_.Body)(updateBodyPipe)),
         _ts_param(1, (0,src_decorators/* .CurrentUser */.NO)()),
         _ts_metadata("design:type", Function),
         _ts_metadata("design:paramtypes", [
@@ -670,7 +694,7 @@ function _ts_param(paramIndex, decorator) {
             isArray: true
         }),
         (0,common_.UseInterceptors)(interceptors/* .SetUpdateByOnBody */._x, interceptors/* .Slug */.Mw),
-        _ts_param(0, (0,common_.Body)()),
+        _ts_param(0, (0,common_.Body)(updateManyBodyPipe)),
         _ts_param(1, (0,src_decorators/* .CurrentUser */.NO)()),
         _ts_metadata("design:type", Function),
         _ts_metadata("design:paramtypes", [
@@ -694,7 +718,7 @@ function _ts_param(paramIndex, decorator) {
             isArray: true
         }),
         (0,common_.UseInterceptors)(interceptors/* .SetCreatedByOnBody */.VS, interceptors/* .SetUpdateByOnBody */._x, interceptors/* .Slug */.Mw),
-        _ts_param(0, (0,common_.Body)()),
+        _ts_param(0, (0,common_.Body)(bulkUpsertBodyPipe)),
         _ts_param(1, (0,src_decorators/* .CurrentUser */.NO)()),
         _ts_metadata("design:type", Function),
         _ts_metadata("design:paramtypes", [
@@ -824,14 +848,18 @@ function _ts_param(paramIndex, decorator) {
 
 // EXTERNAL MODULE: external "typeorm"
 var external_typeorm_ = __webpack_require__(158);
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/constants/index.ts
+var constants = __webpack_require__(43);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/decorators/log-action.decorator.ts
 var log_action_decorator = __webpack_require__(946);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/modules/utils/utils.service.ts
 var utils_service = __webpack_require__(169);
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/utils/cache-tenant.util.ts
+var cache_tenant_util = __webpack_require__(154);
 // EXTERNAL MODULE: external "crypto"
 var external_crypto_ = __webpack_require__(823);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/middlewares/logger.middleware.ts + 2 modules
-var logger_middleware = __webpack_require__(419);
+var logger_middleware = __webpack_require__(591);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/utils/event-pattern.util.ts
 var event_pattern_util = __webpack_require__(456);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/classes/event-bus.registry.ts
@@ -930,6 +958,7 @@ function api_service_class_ts_metadata(metadataKey, metadataValue) {
 
 
 
+
 const DELETE_EVENT_ACTIONS = {
     delete: 'deleted',
     restore: 'restored',
@@ -963,6 +992,9 @@ class ApiService {
     getDataSourceProvider() {
         return this._dataSourceProvider;
     }
+    /** Cached rows belong to the current tenant; pass this to every `UtilsService` cache helper. */ cacheTenant() {
+        return (0,cache_tenant_util/* .cacheTenantId */.q)(this._dataSourceProvider);
+    }
     async ensureDataSourceRepository() {
         if (!this.repositoryInitialized) {
             const provider = this.getDataSourceProvider();
@@ -1067,6 +1099,7 @@ class ApiService {
                 id: (0,external_typeorm_.In)(ids)
             });
             const selectArray = typeof select === 'string' ? select.split(',').map((s)=>s.trim()) : select;
+            selectArray?.forEach((field)=>this.assertColumnProperty(field));
             const { query: finalQuery, isRaw } = await this.getSelectQuery(query, user, selectArray);
             let output;
             if (isRaw) {
@@ -1077,7 +1110,7 @@ class ApiService {
             const result = this.convertEntityListToResponseListDto(output, isRaw);
             if (!result || !result.length) throw new common_.NotFoundException({
                 message: 'No Data Found',
-                messageKey: message_keys/* .ERROR_MESSAGES.NOT_FOUND */.UU.NOT_FOUND
+                messageKey: constants/* .ERROR_MESSAGES.NOT_FOUND */.UU.NOT_FOUND
             });
             return result;
         } catch (error) {
@@ -1090,6 +1123,7 @@ class ApiService {
     async findById(id, user, select) {
         await this.ensureDataSourceRepository();
         try {
+            select?.forEach((field)=>this.assertColumnProperty(field));
             const query = this.repository.createQueryBuilder(this.entityName);
             query.where({
                 id
@@ -1098,7 +1132,7 @@ class ApiService {
             let result;
             let cacheKey = '';
             if (this.isCacheable) {
-                cacheKey = this.utilsService.getCacheKey(this.entityName, finalQuery.getQueryAndParameters(), id);
+                cacheKey = this.utilsService.getCacheKey(this.entityName, finalQuery.getQueryAndParameters(), id, this.cacheTenant());
                 result = await this.cacheManager.get(cacheKey);
             }
             if (!result) {
@@ -1110,13 +1144,13 @@ class ApiService {
                     const singleOutput = await finalQuery.getOne();
                     if (!singleOutput) throw new common_.NotFoundException({
                         message: 'No Data Found',
-                        messageKey: message_keys/* .ERROR_MESSAGES.NOT_FOUND */.UU.NOT_FOUND
+                        messageKey: constants/* .ERROR_MESSAGES.NOT_FOUND */.UU.NOT_FOUND
                     });
                     result = this.convertEntityToResponseDto(singleOutput, false);
                 }
                 if (this.isCacheable) {
                     await this.cacheManager.set(cacheKey, result);
-                    await this.utilsService.trackCacheKey(cacheKey, this.entityName, this.cacheManager, id);
+                    await this.utilsService.trackCacheKey(cacheKey, this.entityName, this.cacheManager, id, this.cacheTenant());
                 }
             }
             return result;
@@ -1133,6 +1167,7 @@ class ApiService {
             let data;
             let total;
             let isRaw = false;
+            filterAndPaginationDto.select?.forEach((field)=>this.assertColumnProperty(field));
             let query = this.repository.createQueryBuilder(this.entityName);
             if (filterAndPaginationDto.filter) {
                 const { query: filterQuery, isRaw: filterIsRaw } = await this.getFilterQuery(query, filterAndPaginationDto.filter, user);
@@ -1171,7 +1206,7 @@ class ApiService {
                     raw: isRaw,
                     pagination: filterAndPaginationDto.pagination,
                     query: query.getQueryAndParameters()
-                });
+                }, undefined, this.cacheTenant());
                 const cached = await this.cacheManager.get(cacheKey);
                 if (cached) {
                     return cached;
@@ -1197,7 +1232,7 @@ class ApiService {
                     if (!(key in parameters)) {
                         throw new common_.InternalServerErrorException({
                             message: `Missing parameter value for: ${key}`,
-                            messageKey: message_keys/* .SYSTEM_MESSAGES.MISSING_PARAMETER */.hg.MISSING_PARAMETER,
+                            messageKey: constants/* .SYSTEM_MESSAGES.MISSING_PARAMETER */.hg.MISSING_PARAMETER,
                             messageVariables: {
                                 key
                             }
@@ -1219,7 +1254,7 @@ class ApiService {
             };
             if (this.isCacheable) {
                 await this.cacheManager.set(cacheKey, finalResponse);
-                await this.utilsService.trackCacheKey(cacheKey, this.entityName, this.cacheManager);
+                await this.utilsService.trackCacheKey(cacheKey, this.entityName, this.cacheManager, undefined, this.cacheTenant());
             }
             return finalResponse;
         } catch (error) {
@@ -1301,10 +1336,10 @@ class ApiService {
         });
     }
     async clearCacheForAll() {
-        await this.utilsService.clearCache(this.entityName, this.cacheManager);
+        await this.utilsService.clearCache(this.entityName, this.cacheManager, undefined, this.cacheTenant());
     }
     async clearCacheForId(entities) {
-        await Promise.all(entities.map((item)=>this.utilsService.clearCache(this.entityName, this.cacheManager, item.id)));
+        await Promise.all(entities.map((item)=>this.utilsService.clearCache(this.entityName, this.cacheManager, item.id, this.cacheTenant())));
     }
     handleError(error) {
         if (error instanceof Error) {
@@ -1312,7 +1347,7 @@ class ApiService {
         }
         throw new common_.InternalServerErrorException({
             message: typeof error === 'string' ? error : 'Unknown error',
-            messageKey: message_keys/* .ERROR_MESSAGES.INTERNAL */.UU.INTERNAL
+            messageKey: constants/* .ERROR_MESSAGES.INTERNAL */.UU.INTERNAL
         });
     }
     ensureArray(value) {
@@ -1356,6 +1391,26 @@ class ApiService {
             await qr.release();
         }
     }
+    /**
+   * Client-supplied filter/sort/select keys are interpolated into SQL as column identifiers
+   * (identifiers cannot be bound as parameters), so every key must first be proven to be a
+   * real column property of this entity - anything else is rejected outright.
+   */ assertColumnProperty(key) {
+        if (!this.repository.metadata.findColumnWithPropertyName(key)) {
+            throw new common_.BadRequestException({
+                message: `'${key}' is not a valid field.`,
+                messageKey: constants/* .ERROR_MESSAGES.VALIDATION */.UU.VALIDATION
+            });
+        }
+    }
+    /** Validated `<alias>.<column> = :param` filter with a per-key parameter name, so several
+   * filters in one request no longer overwrite each other's bound value. */ applyEqualsFilter(query, key, value) {
+        this.assertColumnProperty(key);
+        const param = `flt_${key}`;
+        query.andWhere(`${this.entityName}.${key} = :${param}`, {
+            [param]: value
+        });
+    }
     async beforeInsertOperation(_dto, _user, _queryRunner) {}
     async afterInsertOperation(_entity, _dto, _user, _queryRunner) {}
     async beforeUpdateOperation(_dto, _user, _queryRunner) {}
@@ -1363,11 +1418,7 @@ class ApiService {
     async beforeDeleteOperation(_dto, _user, _queryRunner) {}
     async afterDeleteOperation(_entity, _dto, _user, _queryRunner) {}
     async getFilterQuery(query, filter, _user) {
-        Object.entries(filter).forEach(([key, value])=>{
-            query.andWhere(`${this.entityName}.${key} = :value`, {
-                value
-            });
-        });
+        Object.entries(filter).forEach(([key, value])=>this.applyEqualsFilter(query, key, value));
         return {
             query,
             isRaw: false
@@ -1375,7 +1426,8 @@ class ApiService {
     }
     async getSortQuery(query, sort, _user) {
         Object.entries(sort).forEach(([key, direction])=>{
-            query.addOrderBy(`${this.entityName}.${key}`, direction);
+            this.assertColumnProperty(key);
+            query.addOrderBy(`${this.entityName}.${key}`, direction === 'DESC' ? 'DESC' : 'ASC');
         });
         return {
             query,
@@ -1383,7 +1435,10 @@ class ApiService {
         };
     }
     async getSelectQuery(query, _user, select) {
-        if (select && select.length) query.select(select.map((field)=>`${this.entityName}.${field}`));
+        if (select && select.length) {
+            select.forEach((field)=>this.assertColumnProperty(field));
+            query.select(select.map((field)=>`${this.entityName}.${field}`));
+        }
         return {
             query,
             isRaw: false
@@ -1419,7 +1474,7 @@ class ApiService {
             });
             if (!existing) throw new common_.NotFoundException({
                 message: 'No such entity data found for update! Please, Try Again.',
-                messageKey: message_keys/* .ERROR_MESSAGES.NOT_FOUND */.UU.NOT_FOUND
+                messageKey: constants/* .ERROR_MESSAGES.NOT_FOUND */.UU.NOT_FOUND
             });
             return Object.assign(existing, d);
         }
@@ -1559,7 +1614,7 @@ var permissions = __webpack_require__(975);
 
 },
 997(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _dtos_index_js__rspack_import_0 = __webpack_require__(980);
+/* import */ var _dtos_index_js__rspack_import_0 = __webpack_require__(746);
 /* import */ var _nestjs_common__rspack_import_1 = __webpack_require__(157);
 /* import */ var _nestjs_swagger__rspack_import_2 = __webpack_require__(176);
 
@@ -1730,7 +1785,7 @@ var constants = __webpack_require__(43);
 946(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 /* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(157);
 /* import */ var _classes_winston_logger_class_js__rspack_import_1 = __webpack_require__(245);
-/* import */ var _middlewares_logger_middleware_js__rspack_import_2 = __webpack_require__(419);
+/* import */ var _middlewares_logger_middleware_js__rspack_import_2 = __webpack_require__(591);
 
 
 
@@ -2021,53 +2076,6 @@ __webpack_require__.d(__webpack_exports__, {
 });
 
 
-},
-374(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(157);
-/* import */ var _constants_message_keys_js__rspack_import_1 = __webpack_require__(389);
-
-
-class PermissionSystemUnavailableException extends _nestjs_common__rspack_import_0.InternalServerErrorException {
-    constructor(){
-        super({
-            success: false,
-            message: 'Permission system temporarily unavailable',
-            messageKey: _constants_message_keys_js__rspack_import_1/* .ERROR_MESSAGES.PERMISSION_SYSTEM_UNAVAILABLE */.UU.PERMISSION_SYSTEM_UNAVAILABLE
-        });
-    }
-}
-class InsufficientPermissionsException extends _nestjs_common__rspack_import_0.ForbiddenException {
-    constructor(missingPermissions, operator = 'AND'){
-        const messageKey = operator === 'OR' ? _constants_message_keys_js__rspack_import_1/* .ERROR_MESSAGES.INSUFFICIENT_PERMISSIONS_OR */.UU.INSUFFICIENT_PERMISSIONS_OR : _constants_message_keys_js__rspack_import_1/* .ERROR_MESSAGES.INSUFFICIENT_PERMISSIONS */.UU.INSUFFICIENT_PERMISSIONS;
-        super({
-            success: false,
-            message: 'Insufficient permissions',
-            messageKey,
-            messageVariables: {
-                permissions: missingPermissions.join(', ')
-            },
-            missingPermissions,
-            operator
-        });
-    }
-}
-class NoPermissionsFoundException extends _nestjs_common__rspack_import_0.ForbiddenException {
-    constructor(){
-        super({
-            success: false,
-            message: 'No permissions found',
-            messageKey: _constants_message_keys_js__rspack_import_1/* .ERROR_MESSAGES.NO_PERMISSIONS_FOUND */.UU.NO_PERMISSIONS_FOUND
-        });
-    }
-}
-
-__webpack_require__.d(__webpack_exports__, {
-  GS: () => (PermissionSystemUnavailableException),
-  d$: () => (NoPermissionsFoundException),
-  z8: () => (InsufficientPermissionsException)
-});
-
-
 },
 510(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 
@@ -2080,8 +2088,8 @@ __webpack_require__.d(__webpack_exports__, {
 
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/constants/index.ts
 var constants = __webpack_require__(43);
-// EXTERNAL MODULE: ./projects/nestjs-shared/src/constants/message-keys.ts
-var message_keys = __webpack_require__(389);
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/middlewares/logger.middleware.ts + 2 modules
+var logger_middleware = __webpack_require__(591);
 // EXTERNAL MODULE: external "@nestjs/common"
 var common_ = __webpack_require__(157);
 // EXTERNAL MODULE: external "@nestjs/core"
@@ -2116,6 +2124,7 @@ function _ts_param(paramIndex, decorator) {
 
 
 
+
 class JwtAuthGuard extends (0,__rspack_external__nestjs_passport_18907953.AuthGuard)('jwt') {
     reflector;
     // NOTE: @Inject(Reflector) required for bundled code - external classes need explicit injection
@@ -2137,9 +2146,10 @@ class JwtAuthGuard extends (0,__rspack_external__nestjs_passport_18907953.AuthGu
         if (err || !user) {
             throw err || new common_.UnauthorizedException({
                 message: 'Invalid or expired token',
-                messageKey: message_keys/* .AUTH_MESSAGES.TOKEN_INVALID */.mK.TOKEN_INVALID
+                messageKey: constants/* .AUTH_MESSAGES.TOKEN_INVALID */.mK.TOKEN_INVALID
             });
         }
+        (0,logger_middleware/* .setRequestUser */.ZV)(user);
         return user;
     }
 }
@@ -2180,6 +2190,7 @@ function optional_jwt_auth_guard_ts_param(paramIndex, decorator) {
 
 
 
+
 class OptionalJwtGuard extends (0,__rspack_external__nestjs_passport_18907953.AuthGuard)('jwt') {
     reflector;
     constructor(reflector){
@@ -2196,6 +2207,7 @@ class OptionalJwtGuard extends (0,__rspack_external__nestjs_passport_18907953.Au
         return super.canActivate(context);
     }
     handleRequest(_err, user) {
+        (0,logger_middleware/* .setRequestUser */.ZV)(user);
         return user || undefined;
     }
 }
@@ -2263,7 +2275,7 @@ class PermissionGuard {
         const user = request.user;
         if (!user) throw new common_.UnauthorizedException({
             message: 'Authentication required',
-            messageKey: message_keys/* .AUTH_MESSAGES.TOKEN_REQUIRED */.mK.TOKEN_REQUIRED
+            messageKey: constants/* .AUTH_MESSAGES.TOKEN_REQUIRED */.mK.TOKEN_REQUIRED
         });
         if (!this.permissionCacheService?.isCacheConfigured()) {
             throw new permission_exception/* .PermissionSystemUnavailableException */.GS();
@@ -2449,8 +2461,6 @@ DeleteEmptyIdFromBodyInterceptor = _ts_decorate([
 var hybrid_cache_class = __webpack_require__(375);
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/constants/index.ts
 var constants = __webpack_require__(43);
-// EXTERNAL MODULE: ./projects/nestjs-shared/src/constants/message-keys.ts
-var message_keys = __webpack_require__(389);
 ;// CONCATENATED MODULE: ./projects/nestjs-shared/src/interceptors/idempotency.interceptor.ts
 function idempotency_interceptor_ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -2507,7 +2517,7 @@ class IdempotencyInterceptor {
                 throw new common_.ConflictException({
                     success: false,
                     message: 'Request is already being processed',
-                    messageKey: message_keys/* .SYSTEM_MESSAGES.DUPLICATE_REQUEST */.hg.DUPLICATE_REQUEST
+                    messageKey: constants/* .SYSTEM_MESSAGES.DUPLICATE_REQUEST */.hg.DUPLICATE_REQUEST
                 });
             }
             // Return cached response
@@ -2596,26 +2606,21 @@ function set_user_field_on_body_interceptor_ts_decorate(decorators, target, key,
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
 
-/**
- * Factory function to create interceptors that set user ID fields on request body
- * @param fieldName - The field name to set (e.g., 'createdById', 'updatedById', 'deletedById')
- */ function createSetUserFieldInterceptor(fieldName) {
+/** Stamps `fieldName` on the body from the authenticated user; a client-sent value is always dropped. */ function createSetUserFieldInterceptor(fieldName) {
     let SetUserFieldOnBody = class SetUserFieldOnBody {
         intercept(context, next) {
             const request = context.switchToHttp().getRequest();
-            const user = request?.user;
-            if (user) {
-                if (Array.isArray(request.body)) {
-                    request.body = request.body.map((item)=>({
-                            ...item,
-                            [fieldName]: user.id
-                        }));
-                } else if (typeof request.body === 'object' && request.body !== null) {
-                    request.body = {
-                        ...request.body,
-                        [fieldName]: user.id
-                    };
-                }
+            const userId = request?.user?.id;
+            const stamp = (item)=>{
+                if (typeof item !== 'object' || item === null || Array.isArray(item)) return item;
+                const { [fieldName]: _clientValue, ...rest } = item;
+                return userId ? {
+                    ...rest,
+                    [fieldName]: userId
+                } : rest;
+            };
+            if (request) {
+                request.body = Array.isArray(request.body) ? request.body.map(stamp) : stamp(request.body);
             }
             return next.handle();
         }
@@ -2625,9 +2630,9 @@ function set_user_field_on_body_interceptor_ts_decorate(decorators, target, key,
     ], SetUserFieldOnBody);
     return SetUserFieldOnBody;
 }
-/** Sets createdById field on request body from authenticated user */ const SetCreatedByOnBody = createSetUserFieldInterceptor('createdById');
-/** Sets updatedById field on request body from authenticated user */ const SetUpdateByOnBody = createSetUserFieldInterceptor('updatedById');
-/** Sets deletedById field on request body from authenticated user */ const SetDeletedByOnBody = createSetUserFieldInterceptor('deletedById');
+const SetCreatedByOnBody = createSetUserFieldInterceptor('createdById');
+const SetUpdateByOnBody = createSetUserFieldInterceptor('updatedById');
+const SetDeletedByOnBody = createSetUserFieldInterceptor('deletedById');
 
 // EXTERNAL MODULE: ./projects/nestjs-shared/src/modules/utils/utils.service.ts
 var utils_service = __webpack_require__(169);
@@ -2703,9 +2708,127 @@ Slug = slug_interceptor_ts_decorate([
 
 
 },
-823(module) {
+928(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+
+// EXPORTS
+__webpack_require__.d(__webpack_exports__, {
+  gG: () => (/* reexport */ AUDIT_BODY_KEYS),
+  d0: () => (/* reexport */ DEFAULT_VALIDATION_OPTIONS),
+  zT: () => (/* reexport */ DtoBodyValidationPipe)
+});
+
+// EXTERNAL MODULE: external "@nestjs/common"
+var common_ = __webpack_require__(157);
+// EXTERNAL MODULE: external "class-validator"
+var external_class_validator_ = __webpack_require__(421);
+// EXTERNAL MODULE: ./projects/nestjs-shared/src/constants/message-keys.ts
+var message_keys = __webpack_require__(389);
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/pipes/dto-body-validation.pipe.ts
+
+
+
+const DEFAULT_VALIDATION_OPTIONS = {
+    transform: true,
+    whitelist: true,
+    forbidNonWhitelisted: true,
+    transformOptions: {
+        enableImplicitConversion: false
+    }
+};
+const AUDIT_BODY_KEYS = [
+    'createdById',
+    'updatedById',
+    'deletedById'
+];
+/**
+ * Validates a generic controller body against its concrete DTO class: a generic
+ * `@Body() dto: T` reflects as `Object`, so the global ValidationPipe skips it.
+ * Audit keys are never taken from the client: `stampedKeys` (written by the endpoint's
+ * SetCreatedByOnBody / SetUpdateByOnBody interceptors, which run first) are kept, any other
+ * audit key is dropped. A `slug` the DTO does not declare is the Slug interceptor's and is kept.
+ */ class DtoBodyValidationPipe {
+    resolveDto;
+    stampedKeys;
+    isArray;
+    options;
+    pipes = new Map();
+    constructor(resolveDto, stampedKeys, isArray = false, options = DEFAULT_VALIDATION_OPTIONS){
+        this.resolveDto = resolveDto;
+        this.stampedKeys = stampedKeys;
+        this.isArray = isArray;
+        this.options = options;
+    }
+    static for(dto, stampedKeys, isArray = false) {
+        return new DtoBodyValidationPipe(()=>dto, stampedKeys, isArray);
+    }
+    async transform(value, metadata) {
+        if (!this.isArray) return this.validateItem(value, metadata);
+        if (!Array.isArray(value)) throw new common_.BadRequestException({
+            message: 'Request body must be an array',
+            messageKey: message_keys/* .ERROR_MESSAGES.VALIDATION */.UU.VALIDATION
+        });
+        return Promise.all(value.map((item)=>this.validateItem(item, metadata)));
+    }
+    async validateItem(item, metadata) {
+        if (item === null || typeof item !== 'object' || Array.isArray(item)) {
+            throw new common_.BadRequestException({
+                message: 'Request body item must be an object',
+                messageKey: message_keys/* .ERROR_MESSAGES.VALIDATION */.UU.VALIDATION
+            });
+        }
+        const dto = this.resolveDto(item);
+        const rest = {
+            ...item
+        };
+        const injected = {};
+        for (const key of AUDIT_BODY_KEYS){
+            if (!(key in rest)) continue;
+            if (this.stampedKeys.includes(key)) injected[key] = rest[key];
+            delete rest[key];
+        }
+        if ('slug' in rest && !declaresProperty(dto, 'slug')) {
+            injected['slug'] = rest['slug'];
+            delete rest['slug'];
+        }
+        const validated = await this.pipeFor(dto).transform(rest, {
+            ...metadata,
+            metatype: dto
+        });
+        return Object.assign(validated, injected);
+    }
+    pipeFor(dto) {
+        let pipe = this.pipes.get(dto);
+        if (!pipe) {
+            pipe = new common_.ValidationPipe({
+                ...this.options,
+                expectedType: dto
+            });
+            this.pipes.set(dto, pipe);
+        }
+        return pipe;
+    }
+}
+function declaresProperty(dto, key) {
+    return (0,external_class_validator_.getMetadataStorage)().getTargetValidationMetadatas(dto, '', true, false).some((m)=>m.propertyName === key);
+}
+
+;// CONCATENATED MODULE: ./projects/nestjs-shared/src/pipes/index.ts
+
+
+
+},
+154(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/**
+ * The tenant a cache key belongs to: the provider's current tenant in multi-tenant mode, else
+ * undefined. A single database never prefixes, so a stray tenant header cannot split its cache.
+ */ function cacheTenantId(provider) {
+    if (!provider?.isMultiTenant?.()) return undefined;
+    return provider.getCurrentTenantId?.() ?? undefined;
+}
 
-module.exports = __rspack_external_crypto;
+__webpack_require__.d(__webpack_exports__, {
+  q: () => (cacheTenantId)
+});
 
 
 },