@ftisindia/create-app 0.1.2 → 0.1.4

package/template/src/modules/sample/presentation/sample.controller.ts

@@ -1,61 +1,44 @@
-import {
-  Body,
-  Controller,
-  Get,
-  HttpCode,
-  Param,
-  Post,
-  UseGuards,
-} from "@nestjs/common";
-import {
-  ApiBearerAuth,
-  ApiOkResponse,
-  ApiOperation,
-  ApiParam,
-  ApiTags,
-} from "@nestjs/swagger";
-import { ApiProtectedErrorResponses } from "../../../common/swagger/api-error-responses";
-import { PermissionGuard } from "../../access-control/application/services/permission.guard";
-import { RequirePermissions } from "../../access-control/presentation/permissions.decorator";
-import { JwtAuthGuard } from "../../auth/infrastructure/passport/jwt-auth.guard";
-import { CurrentUser } from "../../auth/presentation/current-user.decorator";
-import { AuthenticatedUser } from "../../auth/types/authenticated-user";
-import { OrgScopeGuard } from "../../request-context/presentation/org-scope.guard";
-import { SampleEchoDto } from "../dto/sample-echo.dto";
-import {
-  SampleEchoResponseDto,
-  SampleStatusResponseDto,
-} from "../dto/sample-response.dto";
-import { SampleService } from "../application/services/sample.service";
+import { Body, Controller, Get, HttpCode, Param, Post, UseGuards } from '@nestjs/common';
+import { ApiBearerAuth, ApiOkResponse, ApiOperation, ApiParam, ApiTags } from '@nestjs/swagger';
+import { ApiProtectedErrorResponses } from '../../../common/swagger/api-error-responses';
+import { PermissionGuard } from '../../access-control/application/services/permission.guard';
+import { RequirePermissions } from '../../access-control/presentation/permissions.decorator';
+import { JwtAuthGuard } from '../../auth/infrastructure/passport/jwt-auth.guard';
+import { CurrentUser } from '../../auth/presentation/current-user.decorator';
+import { AuthenticatedUser } from '../../auth/types/authenticated-user';
+import { OrgScopeGuard } from '../../request-context/presentation/org-scope.guard';
+import { SampleEchoDto } from '../dto/sample-echo.dto';
+import { SampleEchoResponseDto, SampleStatusResponseDto } from '../dto/sample-response.dto';
+import { SampleService } from '../application/services/sample.service';
 
-@ApiTags("Sample")
+@ApiTags('Sample')
 @ApiBearerAuth()
-@ApiParam({ name: "orgId", description: "Organisation ID.", format: "uuid" })
+@ApiParam({ name: 'orgId', description: 'Organisation ID.', format: 'uuid' })
 @ApiProtectedErrorResponses()
-@Controller("organisations/:orgId/sample")
+@Controller('organisations/:orgId/sample')
 @UseGuards(JwtAuthGuard, OrgScopeGuard, PermissionGuard)
 export class SampleController {
   constructor(private readonly sampleService: SampleService) {}
 
-  @Get("status")
-  @RequirePermissions("organisations.read")
-  @ApiOperation({ summary: "Return sample module status and request context." })
+  @Get('status')
+  @RequirePermissions('organisations.read')
+  @ApiOperation({ summary: 'Return sample module status and request context.' })
   @ApiOkResponse({
-    description: "Sample status.",
+    description: 'Sample status.',
     type: SampleStatusResponseDto,
   })
-  status(@Param("orgId") orgId: string) {
+  status(@Param('orgId') orgId: string) {
     return this.sampleService.getStatus(orgId);
   }
 
-  @Post("echo")
+  @Post('echo')
   @HttpCode(200)
-  @RequirePermissions("organisations.update")
-  @ApiOperation({ summary: "Echo a message and write a sample audit record." })
-  @ApiOkResponse({ description: "Echo result.", type: SampleEchoResponseDto })
+  @RequirePermissions('organisations.update')
+  @ApiOperation({ summary: 'Echo a message and write a sample audit record.' })
+  @ApiOkResponse({ description: 'Echo result.', type: SampleEchoResponseDto })
   echo(
     @CurrentUser() user: AuthenticatedUser,
-    @Param("orgId") orgId: string,
+    @Param('orgId') orgId: string,
     @Body() dto: SampleEchoDto,
   ) {
     return this.sampleService.echo(user, orgId, dto);

package/template/src/modules/sample/sample.module.ts

@@ -1,7 +1,7 @@
-import { Module } from "@nestjs/common";
-import { AuthModule } from "../auth/auth.module";
-import { SampleService } from "./application/services/sample.service";
-import { SampleController } from "./presentation/sample.controller";
+import { Module } from '@nestjs/common';
+import { AuthModule } from '../auth/auth.module';
+import { SampleService } from './application/services/sample.service';
+import { SampleController } from './presentation/sample.controller';
 
 @Module({
   imports: [AuthModule],

package/template/src/modules/settings/application/services/settings.service.ts

@@ -1,18 +1,11 @@
-import {
-  BadRequestException,
-  Injectable,
-  NotFoundException,
-} from "@nestjs/common";
-import { Prisma } from "@prisma/client";
-import { PrismaService } from "../../../../database/prisma/prisma.service";
-import { AuditService } from "../../../audit/application/services/audit.service";
-import { AuthenticatedUser } from "../../../auth/types/authenticated-user";
-import { RequestContextService } from "../../../request-context/application/services/request-context.service";
-import { UpdateSettingDto } from "../../dto/update-setting.dto";
-import {
-  settingDefinitions,
-  SettingKey,
-} from "../../types/setting-definitions";
+import { BadRequestException, Injectable, NotFoundException } from '@nestjs/common';
+import { Prisma } from '@prisma/client';
+import { PrismaService } from '../../../../database/prisma/prisma.service';
+import { AuditService } from '../../../audit/application/services/audit.service';
+import { AuthenticatedUser } from '../../../auth/types/authenticated-user';
+import { RequestContextService } from '../../../request-context/application/services/request-context.service';
+import { UpdateSettingDto } from '../../dto/update-setting.dto';
+import { settingDefinitions, SettingKey } from '../../types/setting-definitions';
 
 @Injectable()
 export class SettingsService {
@@ -27,7 +20,8 @@ export class SettingsService {
 
     const settings = await this.prisma.organisationSetting.findMany({
       where: { orgId },
-      orderBy: { key: "asc" },
+      orderBy: { key: 'asc' },
+      take: Object.keys(settingDefinitions).length,
     });
 
     return settings.map(serializeSetting);
@@ -47,19 +41,13 @@ export class SettingsService {
     });
 
     if (!setting) {
-      throw new NotFoundException(
-        "Setting was not found for this organisation.",
-      );
+      throw new NotFoundException('Setting was not found for this organisation.');
     }
 
     return serializeSetting(setting);
   }
 
-  async updateSetting(
-    currentUser: AuthenticatedUser,
-    orgId: string,
-    dto: UpdateSettingDto,
-  ) {
+  async updateSetting(currentUser: AuthenticatedUser, orgId: string, dto: UpdateSettingDto) {
     this.requestContext.assertOrgScope(orgId);
     const definition = getSettingDefinition(dto.key);
     const value = definition.parse(dto.value);
@@ -92,8 +80,8 @@ export class SettingsService {
       await this.auditService.write(tx, {
         orgId,
         actorUserId: currentUser.id,
-        action: "organisation.setting.update",
-        targetType: "OrganisationSetting",
+        action: 'organisation.setting.update',
+        targetType: 'OrganisationSetting',
         targetId: setting.id,
         metadata: {
           key: dto.key,
@@ -111,7 +99,7 @@ export class SettingsService {
 
 function assertKnownSettingKey(key: string): asserts key is SettingKey {
   if (!Object.hasOwn(settingDefinitions, key)) {
-    throw new BadRequestException("Unknown organisation setting key.");
+    throw new BadRequestException('Unknown organisation setting key.');
   }
 }
 

package/template/src/modules/settings/dto/setting-response.dto.ts

@@ -1,27 +1,27 @@
-import { ApiProperty } from "@nestjs/swagger";
+import { ApiProperty } from '@nestjs/swagger';
 
 export class SettingResponseDto {
   @ApiProperty({
-    example: "949b2c7c-b6b4-4db6-a2ed-663fa5f6f877",
-    format: "uuid",
+    example: '949b2c7c-b6b4-4db6-a2ed-663fa5f6f877',
+    format: 'uuid',
   })
   id!: string;
 
   @ApiProperty({
-    example: "2c67399d-670c-4025-a5fd-1ea9a211891e",
-    format: "uuid",
+    example: '2c67399d-670c-4025-a5fd-1ea9a211891e',
+    format: 'uuid',
   })
   orgId!: string;
 
-  @ApiProperty({ example: "timezone" })
+  @ApiProperty({ example: 'timezone' })
   key!: string;
 
-  @ApiProperty({ example: "UTC" })
+  @ApiProperty({ example: 'UTC' })
   value!: unknown;
 
-  @ApiProperty({ example: "2026-06-01T10:30:00.000Z", format: "date-time" })
+  @ApiProperty({ example: '2026-06-01T10:30:00.000Z', format: 'date-time' })
   createdAt!: string;
 
-  @ApiProperty({ example: "2026-06-01T10:30:00.000Z", format: "date-time" })
+  @ApiProperty({ example: '2026-06-01T10:30:00.000Z', format: 'date-time' })
   updatedAt!: string;
 }

package/template/src/modules/settings/dto/update-setting.dto.ts

@@ -1,15 +1,15 @@
-import { ApiProperty } from "@nestjs/swagger";
-import { IsDefined, IsString, MaxLength } from "class-validator";
+import { ApiProperty } from '@nestjs/swagger';
+import { IsDefined, IsString, MaxLength } from 'class-validator';
 
 export class UpdateSettingDto {
-  @ApiProperty({ example: "timezone", maxLength: 120 })
+  @ApiProperty({ example: 'timezone', maxLength: 120 })
   @IsString()
   @MaxLength(120)
   key!: string;
 
   @ApiProperty({
-    description: "JSON value accepted by the setting definition.",
-    example: "UTC",
+    description: 'JSON value accepted by the setting definition.',
+    example: 'UTC',
   })
   @IsDefined()
   value!: unknown;

package/template/src/modules/settings/presentation/settings.controller.ts

@@ -1,64 +1,58 @@
-import { Body, Controller, Get, Param, Patch, UseGuards } from "@nestjs/common";
-import {
-  ApiBearerAuth,
-  ApiOkResponse,
-  ApiOperation,
-  ApiParam,
-  ApiTags,
-} from "@nestjs/swagger";
-import { ApiProtectedErrorResponses } from "../../../common/swagger/api-error-responses";
-import { PermissionGuard } from "../../access-control/application/services/permission.guard";
-import { RequirePermissions } from "../../access-control/presentation/permissions.decorator";
-import { JwtAuthGuard } from "../../auth/infrastructure/passport/jwt-auth.guard";
-import { CurrentUser } from "../../auth/presentation/current-user.decorator";
-import { AuthenticatedUser } from "../../auth/types/authenticated-user";
-import { OrgScopeGuard } from "../../request-context/presentation/org-scope.guard";
-import { UpdateSettingDto } from "../dto/update-setting.dto";
-import { SettingsService } from "../application/services/settings.service";
-import { SettingResponseDto } from "../dto/setting-response.dto";
+import { Body, Controller, Get, Param, Patch, UseGuards } from '@nestjs/common';
+import { ApiBearerAuth, ApiOkResponse, ApiOperation, ApiParam, ApiTags } from '@nestjs/swagger';
+import { ApiProtectedErrorResponses } from '../../../common/swagger/api-error-responses';
+import { PermissionGuard } from '../../access-control/application/services/permission.guard';
+import { RequirePermissions } from '../../access-control/presentation/permissions.decorator';
+import { JwtAuthGuard } from '../../auth/infrastructure/passport/jwt-auth.guard';
+import { CurrentUser } from '../../auth/presentation/current-user.decorator';
+import { AuthenticatedUser } from '../../auth/types/authenticated-user';
+import { OrgScopeGuard } from '../../request-context/presentation/org-scope.guard';
+import { UpdateSettingDto } from '../dto/update-setting.dto';
+import { SettingsService } from '../application/services/settings.service';
+import { SettingResponseDto } from '../dto/setting-response.dto';
 
-@ApiTags("Settings")
+@ApiTags('Settings')
 @ApiBearerAuth()
-@ApiParam({ name: "orgId", description: "Organisation ID.", format: "uuid" })
+@ApiParam({ name: 'orgId', description: 'Organisation ID.', format: 'uuid' })
 @ApiProtectedErrorResponses(404)
-@Controller("organisations/:orgId/settings")
+@Controller('organisations/:orgId/settings')
 @UseGuards(JwtAuthGuard, OrgScopeGuard, PermissionGuard)
 export class SettingsController {
   constructor(private readonly settingsService: SettingsService) {}
 
   @Get()
-  @RequirePermissions("settings.read")
-  @ApiOperation({ summary: "List organisation settings." })
+  @RequirePermissions('settings.read')
+  @ApiOperation({ summary: 'List organisation settings.' })
   @ApiOkResponse({
-    description: "Organisation settings.",
+    description: 'Organisation settings.',
     type: [SettingResponseDto],
   })
-  list(@Param("orgId") orgId: string) {
+  list(@Param('orgId') orgId: string) {
     return this.settingsService.listSettings(orgId);
   }
 
-  @Get(":key")
-  @RequirePermissions("settings.read")
-  @ApiParam({ name: "key", description: "Setting key.", example: "timezone" })
-  @ApiOperation({ summary: "Return one organisation setting." })
+  @Get(':key')
+  @RequirePermissions('settings.read')
+  @ApiParam({ name: 'key', description: 'Setting key.', example: 'timezone' })
+  @ApiOperation({ summary: 'Return one organisation setting.' })
   @ApiOkResponse({
-    description: "Organisation setting.",
+    description: 'Organisation setting.',
     type: SettingResponseDto,
   })
-  get(@Param("orgId") orgId: string, @Param("key") key: string) {
+  get(@Param('orgId') orgId: string, @Param('key') key: string) {
     return this.settingsService.getSetting(orgId, key);
   }
 
   @Patch()
-  @RequirePermissions("settings.update")
-  @ApiOperation({ summary: "Update one organisation setting." })
+  @RequirePermissions('settings.update')
+  @ApiOperation({ summary: 'Update one organisation setting.' })
   @ApiOkResponse({
-    description: "Updated organisation setting.",
+    description: 'Updated organisation setting.',
     type: SettingResponseDto,
   })
   update(
     @CurrentUser() user: AuthenticatedUser,
-    @Param("orgId") orgId: string,
+    @Param('orgId') orgId: string,
     @Body() dto: UpdateSettingDto,
   ) {
     return this.settingsService.updateSetting(user, orgId, dto);

package/template/src/modules/settings/settings.module.ts

@@ -1,8 +1,8 @@
-import { Module } from "@nestjs/common";
-import { AuditModule } from "../audit/audit.module";
-import { AuthModule } from "../auth/auth.module";
-import { SettingsService } from "./application/services/settings.service";
-import { SettingsController } from "./presentation/settings.controller";
+import { Module } from '@nestjs/common';
+import { AuditModule } from '../audit/audit.module';
+import { AuthModule } from '../auth/auth.module';
+import { SettingsService } from './application/services/settings.service';
+import { SettingsController } from './presentation/settings.controller';
 
 @Module({
   imports: [AuditModule, AuthModule],

package/template/src/modules/settings/types/setting-definitions.ts

@@ -1,5 +1,5 @@
-import { BadRequestException } from "@nestjs/common";
-import { Prisma } from "@prisma/client";
+import { BadRequestException } from '@nestjs/common';
+import { Prisma } from '@prisma/client';
 
 type SettingDefinition = {
   defaultValue: Prisma.InputJsonValue;
@@ -7,41 +7,45 @@ type SettingDefinition = {
 };
 
 export const settingDefinitions = {
-  "billing.plan": {
-    defaultValue: "free",
-    parse: parseEnum(["free", "starter", "pro", "enterprise"]),
+  'billing.plan': {
+    defaultValue: 'free',
+    parse: parseEnum(['free', 'starter', 'pro', 'enterprise']),
   },
-  "features.inventory_enabled": {
+  'features.inventory_enabled': {
     defaultValue: false,
     parse: parseBoolean,
   },
-  "features.reports_enabled": {
+  'features.reports_enabled': {
     defaultValue: false,
     parse: parseBoolean,
   },
-  "notifications.email_enabled": {
+  'notifications.email_enabled': {
     defaultValue: true,
     parse: parseBoolean,
   },
-  "invoice.prefix": {
-    defaultValue: "INV",
-    parse: parseShortString("invoice.prefix", 1, 20),
+  'invoice.prefix': {
+    defaultValue: 'INV',
+    parse: parseShortString('invoice.prefix', 1, 20),
   },
-  "invoice.approval_required": {
+  'invoice.approval_required': {
     defaultValue: false,
     parse: parseBoolean,
   },
-  "branding.logo_url": {
-    defaultValue: "",
+  'branding.logo_url': {
+    defaultValue: '',
     parse: parseOptionalUrl,
   },
+  timezone: {
+    defaultValue: 'UTC',
+    parse: parseTimezone,
+  },
 } satisfies Record<string, SettingDefinition>;
 
 export type SettingKey = keyof typeof settingDefinitions;
 
 function parseBoolean(value: unknown) {
-  if (typeof value !== "boolean") {
-    throw new BadRequestException("Setting value must be a boolean.");
+  if (typeof value !== 'boolean') {
+    throw new BadRequestException('Setting value must be a boolean.');
   }
 
   return value;
@@ -49,10 +53,8 @@ function parseBoolean(value: unknown) {
 
 function parseEnum(allowed: string[]) {
   return (value: unknown) => {
-    if (typeof value !== "string" || !allowed.includes(value)) {
-      throw new BadRequestException(
-        `Setting value must be one of: ${allowed.join(", ")}.`,
-      );
+    if (typeof value !== 'string' || !allowed.includes(value)) {
+      throw new BadRequestException(`Setting value must be one of: ${allowed.join(', ')}.`);
     }
 
     return value;
@@ -61,15 +63,13 @@ function parseEnum(allowed: string[]) {
 
 function parseShortString(key: string, min: number, max: number) {
   return (value: unknown) => {
-    if (typeof value !== "string") {
+    if (typeof value !== 'string') {
       throw new BadRequestException(`${key} must be a string.`);
     }
 
     const normalized = value.trim();
     if (normalized.length < min || normalized.length > max) {
-      throw new BadRequestException(
-        `${key} must be between ${min} and ${max} characters.`,
-      );
+      throw new BadRequestException(`${key} must be between ${min} and ${max} characters.`);
     }
 
     return normalized;
@@ -77,20 +77,18 @@ function parseShortString(key: string, min: number, max: number) {
 }
 
 function parseOptionalUrl(value: unknown) {
-  if (value === null || value === "") {
-    return "";
+  if (value === null || value === '') {
+    return '';
   }
 
-  if (typeof value !== "string") {
-    throw new BadRequestException("branding.logo_url must be a URL string.");
+  if (typeof value !== 'string') {
+    throw new BadRequestException('branding.logo_url must be a URL string.');
   }
 
   try {
     const url = new URL(value);
-    if (url.protocol !== "http:" && url.protocol !== "https:") {
-      throw new BadRequestException(
-        "branding.logo_url must use http or https.",
-      );
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+      throw new BadRequestException('branding.logo_url must use http or https.');
     }
 
     return url.toString();
@@ -99,6 +97,24 @@ function parseOptionalUrl(value: unknown) {
       throw error;
     }
 
-    throw new BadRequestException("branding.logo_url must be a valid URL.");
+    throw new BadRequestException('branding.logo_url must be a valid URL.');
+  }
+}
+
+function parseTimezone(value: unknown) {
+  if (typeof value !== 'string') {
+    throw new BadRequestException('timezone must be a string.');
   }
+
+  const normalized = value.trim();
+  try {
+    // Validate the zone, but don't adopt its canonical form: resolvedOptions()
+    // rewrites aliases (e.g. Asia/Kolkata -> Asia/Calcutta) in an ICU/Node-version
+    // dependent way. Preserve the caller's input so settings round-trip stably.
+    new Intl.DateTimeFormat('en-US', { timeZone: normalized }).resolvedOptions();
+  } catch {
+    throw new BadRequestException('timezone must be a valid IANA time zone.');
+  }
+
+  return normalized;
 }

package/template/test/auth-refresh.spec.ts

@@ -0,0 +1,90 @@
+import { UnauthorizedException } from '@nestjs/common';
+import { AuthService } from '../src/modules/auth/application/services/auth.service';
+
+describe('AuthService.refresh', () => {
+  it('commits refresh-token family revocation when a concurrent replay loses the claim', async () => {
+    const existingToken = {
+      id: 'old-token-id',
+      userId: 'user-id',
+      revokedAt: null,
+      replacedByTokenId: null,
+      expiresAt: new Date(Date.now() + 60_000),
+      user: {
+        id: 'user-id',
+        email: 'owner@example.com',
+        mobile: null,
+        displayName: null,
+        isActive: true,
+      },
+    };
+    const tx = {
+      refreshToken: {
+        updateMany: jest
+          .fn()
+          .mockResolvedValueOnce({ count: 0 })
+          .mockResolvedValueOnce({ count: 2 }),
+        findUnique: jest
+          .fn()
+          .mockResolvedValueOnce({ replacedByTokenId: 'next-token-id' })
+          .mockResolvedValueOnce({ replacedByTokenId: 'next-token-id' })
+          .mockResolvedValueOnce({ replacedByTokenId: null }),
+      },
+      auditLog: {
+        create: jest.fn().mockResolvedValue({}),
+      },
+    };
+    const prisma = {
+      refreshToken: {
+        findUnique: jest.fn().mockResolvedValue(existingToken),
+      },
+      $transaction: jest.fn((callback: (txClient: typeof tx) => unknown) =>
+        Promise.resolve(callback(tx)),
+      ),
+    };
+    const tokenService = {
+      hashRefreshToken: jest.fn().mockReturnValue('refresh-token-hash'),
+      createRefreshToken: jest.fn(),
+      signAccessToken: jest.fn(),
+      getAccessTokenTtlSeconds: jest.fn(),
+    };
+    const requestContext = {
+      getIpAddress: jest.fn(),
+      getUserAgent: jest.fn(),
+    };
+
+    const service = new AuthService(
+      {} as never,
+      {} as never,
+      prisma as never,
+      requestContext as never,
+      tokenService as never,
+    );
+
+    await expect(
+      service.refresh({ refreshToken: 'stale-refresh-token-value' }),
+    ).rejects.toBeInstanceOf(UnauthorizedException);
+
+    expect(tx.refreshToken.updateMany).toHaveBeenNthCalledWith(
+      2,
+      expect.objectContaining({
+        where: {
+          id: {
+            in: ['old-token-id', 'next-token-id'],
+          },
+        },
+        data: {
+          revokedAt: expect.any(Date),
+        },
+      }),
+    );
+    expect(tx.auditLog.create).toHaveBeenCalledWith(
+      expect.objectContaining({
+        data: expect.objectContaining({
+          action: 'auth.refresh.reuse_detected',
+          targetId: 'old-token-id',
+        }),
+      }),
+    );
+    expect(tokenService.createRefreshToken).not.toHaveBeenCalled();
+  });
+});