@ftisindia/create-app 0.1.3 → 0.1.4

package/template/src/database/prisma/prisma-transaction.ts

@@ -1,4 +1,4 @@
-import { Prisma } from "@prisma/client";
+import { Prisma } from '@prisma/client';
 
 type TransactionOptions = {
   maxWait?: number;

package/template/src/database/prisma/prisma.module.ts

@@ -1,5 +1,5 @@
-import { Global, Module } from "@nestjs/common";
-import { PrismaService } from "./prisma.service";
+import { Global, Module } from '@nestjs/common';
+import { PrismaService } from './prisma.service';
 
 @Global()
 @Module({

package/template/src/database/prisma/prisma.service.ts

@@ -1,11 +1,8 @@
-import { Injectable, OnModuleDestroy, OnModuleInit } from "@nestjs/common";
-import { PrismaClient } from "@prisma/client";
+import { Injectable, OnModuleDestroy, OnModuleInit } from '@nestjs/common';
+import { PrismaClient } from '@prisma/client';
 
 @Injectable()
-export class PrismaService
-  extends PrismaClient
-  implements OnModuleInit, OnModuleDestroy
-{
+export class PrismaService extends PrismaClient implements OnModuleInit, OnModuleDestroy {
   async onModuleInit() {
     await this.$connect();
   }

package/template/src/main.ts

@@ -1,9 +1,9 @@
-import { ValidationPipe } from "@nestjs/common";
-import { ConfigService } from "@nestjs/config";
-import { NestFactory } from "@nestjs/core";
-import { DocumentBuilder, SwaggerModule } from "@nestjs/swagger";
-import { AppModule } from "./app.module";
-import { HttpExceptionFilter } from "./common/filters/http-exception.filter";
+import { ValidationPipe } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { NestFactory } from '@nestjs/core';
+import { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';
+import { AppModule } from './app.module';
+import { HttpExceptionFilter } from './common/filters/http-exception.filter';
 
 async function bootstrap() {
   const app = await NestFactory.create(AppModule);
@@ -22,21 +22,21 @@ async function bootstrap() {
   const document = SwaggerModule.createDocument(
     app,
     new DocumentBuilder()
-      .setTitle("Foundation Starter API")
+      .setTitle('Foundation Starter API')
       .setDescription(
-        "Modular-monolith starter API with auth, organisations, RBAC, audit, and settings.",
+        'Modular-monolith starter API with auth, organisations, RBAC, audit, and settings.',
       )
-      .setVersion("0.1.0")
+      .setVersion('0.1.0')
       .addBearerAuth()
       .build(),
   );
-  SwaggerModule.setup("docs", app, document, {
+  SwaggerModule.setup('docs', app, document, {
     swaggerOptions: {
       persistAuthorization: true,
     },
   });
 
-  await app.listen(config.get<number>("app.port") ?? 3000);
+  await app.listen(config.get<number>('app.port') ?? 3000);
 }
 
 void bootstrap();

package/template/src/modules/access-control/access-control.module.ts

@@ -1,12 +1,12 @@
-import { Global, Module } from "@nestjs/common";
-import { DiscoveryModule } from "@nestjs/core";
-import { AuthModule } from "../auth/auth.module";
-import { RouteRegistryValidator } from "./application/route-registry.validator";
-import { AbilityFactory } from "./application/services/ability.factory";
-import { AccessControlService } from "./application/services/access-control.service";
-import { PermissionGuard } from "./application/services/permission.guard";
-import { RbacCacheService } from "./application/services/rbac-cache.service";
-import { AccessControlController } from "./presentation/access-control.controller";
+import { Global, Module } from '@nestjs/common';
+import { DiscoveryModule } from '@nestjs/core';
+import { AuthModule } from '../auth/auth.module';
+import { RouteRegistryValidator } from './application/route-registry.validator';
+import { AbilityFactory } from './application/services/ability.factory';
+import { AccessControlService } from './application/services/access-control.service';
+import { PermissionGuard } from './application/services/permission.guard';
+import { RbacCacheService } from './application/services/rbac-cache.service';
+import { AccessControlController } from './presentation/access-control.controller';
 
 @Global()
 @Module({

package/template/src/modules/access-control/application/role-permission-policy.ts

@@ -0,0 +1,71 @@
+import { ForbiddenException } from '@nestjs/common';
+
+/**
+ * Prevents privilege self-elevation: an actor may only assign or invite to a
+ * role whose permission set is a subset of the actor's own effective
+ * permissions. Organisation owners bypass the check.
+ *
+ * Both MembershipsService.assignRole and InvitationsService (create/resend)
+ * call this with the candidate role's permission keys and the actor's RBAC
+ * context, so a member holding only e.g. `roles.manage` / `memberships.invite`
+ * cannot grant a role carrying permissions they do not themselves hold.
+ */
+export function assertRoleWithinActorPermissions(args: {
+  actorIsOwner: boolean;
+  actorPermissionKeys: readonly string[];
+  rolePermissionKeys: readonly string[];
+}) {
+  if (args.actorIsOwner) {
+    return;
+  }
+
+  const heldKeys = new Set(args.actorPermissionKeys);
+  const exceeded = args.rolePermissionKeys.filter((key) => !heldKeys.has(key)).sort();
+
+  if (exceeded.length > 0) {
+    throw new ForbiddenException(
+      `You cannot grant a role with permissions you do not hold: ${exceeded.join(', ')}.`,
+    );
+  }
+}
+
+/**
+ * Prevents privilege escalation when a role's permission set is rewritten: a
+ * non-owner actor may only add or remove permission keys they themselves hold.
+ * Permission keys outside the actor's own set must stay unchanged — they can be
+ * neither granted nor revoked by someone who does not hold them. Owners bypass.
+ */
+export function assertPermissionChangeWithinActor(args: {
+  actorIsOwner: boolean;
+  actorPermissionKeys: readonly string[];
+  previousPermissionKeys: readonly string[];
+  nextPermissionKeys: readonly string[];
+}) {
+  if (args.actorIsOwner) {
+    return;
+  }
+
+  const previous = new Set(args.previousPermissionKeys);
+  const next = new Set(args.nextPermissionKeys);
+  const changed = new Set<string>();
+
+  for (const key of args.nextPermissionKeys) {
+    if (!previous.has(key)) {
+      changed.add(key);
+    }
+  }
+  for (const key of args.previousPermissionKeys) {
+    if (!next.has(key)) {
+      changed.add(key);
+    }
+  }
+
+  const heldKeys = new Set(args.actorPermissionKeys);
+  const exceeded = [...changed].filter((key) => !heldKeys.has(key)).sort();
+
+  if (exceeded.length > 0) {
+    throw new ForbiddenException(
+      `You cannot grant or revoke permissions you do not hold: ${exceeded.join(', ')}.`,
+    );
+  }
+}

package/template/src/modules/access-control/application/route-registry.validator.ts

@@ -1,17 +1,9 @@
-import {
-  Injectable,
-  OnApplicationBootstrap,
-  RequestMethod,
-} from "@nestjs/common";
-import { METHOD_METADATA, PATH_METADATA } from "@nestjs/common/constants";
-import { DiscoveryService, MetadataScanner, Reflector } from "@nestjs/core";
-import { REQUIRED_PERMISSIONS_KEY } from "../presentation/permissions.decorator";
-import {
-  PermissionKey,
-  permissionKeys,
-  RoutePermissionEntry,
-} from "../types/permission-key";
-import { routePermissionRegistry } from "../types/route-permission-registry";
+import { Injectable, OnApplicationBootstrap, RequestMethod } from '@nestjs/common';
+import { METHOD_METADATA, PATH_METADATA } from '@nestjs/common/constants';
+import { DiscoveryService, MetadataScanner, Reflector } from '@nestjs/core';
+import { REQUIRED_PERMISSIONS_KEY } from '../presentation/permissions.decorator';
+import { PermissionKey, permissionKeys, RoutePermissionEntry } from '../types/permission-key';
+import { routePermissionRegistry } from '../types/route-permission-registry';
 
 type ControllerInstance = Record<string, unknown>;
 type RouteHandler = (...args: unknown[]) => unknown;
@@ -33,28 +25,16 @@ export class RouteRegistryValidator implements OnApplicationBootstrap {
     const enforcedRoutes = this.discoverPermissionRoutes();
     const registryRoutes = routePermissionRegistry.map(normalizeEntry);
 
-    const enforcedByRoute = mapByRoute(
-      enforcedRoutes,
-      "enforced route metadata",
-    );
-    const registryByRoute = mapByRoute(
-      registryRoutes,
-      "routePermissionRegistry",
-    );
+    const enforcedByRoute = mapByRoute(enforcedRoutes, 'enforced route metadata');
+    const registryByRoute = mapByRoute(registryRoutes, 'routePermissionRegistry');
     const missingFromRegistry = enforcedRoutes.filter(
       (entry) => !registryByRoute.has(routeKey(entry)),
     );
     const staleRegistryEntries = registryRoutes.filter(
       (entry) => !enforcedByRoute.has(routeKey(entry)),
     );
-    const permissionMismatches = collectPermissionMismatches(
-      registryByRoute,
-      enforcedByRoute,
-    );
-    const unknownPermissions = collectUnknownPermissions([
-      ...registryRoutes,
-      ...enforcedRoutes,
-    ]);
+    const permissionMismatches = collectPermissionMismatches(registryByRoute, enforcedByRoute);
+    const unknownPermissions = collectUnknownPermissions([...registryRoutes, ...enforcedRoutes]);
 
     if (
       missingFromRegistry.length > 0 ||
@@ -83,16 +63,12 @@ export class RouteRegistryValidator implements OnApplicationBootstrap {
         continue;
       }
 
-      const controllerPaths = toPathParts(
-        this.reflector.get(PATH_METADATA, metatype),
-      );
+      const controllerPaths = toPathParts(this.reflector.get(PATH_METADATA, metatype));
       const prototype = Object.getPrototypeOf(instance) as object | null;
 
-      for (const methodName of this.metadataScanner.getAllMethodNames(
-        prototype,
-      )) {
+      for (const methodName of this.metadataScanner.getAllMethodNames(prototype)) {
         const handler = instance[methodName];
-        if (typeof handler !== "function") {
+        if (typeof handler !== 'function') {
           continue;
         }
 
@@ -112,9 +88,7 @@ export class RouteRegistryValidator implements OnApplicationBootstrap {
           continue;
         }
 
-        const methodPaths = toPathParts(
-          this.reflector.get(PATH_METADATA, handler),
-        );
+        const methodPaths = toPathParts(this.reflector.get(PATH_METADATA, handler));
         for (const path of combinePaths(controllerPaths, methodPaths)) {
           entries.push(
             normalizeEntry({
@@ -143,10 +117,7 @@ function collectPermissionMismatches(
       continue;
     }
 
-    if (
-      permissionListKey(registered.permissions) !==
-      permissionListKey(enforced.permissions)
-    ) {
+    if (permissionListKey(registered.permissions) !== permissionListKey(enforced.permissions)) {
       mismatches.push({
         key,
         registryPermissions: registered.permissions,
@@ -176,48 +147,48 @@ function formatRegistryDriftError({
   permissionMismatches: RoutePermissionDiff[];
   unknownPermissions: string[];
 }) {
-  const sections = ["Route permission registry drift detected."];
+  const sections = ['Route permission registry drift detected.'];
 
   if (missingFromRegistry.length > 0) {
     sections.push(
       [
-        "Permission-gated routes missing from routePermissionRegistry:",
+        'Permission-gated routes missing from routePermissionRegistry:',
         ...missingFromRegistry.map(formatEntry),
-      ].join("\n"),
+      ].join('\n'),
     );
   }
 
   if (staleRegistryEntries.length > 0) {
     sections.push(
       [
-        "routePermissionRegistry entries without matching permission-gated routes:",
+        'routePermissionRegistry entries without matching permission-gated routes:',
         ...staleRegistryEntries.map(formatEntry),
-      ].join("\n"),
+      ].join('\n'),
     );
   }
 
   if (permissionMismatches.length > 0) {
     sections.push(
       [
-        "routePermissionRegistry permission mismatches:",
+        'routePermissionRegistry permission mismatches:',
         ...permissionMismatches.map(
           (diff) =>
-            `- ${diff.key}: registry [${diff.registryPermissions.join(", ")}], enforced [${diff.enforcedPermissions.join(", ")}]`,
+            `- ${diff.key}: registry [${diff.registryPermissions.join(', ')}], enforced [${diff.enforcedPermissions.join(', ')}]`,
         ),
-      ].join("\n"),
+      ].join('\n'),
     );
   }
 
   if (unknownPermissions.length > 0) {
     sections.push(
       [
-        "Unknown permission keys referenced by guarded routes or routePermissionRegistry:",
+        'Unknown permission keys referenced by guarded routes or routePermissionRegistry:',
         ...unknownPermissions.map((permission) => `- ${permission}`),
-      ].join("\n"),
+      ].join('\n'),
     );
   }
 
-  return sections.join("\n\n");
+  return sections.join('\n\n');
 }
 
 function mapByRoute(entries: RoutePermissionEntry[], source: string) {
@@ -248,7 +219,7 @@ function combinePaths(controllerPaths: string[], methodPaths: string[]) {
 
   for (const controllerPath of controllerPaths) {
     for (const methodPath of methodPaths) {
-      paths.push(normalizePath([controllerPath, methodPath].join("/")));
+      paths.push(normalizePath([controllerPath, methodPath].join('/')));
     }
   }
 
@@ -257,19 +228,19 @@ function combinePaths(controllerPaths: string[], methodPaths: string[]) {
 
 function toPathParts(metadata: string | string[] | undefined) {
   if (Array.isArray(metadata)) {
-    return metadata.length > 0 ? metadata : [""];
+    return metadata.length > 0 ? metadata : [''];
   }
 
-  return [metadata ?? ""];
+  return [metadata ?? ''];
 }
 
 function normalizePath(path: string) {
   const trimmed = path
-    .split("/")
+    .split('/')
     .filter((part) => part.length > 0)
-    .join("/");
+    .join('/');
 
-  return trimmed ? `/${trimmed}` : "/";
+  return trimmed ? `/${trimmed}` : '/';
 }
 
 function requestMethodToString(method: RequestMethod) {
@@ -281,9 +252,9 @@ function routeKey(entry: RoutePermissionEntry) {
 }
 
 function permissionListKey(permissions: PermissionKey[]) {
-  return permissions.join("\0");
+  return permissions.join('\0');
 }
 
 function formatEntry(entry: RoutePermissionEntry) {
-  return `- ${routeKey(entry)} -> [${entry.permissions.join(", ")}]`;
+  return `- ${routeKey(entry)} -> [${entry.permissions.join(', ')}]`;
 }

package/template/src/modules/access-control/application/services/ability.factory.ts

@@ -1,11 +1,7 @@
-import {
-  AbilityBuilder,
-  createMongoAbility,
-  MongoAbility,
-} from "@casl/ability";
-import { Injectable } from "@nestjs/common";
-import { permissionKeyToRule } from "../../types/permission-key";
-import { RbacContext } from "../../types/rbac-context";
+import { AbilityBuilder, createMongoAbility, MongoAbility } from '@casl/ability';
+import { Injectable } from '@nestjs/common';
+import { permissionKeyToRule } from '../../types/permission-key';
+import { RbacContext } from '../../types/rbac-context';
 
 export type AppAbility = MongoAbility<[string, string]>;
 
@@ -15,7 +11,7 @@ export class AbilityFactory {
     const { can, build } = new AbilityBuilder<AppAbility>(createMongoAbility);
 
     if (context.isOwner) {
-      can("manage", "all");
+      can('manage', 'all');
     }
 
     for (const key of context.permissionKeys) {