@ftisindia/create-app 0.1.3 → 0.1.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ftisindia/create-app",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "One-command scaffolder for the Phase 1 NestJS foundation starter.",
   "type": "module",
   "bin": {

package/template/.env.example

@@ -21,6 +21,12 @@ AUTH_FACEBOOK_ENABLED=false
 AUTH_MOBILE_OTP_ENABLED=false
 AUTH_MAGIC_LINK_ENABLED=false
 
+CORS_ENABLED=false
+# Comma-separated exact browser origins, for example:
+# CORS_ORIGINS=http://localhost:5173,https://app.example.com
+CORS_ORIGINS=
+CORS_CREDENTIALS=false
+
 RBAC_CACHE_TTL_SECONDS=60
 # Path is the only supported mode in this starter phase.
 ORG_CONTEXT_MODE=path

package/template/README.md

@@ -1,4 +1,4 @@
-# __PROJECT_NAME__
+# **PROJECT_NAME**
 
 NestJS modular-monolith starter with email/password auth, Google OAuth handoff, organisations, memberships, invitations, per-organisation RBAC with CASL, request context, audit logs, typed settings, Swagger, and a complete sample module.
 
@@ -78,6 +78,7 @@ GET  /auth/google
 GET  /auth/google/callback
 GET  /auth/me
 POST /organisations
+GET  /organisations/mine
 GET  /organisations/:orgId/memberships/me
 GET  /organisations/:orgId/memberships
 PATCH /organisations/:orgId/memberships/:membershipId/status
@@ -91,6 +92,7 @@ POST /organisations/:orgId/invitations/:invitationId/revoke
 POST /organisations/:orgId/invitations/:invitationId/resend
 POST /invitations/accept
 POST /invitations/decline
+GET  /organisations/:orgId/access-control/me
 GET  /organisations/:orgId/access-control/permissions
 GET  /organisations/:orgId/access-control/route-permissions
 GET  /organisations/:orgId/access-control/roles
@@ -107,6 +109,14 @@ GET  /organisations/:orgId/sample/status
 POST /organisations/:orgId/sample/echo
 ```
 
+## Frontend Bootstrap
+
+After login, call `GET /organisations/mine` to populate the organisation picker,
+store the selected `orgId`, then call
+`GET /organisations/:orgId/access-control/me`. Use the returned
+`permissionKeys` for route, menu, and button visibility in the frontend. Backend
+guards remain the source of truth for access control.
+
 ## Architecture Rules
 
 - JWTs contain identity only. Organisation membership, roles, and permissions are read per request.

package/template/_package.json

@@ -42,7 +42,6 @@
     "bcryptjs": "3.0.3",
     "class-transformer": "0.5.1",
     "class-validator": "0.15.1",
-    "express-session": "1.19.0",
     "passport": "0.7.0",
     "passport-google-oauth20": "2.0.0",
     "passport-jwt": "4.0.1",
@@ -56,7 +55,6 @@
     "@nestjs/cli": "11.0.21",
     "@nestjs/schematics": "11.1.0",
     "@nestjs/testing": "11.1.24",
-    "@types/express-session": "1.19.0",
     "@types/jest": "30.0.0",
     "@types/node": "20.19.41",
     "@types/passport": "1.0.17",

package/template/docs/API_REFERENCE.md

@@ -28,6 +28,19 @@ After authorization, Swagger can call protected routes directly.
 Successful responses are documented per endpoint with typed response DTOs. Most
 date values are ISO strings.
 
+Growable list endpoints such as memberships, invitations, and roles are cursor
+paginated:
+
+```json
+{
+  "items": [],
+  "nextCursor": null
+}
+```
+
+Use `?limit=50` and pass `nextCursor` back as `?cursor=...` to fetch the next
+page.
+
 Errors use one common envelope:
 
 ```json

package/template/docs/OAUTH.md

@@ -18,9 +18,12 @@ Failures redirect to `AUTH_GOOGLE_ERROR_REDIRECT_URL?error=oauth_failed`.
 
 ## State And PKCE
 
-Google OAuth uses state and PKCE. A short-lived `oauth.sid` session cookie is scoped only to `/auth/google` and `/auth/google/callback` so Passport can store and verify the OAuth state and PKCE code verifier during the handshake.
+Google OAuth uses state and PKCE. The API encrypts and authenticates the PKCE
+code verifier inside a short-lived state value, so the callback can be handled
+without an Express session store.
 
-The rest of the app remains stateless JWT. There is no `passport.session()` and no persistent login session.
+The app remains stateless JWT. There is no `passport.session()`, no persistent
+login session, and no in-memory OAuth session store.
 
 ## Auth Endpoint Hardening
 
@@ -43,4 +46,5 @@ SESSION_SECRET=
 
 `SESSION_SECRET` must be at least 32 random characters.
 
-The default `express-session` memory store is intended for development and single-instance deployments. In multi-instance production deployments, use sticky sessions or replace the store with a shared store such as Redis.
+When `NODE_ENV=production`, all configured Google callback/success/error URLs
+must use HTTPS.

package/template/scripts/gen-module.mjs

@@ -78,6 +78,8 @@ export class ${names.pascal}Service {
           messageLength: message.length,
           requestId: this.requestContext.getRequestId(),
         } satisfies Prisma.InputJsonObject,
+        ipAddress: this.requestContext.getIpAddress(),
+        userAgent: this.requestContext.getUserAgent(),
       },
     });
 

package/template/src/app.module.ts

@@ -1,25 +1,19 @@
-import { Module } from "@nestjs/common";
-import { ConfigModule } from "@nestjs/config";
-import { APP_GUARD } from "@nestjs/core";
-import { ThrottlerGuard, ThrottlerModule } from "@nestjs/throttler";
-import {
-  appConfig,
-  authConfig,
-  databaseConfig,
-  rbacConfig,
-  validate,
-} from "./config";
-import { PrismaModule } from "./database/prisma/prisma.module";
-import { AccessControlModule } from "./modules/access-control/access-control.module";
-import { AuditModule } from "./modules/audit/audit.module";
-import { AuthModule } from "./modules/auth/auth.module";
-import { HealthModule } from "./modules/health/health.module";
-import { InvitationsModule } from "./modules/invitations/invitations.module";
-import { MembershipsModule } from "./modules/memberships/memberships.module";
-import { OrganisationsModule } from "./modules/organisations/organisations.module";
-import { RequestContextModule } from "./modules/request-context/request-context.module";
-import { SampleModule } from "./modules/sample/sample.module";
-import { SettingsModule } from "./modules/settings/settings.module";
+import { Module } from '@nestjs/common';
+import { ConfigModule } from '@nestjs/config';
+import { APP_GUARD } from '@nestjs/core';
+import { ThrottlerGuard, ThrottlerModule } from '@nestjs/throttler';
+import { appConfig, authConfig, databaseConfig, rbacConfig, validate } from './config';
+import { PrismaModule } from './database/prisma/prisma.module';
+import { AccessControlModule } from './modules/access-control/access-control.module';
+import { AuditModule } from './modules/audit/audit.module';
+import { AuthModule } from './modules/auth/auth.module';
+import { HealthModule } from './modules/health/health.module';
+import { InvitationsModule } from './modules/invitations/invitations.module';
+import { MembershipsModule } from './modules/memberships/memberships.module';
+import { OrganisationsModule } from './modules/organisations/organisations.module';
+import { RequestContextModule } from './modules/request-context/request-context.module';
+import { SampleModule } from './modules/sample/sample.module';
+import { SettingsModule } from './modules/settings/settings.module';
 
 @Module({
   imports: [

package/template/src/common/dto/error-response.dto.ts

@@ -1,10 +1,10 @@
-import { ApiProperty, ApiPropertyOptional } from "@nestjs/swagger";
+import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';
 
 class ErrorBodyDto {
-  @ApiProperty({ example: "BAD_REQUEST" })
+  @ApiProperty({ example: 'BAD_REQUEST' })
   code!: string;
 
-  @ApiProperty({ example: "Validation failed." })
+  @ApiProperty({ example: 'Validation failed.' })
   message!: string;
 
   @ApiPropertyOptional({ type: Object })

package/template/src/common/dto/membership-response.dto.ts

@@ -1,30 +1,30 @@
-import { ApiProperty, ApiPropertyOptional } from "@nestjs/swagger";
-import { MembershipStatus } from "@prisma/client";
-import { RoleSummaryDto } from "./role-summary.dto";
-import { ActiveUserSummaryDto } from "./user-summary.dto";
+import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';
+import { MembershipStatus } from '@prisma/client';
+import { RoleSummaryDto } from './role-summary.dto';
+import { ActiveUserSummaryDto } from './user-summary.dto';
 
 export class MembershipResponseDto {
   @ApiProperty({
-    example: "0a57fb4a-95c6-4f7e-bd5a-f96dbe0599e3",
-    format: "uuid",
+    example: '0a57fb4a-95c6-4f7e-bd5a-f96dbe0599e3',
+    format: 'uuid',
   })
   id!: string;
 
   @ApiProperty({
-    example: "4a4f0d8a-4bd2-469f-a6a9-3e1cb6a2b456",
-    format: "uuid",
+    example: '4a4f0d8a-4bd2-469f-a6a9-3e1cb6a2b456',
+    format: 'uuid',
   })
   userId!: string;
 
   @ApiProperty({
-    example: "2c67399d-670c-4025-a5fd-1ea9a211891e",
-    format: "uuid",
+    example: '2c67399d-670c-4025-a5fd-1ea9a211891e',
+    format: 'uuid',
   })
   orgId!: string;
 
   @ApiProperty({
-    example: "f602c057-04f4-4ef8-8c84-1b7c62fbf8c5",
-    format: "uuid",
+    example: 'f602c057-04f4-4ef8-8c84-1b7c62fbf8c5',
+    format: 'uuid',
   })
   roleId!: string;
 
@@ -43,9 +43,21 @@ export class MembershipResponseDto {
   @ApiPropertyOptional({ type: RoleSummaryDto })
   role?: RoleSummaryDto;
 
-  @ApiProperty({ example: "2026-06-01T10:30:00.000Z", format: "date-time" })
+  @ApiProperty({ example: '2026-06-01T10:30:00.000Z', format: 'date-time' })
   createdAt!: string;
 
-  @ApiProperty({ example: "2026-06-01T10:30:00.000Z", format: "date-time" })
+  @ApiProperty({ example: '2026-06-01T10:30:00.000Z', format: 'date-time' })
   updatedAt!: string;
 }
+
+export class MembershipListResponseDto {
+  @ApiProperty({ type: [MembershipResponseDto] })
+  items!: MembershipResponseDto[];
+
+  @ApiPropertyOptional({
+    example: '0a57fb4a-95c6-4f7e-bd5a-f96dbe0599e3',
+    format: 'uuid',
+    nullable: true,
+  })
+  nextCursor!: string | null;
+}

package/template/src/common/dto/mutation-response.dto.ts

@@ -1,4 +1,4 @@
-import { ApiProperty } from "@nestjs/swagger";
+import { ApiProperty } from '@nestjs/swagger';
 
 export class DeletedResponseDto {
   @ApiProperty({ example: true })

package/template/src/common/dto/pagination-query.dto.ts

@@ -0,0 +1,37 @@
+import { ApiPropertyOptional } from '@nestjs/swagger';
+import { Type } from 'class-transformer';
+import { IsInt, IsOptional, IsUUID, Max, Min } from 'class-validator';
+
+export const DEFAULT_PAGE_LIMIT = 50;
+export const MAX_PAGE_LIMIT = 100;
+
+export class PaginationQueryDto {
+  @ApiPropertyOptional({ example: 50, minimum: 1, maximum: MAX_PAGE_LIMIT })
+  @IsOptional()
+  @Type(() => Number)
+  @IsInt()
+  @Min(1)
+  @Max(MAX_PAGE_LIMIT)
+  limit?: number;
+
+  @ApiPropertyOptional({
+    example: 'df6537c4-f58b-452e-a67e-18ec528d0f0f',
+    format: 'uuid',
+  })
+  @IsOptional()
+  @IsUUID()
+  cursor?: string;
+}
+
+export function resolvePageLimit(limit: number | undefined) {
+  return Math.min(limit ?? DEFAULT_PAGE_LIMIT, MAX_PAGE_LIMIT);
+}
+
+export function toPage<T extends { id: string }>(rows: T[], limit: number) {
+  const items = rows.slice(0, limit);
+
+  return {
+    items,
+    nextCursor: rows.length > limit ? (items[items.length - 1]?.id ?? null) : null,
+  };
+}

package/template/src/common/dto/role-summary.dto.ts

@@ -1,16 +1,16 @@
-import { ApiProperty, ApiPropertyOptional } from "@nestjs/swagger";
+import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';
 
 export class RoleSummaryDto {
   @ApiProperty({
-    example: "f602c057-04f4-4ef8-8c84-1b7c62fbf8c5",
-    format: "uuid",
+    example: 'f602c057-04f4-4ef8-8c84-1b7c62fbf8c5',
+    format: 'uuid',
   })
   id!: string;
 
-  @ApiProperty({ example: "Owner" })
+  @ApiProperty({ example: 'Owner' })
   name!: string;
 
-  @ApiPropertyOptional({ example: "Full organisation access.", nullable: true })
+  @ApiPropertyOptional({ example: 'Full organisation access.', nullable: true })
   description?: string | null;
 
   @ApiPropertyOptional({ example: true })

package/template/src/common/dto/user-summary.dto.ts

@@ -1,19 +1,19 @@
-import { ApiProperty, ApiPropertyOptional } from "@nestjs/swagger";
+import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';
 
 export class UserSummaryDto {
   @ApiProperty({
-    example: "4a4f0d8a-4bd2-469f-a6a9-3e1cb6a2b456",
-    format: "uuid",
+    example: '4a4f0d8a-4bd2-469f-a6a9-3e1cb6a2b456',
+    format: 'uuid',
   })
   id!: string;
 
-  @ApiPropertyOptional({ example: "owner@example.com", nullable: true })
+  @ApiPropertyOptional({ example: 'owner@example.com', nullable: true })
   email?: string | null;
 
-  @ApiPropertyOptional({ example: "+14155552671", nullable: true })
+  @ApiPropertyOptional({ example: '+14155552671', nullable: true })
   mobile?: string | null;
 
-  @ApiPropertyOptional({ example: "Starter Owner", nullable: true })
+  @ApiPropertyOptional({ example: 'Starter Owner', nullable: true })
   displayName?: string | null;
 }
 

package/template/src/common/filters/http-exception.filter.ts

@@ -1,10 +1,4 @@
-import {
-  ArgumentsHost,
-  Catch,
-  ExceptionFilter,
-  HttpException,
-  HttpStatus,
-} from "@nestjs/common";
+import { ArgumentsHost, Catch, ExceptionFilter, HttpException, HttpStatus } from '@nestjs/common';
 
 type HttpResponse = {
   status: (statusCode: number) => {
@@ -17,9 +11,7 @@ export class HttpExceptionFilter implements ExceptionFilter {
   catch(exception: unknown, host: ArgumentsHost) {
     const response = host.switchToHttp().getResponse<HttpResponse>();
     const status =
-      exception instanceof HttpException
-        ? exception.getStatus()
-        : HttpStatus.INTERNAL_SERVER_ERROR;
+      exception instanceof HttpException ? exception.getStatus() : HttpStatus.INTERNAL_SERVER_ERROR;
 
     response.status(status).json({
       error: {
@@ -32,25 +24,25 @@ export class HttpExceptionFilter implements ExceptionFilter {
 }
 
 function errorCode(status: number) {
-  return HttpStatus[status] ?? "ERROR";
+  return HttpStatus[status] ?? 'ERROR';
 }
 
 function errorMessage(exception: unknown) {
   if (!(exception instanceof HttpException)) {
-    return "Internal server error.";
+    return 'Internal server error.';
   }
 
   const body = exception.getResponse();
-  if (typeof body === "string") {
+  if (typeof body === 'string') {
     return body;
   }
 
-  if (isObject(body) && typeof body.message === "string") {
+  if (isObject(body) && typeof body.message === 'string') {
     return body.message;
   }
 
   if (isObject(body) && Array.isArray(body.message)) {
-    return body.message.join("; ");
+    return body.message.join('; ');
   }
 
   return exception.message;
@@ -67,12 +59,10 @@ function errorDetails(exception: unknown) {
   }
 
   return Object.fromEntries(
-    Object.entries(body).filter(
-      ([key]) => !["statusCode", "error", "message"].includes(key),
-    ),
+    Object.entries(body).filter(([key]) => !['statusCode', 'error', 'message'].includes(key)),
   );
 }
 
 function isObject(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null;
+  return typeof value === 'object' && value !== null;
 }

package/template/src/common/swagger/api-error-responses.ts

@@ -1,4 +1,4 @@
-import { applyDecorators } from "@nestjs/common";
+import { applyDecorators } from '@nestjs/common';
 import {
   ApiBadRequestResponse,
   ApiConflictResponse,
@@ -9,8 +9,8 @@ import {
   ApiServiceUnavailableResponse,
   ApiTooManyRequestsResponse,
   ApiUnauthorizedResponse,
-} from "@nestjs/swagger";
-import { ErrorResponseDto } from "../dto/error-response.dto";
+} from '@nestjs/swagger';
+import { ErrorResponseDto } from '../dto/error-response.dto';
 
 type ApiErrorStatus = 400 | 401 | 403 | 404 | 409 | 410 | 429 | 500 | 503;
 
@@ -27,15 +27,15 @@ const errorResponseFactories = {
 } satisfies Record<ApiErrorStatus, typeof ApiBadRequestResponse>;
 
 const descriptions: Record<ApiErrorStatus, string> = {
-  400: "The request body, route parameter, or query string is invalid.",
-  401: "Authentication failed or the bearer token is missing.",
-  403: "The authenticated user does not have access to this organisation or permission.",
-  404: "The requested resource was not found.",
-  409: "The request conflicts with current resource state.",
-  410: "The resource is no longer available.",
-  429: "Too many requests.",
-  500: "Unexpected server error.",
-  503: "The service is temporarily unavailable.",
+  400: 'The request body, route parameter, or query string is invalid.',
+  401: 'Authentication failed or the bearer token is missing.',
+  403: 'The authenticated user does not have access to this organisation or permission.',
+  404: 'The requested resource was not found.',
+  409: 'The request conflicts with current resource state.',
+  410: 'The resource is no longer available.',
+  429: 'Too many requests.',
+  500: 'Unexpected server error.',
+  503: 'The service is temporarily unavailable.',
 };
 
 export function ApiErrorResponses(...statuses: ApiErrorStatus[]) {

package/template/src/config/app.config.ts

@@ -1,7 +1,12 @@
-import { registerAs } from "@nestjs/config";
-import { getEnv } from "./env.validation";
+import { registerAs } from '@nestjs/config';
+import { getEnv, parseCorsOrigins } from './env.validation';
 
-export default registerAs("app", () => ({
+export default registerAs('app', () => ({
   nodeEnv: getEnv().NODE_ENV,
   port: getEnv().PORT,
+  cors: {
+    enabled: getEnv().CORS_ENABLED,
+    origins: parseCorsOrigins(getEnv().CORS_ORIGINS),
+    credentials: getEnv().CORS_CREDENTIALS,
+  },
 }));

package/template/src/config/auth.config.ts

@@ -1,7 +1,7 @@
-import { registerAs } from "@nestjs/config";
-import { getEnv } from "./env.validation";
+import { registerAs } from '@nestjs/config';
+import { getEnv } from './env.validation';
 
-export default registerAs("auth", () => {
+export default registerAs('auth', () => {
   const env = getEnv();
 
   return {

package/template/src/config/database.config.ts

@@ -1,6 +1,6 @@
-import { registerAs } from "@nestjs/config";
-import { getEnv } from "./env.validation";
+import { registerAs } from '@nestjs/config';
+import { getEnv } from './env.validation';
 
-export default registerAs("database", () => ({
+export default registerAs('database', () => ({
   url: getEnv().DATABASE_URL,
 }));