@ftisindia/create-app 0.1.4 → 0.1.6

package/template/test/reports-query.e2e-spec.ts

@@ -0,0 +1,350 @@
+import { INestApplication, ValidationPipe } from '@nestjs/common';
+import { Test } from '@nestjs/testing';
+import request, { type Response } from 'supertest';
+import { HttpExceptionFilter } from '../src/common/filters/http-exception.filter';
+import { PrismaService } from '../src/database/prisma/prisma.service';
+
+/**
+ * Reports end-to-end (@ftisindia/report-builder) over the `org-members`
+ * CUSTOM source — the Phase-1 standalone milestone (report design §14): a
+ * report that filters/sorts/searches/paginates at constant cost with ZERO
+ * form-builder involvement. Creating an org seeds the owner's membership, so
+ * the source has real rows to query.
+ */
+// Cold ts-jest compile of the full app graph + boot (DI scan, schema checks,
+// Prisma connect) exceeds jest's 5s default; each test also runs many
+// sequential HTTP + DB calls.
+jest.setTimeout(60_000);
+
+describe('Reports query lifecycle (e2e)', () => {
+  let app: INestApplication;
+  let prisma: PrismaService;
+
+  beforeAll(async () => {
+    process.env.DATABASE_URL = process.env.TEST_DATABASE_URL ?? process.env.DATABASE_URL;
+    process.env.JWT_SECRET ||= 'test-jwt-secret-at-least-32-characters-long';
+    process.env.AUTH_GOOGLE_ENABLED ||= 'false';
+    process.env.AUTH_EMAIL_PASSWORD_ENABLED ||= 'true';
+    process.env.NODE_ENV = 'test';
+    process.env.FORMS_OUTBOX_ENABLED = 'false';
+    process.env.REPORTS_SCHEMA_CHECK = 'on';
+
+    const { AppModule } = await import('../src/app.module');
+    const moduleRef = await Test.createTestingModule({ imports: [AppModule] }).compile();
+
+    app = moduleRef.createNestApplication();
+    app.useGlobalFilters(new HttpExceptionFilter());
+    app.useGlobalPipes(
+      new ValidationPipe({ forbidNonWhitelisted: true, transform: true, whitelist: true }),
+    );
+    await app.init();
+    prisma = app.get(PrismaService);
+  });
+
+  afterAll(async () => {
+    await app.close();
+  });
+
+  it('publishes a custom-source report and queries member rows (the standalone milestone)', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('rep-pub');
+    const key = uniqueKey('members');
+
+    const draft = await api()
+      .post(`/organisations/${orgId}/reports`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send(orgMembersDefinition(key))
+      .expect(201);
+    expect(draft.body.status).toBe('DRAFT');
+    expect(draft.body.version).toBe(1);
+
+    await api()
+      .post(`/organisations/${orgId}/reports/${key}/publish`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .expect(200)
+      .expect((res) => expect(res.body.status).toBe('PUBLISHED'));
+
+    const result = await api()
+      .post(`/organisations/${orgId}/reports/${key}/query`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ pageSize: 50 })
+      .expect(200);
+
+    expect(result.body.rows).toHaveLength(1); // the owner
+    const row = result.body.rows[0];
+    expect(typeof row.$id).toBe('string');
+    expect(Array.isArray(row.$tags)).toBe(true);
+    expect(row.role).toBe('Owner');
+    expect(row.status).toBe('ACTIVE');
+    expect(typeof row.displayName).toBe('string');
+    expect(result.body.meta.reportVersion).toBe(1);
+    expect(result.body.pageInfo.hasMore).toBe(false);
+  });
+
+  it('paginates members at constant cost with keyset cursors', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('rep-page');
+    await createMemberInOrg(orgId, 'rep-page-b', ['reports.read']);
+    await createMemberInOrg(orgId, 'rep-page-c', ['reports.read']);
+    const key = uniqueKey('page');
+    await publishOrgMembers(accessToken, orgId, key);
+
+    // Three members; walk one row per page via the signed cursor.
+    const seen = new Set<string>();
+    let cursor: string | null = null;
+    for (let page = 0; page < 3; page += 1) {
+      const res: Response = await api()
+        .post(`/organisations/${orgId}/reports/${key}/query`)
+        .set('Authorization', `Bearer ${accessToken}`)
+        .send({ pageSize: 1, sort: [{ column: 'displayName', dir: 'asc' }], cursor })
+        .expect(200);
+      expect(res.body.rows).toHaveLength(1);
+      seen.add(res.body.rows[0].$id);
+      cursor = res.body.pageInfo.nextCursor;
+      expect(res.body.pageInfo.hasMore).toBe(page < 2);
+    }
+    expect(seen.size).toBe(3); // every page distinct — no OFFSET skips/dupes
+    expect(cursor).toBeNull();
+  });
+
+  it('filters and sorts through the typed compiler', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('rep-filter');
+    const key = uniqueKey('filter');
+    await publishOrgMembers(accessToken, orgId, key);
+
+    await api()
+      .post(`/organisations/${orgId}/reports/${key}/query`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ filters: [{ column: 'status', op: 'eq', value: 'ACTIVE' }] })
+      .expect(200)
+      .expect((res) => expect(res.body.rows.length).toBeGreaterThanOrEqual(1));
+
+    // A typed-operator violation is a 400 BEFORE any SQL runs (§4).
+    await api()
+      .post(`/organisations/${orgId}/reports/${key}/query`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ filters: [{ column: 'joinedAt', op: 'contains', value: 'x' }] })
+      .expect(400);
+  });
+
+  it('describes itself through the meta endpoint', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('rep-meta');
+    const key = uniqueKey('meta');
+    await publishOrgMembers(accessToken, orgId, key);
+
+    const meta = await api()
+      .get(`/organisations/${orgId}/reports/${key}/meta`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .expect(200);
+
+    expect(meta.body.reportVersion).toBe(1);
+    expect(meta.body.searchEnabled).toBe(true);
+    expect(meta.body.rowActions.map((a: { name: string }) => a.name)).toContain('manageTags');
+    const status = meta.body.columns.find((c: { id: string }) => c.id === 'status');
+    expect(status.operators).toEqual(expect.arrayContaining(['eq', 'in']));
+    expect(status.operators).not.toContain('contains');
+  });
+
+  it('gates queries on reports.read', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('rep-perm');
+    const key = uniqueKey('perm');
+    await publishOrgMembers(accessToken, orgId, key);
+
+    const outsider = await createMemberInOrg(orgId, 'rep-perm-no', ['reportTags.manage']);
+    await api()
+      .post(`/organisations/${orgId}/reports/${key}/query`)
+      .set('Authorization', `Bearer ${outsider.accessToken}`)
+      .send({})
+      .expect(403);
+
+    const reader = await createMemberInOrg(orgId, 'rep-perm-yes', ['reports.read']);
+    await api()
+      .post(`/organisations/${orgId}/reports/${key}/query`)
+      .set('Authorization', `Bearer ${reader.accessToken}`)
+      .send({})
+      .expect(200);
+  });
+
+  it('saves a personal view and reports its compatibility', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('rep-view');
+    const key = uniqueKey('view');
+    await publishOrgMembers(accessToken, orgId, key);
+
+    await api()
+      .post(`/organisations/${orgId}/reports/${key}/views`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ name: 'Active only', spec: { filters: [{ column: 'status', op: 'eq', value: 'ACTIVE' }] } })
+      .expect(201);
+
+    const views = await api()
+      .get(`/organisations/${orgId}/reports/${key}/views`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .expect(200);
+    const list = Array.isArray(views.body) ? views.body : views.body.items;
+    expect(list).toHaveLength(1);
+    expect(list[0].compatibility.status).toBe('ok');
+  });
+
+  it('tags rows through the manageTags row action and filters on $tags', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('rep-tag');
+    const key = uniqueKey('tag');
+    await publishOrgMembers(accessToken, orgId, key);
+
+    const first = await api()
+      .post(`/organisations/${orgId}/reports/${key}/query`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({})
+      .expect(200);
+    const rowId = first.body.rows[0].$id;
+
+    await api()
+      .post(`/organisations/${orgId}/reports/${key}/actions/manageTags`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ selection: { byIds: [rowId] }, input: { add: ['shortlisted'] } })
+      .expect(200);
+
+    const tagged = await api()
+      .post(`/organisations/${orgId}/reports/${key}/query`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ filters: [{ column: '$tags', op: 'hasTag', value: 'shortlisted' }] })
+      .expect(200);
+    expect(tagged.body.rows).toHaveLength(1);
+    expect(tagged.body.rows[0].$tags).toContain('shortlisted');
+  });
+
+  it('streams a snapshot-consistent CSV export, gated by reports.export', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('rep-export');
+    const key = uniqueKey('export');
+    await publishOrgMembers(accessToken, orgId, key);
+
+    const csv = await api()
+      .post(`/organisations/${orgId}/reports/${key}/export`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ format: 'csv' })
+      .expect(200);
+    expect(csv.headers['content-disposition']).toContain('attachment');
+    expect(csv.text).toContain('Name'); // the displayName header
+    expect(csv.text.split(/\r?\n/).filter(Boolean).length).toBeGreaterThanOrEqual(2);
+
+    // A member without reports.export cannot egress (never implied by read).
+    const reader = await createMemberInOrg(orgId, 'rep-export-no', ['reports.read']);
+    await api()
+      .post(`/organisations/${orgId}/reports/${key}/export`)
+      .set('Authorization', `Bearer ${reader.accessToken}`)
+      .send({ format: 'csv' })
+      .expect(403);
+  });
+
+  it('rejects a definition that smuggles SQL into a column path (the §2.1 boundary)', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('rep-sql');
+    const def = orgMembersDefinition(uniqueKey('sql'));
+    (def.columns as Array<Record<string, unknown>>).push({
+      id: 'evil',
+      header: 'Evil',
+      path: "name'); DROP TABLE \"User\"; --",
+      type: 'text',
+    });
+    await api()
+      .post(`/organisations/${orgId}/reports`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send(def)
+      .expect(422);
+  });
+
+  // ── helpers (mirrors the forms e2e harness) ─────────────────────────────────
+
+  function api() {
+    return request(app.getHttpServer());
+  }
+
+  function uniqueSuffix() {
+    return `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  }
+
+  function uniqueKey(label: string) {
+    return `${label}-${uniqueSuffix()}`.toLowerCase();
+  }
+
+  function orgMembersDefinition(key: string): Record<string, unknown> {
+    return {
+      key,
+      title: 'Organisation members',
+      source: { kind: 'custom', key: 'org-members' },
+      columns: [
+        { id: 'displayName', header: 'Name', columnId: 'displayName', type: 'text', sortable: true, filterable: true, searchable: true },
+        { id: 'email', header: 'Email', columnId: 'email', type: 'text', sortable: true, filterable: true },
+        { id: 'role', header: 'Role', columnId: 'role', type: 'text', sortable: true, filterable: true },
+        { id: 'status', header: 'Status', columnId: 'status', type: 'enum', filterable: true, enum: ['ACTIVE', 'SUSPENDED', 'REVOKED'] },
+        { id: 'joinedAt', header: 'Joined', columnId: 'joinedAt', type: 'datetime', sortable: true },
+      ],
+      defaultSort: [{ column: 'joinedAt', dir: 'desc' }],
+      search: { columns: ['displayName'] },
+      rowActions: ['manageTags'],
+      export: { formats: ['csv', 'xlsx'] },
+      performanceTier: 'live',
+    };
+  }
+
+  async function publishOrgMembers(accessToken: string, orgId: string, key: string) {
+    await api()
+      .post(`/organisations/${orgId}/reports`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send(orgMembersDefinition(key))
+      .expect(201);
+    await api()
+      .post(`/organisations/${orgId}/reports/${key}/publish`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .expect(200);
+  }
+
+  async function createUserAndOrg(label: string) {
+    const user = await createUser(label);
+    const org = await createOrganisation(user.accessToken, label);
+    return { ...user, orgId: org.orgId, membershipId: org.membershipId };
+  }
+
+  async function createUser(label: string) {
+    const suffix = uniqueSuffix();
+    const signup = await api()
+      .post('/auth/signup')
+      .send({ email: `${label}-${suffix}@example.com`, password: 'test-password-123', displayName: label })
+      .expect(201);
+    return {
+      accessToken: signup.body.accessToken as string,
+      userId: signup.body.user.id as string,
+    };
+  }
+
+  async function createOrganisation(accessToken: string, label: string) {
+    const suffix = uniqueSuffix();
+    const org = await api()
+      .post('/organisations')
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ name: `${label} ${suffix}`, slug: `${label}-${suffix}` })
+      .expect(201);
+    return {
+      orgId: org.body.organisation.id as string,
+      membershipId: org.body.membership.id as string,
+    };
+  }
+
+  async function createMemberInOrg(orgId: string, label: string, permissionKeys: string[]) {
+    const user = await createUser(label);
+    const permissions = await prisma.permission.findMany({
+      where: { key: { in: permissionKeys } },
+      select: { id: true },
+    });
+    expect(permissions).toHaveLength(permissionKeys.length);
+    const role = await prisma.role.create({
+      data: {
+        orgId,
+        name: `${label}-${uniqueSuffix()}`,
+        permissions: { create: permissions.map((permission) => ({ permissionId: permission.id })) },
+      },
+      select: { id: true },
+    });
+    const membership = await prisma.membership.create({
+      data: { userId: user.userId, orgId, roleId: role.id },
+      select: { id: true, roleId: true },
+    });
+    return { ...user, membershipId: membership.id, roleId: membership.roleId };
+  }
+});

package/template/test/reports-tiers.e2e-spec.ts

@@ -0,0 +1,257 @@
+import { INestApplication, ValidationPipe } from '@nestjs/common';
+import { Test } from '@nestjs/testing';
+import request from 'supertest';
+import { ReportSourceRegistry } from '@ftisindia/report-builder';
+import type { ReportSourceDef } from '@ftisindia/report-builder';
+import { HttpExceptionFilter } from '../src/common/filters/http-exception.filter';
+import { PrismaService } from '../src/database/prisma/prisma.service';
+import { ReportsSchemaCheckService } from '../src/modules/reports/infrastructure/schema-check/reports-schema-check.service';
+
+/**
+ * Reports e2e for the production-critical surfaces the basic specs do not
+ * reach: the indexed-tier publish → apply-migration → republish ROUND TRIP,
+ * the materialized tier over a real materialized view, and the boot
+ * schema-check FAILURE mode. All against real Postgres; test-only sources are
+ * registered into the engine's source registry at runtime (no shipped
+ * production code needed to exercise them).
+ */
+jest.setTimeout(60_000);
+
+describe('Reports performance tiers + schema check (e2e)', () => {
+  let app: INestApplication;
+  let prisma: PrismaService;
+  let sources: ReportSourceRegistry;
+
+  beforeAll(async () => {
+    process.env.DATABASE_URL = process.env.TEST_DATABASE_URL ?? process.env.DATABASE_URL;
+    process.env.JWT_SECRET ||= 'test-jwt-secret-at-least-32-characters-long';
+    process.env.AUTH_GOOGLE_ENABLED ||= 'false';
+    process.env.NODE_ENV = 'test';
+    process.env.FORMS_OUTBOX_ENABLED = 'false';
+    process.env.REPORTS_EXPORT_WORKER_ENABLED = 'false';
+
+    const { AppModule } = await import('../src/app.module');
+    const moduleRef = await Test.createTestingModule({ imports: [AppModule] }).compile();
+
+    app = moduleRef.createNestApplication();
+    app.useGlobalFilters(new HttpExceptionFilter());
+    app.useGlobalPipes(
+      new ValidationPipe({ forbidNonWhitelisted: true, transform: true, whitelist: true }),
+    );
+    await app.init();
+    prisma = app.get(PrismaService);
+    sources = app.get(ReportSourceRegistry);
+  });
+
+  afterAll(async () => {
+    await app.close();
+  });
+
+  it('indexed tier: publish fails with the migration snippet, then SUCCEEDS after applying it', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('rep-idxrt');
+    const tag = uniqueTag();
+    const sourceKey = `idx-test-${tag}`;
+    const statusIdx = `idx_rb_test_status_${tag}`;
+    const joinedIdx = `idx_rb_test_joined_${tag}`;
+    sources.register(indexedTestSource(sourceKey, statusIdx, joinedIdx));
+
+    const key = uniqueKey('idxrt');
+    const def = indexedDefinition(key, sourceKey);
+
+    try {
+      await api().post(`/organisations/${orgId}/reports`).set(auth(accessToken)).send(def).expect(201);
+
+      // Publish runs the catalog lint: the declared indexes do not exist yet,
+      // so it fails CONSTRUCTIVELY with the exact CREATE INDEX SQL (§8).
+      const failed = await api()
+        .post(`/organisations/${orgId}/reports/${key}/publish`)
+        .set(auth(accessToken))
+        .expect(422);
+      expect(JSON.stringify(failed.body)).toContain('CREATE INDEX');
+      expect(JSON.stringify(failed.body)).toContain(statusIdx);
+
+      // Apply the suggested indexes (org-leading btrees on the physical columns).
+      await prisma.$executeRawUnsafe(`CREATE INDEX "${statusIdx}" ON "Membership" ("orgId", "status")`);
+      await prisma.$executeRawUnsafe(`CREATE INDEX "${joinedIdx}" ON "Membership" ("orgId", "createdAt")`);
+
+      // The SAME draft now publishes: catalog + plan lint pass.
+      await api()
+        .post(`/organisations/${orgId}/reports/${key}/publish`)
+        .set(auth(accessToken))
+        .expect(200);
+
+      const result = await api()
+        .post(`/organisations/${orgId}/reports/${key}/query`)
+        .set(auth(accessToken))
+        .send({ sort: [{ column: 'joinedAt', dir: 'desc' }] })
+        .expect(200);
+      expect(result.body.rows.length).toBeGreaterThanOrEqual(1);
+    } finally {
+      await prisma.$executeRawUnsafe(`DROP INDEX IF EXISTS "${statusIdx}"`);
+      await prisma.$executeRawUnsafe(`DROP INDEX IF EXISTS "${joinedIdx}"`);
+    }
+  });
+
+  it('materialized tier: publishes against a materialized view and reports freshAsOf', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('rep-matrt');
+    const tag = uniqueTag();
+    const mv = `rb_test_mv_${tag}`;
+
+    // Create the matview AFTER the org exists so it captures the owner row.
+    await prisma.$executeRawUnsafe(
+      `CREATE MATERIALIZED VIEW ${mv} AS ` +
+        `SELECT m."id" AS "rowId", m."orgId" AS "orgId", m."status"::text AS "status", ` +
+        `m."createdAt" AS "joinedAt" FROM "Membership" m`,
+    );
+    try {
+      const sourceKey = `mat-test-${tag}`;
+      sources.register(materializedTestSource(sourceKey, mv));
+
+      const key = uniqueKey('matrt');
+      const def = {
+        key,
+        title: 'Member stats (materialized)',
+        source: { kind: 'custom', key: sourceKey },
+        columns: [
+          { id: 'status', header: 'Status', columnId: 'status', type: 'enum', filterable: true, enum: ['ACTIVE', 'SUSPENDED', 'REVOKED'] },
+          { id: 'joinedAt', header: 'Joined', columnId: 'joinedAt', type: 'datetime', sortable: true },
+        ],
+        defaultSort: [{ column: 'joinedAt', dir: 'desc' }],
+        performanceTier: 'materialized',
+      };
+
+      await api().post(`/organisations/${orgId}/reports`).set(auth(accessToken)).send(def).expect(201);
+      await api().post(`/organisations/${orgId}/reports/${key}/publish`).set(auth(accessToken)).expect(200);
+
+      const result = await api()
+        .post(`/organisations/${orgId}/reports/${key}/query`)
+        .set(auth(accessToken))
+        .send({})
+        .expect(200);
+      expect(result.body.rows.length).toBeGreaterThanOrEqual(1);
+      expect(result.body.meta.freshAsOf).not.toBeNull();
+    } finally {
+      await prisma.$executeRawUnsafe(`DROP MATERIALIZED VIEW IF EXISTS ${mv}`);
+    }
+  });
+
+  it('boot schema check fails loudly when a required partial unique index is missing', async () => {
+    const check = app.get(ReportsSchemaCheckService);
+    // A freshly migrated DB passes.
+    await expect(check.check()).resolves.toBeUndefined();
+
+    await prisma.$executeRawUnsafe('DROP INDEX "report_view_shared_uq"');
+    try {
+      await expect(check.check()).rejects.toThrow(/report_view_shared_uq|CREATE UNIQUE INDEX/);
+    } finally {
+      // Restore so the rest of the suite (and the DB) stays intact.
+      await prisma.$executeRawUnsafe(
+        'CREATE UNIQUE INDEX "report_view_shared_uq" ON "ReportSavedView" ("orgId", "reportKey", "name") WHERE "ownerId" IS NULL',
+      );
+    }
+    // Green again after restore.
+    await expect(check.check()).resolves.toBeUndefined();
+  });
+
+  // ── test-only sources ───────────────────────────────────────────────────────
+
+  function indexedDefinition(key: string, sourceKey: string): Record<string, unknown> {
+    return {
+      key,
+      title: 'Indexed members',
+      source: { kind: 'custom', key: sourceKey },
+      columns: [
+        { id: 'status', header: 'Status', columnId: 'status', type: 'enum', filterable: true, sortable: true, enum: ['ACTIVE', 'SUSPENDED', 'REVOKED'] },
+        { id: 'joinedAt', header: 'Joined', columnId: 'joinedAt', type: 'datetime', sortable: true },
+      ],
+      defaultSort: [{ column: 'joinedAt', dir: 'desc' }],
+      performanceTier: 'indexed',
+    };
+  }
+
+  function indexedTestSource(key: string, statusIdx: string, joinedIdx: string): ReportSourceDef {
+    return {
+      key,
+      manifest: () => ({
+        rowId: 'm."id"',
+        orgScoped: true,
+        columns: [
+          {
+            id: 'status',
+            sql: 'm."status"::text',
+            type: 'enum',
+            filterable: true,
+            sortable: true,
+            nullable: false,
+            index: { name: statusIdx, kind: 'btree', table: 'Membership', expr: '"orgId", "status"' },
+          },
+          {
+            id: 'joinedAt',
+            sql: 'm."createdAt"',
+            type: 'datetime',
+            valueKind: 'native',
+            sortable: true,
+            nullable: false,
+            index: { name: joinedIdx, kind: 'btree', table: 'Membership', expr: '"orgId", "createdAt"' },
+          },
+        ],
+      }),
+      baseQuery: () => ({ from: '"Membership" m', orgColumn: 'm."orgId"', primaryTable: 'Membership' }),
+    };
+  }
+
+  function materializedTestSource(key: string, mv: string): ReportSourceDef {
+    return {
+      key,
+      manifest: () => ({
+        rowId: 'm."id"',
+        orgScoped: true,
+        columns: [
+          { id: 'status', sql: '"status"', type: 'enum', filterable: true, nullable: false },
+          { id: 'joinedAt', sql: '"joinedAt"', type: 'datetime', valueKind: 'native', sortable: true, nullable: false },
+        ],
+        materialization: { relation: mv, orgColumn: '"orgId"', rowIdColumn: 'rowId', stalenessSeconds: 300 },
+      }),
+      baseQuery: () => ({ from: mv, orgColumn: '"orgId"', primaryTable: mv }),
+      freshAsOf: async () => new Date(),
+    };
+  }
+
+  // ── shared harness ──────────────────────────────────────────────────────────
+
+  function api() {
+    return request(app.getHttpServer());
+  }
+
+  function auth(token: string) {
+    return { Authorization: `Bearer ${token}` };
+  }
+
+  function uniqueSuffix() {
+    return `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  }
+
+  /** A lowercase alphanumeric tag safe for SQL identifiers and report keys. */
+  function uniqueTag() {
+    return uniqueSuffix().replace(/[^a-z0-9]/gi, '').toLowerCase();
+  }
+
+  function uniqueKey(label: string) {
+    return `${label}-${uniqueTag()}`;
+  }
+
+  async function createUserAndOrg(label: string) {
+    const suffix = uniqueSuffix();
+    const signup = await api()
+      .post('/auth/signup')
+      .send({ email: `${label}-${suffix}@example.com`, password: 'test-password-123', displayName: label })
+      .expect(201);
+    const accessToken = signup.body.accessToken as string;
+    const org = await api()
+      .post('/organisations')
+      .set(auth(accessToken))
+      .send({ name: `${label} ${suffix}`, slug: `${label}-${suffix}` })
+      .expect(201);
+    return { accessToken, orgId: org.body.organisation.id as string };
+  }
+});

package/template/test/route-registry.validator.spec.ts

@@ -1,24 +1,49 @@
 import { Controller, Get } from '@nestjs/common';
 import { MetadataScanner, Reflector } from '@nestjs/core';
 import { AccessControlController } from '../src/modules/access-control/presentation/access-control.controller';
+import { CurrentAccessControlController } from '../src/modules/access-control/presentation/current-access-control.controller';
 import { RequirePermissions } from '../src/modules/access-control/presentation/permissions.decorator';
 import { RouteRegistryValidator } from '../src/modules/access-control/application/route-registry.validator';
 import { PermissionKey } from '../src/modules/access-control/types/permission-key';
+import { routePermissionRegistry } from '../src/modules/access-control/types/route-permission-registry';
 import { AuditController } from '../src/modules/audit/presentation/audit.controller';
 import { AuthController } from '../src/modules/auth/presentation/auth.controller';
+import { FormsDataSourcesController } from '../src/modules/forms/presentation/forms-data-sources.controller';
+import { FormsDefinitionsController } from '../src/modules/forms/presentation/forms-definitions.controller';
+import { FormsFilesController } from '../src/modules/forms/presentation/forms-files.controller';
+import { FormsSubmissionsController } from '../src/modules/forms/presentation/forms-submissions.controller';
+import { PublicFormsController } from '../src/modules/forms/presentation/public-forms.controller';
 import { InvitationsController } from '../src/modules/invitations/presentation/invitations.controller';
 import { MembershipsController } from '../src/modules/memberships/presentation/memberships.controller';
 import { OrganisationsController } from '../src/modules/organisations/presentation/organisations.controller';
+import { ReportsActionsController } from '../src/modules/reports/presentation/reports-actions.controller';
+import { ReportsDefinitionsController } from '../src/modules/reports/presentation/reports-definitions.controller';
+import { ReportsExportController } from '../src/modules/reports/presentation/reports-export.controller';
+import { ReportsExportJobsController } from '../src/modules/reports/presentation/reports-export-jobs.controller';
+import { ReportsQueryController } from '../src/modules/reports/presentation/reports-query.controller';
+import { ReportsViewsController } from '../src/modules/reports/presentation/reports-views.controller';
 import { SampleController } from '../src/modules/sample/presentation/sample.controller';
 import { SettingsController } from '../src/modules/settings/presentation/settings.controller';
 
 const controllers = [
   AccessControlController,
+  CurrentAccessControlController,
   AuditController,
   AuthController,
+  FormsDataSourcesController,
+  FormsDefinitionsController,
+  FormsFilesController,
+  FormsSubmissionsController,
+  PublicFormsController,
   InvitationsController,
   MembershipsController,
   OrganisationsController,
+  ReportsActionsController,
+  ReportsDefinitionsController,
+  ReportsExportController,
+  ReportsExportJobsController,
+  ReportsQueryController,
+  ReportsViewsController,
   SampleController,
   SettingsController,
 ];
@@ -28,6 +53,15 @@ describe('RouteRegistryValidator', () => {
     expect(() => createValidator(controllers).onApplicationBootstrap()).not.toThrow();
   });
 
+  it('does not register the current access-control bootstrap route as permission-gated', () => {
+    expect(routePermissionRegistry).not.toContainEqual(
+      expect.objectContaining({
+        method: 'GET',
+        path: '/organisations/:orgId/access-control/me',
+      }),
+    );
+  });
+
   it('fails when a permission-gated route is missing from the registry', () => {
     class DriftController {
       probe() {