@ftisindia/create-app 0.1.4 → 0.1.6

package/template/scripts/export-openapi.ts

@@ -0,0 +1,85 @@
+import { existsSync, readFileSync } from 'fs';
+import { writeFile } from 'fs/promises';
+import { resolve } from 'path';
+
+loadEnvFile();
+ensurePlaceholderEnv();
+
+main().catch((error: unknown) => {
+  console.error(error);
+  process.exit(1);
+});
+
+async function main() {
+  // Imported after env preparation so config validation sees the placeholders.
+  const { NestFactory } = await import('@nestjs/core');
+  const { SwaggerModule } = await import('@nestjs/swagger');
+  const { AppModule } = await import('../src/app.module');
+  const { buildOpenApiConfig } = await import('../src/config/openapi');
+
+  const app = await NestFactory.create(AppModule, {
+    logger: false,
+    abortOnError: false,
+  });
+
+  try {
+    const document = SwaggerModule.createDocument(app, buildOpenApiConfig());
+    const outputPath = resolve(process.cwd(), 'docs-json.json');
+    await writeFile(outputPath, `${JSON.stringify(document, null, 2)}\n`);
+    console.log(`OpenAPI document written to ${outputPath}`);
+  } finally {
+    await app.close().catch(() => undefined);
+  }
+}
+
+// The document is built from route metadata only; no server starts and no
+// database connection is made, so missing secrets get safe placeholders.
+function ensurePlaceholderEnv() {
+  if (!process.env.DATABASE_URL) {
+    process.env.DATABASE_URL =
+      'postgresql://placeholder:placeholder@localhost:5432/placeholder';
+  }
+
+  if (!process.env.JWT_SECRET) {
+    process.env.JWT_SECRET = 'openapi-export-placeholder-secret-0123456789';
+  }
+}
+
+function loadEnvFile() {
+  const envPath = resolve(process.cwd(), '.env');
+  if (!existsSync(envPath)) {
+    return;
+  }
+
+  const lines = readFileSync(envPath, 'utf8').split(/\r?\n/);
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) {
+      continue;
+    }
+
+    const equalsIndex = trimmed.indexOf('=');
+    if (equalsIndex === -1) {
+      continue;
+    }
+
+    const key = trimmed.slice(0, equalsIndex).trim();
+    const rawValue = trimmed.slice(equalsIndex + 1).trim();
+    if (!key || process.env[key] !== undefined) {
+      continue;
+    }
+
+    process.env[key] = stripQuotes(rawValue);
+  }
+}
+
+function stripQuotes(value: string) {
+  if (
+    (value.startsWith('"') && value.endsWith('"')) ||
+    (value.startsWith("'") && value.endsWith("'"))
+  ) {
+    return value.slice(1, -1);
+  }
+
+  return value;
+}

package/template/scripts/gen-form.mjs

@@ -0,0 +1,149 @@
+// Scaffold a form definition + a DB-free lint spec (definitions-as-code).
+//
+//   npm run gen:form -- customer-feedback
+//   npm run gen:form -- customer-feedback --title "Customer feedback"
+//
+// Generates:
+//   src/modules/forms/definitions/<key>.form.json   (starter definition)
+//   test/<key>.form.spec.ts                          (meta-schema + publish lint, runs in `npm test`)
+//
+// Load it into an organisation with:
+//   npm run forms:push -- --file src/modules/forms/definitions/<key>.form.json --org <org> --user <email> --publish
+
+import { existsSync, mkdirSync, writeFileSync } from 'fs';
+import { dirname, join } from 'path';
+
+const args = process.argv.slice(2);
+const key = args[0];
+if (!key || key.startsWith('--')) {
+  throw new Error('Usage: npm run gen:form -- <form-key> [--title "Display title"]');
+}
+if (!/^[a-z0-9][a-z0-9-]*$/.test(key) || key.length > 100) {
+  throw new Error(
+    `Form key "${key}" is invalid. Use lowercase letters, digits, and hyphens (must start with a letter or digit).`,
+  );
+}
+
+const titleFlag = args.indexOf('--title');
+const title =
+  titleFlag !== -1 && args[titleFlag + 1]
+    ? args[titleFlag + 1]
+    : key
+        .split('-')
+        .map((part) => part.charAt(0).toUpperCase() + part.slice(1))
+        .join(' ');
+
+const definitionPath = join('src', 'modules', 'forms', 'definitions', `${key}.form.json`);
+const specPath = join('test', `${key}.form.spec.ts`);
+
+for (const path of [definitionPath, specPath]) {
+  if (existsSync(path)) {
+    throw new Error(`Refusing to overwrite existing file: ${path}`);
+  }
+}
+
+const definition = {
+  key,
+  version: 1,
+  title,
+  fields: [
+    {
+      type: 'text',
+      name: 'title',
+      label: 'Title',
+      validators: { required: true, maxLength: 200 },
+      reportable: true,
+    },
+    {
+      type: 'text',
+      name: 'notes',
+      label: 'Notes',
+      validators: { maxLength: 2000 },
+    },
+  ],
+  actions: {
+    submit: ['validateAll', 'persist'],
+    saveDraft: ['persistDraft'],
+  },
+};
+
+const spec = `import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import {
+  ActionRegistry,
+  DEFAULT_ORG_FORMS_POLICY,
+  DEFAULT_RULE_LIMITS,
+  DataSourceRegistry,
+  FieldTypeRegistry,
+  lintDefinition,
+  lintRules,
+  registerBuiltinActions,
+  registerCoreFieldTypes,
+  validateDefinitionShape,
+} from '@ftisindia/form-builder';
+import type { FormDefinition, SubmissionStore } from '@ftisindia/form-builder';
+
+/**
+ * DB-free definition lint for ${key}.form.json — fails the unit-test run the
+ * moment the definition would be rejected at save/publish time. If your
+ * definition references custom actions or data sources, register matching
+ * stubs below (same names/kinds as the real providers).
+ */
+const definition = JSON.parse(
+  readFileSync(
+    join(__dirname, '..', 'src', 'modules', 'forms', 'definitions', '${key}.form.json'),
+    'utf8',
+  ),
+) as FormDefinition;
+
+describe('${key} form definition', () => {
+  const fieldTypes = new FieldTypeRegistry();
+  registerCoreFieldTypes(fieldTypes);
+
+  const actions = new ActionRegistry();
+  registerBuiltinActions(actions, {
+    validate: () => ({ valid: true, errors: [] }),
+    submissions: {} as SubmissionStore,
+  });
+  actions.register({ name: 'sendConfirmationEmail', kind: 'post-commit', execute: async () => ({}) });
+  actions.register({
+    name: 'authenticate',
+    kind: 'transactional',
+    dangerous: true,
+    execute: async () => ({}),
+  });
+
+  it('passes the engine meta-schema', () => {
+    expect(validateDefinitionShape(definition)).toEqual([]);
+  });
+
+  it('passes publish-stage linting', () => {
+    expect(
+      lintDefinition(definition, {
+        fieldTypes,
+        actions,
+        dataSources: new DataSourceRegistry(),
+        policy: { ...DEFAULT_ORG_FORMS_POLICY, allowedDangerousActions: ['authenticate'] },
+        ruleLimits: DEFAULT_RULE_LIMITS,
+        lintRules,
+        stage: 'publish',
+        canWireDangerous: true,
+      }),
+    ).toEqual([]);
+  });
+});
+`;
+
+mkdirSync(dirname(definitionPath), { recursive: true });
+writeFileSync(definitionPath, `${JSON.stringify(definition, null, 2)}\n`);
+writeFileSync(specPath, spec);
+
+console.log(`Created ${definitionPath}`);
+console.log(`Created ${specPath}`);
+console.log('');
+console.log('Next steps:');
+console.log('  1. Edit the definition (fields, rules, actions, settings).');
+console.log('  2. npm test                              # lint spec runs without a database');
+console.log(
+  `  3. npm run forms:push -- --file ${definitionPath.replaceAll('\\', '/')} --org <org-id-or-slug> --user <owner-email> --publish`,
+);

package/template/scripts/push-form.ts

@@ -0,0 +1,124 @@
+/**
+ * Push a form-definition JSON file into an organisation — headless
+ * definitions-as-code, through the REAL engine path (save-time lint, RBAC,
+ * audit rows, versioning). Nothing is bypassed: the script impersonates an
+ * existing member (their CASL permissions apply; org owners pass everything).
+ *
+ *   npm run forms:push -- --file src/modules/forms/definitions/my-form.form.json \
+ *       --org <org-id-or-slug> --user <member-email> [--publish]
+ *
+ * Idempotent: if the file matches the latest stored version's schema, nothing
+ * new is created (with --publish, a matching DRAFT is published in place).
+ * Runs under ts-node (it bootstraps Nest — tsx drops decorator metadata).
+ */
+import { readFileSync } from 'node:fs';
+import { NestFactory } from '@nestjs/core';
+import type { FormDefinition } from '@ftisindia/form-builder';
+import { AppModule } from '../src/app.module';
+import { PrismaService } from '../src/database/prisma/prisma.service';
+import { RbacCacheService } from '../src/modules/access-control/application/services/rbac-cache.service';
+import { FormsDefinitionsService } from '../src/modules/forms/application/services/forms-definitions.service';
+import { RequestContextService } from '../src/modules/request-context/application/services/request-context.service';
+
+function argValue(flag: string): string | undefined {
+  const index = process.argv.indexOf(flag);
+  return index !== -1 ? process.argv[index + 1] : undefined;
+}
+
+function stableStringify(value: unknown): string {
+  if (Array.isArray(value)) {
+    return `[${value.map(stableStringify).join(',')}]`;
+  }
+  if (value && typeof value === 'object') {
+    const entries = Object.entries(value as Record<string, unknown>)
+      .filter(([, v]) => v !== undefined)
+      .sort(([a], [b]) => a.localeCompare(b))
+      .map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`);
+    return `{${entries.join(',')}}`;
+  }
+  return JSON.stringify(value);
+}
+
+/** Version/status are managed by the engine — compare the authored content only. */
+function normalized(schema: FormDefinition): string {
+  const { version: _version, status: _status, ...rest } = schema;
+  return stableStringify(rest);
+}
+
+async function main() {
+  const file = argValue('--file');
+  const orgRef = argValue('--org');
+  const userEmail = argValue('--user');
+  const publish = process.argv.includes('--publish');
+  if (!file || !orgRef || !userEmail) {
+    throw new Error(
+      'Usage: npm run forms:push -- --file <path> --org <org-id-or-slug> --user <member-email> [--publish]',
+    );
+  }
+
+  const definition = JSON.parse(readFileSync(file, 'utf8')) as FormDefinition;
+  if (!definition.key) {
+    throw new Error(`${file} does not look like a form definition (missing "key").`);
+  }
+
+  const app = await NestFactory.createApplicationContext(AppModule, {
+    logger: ['error', 'warn'],
+  });
+  try {
+    const prisma = app.get(PrismaService);
+    const user = await prisma.user.findFirst({ where: { email: userEmail } });
+    if (!user) {
+      throw new Error(`No user found with email "${userEmail}".`);
+    }
+    const org = await prisma.organisation.findFirst({
+      where: { OR: [{ id: orgRef }, { slug: orgRef }] },
+    });
+    if (!org) {
+      throw new Error(`No organisation found with id or slug "${orgRef}".`);
+    }
+
+    // Real membership + permissions — the engine's authz seam sees exactly
+    // what this user could do over HTTP.
+    const rbac = await app.get(RbacCacheService).getContext(user.id, org.id);
+    const requestContext = app.get(RequestContextService);
+    const definitions = app.get(FormsDefinitionsService);
+
+    await requestContext.run(
+      { source: 'worker', orgId: org.id, userId: user.id, rbac },
+      async () => {
+        const latest = await prisma.formDefinition.findFirst({
+          where: { orgId: org.id, key: definition.key },
+          orderBy: { version: 'desc' },
+        });
+
+        if (latest && normalized(latest.schema as unknown as FormDefinition) === normalized(definition)) {
+          if (publish && latest.status === 'DRAFT') {
+            await definitions.publish(org.id, definition.key, latest.version);
+            console.log(`Unchanged content — published existing draft v${latest.version}.`);
+          } else {
+            console.log(
+              `No changes — "${definition.key}" v${latest.version} (${latest.status}) already matches ${file}.`,
+            );
+          }
+          return;
+        }
+
+        const created = await definitions.create(org.id, {
+          definition: definition as unknown as Record<string, unknown>,
+        });
+        console.log(`Created "${created.key}" v${created.version} (DRAFT).`);
+        if (publish) {
+          await definitions.publish(org.id, created.key, created.version);
+          console.log(`Published "${created.key}" v${created.version}.`);
+        }
+      },
+    );
+  } finally {
+    await app.close();
+  }
+}
+
+main().catch((error) => {
+  console.error(error instanceof Error ? error.message : error);
+  process.exit(1);
+});

package/template/src/app.module.ts

@@ -2,15 +2,26 @@ import { Module } from '@nestjs/common';
 import { ConfigModule } from '@nestjs/config';
 import { APP_GUARD } from '@nestjs/core';
 import { ThrottlerGuard, ThrottlerModule } from '@nestjs/throttler';
-import { appConfig, authConfig, databaseConfig, rbacConfig, validate } from './config';
+import {
+  appConfig,
+  authConfig,
+  databaseConfig,
+  formsConfig,
+  rbacConfig,
+  reportsConfig,
+  validate,
+} from './config';
 import { PrismaModule } from './database/prisma/prisma.module';
 import { AccessControlModule } from './modules/access-control/access-control.module';
 import { AuditModule } from './modules/audit/audit.module';
 import { AuthModule } from './modules/auth/auth.module';
+import { FormsModule } from './modules/forms/forms.module';
 import { HealthModule } from './modules/health/health.module';
 import { InvitationsModule } from './modules/invitations/invitations.module';
 import { MembershipsModule } from './modules/memberships/memberships.module';
 import { OrganisationsModule } from './modules/organisations/organisations.module';
+import { ReportsModule } from './modules/reports/reports.module';
+import { ReportsFormsModule } from './modules/reports/reports-forms.module';
 import { RequestContextModule } from './modules/request-context/request-context.module';
 import { SampleModule } from './modules/sample/sample.module';
 import { SettingsModule } from './modules/settings/settings.module';
@@ -21,15 +32,20 @@ import { SettingsModule } from './modules/settings/settings.module';
       isGlobal: true,
       cache: true,
       expandVariables: true,
-      load: [appConfig, authConfig, databaseConfig, rbacConfig],
+      load: [appConfig, authConfig, databaseConfig, formsConfig, rbacConfig, reportsConfig],
       validate,
     }),
-    ThrottlerModule.forRoot([
-      {
-        ttl: 60_000,
-        limit: 100,
-      },
-    ]),
+    ThrottlerModule.forRoot({
+      throttlers: [
+        {
+          ttl: 60_000,
+          limit: 100,
+        },
+      ],
+      // e2e suites create many users/submissions in seconds; rate limiting is
+      // not what they test. Production/dev behavior is unchanged.
+      skipIf: () => process.env.NODE_ENV === 'test',
+    }),
     PrismaModule,
     HealthModule,
     AuthModule,
@@ -40,6 +56,11 @@ import { SettingsModule } from './modules/settings/settings.module';
     MembershipsModule,
     InvitationsModule,
     SettingsModule,
+    FormsModule,
+    ReportsModule,
+    // Optional bridge: adds form-backed reports + delegated grid verbs. Remove
+    // this line and ReportsModule keeps working over custom sources alone.
+    ReportsFormsModule,
     SampleModule,
   ],
   providers: [

package/template/src/common/dto/membership-response.dto.ts

@@ -55,6 +55,7 @@ export class MembershipListResponseDto {
   items!: MembershipResponseDto[];
 
   @ApiPropertyOptional({
+    type: String,
     example: '0a57fb4a-95c6-4f7e-bd5a-f96dbe0599e3',
     format: 'uuid',
     nullable: true,

package/template/src/common/dto/role-summary.dto.ts

@@ -10,9 +10,9 @@ export class RoleSummaryDto {
   @ApiProperty({ example: 'Owner' })
   name!: string;
 
-  @ApiPropertyOptional({ example: 'Full organisation access.', nullable: true })
+  @ApiPropertyOptional({ type: String, example: 'Full organisation access.', nullable: true })
   description?: string | null;
 
-  @ApiPropertyOptional({ example: true })
-  isSystemSeeded?: boolean;
+  @ApiProperty({ example: true })
+  isSystemSeeded!: boolean;
 }

package/template/src/common/dto/user-summary.dto.ts

@@ -7,13 +7,13 @@ export class UserSummaryDto {
   })
   id!: string;
 
-  @ApiPropertyOptional({ example: 'owner@example.com', nullable: true })
+  @ApiPropertyOptional({ type: String, example: 'owner@example.com', nullable: true })
   email?: string | null;
 
-  @ApiPropertyOptional({ example: '+14155552671', nullable: true })
+  @ApiPropertyOptional({ type: String, example: '+14155552671', nullable: true })
   mobile?: string | null;
 
-  @ApiPropertyOptional({ example: 'Starter Owner', nullable: true })
+  @ApiPropertyOptional({ type: String, example: 'Starter Owner', nullable: true })
   displayName?: string | null;
 }
 

package/template/src/config/app.config.ts

@@ -1,7 +1,12 @@
 import { registerAs } from '@nestjs/config';
-import { getEnv } from './env.validation';
+import { getEnv, parseCorsOrigins } from './env.validation';
 
 export default registerAs('app', () => ({
   nodeEnv: getEnv().NODE_ENV,
   port: getEnv().PORT,
+  cors: {
+    enabled: getEnv().CORS_ENABLED,
+    origins: parseCorsOrigins(getEnv().CORS_ORIGINS),
+    credentials: getEnv().CORS_CREDENTIALS,
+  },
 }));

package/template/src/config/env.validation.ts

@@ -61,10 +61,48 @@ export const envSchema = z
     AUTH_FACEBOOK_ENABLED: booleanFromEnv.default(false),
     AUTH_MOBILE_OTP_ENABLED: booleanFromEnv.default(false),
     AUTH_MAGIC_LINK_ENABLED: booleanFromEnv.default(false),
+    CORS_ENABLED: booleanFromEnv.default(false),
+    CORS_ORIGINS: z.string().trim().optional().default(''),
+    CORS_CREDENTIALS: booleanFromEnv.default(false),
     RBAC_CACHE_TTL_SECONDS: z.coerce.number().int().positive().default(60),
     ORG_CONTEXT_MODE: z.literal('path').default('path'),
+    FORMS_OUTBOX_ENABLED: booleanFromEnv.default(true),
+    FORMS_OUTBOX_POLL_MS: z.coerce.number().int().positive().default(5000),
+    FORMS_FILE_GC_INTERVAL_MS: z.coerce.number().int().positive().default(3_600_000),
+    FORMS_FILE_TEMP_TTL_HOURS: z.coerce.number().int().positive().default(24),
+    FORMS_MAX_UPLOAD_MB: z.coerce.number().int().positive().default(25),
+    FORMS_FILE_STORAGE_DIR: z.string().trim().min(1).default('./var/uploads'),
+    FORMS_SCHEMA_CHECK: z.enum(['on', 'off']).default('on'),
+    REPORTS_SCHEMA_CHECK: z.enum(['on', 'off']).default('on'),
+    // HMAC secret for report cursors and bulk-action tokens (report design
+    // §5.3/§6.3). Optional: when empty, a key is derived from JWT_SECRET via
+    // HKDF so existing apps need no new mandatory env. Rotating it invalidates
+    // outstanding cursors/tokens — clients restart from page one by design.
+    REPORTS_TOKEN_SECRET: z.string().trim().optional().default(''),
+    // Reports-owned async-export worker + file storage (report design §9).
+    REPORTS_EXPORT_WORKER_ENABLED: booleanFromEnv.default(true),
+    REPORTS_EXPORT_POLL_MS: z.coerce.number().int().positive().default(5000),
+    REPORTS_EXPORT_STORAGE_DIR: z.string().trim().min(1).default('./var/report-exports'),
   })
   .superRefine((env, ctx) => {
+    if (env.REPORTS_TOKEN_SECRET.length > 0 && env.REPORTS_TOKEN_SECRET.length < 32) {
+      ctx.addIssue({
+        code: 'custom',
+        path: ['REPORTS_TOKEN_SECRET'],
+        message: 'REPORTS_TOKEN_SECRET must be at least 32 characters when set',
+      });
+    }
+
+    const corsOrigins = parseCorsOrigins(env.CORS_ORIGINS);
+
+    if (env.CORS_CREDENTIALS && corsOrigins.includes('*')) {
+      ctx.addIssue({
+        code: 'custom',
+        path: ['CORS_ORIGINS'],
+        message: 'CORS_ORIGINS cannot include * when CORS_CREDENTIALS=true',
+      });
+    }
+
     if (!env.AUTH_GOOGLE_ENABLED) {
       return;
     }
@@ -136,6 +174,13 @@ export function getEnv(): Env {
   return validatedEnv;
 }
 
+export function parseCorsOrigins(value: string) {
+  return value
+    .split(',')
+    .map((origin) => origin.trim())
+    .filter(Boolean);
+}
+
 function requireHttpsInProduction(ctx: z.RefinementCtx, key: string, value: string) {
   if (new URL(value).protocol === 'https:') {
     return;

package/template/src/config/forms.config.ts

@@ -0,0 +1,12 @@
+import { registerAs } from '@nestjs/config';
+import { getEnv } from './env.validation';
+
+export default registerAs('forms', () => ({
+  outboxEnabled: getEnv().FORMS_OUTBOX_ENABLED,
+  outboxPollMs: getEnv().FORMS_OUTBOX_POLL_MS,
+  fileGcIntervalMs: getEnv().FORMS_FILE_GC_INTERVAL_MS,
+  fileTempTtlHours: getEnv().FORMS_FILE_TEMP_TTL_HOURS,
+  maxUploadMb: getEnv().FORMS_MAX_UPLOAD_MB,
+  storageDir: getEnv().FORMS_FILE_STORAGE_DIR,
+  schemaCheck: getEnv().FORMS_SCHEMA_CHECK,
+}));

package/template/src/config/index.ts

@@ -1,5 +1,7 @@
 export { default as appConfig } from './app.config';
 export { default as authConfig } from './auth.config';
 export { default as databaseConfig } from './database.config';
+export { default as formsConfig } from './forms.config';
 export { default as rbacConfig } from './rbac.config';
+export { default as reportsConfig } from './reports.config';
 export { validate } from './env.validation';

package/template/src/config/openapi.ts

@@ -0,0 +1,12 @@
+import { DocumentBuilder } from '@nestjs/swagger';
+
+export function buildOpenApiConfig() {
+  return new DocumentBuilder()
+    .setTitle('Foundation Starter API')
+    .setDescription(
+      'Modular-monolith starter API with auth, organisations, RBAC, audit, and settings.',
+    )
+    .setVersion('0.1.0')
+    .addBearerAuth()
+    .build();
+}

package/template/src/config/reports-secret.ts

@@ -0,0 +1,15 @@
+import { hkdfSync } from 'node:crypto';
+
+/**
+ * Key bytes for report cursor/action-token HMACs (report design §5.3/§6.3).
+ * Uses REPORTS_TOKEN_SECRET verbatim when configured; otherwise derives a
+ * dedicated 32-byte key from JWT_SECRET via HKDF-SHA256 so the raw JWT secret
+ * never signs report tokens directly.
+ */
+export function createHkdfSync(reportsSecret: string, jwtSecret: string): Uint8Array {
+  if (reportsSecret.length > 0) {
+    return new TextEncoder().encode(reportsSecret);
+  }
+
+  return new Uint8Array(hkdfSync('sha256', jwtSecret, '', 'ftis-reports-tokens', 32));
+}

package/template/src/config/reports.config.ts

@@ -0,0 +1,16 @@
+import { registerAs } from '@nestjs/config';
+import { getEnv } from './env.validation';
+import { createHkdfSync } from './reports-secret';
+
+export default registerAs('reports', () => ({
+  schemaCheck: getEnv().REPORTS_SCHEMA_CHECK,
+  // Resolved key bytes for cursor/action-token HMACs (report design §5.3/§6.3):
+  // REPORTS_TOKEN_SECRET when set, else HKDF-derived from JWT_SECRET so the raw
+  // JWT secret never signs report tokens directly.
+  tokenSecret: createHkdfSync(getEnv().REPORTS_TOKEN_SECRET, getEnv().JWT_SECRET),
+  // Reports-owned async-export worker + file storage (report design §9) — no
+  // dependency on the forms outbox or UploadedFile machinery.
+  exportWorkerEnabled: getEnv().REPORTS_EXPORT_WORKER_ENABLED,
+  exportPollMs: getEnv().REPORTS_EXPORT_POLL_MS,
+  exportStorageDir: getEnv().REPORTS_EXPORT_STORAGE_DIR,
+}));

package/template/src/main.ts

@@ -1,13 +1,27 @@
 import { ValidationPipe } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
 import { NestFactory } from '@nestjs/core';
-import { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';
+import { SwaggerModule } from '@nestjs/swagger';
 import { AppModule } from './app.module';
 import { HttpExceptionFilter } from './common/filters/http-exception.filter';
+import { buildOpenApiConfig } from './config/openapi';
 
 async function bootstrap() {
   const app = await NestFactory.create(AppModule);
   const config = app.get(ConfigService);
+  const cors = config.get<{
+    enabled: boolean;
+    origins: string[];
+    credentials: boolean;
+  }>('app.cors');
+
+  if (cors?.enabled) {
+    app.enableCors({
+      origin: cors.origins,
+      credentials: cors.credentials,
+    });
+  }
+
   app.enableShutdownHooks();
   app.useGlobalFilters(new HttpExceptionFilter());
 
@@ -19,17 +33,7 @@ async function bootstrap() {
     }),
   );
 
-  const document = SwaggerModule.createDocument(
-    app,
-    new DocumentBuilder()
-      .setTitle('Foundation Starter API')
-      .setDescription(
-        'Modular-monolith starter API with auth, organisations, RBAC, audit, and settings.',
-      )
-      .setVersion('0.1.0')
-      .addBearerAuth()
-      .build(),
-  );
+  const document = SwaggerModule.createDocument(app, buildOpenApiConfig());
   SwaggerModule.setup('docs', app, document, {
     swaggerOptions: {
       persistAuthorization: true,

package/template/src/modules/access-control/access-control.module.ts

@@ -7,11 +7,12 @@ import { AccessControlService } from './application/services/access-control.serv
 import { PermissionGuard } from './application/services/permission.guard';
 import { RbacCacheService } from './application/services/rbac-cache.service';
 import { AccessControlController } from './presentation/access-control.controller';
+import { CurrentAccessControlController } from './presentation/current-access-control.controller';
 
 @Global()
 @Module({
   imports: [AuthModule, DiscoveryModule],
-  controllers: [AccessControlController],
+  controllers: [AccessControlController, CurrentAccessControlController],
   providers: [
     AbilityFactory,
     AccessControlService,