@futdevpro/nts-dynamo 1.15.82 → 1.15.83

package/src/_modules/server/errors/errors.controller.ts

@@ -145,6 +145,32 @@ export abstract class DyNTS_Errors_Controller<
     return protectedNames.includes(endpointName) ? [cfg.authPreProcess] : [];
   }
 
+  /**
+   * FR-263 (2026-06-26) — LAZY, REQUEST-IDŐBEN kiértékelt guard-wrapper.
+   *
+   * GYÖKÉR-OK: a `setupEndpoints()` a controller ELSŐ konstrukciójakor fut, ami a built-in
+   * error-controllernél a host-app `configure()`-ja ELŐTT történhet (a framework korán példányosítja
+   * a singletont). Ilyenkor a `getPreProcessesFor()` még az ÜRES configot olvasta → a guard SOHA nem
+   * kötődött → az admin error-read endpoint-ok (`get-range`, `get-paged`, …) token nélkül **200**-at
+   * adtak vissza, kiszivárogtatva a belső error-logot (info-disclosure). A 39 másik (controller-szinten
+   * HARDCODE-olt) guard azért működött, mert nem függ a `configure()` időzítésétől.
+   *
+   * FIX: a `preProcesses` egy wrapper, ami a configot KÉRÉS-IDŐBEN olvassa (`getPreProcessesFor`), így
+   * a `configure()` SORREND-FÜGGETLEN — bármikor hívható az első kérés előtt. A 401-et a VALÓDI guard
+   * küldi; `res.headersSent`-re leállunk (nincs dupla-send), és nem-védett endpointnál no-op (átenged).
+   */
+  protected lazyPreProcessesFor(endpointName: string): ((req: Request, res: Response) => Promise<void>)[] {
+    return [
+      async (req: Request, res: Response): Promise<void> => {
+        const guards: ((req: Request, res: Response) => Promise<void>)[] = this.getPreProcessesFor(endpointName);
+        for (const guard of guards) {
+          if (res.headersSent) { return; }
+          await guard(req, res);
+        }
+      },
+    ];
+  }
+
   setupEndpoints(): void {
     /* if (!this.getErrorDataService) {
       throw new DyFM_Error({
@@ -165,7 +191,7 @@ export abstract class DyNTS_Errors_Controller<
         name: 'logError',
         type: DyFM_HttpCallType.post,
         endpoint: '/error/log',
-        preProcesses: this.getPreProcessesFor('logError'),
+        preProcesses: this.lazyPreProcessesFor('logError'),
         tasks: [
           async (req: Request, res: Response, issuer: string = 'unknown-issuer'): Promise<void> => {
             const error_CS: T_Error_ControlService = this.getError_ControlService({
@@ -184,7 +210,7 @@ export abstract class DyNTS_Errors_Controller<
         name: 'newError',
         type: DyFM_HttpCallType.post,
         endpoint: '/error/new',
-        preProcesses: this.getPreProcessesFor('newError'),
+        preProcesses: this.lazyPreProcessesFor('newError'),
         tasks: [
           async (req: Request, res: Response, issuer: string = 'unknown-issuer'): Promise<void> => {
             const error_CS: T_Error_ControlService = this.getError_ControlService({
@@ -204,7 +230,7 @@ export abstract class DyNTS_Errors_Controller<
         name: 'markErrorDone',
         type: DyFM_HttpCallType.get,
         endpoint: '/error/mark-done/:errorId',
-        preProcesses: this.getPreProcessesFor('markErrorDone'),
+        preProcesses: this.lazyPreProcessesFor('markErrorDone'),
         tasks: [
           async (req: Request, res: Response, issuer: string = 'unknown-issuer'): Promise<void> => {
             const error_CS: T_Error_ControlService = this.getError_ControlService({
@@ -224,7 +250,7 @@ export abstract class DyNTS_Errors_Controller<
         name: 'markAllErrorDone',
         type: DyFM_HttpCallType.get,
         endpoint: '/error/mark-all-done',
-        preProcesses: this.getPreProcessesFor('markAllErrorDone'),
+        preProcesses: this.lazyPreProcessesFor('markAllErrorDone'),
         tasks: [
           async (req: Request, res: Response, issuer: string = 'unknown-issuer'): Promise<void> => {
             const error_CS: T_Error_ControlService = this.getError_ControlService({
@@ -244,7 +270,7 @@ export abstract class DyNTS_Errors_Controller<
         name: 'recordFixAttempt',
         type: DyFM_HttpCallType.post,
         endpoint: '/error/:errorId/fix-attempt',
-        preProcesses: this.getPreProcessesFor('recordFixAttempt'),
+        preProcesses: this.lazyPreProcessesFor('recordFixAttempt'),
         tasks: [
           async (req: Request, res: Response, issuer: string = 'unknown-issuer'): Promise<void> => {
             const errorId: string = req.params.errorId;
@@ -274,7 +300,7 @@ export abstract class DyNTS_Errors_Controller<
         name: 'resolveError',
         type: DyFM_HttpCallType.post,
         endpoint: '/error/:errorId/resolve',
-        preProcesses: this.getPreProcessesFor('resolveError'),
+        preProcesses: this.lazyPreProcessesFor('resolveError'),
         tasks: [
           async (req: Request, res: Response, issuer: string = 'unknown-issuer'): Promise<void> => {
             const errorId: string = req.params.errorId;
@@ -321,7 +347,7 @@ export abstract class DyNTS_Errors_Controller<
         name: 'getErrors',
         type: DyFM_HttpCallType.get,
         endpoint: '/error/get-range/:range',
-        preProcesses: this.getPreProcessesFor('getErrors'),
+        preProcesses: this.lazyPreProcessesFor('getErrors'),
         tasks: [
           async (req: Request, res: Response, issuer: string = 'unknown-issuer') : Promise<void> => {
             const error_CS: T_Error_ControlService = this.getError_ControlService({
@@ -342,7 +368,7 @@ export abstract class DyNTS_Errors_Controller<
         name: 'getErrorsPaged',
         type: DyFM_HttpCallType.get,
         endpoint: '/error/get-paged/:range/:pageSize/:pageIndex',
-        preProcesses: this.getPreProcessesFor('getErrorsPaged'),
+        preProcesses: this.lazyPreProcessesFor('getErrorsPaged'),
         tasks: [
           async (req: Request, res: Response, issuer: string = 'unknown-issuer') : Promise<void> => {
             const error_CS: T_Error_ControlService = this.getError_ControlService({
@@ -374,7 +400,7 @@ export abstract class DyNTS_Errors_Controller<
         name: 'getErrorsByCategoryPaged',
         type: DyFM_HttpCallType.get,
         endpoint: '/error/get-by-category/:category/:range/:pageSize/:pageIndex',
-        preProcesses: this.getPreProcessesFor('getErrorsByCategoryPaged'),
+        preProcesses: this.lazyPreProcessesFor('getErrorsByCategoryPaged'),
         tasks: [
           async (req: Request, res: Response, issuer: string = 'unknown-issuer'): Promise<void> => {
             const error_CS: T_Error_ControlService = this.getError_ControlService({ issuer });
@@ -403,7 +429,7 @@ export abstract class DyNTS_Errors_Controller<
         name: 'getErrorsByStatusPaged',
         type: DyFM_HttpCallType.get,
         endpoint: '/error/get-by-status/:status/:range/:pageSize/:pageIndex',
-        preProcesses: this.getPreProcessesFor('getErrorsByStatusPaged'),
+        preProcesses: this.lazyPreProcessesFor('getErrorsByStatusPaged'),
         tasks: [
           async (req: Request, res: Response, issuer: string = 'unknown-issuer'): Promise<void> => {
             const error_CS: T_Error_ControlService = this.getError_ControlService({ issuer });
@@ -432,7 +458,7 @@ export abstract class DyNTS_Errors_Controller<
         name: 'getLastErrors',
         type: DyFM_HttpCallType.get,
         endpoint: '/error/get-last-paged/:range/:pageSize/:pageIndex',
-        preProcesses: this.getPreProcessesFor('getLastErrors'),
+        preProcesses: this.lazyPreProcessesFor('getLastErrors'),
         tasks: [
           async (req: Request, res: Response, issuer: string = 'unknown-issuer') : Promise<void> => {
             const error_CS: T_Error_ControlService = this.getError_ControlService({
@@ -464,7 +490,7 @@ export abstract class DyNTS_Errors_Controller<
         name: 'searchErrors',
         type: DyFM_HttpCallType.get,
         endpoint: '/error/search',
-        preProcesses: this.getPreProcessesFor('searchErrors'),
+        preProcesses: this.lazyPreProcessesFor('searchErrors'),
         tasks: [
           async (req: Request, res: Response, issuer: string = 'unknown-issuer') : Promise<void> => {
             const error_CS: T_Error_ControlService = this.getError_ControlService({

package/src/_modules/server/server-status/server-status.controller.spec.ts

@@ -172,62 +172,69 @@ describe('| DyNTS_ServerStatus_Controller', () => {
       DyNTS_ServerStatus_Controller._resetAuthConfigForTesting();
     });
 
-    const preCount = (controller: any, name: string): number => {
-      const ep: any = controller.endpoints.find((e: any) => e.name === name);
-      return (ep?.preProcesses ?? []).length;
+    // FR-263 — a guard request-idoben fut (lazy wrapper). "Gated-e egy endpoint" = a wrapper
+    // meghivasa lefuttatja-e a configured authPreProcess-t. A counter-t a teszt-spy lepteti.
+    let guardCalls: number = 0;
+    const spyAuth = async (): Promise<void> => { guardCalls++; };
+    const runGuard = async (c: any, name: string): Promise<void> => {
+      const ep: any = c.endpoints.find((e: any) => e.name === name);
+      await ep?.preProcesses?.[0]?.({} as any, { headersSent: false } as any);
     };
+    beforeEach((): void => { guardCalls = 0; });
 
-    it('| default: NO preProcesses on any endpoint (backwards compatible)', (): void => {
+    it('| default (no config): a wrapper jelen van, de egy keres NEM hiv guardot (nyitva marad)', async (): Promise<void> => {
       controller.setupEndpoints();
       for (const ep of controller.endpoints) {
-        const pre: any = (ep as any).preProcesses;
-        expect(pre === undefined || pre.length === 0).toBe(true);
+        await (ep as any).preProcesses?.[0]?.({} as any, { headersSent: false } as any); // no-op, nem dob
       }
+      expect(guardCalls).toBe(0);
     });
 
-    it('| configure({ authPreProcess }) → csak getErrorStatistics gated, a status-vegpontok NEM', (): void => {
-      const fakeAuth = async (): Promise<void> => { /* noop */ };
-      DyNTS_ServerStatus_Controller.configure({ authPreProcess: fakeAuth });
+    it('| configure({ authPreProcess }) → CSAK getErrorStatistics-en fut a guard, a status-vegpontokon NEM', async (): Promise<void> => {
+      DyNTS_ServerStatus_Controller.configure({ authPreProcess: spyAuth });
       const c: any = new (TestServerStatusController as any)();
       c.setupEndpoints();
-
-      // admin-adat → gated
-      expect(preCount(c, 'getErrorStatistics')).toBe(1);
-      // status-vegpontok (a kliens-indikator hivja, /health-tel adat-ekvivalens) → SOHA nem gated
-      expect(preCount(c, 'getServerStatus')).toBe(0);
-      expect(preCount(c, 'getServerHealth')).toBe(0);
-      expect(preCount(c, 'getServerReadiness')).toBe(0);
-      expect(preCount(c, 'getServerStatusForClient')).toBe(0);
+      await runGuard(c, 'getErrorStatistics');
+      expect(guardCalls).withContext('admin-adat → gated').toBe(1);
+      guardCalls = 0;
+      for (const name of ['getServerStatus', 'getServerHealth', 'getServerReadiness', 'getServerStatusForClient']) {
+        await runGuard(c, name);
+      }
+      expect(guardCalls).withContext('status-probak SOHA nem gated').toBe(0);
     });
 
-    it('| a status-vegpontokat (getServerStatus is) explicit protectedEndpoints-lista SEM gate-eli', (): void => {
-      const fakeAuth = async (): Promise<void> => { /* noop */ };
+    it('| a status-vegpontokat explicit protectedEndpoints-lista SEM gate-eli (PUBLIC_PROBE kizart)', async (): Promise<void> => {
       DyNTS_ServerStatus_Controller.configure({
-        authPreProcess: fakeAuth,
+        authPreProcess: spyAuth,
         protectedEndpoints: [ 'getServerHealth', 'getServerReadiness', 'getServerStatusForClient', 'getServerStatus', 'getErrorStatistics' ],
       });
       const c: any = new (TestServerStatusController as any)();
       c.setupEndpoints();
-
-      expect(preCount(c, 'getServerStatus')).toBe(0);
-      expect(preCount(c, 'getServerHealth')).toBe(0);
-      expect(preCount(c, 'getServerReadiness')).toBe(0);
-      expect(preCount(c, 'getServerStatusForClient')).toBe(0);
-      // a valodi admin-adat viszont gated
-      expect(preCount(c, 'getErrorStatistics')).toBe(1);
+      for (const name of ['getServerStatus', 'getServerHealth', 'getServerReadiness', 'getServerStatusForClient']) {
+        await runGuard(c, name);
+      }
+      expect(guardCalls).withContext('status-probak kizartak meg explicit listan is').toBe(0);
+      await runGuard(c, 'getErrorStatistics');
+      expect(guardCalls).withContext('getErrorStatistics gated').toBe(1);
     });
 
-    it('| protectedEndpoints subset → csak a megadott (nem-proba) neveken aktiv', (): void => {
-      const fakeAuth = async (): Promise<void> => { /* noop */ };
-      DyNTS_ServerStatus_Controller.configure({
-        authPreProcess: fakeAuth,
-        protectedEndpoints: [ 'getErrorStatistics' ],
-      });
+    it('| protectedEndpoints subset → getErrorStatistics gated, getServerStatus NEM', async (): Promise<void> => {
+      DyNTS_ServerStatus_Controller.configure({ authPreProcess: spyAuth, protectedEndpoints: [ 'getErrorStatistics' ] });
       const c: any = new (TestServerStatusController as any)();
       c.setupEndpoints();
+      await runGuard(c, 'getErrorStatistics');
+      expect(guardCalls).toBe(1);
+      guardCalls = 0;
+      await runGuard(c, 'getServerStatus');
+      expect(guardCalls).toBe(0);
+    });
 
-      expect(preCount(c, 'getErrorStatistics')).toBe(1);
-      expect(preCount(c, 'getServerStatus')).toBe(0);
+    it('| FR-263 ORDER-INDEPENDENCE: setupEndpoints() ELOTT epitett endpoint is enforce-olja a guardot', async (): Promise<void> => {
+      const c: any = new (TestServerStatusController as any)();
+      c.setupEndpoints(); // config NELKUL (korai framework-konstrukcio szimulacioja)
+      DyNTS_ServerStatus_Controller.configure({ authPreProcess: spyAuth }); // configure UTANA
+      await runGuard(c, 'getErrorStatistics');
+      expect(guardCalls).withContext('guard runs despite configure() AFTER setupEndpoints').toBe(1);
     });
 
     it('| getAuthConfig() returns the active config', (): void => {

package/src/_modules/server/server-status/server-status.controller.ts

@@ -151,6 +151,25 @@ export abstract class DyNTS_ServerStatus_Controller<
     return protectedNames.includes(endpointName) ? [cfg.authPreProcess] : [];
   }
 
+  /**
+   * FR-263 (2026-06-26) — LAZY, REQUEST-IDŐBEN kiértékelt guard-wrapper (lásd a DyNTS_Errors_Controller
+   * azonos fixét). A `setupEndpoints()` a host-app `configure()`-ja ELŐTT futhat (korai singleton-
+   * konstrukció) → a guard ürès configgal kötődött → a `getServerStatus`/`getErrorStatistics` admin-adat
+   * token nélkül 200-at adott (info-disclosure). A wrapper a configot KÉRÉS-IDŐBEN olvassa → sorrend-
+   * független. A 401-et a valódi guard küldi; `headersSent`-re leállunk; nem-védett endpointnál no-op.
+   */
+  protected lazyPreProcessesFor(endpointName: string): ((req: Request, res: Response) => Promise<void>)[] {
+    return [
+      async (req: Request, res: Response): Promise<void> => {
+        const guards: ((req: Request, res: Response) => Promise<void>)[] = this.getPreProcessesFor(endpointName);
+        for (const guard of guards) {
+          if (res.headersSent) { return; }
+          await guard(req, res);
+        }
+      },
+    ];
+  }
+
   setupEndpoints(): void {
     /* if (!this.getServerService) {
       throw new DyFM_Error({
@@ -173,7 +192,7 @@ export abstract class DyNTS_ServerStatus_Controller<
         name: 'getServerStatus',
         type: DyFM_HttpCallType.get,
         endpoint: '/status',
-        preProcesses: this.getPreProcessesFor('getServerStatus'),
+        preProcesses: this.lazyPreProcessesFor('getServerStatus'),
         tasks: [
           async (req: Request, res: Response, issuer: string): Promise<void> => {
             res.send(
@@ -187,7 +206,7 @@ export abstract class DyNTS_ServerStatus_Controller<
         name: 'getServerHealth',
         type: DyFM_HttpCallType.get,
         endpoint: '/health',
-        preProcesses: this.getPreProcessesFor('getServerHealth'),
+        preProcesses: this.lazyPreProcessesFor('getServerHealth'),
         tasks: [
           async (req: Request, res: Response, issuer: string): Promise<void> => {
             res.send(
@@ -203,7 +222,7 @@ export abstract class DyNTS_ServerStatus_Controller<
         name: 'getServerReadiness',
         type: DyFM_HttpCallType.get,
         endpoint: '/readiness',
-        preProcesses: this.getPreProcessesFor('getServerReadiness'),
+        preProcesses: this.lazyPreProcessesFor('getServerReadiness'),
         tasks: [
           async (req: Request, res: Response, issuer: string): Promise<void> => {
             const readiness: DyNTS_DbReadiness = await this.server_CS.checkDbReadiness();
@@ -217,7 +236,7 @@ export abstract class DyNTS_ServerStatus_Controller<
         name: 'getServerStatusForClient',
         type: DyFM_HttpCallType.get,
         endpoint: '/status/:version',
-        preProcesses: this.getPreProcessesFor('getServerStatusForClient'),
+        preProcesses: this.lazyPreProcessesFor('getServerStatusForClient'),
         tasks: [
           async (req: Request, res: Response, issuer: string): Promise<void> => {
 
@@ -232,7 +251,7 @@ export abstract class DyNTS_ServerStatus_Controller<
         name: 'getErrorStatistics',
         type: DyFM_HttpCallType.get,
         endpoint: '/statistics/error/:range',
-        preProcesses: this.getPreProcessesFor('getErrorStatistics'),
+        preProcesses: this.lazyPreProcessesFor('getErrorStatistics'),
         tasks: [
           async (req: Request, res: Response, issuer: string) : Promise<void> => {