@heavybit/pendoadmin-shared-lib 1.0.0 → 1.1.0

package/dist/tenant/knex-tenant.js

@@ -0,0 +1,43 @@
+// pendoadmin-shared-lib/src/tenant/knex-tenant.ts
+//
+// Proxy-based Knex wrapper that automatically applies
+//   WHERE company_id = ? to every query on the returned builder.
+/**
+ * Returns a Proxy around `knex` that intercepts table calls and
+ * injects `.where(tenantColumn, companyId)`.
+ */
+export function scopedKnex(knex, companyId, options = {}) {
+    const { tenantColumn = "company_id", excludeTables = [] } = options;
+    const excluded = new Set(excludeTables.map((t) => t.toLowerCase()));
+    return new Proxy(knex, {
+        apply(_target, _thisArg, args) {
+            const tableName = args[0];
+            const qb = knex(tableName);
+            if (typeof tableName === "string" && !excluded.has(tableName.toLowerCase())) {
+                return qb.where(`${tableName}.${tenantColumn}`, companyId);
+            }
+            return qb;
+        },
+        get(target, prop, receiver) {
+            if (prop === "raw" || prop === "schema" || prop === "destroy" || prop === "transaction") {
+                return Reflect.get(target, prop, receiver);
+            }
+            const value = Reflect.get(target, prop, receiver);
+            if (typeof value === "function" && typeof prop === "string") {
+                return (...args) => {
+                    const result = value.apply(target, args);
+                    if (result &&
+                        typeof result === "object" &&
+                        "where" in result &&
+                        typeof args[0] === "string" &&
+                        !excluded.has(args[0].toLowerCase())) {
+                        return result.where(`${args[0]}.${tenantColumn}`, companyId);
+                    }
+                    return result;
+                };
+            }
+            return value;
+        },
+    });
+}
+//# sourceMappingURL=knex-tenant.js.map

package/dist/tenant/knex-tenant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"knex-tenant.js","sourceRoot":"","sources":["../../src/tenant/knex-tenant.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,EAAE;AACF,sDAAsD;AACtD,iEAAiE;AAWjE;;;GAGG;AACH,MAAM,UAAU,UAAU,CACxB,IAAU,EACV,SAA0B,EAC1B,UAA6B,EAAE;IAE/B,MAAM,EAAE,YAAY,GAAG,YAAY,EAAE,aAAa,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC;IACpE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAEpE,OAAO,IAAI,KAAK,CAAC,IAAI,EAAE;QACrB,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,IAA4B;YACnD,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;YAC3B,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBAC5E,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,SAAS,IAAI,YAAY,EAAE,EAAE,SAAS,CAAC,CAAC;YAC7D,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ;YACxB,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;gBACxF,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC7C,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YAClD,IAAI,OAAO,KAAK,KAAK,UAAU,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC5D,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;oBAC5B,MAAM,MAAM,GAAI,KAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;oBACvD,IACE,MAAM;wBACN,OAAO,MAAM,KAAK,QAAQ;wBAC1B,OAAO,IAAI,MAAM;wBACjB,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ;wBAC3B,CAAC,QAAQ,CAAC,GAAG,CAAE,IAAI,CAAC,CAAC,CAAY,CAAC,WAAW,EAAE,CAAC,EAChD,CAAC;wBACD,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,YAAY,EAAE,EAAE,SAAS,CAAC,CAAC;oBAC/D,CAAC;oBACD,OAAO,MAAM,CAAC;gBAChB,CAAC,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAoB,CAAC;AACxB,CAAC"}

package/dist/tenant/tenant-access-control.d.ts

@@ -0,0 +1,93 @@
+import type { Request, Response, NextFunction } from "express";
+import type { Knex } from "knex";
+/**
+ * Every discrete feature / service area that can be gated.
+ * Extend this union as the platform grows.
+ */
+export type Feature = "sms" | "email" | "whatsapp" | "ussd" | "mpesa" | "analytics" | "ai" | "notifications" | "api-gateway" | (string & {});
+/**
+ * Named subscription plans. Each plan grants access to a set of features.
+ * Plans are ordered by tier — higher tiers include all features of lower tiers.
+ */
+export interface SubscriptionPlan {
+    name: string;
+    /** Numeric tier level — higher = more features */
+    tier: number;
+    /** Features included in this plan */
+    features: Feature[];
+}
+/** Default plans — consumers can override with their own */
+export declare const DEFAULT_PLANS: SubscriptionPlan[];
+export interface TenantAccessControlConfig {
+    /**
+     * Function that looks up a company's active features.
+     * Should return the list of feature names the company is entitled to.
+     * This is called once per request and cached on the request object.
+     */
+    getCompanyFeatures: (companyId: string) => Promise<Feature[]>;
+    /**
+     * Optional: check whether the tenant (company) itself is active.
+     * If it returns false the request is rejected with 403.
+     * Default: always active (not checked).
+     */
+    isCompanyActive?: (companyId: string) => Promise<boolean>;
+    /** Cache TTL in seconds for feature lookups. 0 = no cache. Default: 60. */
+    cacheTtlSeconds?: number;
+    /** Custom logger (default: console) */
+    logger?: Pick<Console, "info" | "warn" | "error">;
+}
+/** Clear the entire feature cache (useful for tests or after plan changes) */
+export declare function clearFeatureCache(): void;
+/** Invalidate cache for a specific company (call after plan upgrade/downgrade) */
+export declare function invalidateCompanyFeatureCache(companyId: string): void;
+/**
+ * Creates an Express middleware that checks whether the requesting tenant
+ * is active and has access to the specified feature(s).
+ *
+ * Usage:
+ * ```ts
+ * const ctrl = createTenantAccessControl({ getCompanyFeatures, isCompanyActive });
+ *
+ * // Gate an entire router
+ * router.use(ctrl.requireFeature("whatsapp"));
+ *
+ * // Gate a specific route with multiple required features
+ * router.post("/campaigns", ctrl.requireAllFeatures(["sms", "analytics"]), handler);
+ *
+ * // Gate where ANY one feature is sufficient
+ * router.get("/inbox", ctrl.requireAnyFeature(["sms", "whatsapp", "email"]), handler);
+ * ```
+ */
+export declare function createTenantAccessControl(config: TenantAccessControlConfig): {
+    requireFeature: (feature: Feature) => (req: Request, res: Response, next: NextFunction) => Promise<Response<any, Record<string, any>> | undefined>;
+    requireAllFeatures: (features: Feature[]) => (req: Request, res: Response, next: NextFunction) => Promise<Response<any, Record<string, any>> | undefined>;
+    requireAnyFeature: (features: Feature[]) => (req: Request, res: Response, next: NextFunction) => Promise<Response<any, Record<string, any>> | undefined>;
+    requireActiveTenant: () => (req: Request, res: Response, next: NextFunction) => Promise<Response<any, Record<string, any>> | undefined>;
+    resolveFeatures: (companyId: string) => Promise<Feature[]>;
+    clearFeatureCache: typeof clearFeatureCache;
+    invalidateCompanyFeatureCache: typeof invalidateCompanyFeatureCache;
+};
+/**
+ * Default implementation of `getCompanyFeatures` using Knex
+ * against the `company_service_configs` table.
+ *
+ * Returns the `service_name` of every row where `is_active = true`
+ * for the given company.
+ */
+export declare function knexFeatureResolver(knex: Knex): (companyId: string) => Promise<Feature[]>;
+/**
+ * Default implementation of `isCompanyActive` using Knex
+ * against the `companies` table.
+ */
+export declare function knexCompanyActiveChecker(knex: Knex): (companyId: string) => Promise<boolean>;
+/**
+ * Given a plan name, return the set of features it grants.
+ * Useful for provisioning a new company.
+ */
+export declare function getFeaturesForPlan(planName: string, plans?: SubscriptionPlan[]): Feature[];
+/**
+ * Provision a company's service configs based on a plan.
+ * Inserts rows into `company_service_configs` for each feature in the plan.
+ */
+export declare function provisionCompanyPlan(knex: Knex, companyId: string, planName: string, plans?: SubscriptionPlan[]): Promise<void>;
+//# sourceMappingURL=tenant-access-control.d.ts.map

package/dist/tenant/tenant-access-control.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-access-control.d.ts","sourceRoot":"","sources":["../../src/tenant/tenant-access-control.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAIjC;;;GAGG;AACH,MAAM,MAAM,OAAO,GACf,KAAK,GACL,OAAO,GACP,UAAU,GACV,MAAM,GACN,OAAO,GACP,WAAW,GACX,IAAI,GACJ,eAAe,GACf,aAAa,GACb,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,qCAAqC;IACrC,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAED,4DAA4D;AAC5D,eAAO,MAAM,aAAa,EAAE,gBAAgB,EAqB3C,CAAC;AAIF,MAAM,WAAW,yBAAyB;IACxC;;;;OAIG;IACH,kBAAkB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAE9D;;;;OAIG;IACH,eAAe,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1D,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB,uCAAuC;IACvC,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;CACnD;AAwBD,8EAA8E;AAC9E,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAED,kFAAkF;AAClF,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAErE;AAID;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,yBAAyB;8BAqCxC,OAAO,MACxB,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY;mCAwBzB,OAAO,EAAE,MAC/B,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY;kCAyB1B,OAAO,EAAE,MAC9B,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY;gCAuB/C,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY;iCAtGrB,MAAM,KAAG,OAAO,CAAC,OAAO,EAAE,CAAC;;;EAyHtE;AAID;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,IAC9B,WAAW,MAAM,KAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAMrD;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,IAAI,IACnC,WAAW,MAAM,KAAG,OAAO,CAAC,OAAO,CAAC,CAOnD;AAID;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,KAAK,GAAE,gBAAgB,EAAkB,GACxC,OAAO,EAAE,CAGX;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,IAAI,EACV,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,KAAK,GAAE,gBAAgB,EAAkB,GACxC,OAAO,CAAC,IAAI,CAAC,CA+Bf"}

package/dist/tenant/tenant-access-control.js

@@ -0,0 +1,260 @@
+// pendoadmin-shared-lib/src/tenant/tenant-access-control.ts
+//
+// Feature-gating middleware and helpers.
+// Restricts tenant access to services/features based on their subscription plan
+// and per-service activation status (ICompanyServiceConfig).
+/** Default plans — consumers can override with their own */
+export const DEFAULT_PLANS = [
+    {
+        name: "starter",
+        tier: 1,
+        features: ["sms", "notifications"],
+    },
+    {
+        name: "professional",
+        tier: 2,
+        features: ["sms", "email", "notifications", "analytics"],
+    },
+    {
+        name: "business",
+        tier: 3,
+        features: ["sms", "email", "whatsapp", "mpesa", "notifications", "analytics"],
+    },
+    {
+        name: "enterprise",
+        tier: 4,
+        features: ["sms", "email", "whatsapp", "ussd", "mpesa", "analytics", "ai", "notifications", "api-gateway"],
+    },
+];
+const featureCache = new Map();
+function getCachedFeatures(companyId, ttl) {
+    if (ttl <= 0)
+        return null;
+    const entry = featureCache.get(companyId);
+    if (entry && Date.now() < entry.expiresAt)
+        return entry.features;
+    featureCache.delete(companyId);
+    return null;
+}
+function setCachedFeatures(companyId, features, ttl) {
+    if (ttl <= 0)
+        return;
+    featureCache.set(companyId, { features, expiresAt: Date.now() + ttl * 1000 });
+}
+/** Clear the entire feature cache (useful for tests or after plan changes) */
+export function clearFeatureCache() {
+    featureCache.clear();
+}
+/** Invalidate cache for a specific company (call after plan upgrade/downgrade) */
+export function invalidateCompanyFeatureCache(companyId) {
+    featureCache.delete(companyId);
+}
+// ─── Middleware Factory ─────────────────────────────────
+/**
+ * Creates an Express middleware that checks whether the requesting tenant
+ * is active and has access to the specified feature(s).
+ *
+ * Usage:
+ * ```ts
+ * const ctrl = createTenantAccessControl({ getCompanyFeatures, isCompanyActive });
+ *
+ * // Gate an entire router
+ * router.use(ctrl.requireFeature("whatsapp"));
+ *
+ * // Gate a specific route with multiple required features
+ * router.post("/campaigns", ctrl.requireAllFeatures(["sms", "analytics"]), handler);
+ *
+ * // Gate where ANY one feature is sufficient
+ * router.get("/inbox", ctrl.requireAnyFeature(["sms", "whatsapp", "email"]), handler);
+ * ```
+ */
+export function createTenantAccessControl(config) {
+    const { getCompanyFeatures, isCompanyActive, cacheTtlSeconds = 60, logger = console, } = config;
+    // ─── Resolve features (with cache) ─────────────────
+    async function resolveFeatures(companyId) {
+        const cached = getCachedFeatures(companyId, cacheTtlSeconds);
+        if (cached)
+            return cached;
+        const features = await getCompanyFeatures(companyId);
+        setCachedFeatures(companyId, features, cacheTtlSeconds);
+        return features;
+    }
+    // ─── Tenant active check ───────────────────────────
+    async function checkTenantActive(companyId, res) {
+        if (!isCompanyActive)
+            return true;
+        const active = await isCompanyActive(companyId);
+        if (!active) {
+            logger.warn(`[TenantAccess] Company ${companyId} is disabled — blocking request`);
+            res.status(403).json({
+                success: false,
+                message: "Your account has been disabled. Please contact support.",
+            });
+            return false;
+        }
+        return true;
+    }
+    // ─── Middleware: require a single feature ──────────
+    function requireFeature(feature) {
+        return async (req, res, next) => {
+            const companyId = extractCompanyId(req);
+            if (!companyId) {
+                return res.status(401).json({ success: false, message: "Company context required." });
+            }
+            if (!(await checkTenantActive(companyId, res)))
+                return;
+            const features = await resolveFeatures(companyId);
+            if (!features.includes(feature)) {
+                logger.info(`[TenantAccess] Company ${companyId} denied access to "${feature}" — not in plan`);
+                return res.status(403).json({
+                    success: false,
+                    message: `Your subscription does not include access to the "${feature}" service. Please upgrade your plan.`,
+                });
+            }
+            next();
+        };
+    }
+    // ─── Middleware: require ALL listed features ───────
+    function requireAllFeatures(features) {
+        return async (req, res, next) => {
+            const companyId = extractCompanyId(req);
+            if (!companyId) {
+                return res.status(401).json({ success: false, message: "Company context required." });
+            }
+            if (!(await checkTenantActive(companyId, res)))
+                return;
+            const allowed = await resolveFeatures(companyId);
+            const missing = features.filter((f) => !allowed.includes(f));
+            if (missing.length > 0) {
+                logger.info(`[TenantAccess] Company ${companyId} missing features: ${missing.join(", ")}`);
+                return res.status(403).json({
+                    success: false,
+                    message: `Your subscription is missing access to: ${missing.join(", ")}. Please upgrade your plan.`,
+                });
+            }
+            next();
+        };
+    }
+    // ─── Middleware: require ANY one of listed features ─
+    function requireAnyFeature(features) {
+        return async (req, res, next) => {
+            const companyId = extractCompanyId(req);
+            if (!companyId) {
+                return res.status(401).json({ success: false, message: "Company context required." });
+            }
+            if (!(await checkTenantActive(companyId, res)))
+                return;
+            const allowed = await resolveFeatures(companyId);
+            const hasAny = features.some((f) => allowed.includes(f));
+            if (!hasAny) {
+                return res.status(403).json({
+                    success: false,
+                    message: `Your subscription does not include any of: ${features.join(", ")}. Please upgrade your plan.`,
+                });
+            }
+            next();
+        };
+    }
+    // ─── Middleware: just check tenant is active ───────
+    function requireActiveTenant() {
+        return async (req, res, next) => {
+            const companyId = extractCompanyId(req);
+            if (!companyId) {
+                return res.status(401).json({ success: false, message: "Company context required." });
+            }
+            if (!(await checkTenantActive(companyId, res)))
+                return;
+            next();
+        };
+    }
+    return {
+        requireFeature,
+        requireAllFeatures,
+        requireAnyFeature,
+        requireActiveTenant,
+        resolveFeatures,
+        clearFeatureCache,
+        invalidateCompanyFeatureCache,
+    };
+}
+// ─── Knex-backed Feature Resolver ───────────────────────
+/**
+ * Default implementation of `getCompanyFeatures` using Knex
+ * against the `company_service_configs` table.
+ *
+ * Returns the `service_name` of every row where `is_active = true`
+ * for the given company.
+ */
+export function knexFeatureResolver(knex) {
+    return async (companyId) => {
+        const rows = await knex("company_service_configs")
+            .select("service_name")
+            .where({ company_id: companyId, is_active: true });
+        return rows.map((r) => r.service_name);
+    };
+}
+/**
+ * Default implementation of `isCompanyActive` using Knex
+ * against the `companies` table.
+ */
+export function knexCompanyActiveChecker(knex) {
+    return async (companyId) => {
+        const row = await knex("companies")
+            .select("is_active")
+            .where({ id: companyId })
+            .first();
+        return row?.is_active === true || row?.is_active === 1;
+    };
+}
+// ─── Plan Helpers ───────────────────────────────────────
+/**
+ * Given a plan name, return the set of features it grants.
+ * Useful for provisioning a new company.
+ */
+export function getFeaturesForPlan(planName, plans = DEFAULT_PLANS) {
+    const plan = plans.find((p) => p.name === planName);
+    return plan ? [...plan.features] : [];
+}
+/**
+ * Provision a company's service configs based on a plan.
+ * Inserts rows into `company_service_configs` for each feature in the plan.
+ */
+export async function provisionCompanyPlan(knex, companyId, planName, plans = DEFAULT_PLANS) {
+    const features = getFeaturesForPlan(planName, plans);
+    if (features.length === 0)
+        return;
+    // Deactivate all existing configs
+    await knex("company_service_configs")
+        .where({ company_id: companyId })
+        .update({ is_active: false });
+    // Upsert new configs
+    for (const feature of features) {
+        const existing = await knex("company_service_configs")
+            .where({ company_id: companyId, service_name: feature })
+            .first();
+        if (existing) {
+            await knex("company_service_configs")
+                .where({ id: existing.id })
+                .update({ is_active: true, updated_at: knex.fn.now() });
+        }
+        else {
+            await knex("company_service_configs").insert({
+                id: knex.raw("UUID()"),
+                company_id: companyId,
+                service_name: feature,
+                config: JSON.stringify({}),
+                is_active: true,
+                created_at: knex.fn.now(),
+                updated_at: knex.fn.now(),
+            });
+        }
+    }
+}
+// ─── Helpers ────────────────────────────────────────────
+function extractCompanyId(req) {
+    // Gateway sets x-company-id header; fallback to req.user.company_id / companyId
+    return (req.headers["x-company-id"] ||
+        req.user?.company_id ||
+        req.user?.companyId);
+}
+//# sourceMappingURL=tenant-access-control.js.map

package/dist/tenant/tenant-access-control.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-access-control.js","sourceRoot":"","sources":["../../src/tenant/tenant-access-control.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,EAAE;AACF,yCAAyC;AACzC,gFAAgF;AAChF,6DAA6D;AAmC7D,4DAA4D;AAC5D,MAAM,CAAC,MAAM,aAAa,GAAuB;IAC/C;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,CAAC;QACP,QAAQ,EAAE,CAAC,KAAK,EAAE,eAAe,CAAC;KACnC;IACD;QACE,IAAI,EAAE,cAAc;QACpB,IAAI,EAAE,CAAC;QACP,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,CAAC;KACzD;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,CAAC;QACP,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,CAAC;KAC9E;IACD;QACE,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,CAAC;QACP,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE,aAAa,CAAC;KAC3G;CACF,CAAC;AAiCF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAsB,CAAC;AAEnD,SAAS,iBAAiB,CAAC,SAAiB,EAAE,GAAW;IACvD,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC;IACjE,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAiB,EAAE,QAAmB,EAAE,GAAW;IAC5E,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO;IACrB,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,IAAI,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,iBAAiB;IAC/B,YAAY,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,6BAA6B,CAAC,SAAiB;IAC7D,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AACjC,CAAC;AAED,2DAA2D;AAE3D;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAiC;IACzE,MAAM,EACJ,kBAAkB,EAClB,eAAe,EACf,eAAe,GAAG,EAAE,EACpB,MAAM,GAAG,OAAO,GACjB,GAAG,MAAM,CAAC;IAEX,sDAAsD;IAEtD,KAAK,UAAU,eAAe,CAAC,SAAiB;QAC9C,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QAC7D,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACrD,iBAAiB,CAAC,SAAS,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;QACxD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,sDAAsD;IAEtD,KAAK,UAAU,iBAAiB,CAAC,SAAiB,EAAE,GAAa;QAC/D,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,0BAA0B,SAAS,iCAAiC,CAAC,CAAC;YAClF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,yDAAyD;aACnE,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sDAAsD;IAEtD,SAAS,cAAc,CAAC,OAAgB;QACtC,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;YAC/D,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACxF,CAAC;YAED,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;gBAAE,OAAO;YAEvD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChC,MAAM,CAAC,IAAI,CACT,0BAA0B,SAAS,sBAAsB,OAAO,iBAAiB,CAClF,CAAC;gBACF,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC1B,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,qDAAqD,OAAO,sCAAsC;iBAC5G,CAAC,CAAC;YACL,CAAC;YACD,IAAI,EAAE,CAAC;QACT,CAAC,CAAC;IACJ,CAAC;IAED,sDAAsD;IAEtD,SAAS,kBAAkB,CAAC,QAAmB;QAC7C,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;YAC/D,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACxF,CAAC;YAED,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;gBAAE,OAAO;YAEvD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;YACjD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CACT,0BAA0B,SAAS,sBAAsB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC9E,CAAC;gBACF,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC1B,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,2CAA2C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B;iBACpG,CAAC,CAAC;YACL,CAAC;YACD,IAAI,EAAE,CAAC;QACT,CAAC,CAAC;IACJ,CAAC;IAED,uDAAuD;IAEvD,SAAS,iBAAiB,CAAC,QAAmB;QAC5C,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;YAC/D,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACxF,CAAC;YAED,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;gBAAE,OAAO;YAEvD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC1B,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,8CAA8C,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B;iBACxG,CAAC,CAAC;YACL,CAAC;YACD,IAAI,EAAE,CAAC;QACT,CAAC,CAAC;IACJ,CAAC;IAED,sDAAsD;IAEtD,SAAS,mBAAmB;QAC1B,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;YAC/D,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACxF,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;gBAAE,OAAO;YACvD,IAAI,EAAE,CAAC;QACT,CAAC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,cAAc;QACd,kBAAkB;QAClB,iBAAiB;QACjB,mBAAmB;QACnB,eAAe;QACf,iBAAiB;QACjB,6BAA6B;KAC9B,CAAC;AACJ,CAAC;AAED,2DAA2D;AAE3D;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAU;IAC5C,OAAO,KAAK,EAAE,SAAiB,EAAsB,EAAE;QACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC;aAC/C,MAAM,CAAC,cAAc,CAAC;aACtB,KAAK,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,YAAuB,CAAC,CAAC;IACzD,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAU;IACjD,OAAO,KAAK,EAAE,SAAiB,EAAoB,EAAE;QACnD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC;aAChC,MAAM,CAAC,WAAW,CAAC;aACnB,KAAK,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;aACxB,KAAK,EAAE,CAAC;QACX,OAAO,GAAG,EAAE,SAAS,KAAK,IAAI,IAAI,GAAG,EAAE,SAAS,KAAK,CAAC,CAAC;IACzD,CAAC,CAAC;AACJ,CAAC;AAED,2DAA2D;AAE3D;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAgB,EAChB,QAA4B,aAAa;IAEzC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACpD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAU,EACV,SAAiB,EACjB,QAAgB,EAChB,QAA4B,aAAa;IAEzC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAElC,kCAAkC;IAClC,MAAM,IAAI,CAAC,yBAAyB,CAAC;SAClC,KAAK,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;SAChC,MAAM,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IAEhC,qBAAqB;IACrB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,yBAAyB,CAAC;aACnD,KAAK,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;aACvD,KAAK,EAAE,CAAC;QAEX,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,yBAAyB,CAAC;iBAClC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;iBAC1B,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,yBAAyB,CAAC,CAAC,MAAM,CAAC;gBAC3C,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACtB,UAAU,EAAE,SAAS;gBACrB,YAAY,EAAE,OAAO;gBACrB,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1B,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE;gBACzB,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE;aAC1B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,2DAA2D;AAE3D,SAAS,gBAAgB,CAAC,GAAY;IACpC,gFAAgF;IAChF,OAAO,CACJ,GAAG,CAAC,OAAO,CAAC,cAAc,CAAY;QACtC,GAAW,CAAC,IAAI,EAAE,UAAU;QAC5B,GAAW,CAAC,IAAI,EAAE,SAAS,CAC7B,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heavybit/pendoadmin-shared-lib",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Shared library for PendoAdmin microservices",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -40,7 +40,11 @@
     "./validation": "./dist/validation/index.js",
     "./logging": "./dist/logging/index.js",
     "./config": "./dist/config/index.js",
-    "./types": "./dist/types/index.js"
+    "./types": "./dist/types/index.js",
+    "./rate-limit": "./dist/rate-limit/index.js",
+    "./socket": "./dist/socket/index.js",
+    "./tenant": "./dist/tenant/index.js",
+    "./scheduling": "./dist/scheduling/index.js"
   },
   "typesVersions": {
     "*": {
@@ -52,7 +56,11 @@
       "validation": ["dist/validation/index.d.ts"],
       "logging": ["dist/logging/index.d.ts"],
       "config": ["dist/config/index.d.ts"],
-      "types": ["dist/types/index.d.ts"]
+      "types": ["dist/types/index.d.ts"],
+      "rate-limit": ["dist/rate-limit/index.d.ts"],
+      "socket": ["dist/socket/index.d.ts"],
+      "tenant": ["dist/tenant/index.d.ts"],
+      "scheduling": ["dist/scheduling/index.d.ts"]
     }
   },
   "dependencies": {
@@ -64,6 +72,7 @@
     "mysql2": "^3.11.0",
     "uuid": "^10.0.0",
     "winston": "^3.14.0",
+    "rate-limiter-flexible": "^5.0.0",
     "zod": "^3.23.0"
   },
   "devDependencies": {
@@ -76,15 +85,23 @@
     "@types/jsonwebtoken": "^9.0.7",
     "@types/node": "^20.14.0",
     "@types/uuid": "^10.0.0",
+    "@nestjs/websockets": "^11.0.0",
+    "drizzle-orm": "^0.30.0",
     "express": "^5.2.1",
+    "ioredis": "^5.4.0",
     "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.2",
+    "socket.io": "^4.7.0",
     "typescript": "^5.5.0"
   },
   "peerDependencies": {
     "@nestjs/common": ">=10.0.0",
     "@nestjs/core": ">=10.0.0",
-    "express": ">=4.0.0"
+    "@nestjs/websockets": ">=10.0.0",
+    "drizzle-orm": ">=0.30.0",
+    "express": ">=4.0.0",
+    "ioredis": ">=5.0.0",
+    "socket.io": ">=4.0.0"
   },
   "peerDependenciesMeta": {
     "@nestjs/common": {
@@ -93,8 +110,20 @@
     "@nestjs/core": {
       "optional": true
     },
+    "@nestjs/websockets": {
+      "optional": true
+    },
+    "drizzle-orm": {
+      "optional": true
+    },
     "express": {
       "optional": true
+    },
+    "ioredis": {
+      "optional": true
+    },
+    "socket.io": {
+      "optional": true
     }
   }
 }

package/src/index.ts

@@ -21,3 +21,9 @@ export * from './database/index.js';
 
 // Express middleware (for Express-based services)
 export * from './express/index.js';
+
+// Rate limiting
+export * from './rate-limit/index.js';
+
+// Scheduling
+export * from './scheduling/index.js';

package/src/rate-limit/create-rate-limiter.ts

@@ -0,0 +1,107 @@
+// pendoadmin-shared-lib/src/rate-limit/create-rate-limiter.ts
+//
+// Factory that creates a dual-layer (Redis + memory fallback) rate limiter.
+// Available for any Express-based service.
+
+import { Request, Response, NextFunction } from "express";
+import { RateLimiterRedis, RateLimiterMemory, RateLimiterAbstract } from "rate-limiter-flexible";
+import type Redis from "ioredis";
+
+// ─── Types ──────────────────────────────────────────────
+
+export interface RateLimitConfig {
+  /** Max requests per window (default: 100) */
+  maxRequests?: number;
+  /** Window duration in milliseconds (default: 60 000) */
+  windowMs?: number;
+  /** Redis key prefix — use unique per service to avoid collisions (default: "rl:service") */
+  keyPrefix?: string;
+  /** Optional Redis client — falls back to in-memory if omitted */
+  redisClient?: Redis | null;
+  /** Extract the rate-limit key from the request. Default: X-User-Id header → IP → "unknown" */
+  keyExtractor?: (req: Request) => string;
+}
+
+export interface RateLimitResult {
+  /** The rate-limiter instance (for advanced use) */
+  limiter: RateLimiterAbstract;
+  /** Express middleware */
+  middleware: (req: Request, res: Response, next: NextFunction) => Promise<void>;
+}
+
+// ─── Factory ────────────────────────────────────────────
+
+export function createRateLimiter(cfg: RateLimitConfig = {}): RateLimitResult {
+  const {
+    maxRequests = 100,
+    windowMs = 60_000,
+    keyPrefix = "rl:service",
+    redisClient = null,
+    keyExtractor = defaultKeyExtractor,
+  } = cfg;
+
+  const durationSecs = Math.max(1, Math.round(windowMs / 1000));
+
+  const memoryLimiter = new RateLimiterMemory({
+    keyPrefix,
+    points: maxRequests,
+    duration: durationSecs,
+  });
+
+  let limiter: RateLimiterAbstract;
+
+  if (redisClient) {
+    limiter = new RateLimiterRedis({
+      storeClient: redisClient,
+      keyPrefix,
+      points: maxRequests,
+      duration: durationSecs,
+      blockDuration: 0,
+      insuranceLimiter: memoryLimiter,
+    });
+  } else {
+    limiter = memoryLimiter;
+  }
+
+  // ─── Middleware ──────────────────────────────────────
+
+  async function middleware(
+    req: Request,
+    res: Response,
+    next: NextFunction,
+  ): Promise<void> {
+    try {
+      const key = keyExtractor(req);
+      const result = await limiter.consume(key);
+
+      res.setHeader("X-RateLimit-Limit", maxRequests);
+      res.setHeader("X-RateLimit-Remaining", result.remainingPoints);
+      res.setHeader(
+        "X-RateLimit-Reset",
+        new Date(Date.now() + result.msBeforeNext).toISOString(),
+      );
+      next();
+    } catch (rejRes: any) {
+      // Non-rate-limit errors should not block traffic
+      if (typeof rejRes?.msBeforeNext !== "number") {
+        console.error(`[RateLimit:${keyPrefix}] Unexpected error:`, rejRes?.message || rejRes);
+        return next();
+      }
+      res.setHeader("X-RateLimit-Limit", maxRequests);
+      res.setHeader("X-RateLimit-Remaining", 0);
+      res.setHeader("Retry-After", Math.ceil(rejRes.msBeforeNext / 1000));
+      res.status(429).json({
+        success: false,
+        message: "Too many requests. Please try again later.",
+      });
+    }
+  }
+
+  return { limiter, middleware };
+}
+
+// ─── Defaults ───────────────────────────────────────────
+
+function defaultKeyExtractor(req: Request): string {
+  return (req.headers["x-user-id"] as string) || req.ip || "unknown";
+}

package/src/rate-limit/index.ts

@@ -0,0 +1,2 @@
+export { createRateLimiter } from "./create-rate-limiter.js";
+export type { RateLimitConfig, RateLimitResult } from "./create-rate-limiter.js";