@lenne.tech/nest-server 11.25.6 → 11.26.0

package/src/core/modules/ai/tools/ai-tool.base.ts

@@ -0,0 +1,46 @@
+import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
+
+import { RoleEnum } from '../../../common/enums/role.enum';
+import { AiToolContext, AiToolResult, IAiTool } from '../interfaces/ai-tool.interface';
+import { AiToolRegistry } from './ai-tool.registry';
+
+/**
+ * Convenience base class for AI tools.
+ *
+ * Extending {@link AiTool} gives a tool automatic self-registration in the
+ * {@link AiToolRegistry} on module init — so a project only needs to declare the
+ * class as a provider in its module. Implement {@link name}, {@link description},
+ * {@link parameters}, {@link roles} and {@link execute}.
+ *
+ * @example
+ * ```typescript
+ * @Injectable()
+ * export class FindUsersAiTool extends AiTool {
+ *   readonly name = 'find_users';
+ *   readonly description = 'Search users by email or name.';
+ *   readonly parameters = { properties: { query: { type: 'string' } }, type: 'object' };
+ *   readonly roles = [RoleEnum.ADMIN];
+ *   constructor(registry: AiToolRegistry, private readonly userService: UserService) { super(registry); }
+ *   async execute(args, context) {
+ *     return this.userService.find({ filterQuery: { ... } }, context.serviceOptions);
+ *   }
+ * }
+ * ```
+ */
+@Injectable()
+export abstract class AiTool implements IAiTool, OnModuleInit {
+  protected readonly logger = new Logger(this.constructor.name);
+
+  abstract readonly description: string;
+  abstract readonly name: string;
+  abstract readonly parameters: Record<string, any>;
+  abstract readonly roles: (RoleEnum | string)[];
+
+  protected constructor(protected readonly registry: AiToolRegistry) {}
+
+  onModuleInit(): void {
+    this.registry.register(this);
+  }
+
+  abstract execute(args: Record<string, any>, context: AiToolContext): Promise<AiToolResult | unknown>;
+}

package/src/core/modules/ai/tools/ai-tool.registry.ts

@@ -0,0 +1,124 @@
+import { Injectable, Logger } from '@nestjs/common';
+
+import { RoleEnum } from '../../../common/enums/role.enum';
+import { IAiTool } from '../interfaces/ai-tool.interface';
+
+/**
+ * Minimal shape of the current user needed for tool-visibility checks.
+ */
+export interface AiToolUser {
+  [key: string]: any;
+  emailVerified?: boolean;
+  id?: string;
+  roles?: string[];
+  verified?: boolean;
+  verifiedAt?: Date | string;
+}
+
+/**
+ * Central registry of all AI tools — the single source of truth that feeds both
+ * the internal agent loop ({@link CoreAiService}) and any external MCP server.
+ *
+ * The registry is a global singleton service: tools self-register (typically
+ * from `onModuleInit`), so projects can add or override tools from ANY module
+ * without running into NestJS DI-scope limitations. Registering a tool whose
+ * name already exists overrides the previous one (last write wins) — this is the
+ * supported override mechanism for projects customizing core tools.
+ */
+@Injectable()
+export class AiToolRegistry {
+  private readonly logger = new Logger(AiToolRegistry.name);
+  private readonly tools = new Map<string, IAiTool>();
+
+  /**
+   * Register (or override) a tool by its name.
+   */
+  register(tool: IAiTool): void {
+    if (this.tools.has(tool.name)) {
+      this.logger.warn(`AI tool "${tool.name}" is being overridden.`);
+    }
+    this.tools.set(tool.name, tool);
+    this.logger.debug(`Registered AI tool: ${tool.name}`);
+  }
+
+  /**
+   * Remove a tool from the registry.
+   */
+  unregister(name: string): void {
+    this.tools.delete(name);
+  }
+
+  /**
+   * Get a tool by name.
+   */
+  get(name: string): IAiTool | undefined {
+    return this.tools.get(name);
+  }
+
+  /**
+   * All registered tools (unfiltered).
+   */
+  all(): IAiTool[] {
+    return [...this.tools.values()];
+  }
+
+  /**
+   * Tools the given user is allowed to see and use.
+   *
+   * This is a first-line visibility filter (defense in depth) — the authoritative
+   * authorization happens when a tool's `execute()` routes through a CrudService
+   * with the user's serviceOptions.
+   */
+  forUser(user: AiToolUser | null | undefined): IAiTool[] {
+    return this.all().filter((tool) => this.userCanAccess(tool, user));
+  }
+
+  /**
+   * Whether a user satisfies a tool's role requirements.
+   */
+  userCanAccess(tool: IAiTool, user: AiToolUser | null | undefined): boolean {
+    const roles = tool.roles ?? [];
+
+    // Locked tools are never accessible.
+    if (roles.includes(RoleEnum.S_NO_ONE)) {
+      return false;
+    }
+
+    // Public tools are always accessible.
+    if (roles.includes(RoleEnum.S_EVERYONE)) {
+      return true;
+    }
+
+    // Everything below requires an authenticated user.
+    if (!user?.id) {
+      return false;
+    }
+
+    // Admin bypass.
+    if (user.roles?.includes(RoleEnum.ADMIN)) {
+      return true;
+    }
+
+    // Any authenticated user.
+    if (roles.includes(RoleEnum.S_USER)) {
+      return true;
+    }
+
+    // Verified users.
+    if (roles.includes(RoleEnum.S_VERIFIED) && (user.verified || user.verifiedAt || user.emailVerified)) {
+      return true;
+    }
+
+    // Real roles: user must hold at least one of the required roles.
+    const systemRoles: string[] = [
+      RoleEnum.S_CREATOR,
+      RoleEnum.S_EVERYONE,
+      RoleEnum.S_NO_ONE,
+      RoleEnum.S_SELF,
+      RoleEnum.S_USER,
+      RoleEnum.S_VERIFIED,
+    ];
+    const requiredRealRoles = roles.filter((r) => !systemRoles.includes(r));
+    return requiredRealRoles.some((r) => user.roles?.includes(r));
+  }
+}

package/src/core/modules/ai/tools/ask-user-question.tool.ts

@@ -0,0 +1,76 @@
+import { Injectable } from '@nestjs/common';
+
+import { RoleEnum } from '../../../common/enums/role.enum';
+import { AiToolContext, AiToolResult } from '../interfaces/ai-tool.interface';
+import { AiTool } from './ai-tool.base';
+import { AiToolRegistry } from './ai-tool.registry';
+
+/**
+ * Sentinel marker the orchestrator detects to short-circuit the loop with a
+ * `pendingQuestion`. Tools never set this directly — only this built-in does.
+ */
+export const ASK_USER_QUESTION_SENTINEL = Symbol.for('@lenne.tech/nest-server/ai/ask-user-question');
+
+/**
+ * Built-in tool the model can call to pause the run and ask the end user for a
+ * clarification (e.g. "did you mean A, B or C?") instead of guessing — important
+ * because our target users are NOT prompt experts: a focused question often beats
+ * a wrong action. The tool does not perform an action; the orchestrator detects the
+ * sentinel return shape, breaks the loop, and surfaces the question on `CoreAiResponse.pendingQuestion`.
+ *
+ * After answering, the client sends the user's answer as the next prompt — no
+ * special "answer" field is needed; the conversation continues naturally.
+ *
+ * Roles: `S_USER` (anyone can be asked). Not `mutating`/`destructive` (it is a
+ * read-only interaction surface).
+ */
+@Injectable()
+export class AskUserQuestionAiTool extends AiTool {
+  readonly description =
+    'Ask the end user a clarifying question before acting. Use ONLY when you genuinely cannot proceed without more information from the user; otherwise prefer using a tool to find the answer.';
+  readonly name = 'ask_user_question';
+  readonly parameters = {
+    properties: {
+      options: {
+        description: 'Optional list of suggested answers ({label, value}) for a multiple-choice question.',
+        items: {
+          properties: {
+            label: { type: 'string' },
+            value: { type: 'string' },
+          },
+          required: ['label', 'value'],
+          type: 'object',
+        },
+        type: 'array',
+      },
+      question: { description: 'The clarifying question to ask the user, in their language.', type: 'string' },
+    },
+    required: ['question'],
+    type: 'object',
+  };
+  readonly roles = [RoleEnum.S_USER];
+
+  // Re-declares the constructor publicly so NestJS DI can instantiate this provider
+  // (AiTool's constructor is `protected`).
+  // eslint-disable-next-line no-useless-constructor
+  constructor(registry: AiToolRegistry) {
+    super(registry);
+  }
+
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
+  async execute(args: Record<string, any>, _context: AiToolContext): Promise<AiToolResult> {
+    const question = typeof args?.question === 'string' ? args.question.trim() : '';
+    if (!question) {
+      return { message: 'question is required.', success: false };
+    }
+    const options = Array.isArray(args?.options)
+      ? args.options
+          .filter((o: any) => o && typeof o.value === 'string' && typeof o.label === 'string')
+          .map((o: any) => ({ label: o.label, value: o.value }))
+      : undefined;
+    return {
+      data: { [ASK_USER_QUESTION_SENTINEL as unknown as string]: true, options, question },
+      success: true,
+    };
+  }
+}

package/src/core/modules/ai/tools/search-tools.tool.ts

@@ -0,0 +1,70 @@
+import { Injectable } from '@nestjs/common';
+
+import { RoleEnum } from '../../../common/enums/role.enum';
+import { AiToolContext, AiToolResult } from '../interfaces/ai-tool.interface';
+import { AiTool } from './ai-tool.base';
+import { AiToolRegistry } from './ai-tool.registry';
+
+/**
+ * Built-in **meta-tool** for the "deferred tool-schemas" mode
+ * (`ai.deferToolSchemas: true`): the system prompt then contains only the tool
+ * NAMES + short descriptions, not the full JSON-Schemas — which can drastically
+ * cut the context cost when many tools are registered. The LLM uses this tool to
+ * fetch the parameter schema for a specific tool BEFORE calling it.
+ *
+ * The result respects the caller's role visibility — only tools the user can use
+ * are returned (defense in depth on top of the orchestrator's role filter).
+ */
+@Injectable()
+export class SearchToolsAiTool extends AiTool {
+  readonly description =
+    'Search the available backend tools and fetch the parameter schema of a specific tool. Use this before calling a tool whose parameter schema you have not yet seen.';
+  readonly name = 'search_tools';
+  readonly parameters = {
+    properties: {
+      name: { description: 'The exact tool name to fetch the full schema for.', type: 'string' },
+      query: {
+        description: 'Optional substring matched against tool name and description (returns a short list).',
+        type: 'string',
+      },
+    },
+    type: 'object',
+  };
+  readonly roles = [RoleEnum.S_USER];
+
+  // Re-declares the constructor publicly so NestJS DI can instantiate this provider
+  // (AiTool's constructor is `protected`).
+  // eslint-disable-next-line no-useless-constructor
+  constructor(registry: AiToolRegistry) {
+    super(registry);
+  }
+
+  async execute(args: Record<string, any>, context: AiToolContext): Promise<AiToolResult> {
+    const allowed = this.registry.forUser(context.currentUser);
+    const query = typeof args?.query === 'string' ? args.query.trim().toLowerCase() : '';
+    const name = typeof args?.name === 'string' ? args.name.trim() : '';
+    if (name) {
+      const tool = allowed.find((t) => t.name === name);
+      if (!tool) {
+        return { message: `Tool "${name}" is not available to you.`, success: false };
+      }
+      return {
+        data: {
+          description: tool.description,
+          mutating: !!tool.mutating,
+          destructive: !!tool.destructive,
+          name: tool.name,
+          parameters: tool.parameters,
+        },
+        success: true,
+      };
+    }
+    const matches = query
+      ? allowed.filter((t) => t.name.toLowerCase().includes(query) || t.description.toLowerCase().includes(query))
+      : allowed;
+    return {
+      data: matches.map((t) => ({ description: t.description, name: t.name })),
+      success: true,
+    };
+  }
+}

package/src/core/modules/error-code/error-codes.ts

@@ -21,6 +21,7 @@
  * - LTNS_0300-LTNS_0399: Validation errors
  * - LTNS_0400-LTNS_0499: Resource errors
  * - LTNS_0500-LTNS_0599: File errors
+ * - LTNS_0600-LTNS_0699: AI errors
  * - LTNS_0900-LTNS_0999: Internal errors
  *
  * @example
@@ -493,6 +494,91 @@ export const LtnsErrors = {
       en: 'System setup requires BetterAuth.',
     },
   },
+
+  // =====================================================
+  // AI Errors (LTNS_0600-LTNS_0699)
+  // =====================================================
+
+  AI_NO_CONNECTION: {
+    code: 'LTNS_0600',
+    message: 'No usable AI connection configured',
+    translations: {
+      de: 'Es ist keine nutzbare KI-Verbindung konfiguriert.',
+      en: 'No usable AI connection is configured.',
+    },
+  },
+
+  AI_CONNECTION_DISABLED: {
+    code: 'LTNS_0601',
+    message: 'AI connection is disabled',
+    translations: {
+      de: 'Die KI-Verbindung ist deaktiviert.',
+      en: 'The AI connection is disabled.',
+    },
+  },
+
+  AI_CONNECTION_NOT_AVAILABLE: {
+    code: 'LTNS_0602',
+    message: 'The selected AI connection is not available',
+    translations: {
+      de: 'Die ausgewählte KI-Verbindung ist nicht verfügbar.',
+      en: 'The selected AI connection is not available.',
+    },
+  },
+
+  AI_CONNECTION_NOT_FOUND: {
+    code: 'LTNS_0603',
+    message: 'AI connection does not exist or is not usable',
+    translations: {
+      de: 'Die KI-Verbindung existiert nicht oder ist nicht nutzbar.',
+      en: 'The AI connection does not exist or is not usable.',
+    },
+  },
+
+  AI_PREFERENCES_UNAVAILABLE: {
+    code: 'LTNS_0604',
+    message: 'AI connection preferences are not available',
+    translations: {
+      de: 'KI-Verbindungseinstellungen sind nicht verfügbar.',
+      en: 'AI connection preferences are not available.',
+    },
+  },
+
+  AI_BUDGET_EXCEEDED: {
+    code: 'LTNS_0605',
+    message: 'AI token budget for this period is exhausted',
+    translations: {
+      de: 'Dein KI-Token-Kontingent für diesen Zeitraum ist aufgebraucht. Bitte versuche es nach dem nächsten Reset erneut.',
+      en: 'Your AI token budget for this period is exhausted. Please try again after the next reset.',
+    },
+  },
+
+  AI_RATE_LIMITED: {
+    code: 'LTNS_0606',
+    message: 'Too many AI requests',
+    translations: {
+      de: 'Zu viele KI-Anfragen. Bitte etwas langsamer.',
+      en: 'Too many AI requests, please slow down.',
+    },
+  },
+
+  AI_PROVIDER_ERROR: {
+    code: 'LTNS_0607',
+    message: 'The AI provider request failed',
+    translations: {
+      de: 'Die Anfrage an den KI-Anbieter ist fehlgeschlagen.',
+      en: 'The AI provider request failed.',
+    },
+  },
+
+  AI_CONNECTION_INVALID_URL: {
+    code: 'LTNS_0608',
+    message: 'AI connection has no valid base URL',
+    translations: {
+      de: 'Die KI-Verbindung hat keine gültige Basis-URL.',
+      en: 'The AI connection has no valid base URL.',
+    },
+  },
 } as const satisfies IErrorRegistry;
 
 // =====================================================

package/src/core.module.ts

@@ -37,6 +37,7 @@ import { EmailService } from './core/common/services/email.service';
 import { MailjetService } from './core/common/services/mailjet.service';
 import { ModelDocService } from './core/common/services/model-doc.service';
 import { TemplateService } from './core/common/services/template.service';
+import { CoreAiModule } from './core/modules/ai/core-ai.module';
 import { CoreBetterAuthUserMapper } from './core/modules/better-auth/core-better-auth-user.mapper';
 import { CoreBetterAuthModule } from './core/modules/better-auth/core-better-auth.module';
 import { CoreBetterAuthService } from './core/modules/better-auth/core-better-auth.service';
@@ -443,6 +444,17 @@ export class CoreModule implements NestModule {
       imports.push(CoreSystemSetupModule);
     }
 
+    // Add CoreAiModule when an `ai` config block is present (presence implies enabled)
+    const aiConfig = config.ai;
+    const isAiEnabled =
+      aiConfig === true || (typeof aiConfig === 'object' && aiConfig !== null && aiConfig.enabled !== false);
+    if (isAiEnabled) {
+      const aiObj = typeof aiConfig === 'object' && aiConfig !== null ? aiConfig : undefined;
+      const mcpEnabled =
+        aiObj?.mcp === true || (typeof aiObj?.mcp === 'object' && aiObj.mcp !== null && aiObj.mcp.enabled !== false);
+      imports.push(CoreAiModule.forRoot({ ...overrides?.ai, mcpEnabled }));
+    }
+
     // Add CoreTenantModule when multiTenancy is configured (presence implies enabled)
     if (config.multiTenancy && config.multiTenancy.enabled !== false) {
       // Auto-add TenantMember to excludeSchemas (membership is tenant-spanning)

package/src/index.ts

@@ -140,6 +140,12 @@ export * from './core/modules/auth/strategies/jwt-refresh.strategy';
 export * from './core/modules/auth/strategies/jwt.strategy';
 export * from './core/modules/auth/tokens.decorator';
 
+// =====================================================================================================================
+// Core - Modules - AI
+// =====================================================================================================================
+
+export * from './core/modules/ai';
+
 // =====================================================================================================================
 // Core - Modules - BetterAuth
 // =====================================================================================================================

package/src/server/modules/ai/ai-tools.module.ts

@@ -0,0 +1,33 @@
+import { Module } from '@nestjs/common';
+
+import { ClaudeCliProvider } from '../../../core/modules/ai/providers/claude-cli.provider';
+import { LlmProviderFactory } from '../../../core/modules/ai/providers/llm-provider.factory';
+import { UserModule } from '../user/user.module';
+import { DeleteUserAiTool } from './tools/delete-user.tool';
+import { FindUsersAiTool } from './tools/find-users.tool';
+import { GetUserAiTool } from './tools/get-user.tool';
+import { UpdateUserJobTitleAiTool } from './tools/update-user-job-title.tool';
+
+/**
+ * Registers the example AI tools.
+ *
+ * Each tool extends `AiTool` and self-registers in the global `AiToolRegistry`
+ * on module init. The registry is provided globally by `CoreAiModule` (auto-
+ * registered by `CoreModule` when an `ai` config block is present), so no extra
+ * import is needed for it here — only `UserModule` for `UserService`.
+ *
+ * This is the reference implementation showing how a project adds (or overrides)
+ * AI tools from its own module. It also demonstrates the opt-in registration of
+ * the Claude Code CLI provider on the global {@link LlmProviderFactory}, so a
+ * connection with `providerType: 'claude-cli'` can be used.
+ */
+@Module({
+  imports: [UserModule],
+  providers: [DeleteUserAiTool, FindUsersAiTool, GetUserAiTool, UpdateUserJobTitleAiTool],
+})
+export class AiToolsModule {
+  constructor(protected readonly providerFactory: LlmProviderFactory) {
+    // Opt-in: enable connections with providerType 'claude-cli' (Claude Code CLI backend).
+    this.providerFactory.registerBuilder('claude-cli', (connection) => new ClaudeCliProvider(connection));
+  }
+}

package/src/server/modules/ai/tools/delete-user.tool.ts

@@ -0,0 +1,44 @@
+import { Injectable } from '@nestjs/common';
+
+import { AiToolContext } from '../../../../core/modules/ai/interfaces/ai-tool.interface';
+import { AiTool } from '../../../../core/modules/ai/tools/ai-tool.base';
+import { AiToolRegistry } from '../../../../core/modules/ai/tools/ai-tool.registry';
+import { RoleEnum } from '../../../../core/common/enums/role.enum';
+import { UserService } from '../../user/user.service';
+
+/**
+ * Example destructive AI tool: delete a user (admin only).
+ *
+ * Marked `destructive: true`, so the orchestrator returns a `requiresConfirmation`
+ * response listing this action instead of executing it — the prompt must be
+ * re-sent with `confirm: true` to actually delete.
+ */
+@Injectable()
+export class DeleteUserAiTool extends AiTool {
+  readonly description = 'Delete a user identified by id. Destructive — requires confirmation. Admin only.';
+  readonly destructive = true;
+  readonly name = 'delete_user';
+  readonly parameters = {
+    properties: {
+      id: { description: 'The user id', type: 'string' },
+    },
+    required: ['id'],
+    type: 'object',
+  };
+  readonly roles = [RoleEnum.ADMIN];
+
+  constructor(
+    registry: AiToolRegistry,
+    private readonly userService: UserService,
+  ) {
+    super(registry);
+  }
+
+  async execute(args: Record<string, any>, context: AiToolContext) {
+    const deleted = await this.userService.delete(String(args.id), {
+      ...context.serviceOptions,
+      roles: [RoleEnum.ADMIN],
+    });
+    return { data: { id: deleted?.id }, message: 'User deleted', success: true };
+  }
+}

package/src/server/modules/ai/tools/find-users.tool.ts

@@ -0,0 +1,49 @@
+import { Injectable } from '@nestjs/common';
+
+import { AiToolContext } from '../../../../core/modules/ai/interfaces/ai-tool.interface';
+import { AiTool } from '../../../../core/modules/ai/tools/ai-tool.base';
+import { AiToolRegistry } from '../../../../core/modules/ai/tools/ai-tool.registry';
+import { RoleEnum } from '../../../../core/common/enums/role.enum';
+import { UserService } from '../../user/user.service';
+
+/**
+ * Example AI tool: search users (admin only).
+ *
+ * Demonstrates the secure pattern: the tool routes through `UserService.find`
+ * with the caller's `serviceOptions`, so `@Restricted` field filtering and
+ * `securityCheck()` still apply — the LLM never receives data the user may not see.
+ */
+@Injectable()
+export class FindUsersAiTool extends AiTool {
+  readonly description =
+    'Search users by email or username and return the matches. Use for questions like ' +
+    '"how many users are there", "find the user with email X" or "list recent users". Admin only.';
+  readonly name = 'find_users';
+  readonly parameters = {
+    properties: {
+      limit: { description: 'Maximum number of results (default 20, max 100)', type: 'number' },
+      search: { description: 'Search term matched against email and username', type: 'string' },
+    },
+    type: 'object',
+  };
+  readonly roles = [RoleEnum.ADMIN];
+
+  constructor(
+    registry: AiToolRegistry,
+    private readonly userService: UserService,
+  ) {
+    super(registry);
+  }
+
+  async execute(args: Record<string, any>, context: AiToolContext) {
+    const search = typeof args.search === 'string' ? args.search.trim() : '';
+    const limit = Math.min(Math.max(Number(args.limit) || 20, 1), 100);
+    const escaped = search.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const filterQuery = search
+      ? { $or: [{ email: { $options: 'i', $regex: escaped } }, { username: { $options: 'i', $regex: escaped } }] }
+      : {};
+
+    const users = await this.userService.find({ filterQuery, queryOptions: { limit } }, context.serviceOptions);
+    return { data: users, message: `Found ${users.length} user(s)`, success: true };
+  }
+}

package/src/server/modules/ai/tools/get-user.tool.ts

@@ -0,0 +1,43 @@
+import { Injectable } from '@nestjs/common';
+
+import { AiToolContext } from '../../../../core/modules/ai/interfaces/ai-tool.interface';
+import { AiTool } from '../../../../core/modules/ai/tools/ai-tool.base';
+import { AiToolRegistry } from '../../../../core/modules/ai/tools/ai-tool.registry';
+import { RoleEnum } from '../../../../core/common/enums/role.enum';
+import { UserService } from '../../user/user.service';
+
+/**
+ * Example AI tool: get a single user by id (any authenticated user).
+ *
+ * Authorization is enforced by passing `roles: [ADMIN, S_CREATOR, S_SELF]` to the
+ * service — regular users only get their own record, admins get any.
+ */
+@Injectable()
+export class GetUserAiTool extends AiTool {
+  readonly description =
+    'Get a single user by id. Regular users can only access their own data; admins can access any user.';
+  readonly name = 'get_user';
+  readonly parameters = {
+    properties: {
+      id: { description: 'The user id', type: 'string' },
+    },
+    required: ['id'],
+    type: 'object',
+  };
+  readonly roles = [RoleEnum.S_USER];
+
+  constructor(
+    registry: AiToolRegistry,
+    private readonly userService: UserService,
+  ) {
+    super(registry);
+  }
+
+  async execute(args: Record<string, any>, context: AiToolContext) {
+    const user = await this.userService.get(String(args.id), {
+      ...context.serviceOptions,
+      roles: [RoleEnum.ADMIN, RoleEnum.S_CREATOR, RoleEnum.S_SELF],
+    });
+    return { data: user, success: true };
+  }
+}