@neohm/nestend 1.0.2 → 2.0.0

package/README.md

@@ -81,24 +81,263 @@ app.useGlobalInterceptors(
 
 ## Feature Map
 
-| Area              | Key exports                                                                                             | Notes                                                                                                                                           |
-| ----------------- | ------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
-| Entities          | `RootEntity`, `CommonEntity`, `UserEntity`, `SystemRoleEntity`, ...                                     | uuid PK, soft deletes, `created_by`, jsonb `attributes`; entity-level `findOneOrNew`, `softDelete`, `hardDelete`, `restore`, `paginate` statics |
-| Migrations        | `CreateSysUsersTable...` (16 files), `MigrationUtility`, `SeederUtility`                                | fluent `this.string()`, `this.numeric()`, `addRecord()` seeding                                                                                 |
-| Queue             | `QueueModule`, `QueueService`, `CommonJob`                                                              | BullMQ; duplicate prevention, failed jobs persisted to `sys_failed_jobs`                                                                        |
-| Auth              | `AuthModule`, `AuthService`, `JwtAuthGuard`, `JwtRefreshGuard`, `@Public()`, `@CurrentUser()`           | access + rotating refresh tokens, Redis JTI blocklist                                                                                           |
-| API keys          | `ApiKeyService`, `ApiKeyGuard`, `@ApiKeyScopes()`                                                       | hashed keys in `sys_api_keys`, scopes, expiry/revocation, `x-api-key` header                                                                    |
-| Multi-tenancy     | `TenantModule`, `TenantEntity`, `TenantCommonEntity`, `TenantContextService`, `TenantContextMiddleware` | AsyncLocalStorage tenant context; resolve by header, slug, or domain                                                                            |
-| Notifications     | `NotificationModule`, `NotificationService`, `FcmPushNotificationService`                               | in-app rows + FCM push (optional `firebase-admin`); device token registry                                                                       |
-| Audit             | `AuditService`                                                                                          | `saveAuditLog(old, new)` with changed-value diffing into `sys_audit_logs`                                                                       |
-| Feature flags     | `FeatureFlagService`                                                                                    | on/off, percentage rollouts, allow lists — stored as `feature.*` system properties                                                              |
-| Cache             | `CacheService`                                                                                          | Redis, TTL objects (`{days, hours, min}`), transparent encryption                                                                               |
-| Encryption        | `EncryptionService`                                                                                     | AES-256-GCM, scrypt-derived keys                                                                                                                |
-| System properties | `SystemPropertyModule`, `SystemPropertyService`                                                         | cached + optionally encrypted key/value settings in `sys_properties`                                                                            |
-| Documents         | `DocumentModule`, `DocumentService`, `S3BucketDocumentService`, `MinioBucketDocumentService`            | `uploadDocument(multerFiles) → links[]`; driver chosen via `DOCUMENT_STORAGE_DRIVER`                                                            |
-| HTTP              | `CommonController`, `GlobalExceptionFilter`, common DTOs                                                | health endpoint base controller, uniform error envelope                                                                                         |
-| Observability     | `LoggingInterceptor`, `MonitoringInterceptor`, `MonitoringService`                                      | Sentry auto-registers when `@sentry/node` + `SENTRY_DSN` present; pluggable `MonitoringAdapter`                                                 |
-| Jobs/Events       | `CommonJob`, `CommonSubscriber`, `CommonDataProcessor`                                                  | dispatch/handle separation, column-change detection, field error collection                                                                     |
+| Area              | Key exports                                                                                                                                               | Notes                                                                                                                                                                                                                                    |
+| ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Entities          | `RootEntity`, `CommonEntity`, `UserEntity`, `SystemRoleEntity`, ...                                                                                       | uuid PK, soft deletes, `created_by`, jsonb `attributes`; entity-level `findOneOrNew`, `softDelete`, `hardDelete`, `restore`, `paginate` statics                                                                                          |
+| Migrations        | `CreateSysUsersTable...` (16 files), `MigrationUtility`, `SeederUtility`                                                                                  | fluent `this.string()`, `this.numeric()`, `addRecord()` seeding                                                                                                                                                                          |
+| Queue             | `QueueModule`, `QueueService`, `CommonJob`, `JobConsumer`                                                                                                 | BullMQ `@Processor`/`WorkerHost` consumer; auto-discovered jobs, duplicate prevention, recurring schedulers, 1-day TTL, retries, failures persisted to `sys_failed_jobs`                                                                 |
+| Scheduled events  | `SystemScheduledTaskEntity`, `ScheduledEventEntity`, `SetScheduledEventJob`, `DispatchScheduledEventJob`                                                  | schedule definitions in `sys_scheduled_tasks` → events in `sys_scheduled_events`; worker-driven materialisation + dispatch via `SCHEDULED_EVENT_*` env                                                                                   |
+| Auth              | `AuthModule`, `AuthService.validateAccess()`, `AuthContextService`, `AuthContextMiddleware`                                                               | imperative auth (open by default); bearer token via AsyncLocalStorage → user + roles; access + rotating refresh tokens, Redis JTI blocklist                                                                                              |
+| API keys          | `ApiKeyService`, `ApiKeyGuard`, `@ApiKeyScopes()`                                                                                                         | hashed keys in `sys_api_keys`, scopes, expiry/revocation, `x-api-key` header                                                                                                                                                             |
+| Multi-tenancy     | `TenantModule`, `TenantEntity`, `TenantCommonEntity`, `TenantContextService`, `TenantContextMiddleware`                                                   | AsyncLocalStorage tenant context; resolve by header, slug, or domain                                                                                                                                                                     |
+| Admin             | `AdminModule`, `AdminAccessService`, `TenantDataProcessor`, `ClientUserDataProcessor`, `BulkUserDataProcessor`, `AdminUserDataProcessor`, list processors | back-office APIs: tenant onboarding, client/admin user registration (single + bulk), tenant + scheduled-task listing; 4-tier `GlobalAdminRoles` gate; `UserType` discriminator on `sys_users`; Swagger at `/docs` (hidden in production) |
+| Notifications     | `NotificationModule`, `NotificationService`, `FcmPushNotificationService`                                                                                 | in-app rows + FCM push (optional `firebase-admin`); device token registry                                                                                                                                                                |
+| Audit             | `AuditService`                                                                                                                                            | `saveAuditLog(old, new)` with changed-value diffing into `sys_audit_logs`                                                                                                                                                                |
+| Feature flags     | `FeatureFlagService`                                                                                                                                      | on/off, percentage rollouts, allow lists — stored as `feature.*` system properties                                                                                                                                                       |
+| Cache             | `CacheService`                                                                                                                                            | Redis, TTL objects (`{days, hours, min}`), transparent encryption                                                                                                                                                                        |
+| Encryption        | `EncryptionService`                                                                                                                                       | AES-256-GCM, scrypt-derived keys                                                                                                                                                                                                         |
+| System properties | `SystemPropertyModule`, `SystemPropertyService`                                                                                                           | cached + optionally encrypted key/value settings in `sys_properties`                                                                                                                                                                     |
+| Documents         | `DocumentModule`, `DocumentService`, `S3BucketDocumentService`, `MinioBucketDocumentService`                                                              | `uploadDocument(multerFiles) → links[]`; driver chosen via `DOCUMENT_STORAGE_DRIVER`                                                                                                                                                     |
+| HTTP              | `CommonController`, `GlobalExceptionFilter`, common DTOs                                                                                                  | health endpoint base controller, uniform error envelope                                                                                                                                                                                  |
+| Observability     | `LoggingInterceptor`, `MonitoringInterceptor`, `MonitoringService`                                                                                        | Sentry auto-registers when `@sentry/node` + `SENTRY_DSN` present; pluggable `MonitoringAdapter`                                                                                                                                          |
+| Jobs/Events       | `CommonJob`, `JobConsumer`, `CommonSubscriber`, `CommonDataProcessor`                                                                                     | dispatch/handle separation, discovery-based registration, worker-event lifecycle, column-change detection, field error collection                                                                                                        |
+
+## Environment Variables
+
+Copy [`.env.example`](./.env.example) into your project. Every variable is optional
+unless marked **required**.
+
+### Application
+
+| Variable     | Default       | Description                                                                                                                                          |
+| ------------ | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `SERVER_ENV` | `development` | Runtime environment (`development` / `staging` / `production` / `test`). Swagger docs at `/docs` are mounted in every value **except** `production`. |
+| `PORT`       | `8000`        | HTTP port the server listens on                                                                                                                      |
+
+### Database (PostgreSQL)
+
+| Variable      | Default     | Description       |
+| ------------- | ----------- | ----------------- |
+| `DB_HOST`     | `localhost` | Postgres host     |
+| `DB_PORT`     | `5432`      | Postgres port     |
+| `DB_USERNAME` | `postgres`  | Postgres user     |
+| `DB_PASSWORD` | `postgres`  | Postgres password |
+| `DB_NAME`     | `myapp_db`  | Database name     |
+
+### JWT / Auth
+
+| Variable               | Default | Description                                                   |
+| ---------------------- | ------- | ------------------------------------------------------------- |
+| `ACCESS_TOKEN_SECRET`  | —       | **Required.** Secret for signing access tokens. Min 32 chars  |
+| `REFRESH_TOKEN_SECRET` | —       | **Required.** Secret for signing refresh tokens. Min 32 chars |
+| `ACCESS_TOKEN_EXPIRY`  | `1h`    | Access token lifetime (`60s`, `15m`, `1h`, `7d`, …)           |
+| `REFRESH_TOKEN_EXPIRY` | `30d`   | Refresh token lifetime                                        |
+
+#### Authentication (imperative)
+
+Controllers are **open by default**; you authenticate explicitly inside the
+handler with `AuthService.validateAccess()`. It reads the bearer token from the
+request (held in `AsyncLocalStorage` by `AuthContextMiddleware`), verifies it,
+rejects revoked tokens, and returns the user row with its roles — throwing
+`AccessException` (403) when missing/invalid. This keeps authorization next to
+your business logic, so layering tenant/plan/role checks is just more code.
+
+`AuthController` (mounted at `/auth`) exposes the ready-made flows: `POST
+/auth/login`, `/auth/register`, `/auth/refresh`, `/auth/logout`,
+`/auth/change-password`, and `GET /auth/me`. Passwords are hashed/verified via
+`AuthUtility` (bcrypt); the write flows use the processor lifecycle.
+
+```ts
+@Controller('reports')
+export class ReportController {
+  constructor(private readonly authService: AuthService) {}
+
+  @Get()
+  async list() {
+    const { user, roles } = await this.authService.validateAccess();
+    // ...custom checks: roles, tenant membership, subscription, ownership
+  }
+}
+```
+
+Wire the middleware once in your app so the token is captured per request
+(mirrors `TenantContextMiddleware`):
+
+```ts
+export class AppModule implements NestModule {
+  configure(consumer: MiddlewareConsumer) {
+    consumer.apply(AuthContextMiddleware).forRoutes('*'); // Express 5: e.g. '{*splat}'
+  }
+}
+```
+
+`validateAccess()` reads the token via `AuthContextService` (no request-scoped
+providers). The Passport `JwtStrategy`/`JwtAuthGuard` remain available if you
+prefer guard-based protection on specific routes, but they're no longer the
+default path.
+
+### Encryption
+
+| Variable            | Default | Description                                                                           |
+| ------------------- | ------- | ------------------------------------------------------------------------------------- |
+| `ENCRYPTION_SECRET` | —       | **Required** when `EncryptionService` is used. AES-256-GCM key material. Min 32 chars |
+
+### Cache (Redis)
+
+| Variable               | Default     | Description                               |
+| ---------------------- | ----------- | ----------------------------------------- |
+| `CACHE_REDIS_HOST`     | `localhost` | Redis host for `CacheService`             |
+| `CACHE_REDIS_PORT`     | `6379`      | Redis port                                |
+| `CACHE_REDIS_PASSWORD` | _(empty)_   | Redis password                            |
+| `CACHE_REDIS_DB`       | `1`         | Redis DB index (keep separate from queue) |
+
+### Queue (BullMQ / Redis)
+
+| Variable               | Default       | Description                                                                                         |
+| ---------------------- | ------------- | --------------------------------------------------------------------------------------------------- |
+| `BULL_REDIS_HOST`      | `localhost`   | Redis host for BullMQ                                                                               |
+| `BULL_REDIS_PORT`      | `6379`        | Redis port                                                                                          |
+| `BULL_REDIS_PASSWORD`  | _(empty)_     | Redis password                                                                                      |
+| `BULL_REDIS_DB`        | `0`           | Redis DB index                                                                                      |
+| `BULL_QUEUE_NAME`      | `myapp-queue` | Name of the BullMQ queue                                                                            |
+| `BULL_WORKERS`         | `2`           | Concurrent worker threads per process                                                               |
+| `BULL_QUEUE_WORKER`    | `false`       | Set `true` on consumer instances only — API servers should leave this `false`                       |
+| `BULL_JOB_TTL_SECONDS` | `86400`       | Retention (seconds) for completed/failed jobs before removal from the queue + Redis (default 1 day) |
+| `MAX_JOB_RETRIES`      | `3`           | Max attempts per job (BullMQ `attempts` default) and the scheduled-event retry ceiling              |
+| `SCHEDULED_EVENT_HOUR` | `1`           | Hour component of the `SetScheduledEventJob` cadence                                                |
+| `SCHEDULED_EVENT_MIN`  | `0`           | Minute component of the cadence                                                                     |
+| `SCHEDULED_EVENT_SEC`  | `0`           | Second component of the cadence (all three are summed; all-zero disables it)                        |
+
+#### Jobs
+
+A job pairs a **dispatch** side (enqueue work) with a **handle** side (process it).
+Extend `CommonJob`, add it to your module's providers, and inject `QueueService`:
+
+```ts
+@Injectable()
+export class WelcomeEmailJob extends CommonJob {
+  constructor(protected readonly queueService: QueueService) {
+    super('welcome.email.job'); // unique identifier
+  }
+  async handle(data: { userId: string }): Promise<void> {
+    // ...send the email
+  }
+}
+
+// elsewhere: await welcomeEmailJob.dispatch({ userId });
+```
+
+`CommonJob` has **no `onModuleInit`**. At boot `QueueService` uses Nest's
+`DiscoveryService` to find every `CommonJob` provider and register its handler
+by identifier — so simply providing the job is enough; nothing self-registers.
+
+For database-event jobs (dispatched by a `CommonSubscriber`), `CommonJob`
+exposes `isNewRecord(event)`, `isColumnUpdated(event, col)` and
+`isAnyColumnUpdated(event, cols)` — usable directly inside `handle()` (they work
+on the plain event object after the queue round-trip).
+
+**Consumer / worker.** A single `JobConsumer` (a BullMQ `@Processor` /
+`WorkerHost`) is the only worker. On instances where `BULL_QUEUE_WORKER=true` it
+processes every job — routing each to the handler registered under
+`job.data.job` — tracks queue stats via worker lifecycle events
+(`active`/`completed`/`failed`), and persists _final_ failures (after
+`MAX_JOB_RETRIES` attempts) to `sys_failed_jobs`. API instances leave
+`BULL_QUEUE_WORKER=false` so no worker spawns; they can still `dispatch()`.
+
+#### Scheduled events
+
+Recurring work is event-driven (off the BullMQ worker), not a reconciliation
+loop. Two tables back it:
+
+| Table                  | Entity                      | Role                                                                                                                                   |
+| ---------------------- | --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
+| `sys_scheduled_tasks`  | `SystemScheduledTaskEntity` | a schedule definition (`identifier`, `name`, `start_from`, `schedule_interval`, `enabled`, `next_upsert_at`)                           |
+| `sys_scheduled_events` | `ScheduledEventEntity`      | one row per fire time (`job_id` → task, `scheduled_at`, `started_at`, `failed_at`, `total_attempts`, `active`); one task → many events |
+
+When the worker emits `ready`, `JobConsumer` enrols `SetScheduledEventJob` as a
+recurring scheduler whose cadence comes from `SCHEDULED_EVENT_{HOUR,MIN,SEC}`
+(summed to an interval; all-zero disables it). BullMQ keys the scheduler on the
+job identifier, so re-running on each boot **upserts** rather than duplicates.
+
+Each tick, `SetScheduledEventJob.handle()` materialises due
+`sys_scheduled_events` rows from enabled `sys_scheduled_tasks` (using
+`ScheduleUtility.addInterval`) and triggers `DispatchScheduledEventJob`, which
+enqueues each due event's job (bounded by `MAX_JOB_RETRIES`).
+`SystemScheduledTaskJob` (via `SystemScheduledTaskSubscriber`) keeps events in
+step with task changes — toggling `active` when a task is enabled/disabled and
+soft-deleting events when a task is removed.
+
+When a `ScheduledEventEntity` row is written, `ScheduledEventSubscriber` fires
+`ScheduledEventJob` with the database event — wire your per-event dispatch logic
+into that job's `handle()`.
+
+### Document Storage
+
+| Variable                                | Default | Description                                |
+| --------------------------------------- | ------- | ------------------------------------------ |
+| `DOCUMENT_STORAGE_DRIVER`               | `minio` | Active driver: `s3` or `minio`             |
+| `DOCUMENT_PRESIGNED_URL_EXPIRY_SECONDS` | `3600`  | Presigned download URL validity in seconds |
+
+**S3 driver** (`DOCUMENT_STORAGE_DRIVER=s3`):
+
+| Variable                  | Default     | Description                                                     |
+| ------------------------- | ----------- | --------------------------------------------------------------- |
+| `AWS_S3_BUCKET`           | —           | **Required.** S3 bucket name                                    |
+| `AWS_S3_REGION`           | `us-east-1` | AWS region                                                      |
+| `AWS_ACCESS_KEY_ID`       | —           | AWS access key (falls back to instance profile / env chain)     |
+| `AWS_SECRET_ACCESS_KEY`   | —           | AWS secret key                                                  |
+| `AWS_S3_ENDPOINT`         | _(empty)_   | Custom endpoint for S3-compatible providers                     |
+| `AWS_S3_PUBLIC_URL`       | _(empty)_   | CDN base URL for public files                                   |
+| `AWS_S3_FORCE_PATH_STYLE` | `false`     | Force path-style URLs (required by some S3-compatible services) |
+
+**MinIO driver** (`DOCUMENT_STORAGE_DRIVER=minio`):
+
+| Variable           | Default      | Description                                 |
+| ------------------ | ------------ | ------------------------------------------- |
+| `MINIO_ENDPOINT`   | `localhost`  | MinIO host                                  |
+| `MINIO_PORT`       | `9000`       | MinIO port                                  |
+| `MINIO_USE_SSL`    | `false`      | Enable TLS                                  |
+| `MINIO_ACCESS_KEY` | `minioadmin` | MinIO access key                            |
+| `MINIO_SECRET_KEY` | `minioadmin` | MinIO secret key                            |
+| `MINIO_BUCKET`     | `documents`  | Bucket name (auto-created if missing)       |
+| `MINIO_PUBLIC_URL` | _(empty)_    | CDN base URL when MinIO sits behind a proxy |
+
+### HTTP Logging
+
+| Variable          | Default | Description                                                                 |
+| ----------------- | ------- | --------------------------------------------------------------------------- |
+| `HTTP_LOG_FORMAT` | `dev`   | Morgan log format: `dev` (compact) or `combined` (includes IP + user agent) |
+
+### Monitoring
+
+| Variable                     | Default   | Description                                                                            |
+| ---------------------------- | --------- | -------------------------------------------------------------------------------------- |
+| `SENTRY_DSN`                 | _(empty)_ | Sentry DSN — Sentry is only activated when this is set and `@sentry/node` is installed |
+| `SENTRY_TRACES_SAMPLE_RATE`  | `0`       | Sentry performance traces sample rate (0–1)                                            |
+| `MONITORING_SLOW_REQUEST_MS` | `3000`    | Requests slower than this (ms) are flagged as warnings                                 |
+
+### Multi-tenancy
+
+| Variable             | Default       | Description                                     |
+| -------------------- | ------------- | ----------------------------------------------- |
+| `TENANT_HEADER_NAME` | `x-tenant-id` | Request header carrying the tenant UUID or slug |
+
+### API Keys
+
+| Variable              | Default     | Description                         |
+| --------------------- | ----------- | ----------------------------------- |
+| `API_KEY_HEADER_NAME` | `x-api-key` | Request header carrying the API key |
+
+### Push Notifications (FCM)
+
+Requires the optional peer dependency `firebase-admin`. Provide **one** of:
+
+| Variable                     | Default   | Description                                                                   |
+| ---------------------------- | --------- | ----------------------------------------------------------------------------- |
+| `FCM_SERVICE_ACCOUNT_PATH`   | _(empty)_ | Absolute path to the Firebase service account JSON file                       |
+| `FCM_SERVICE_ACCOUNT_BASE64` | _(empty)_ | Base64-encoded service account JSON (preferred for containerised deployments) |
+
+---
 
 ## Document Uploads in 10 Lines
 
@@ -120,6 +359,65 @@ async upload(@UploadedFiles() files: Express.Multer.File[], @CurrentUser() user:
 Set `DOCUMENT_STORAGE_DRIVER=minio` for a local MinIO bucket (auto-created) or
 `DOCUMENT_STORAGE_DRIVER=s3` for Amazon S3. Switching drivers requires no code change.
 
+## Admin Module
+
+`AdminModule` is the back-office surface — tenant onboarding, client/admin user
+registration, tenant listing and scheduled-task management. It uses the same
+imperative auth model as the rest of the app: controllers are open by default and
+gate each action through `AdminAccessService` before handing the work to a
+processor.
+
+### Roles
+
+Global roles (`GlobalAdminRoles`) are ordered by seniority — a senior role
+satisfies any junior requirement:
+
+| Role (`sys_roles.name`)  | Capability                                           |
+| ------------------------ | ---------------------------------------------------- |
+| `global.super.admin`     | View/change/delete everything, including tenant info |
+| `global.admin`           | Tenant listing and admin-user management             |
+| `global.content.manager` | View/change/edit everything except tenant info       |
+| `global.content.reader`  | Read-only access to non-tenant content               |
+
+`AdminAccessService` exposes `validateSuperAdmin()`, `validateAdmin()`,
+`validateContentManager()` and `validateContentReader()`. Each authenticates the
+caller and returns `{ user, roles }` so the controller can pass the actor to a
+processor.
+
+### Endpoints
+
+| Route                            | Min. role       | Processor                    |
+| -------------------------------- | --------------- | ---------------------------- |
+| `POST /admin/tenants`            | super admin     | `TenantDataProcessor`        |
+| `GET /admin/tenants`             | admin           | `TenantListProcessor`        |
+| `POST /admin/users/clients`      | super admin     | `ClientUserDataProcessor`    |
+| `POST /admin/users/clients/bulk` | super admin     | `BulkUserDataProcessor`      |
+| `POST /admin/users/admins`       | admin           | `AdminUserDataProcessor`     |
+| `POST /admin/scheduled-tasks`    | content manager | `ScheduledTaskDataProcessor` |
+| `GET /admin/scheduled-tasks`     | content reader  | `ScheduledTaskListProcessor` |
+
+### Flow
+
+```ts
+@Post()
+async onboard(@Body() dto: AddTenantDto) {
+  const { user } = await this.adminAccessService.validateSuperAdmin();
+  return new TenantDataProcessor(user).process(dto);
+}
+```
+
+Data processors extend `CommonDataProcessor` and are created per request
+(`new XxxDataProcessor(actor, ...deps).process(dto)`); list processors return a
+`PaginatedResult`. Bulk registration validates the entire batch before any insert.
+Admins and client users share `sys_users`, distinguished by the `UserType` enum on
+`user_type` (`system.user` vs `tenant.user`).
+
+### API docs (Swagger)
+
+Interactive docs are served at `GET /docs` (JSON at `/docs-json`) in every
+environment **except production** — `main.ts` only mounts Swagger when
+`SERVER_ENV !== 'production'`, so the schema is never exposed in prod.
+
 ## License
 
 MIT

package/dist/admin/admin.module.d.ts

@@ -0,0 +1,8 @@
+import { DynamicModule } from '@nestjs/common';
+export interface AdminModuleOptions {
+    dataSourceName?: string;
+}
+export declare class AdminModule {
+    static register(options?: AdminModuleOptions): DynamicModule;
+}
+//# sourceMappingURL=admin.module.d.ts.map

package/dist/admin/admin.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.module.d.ts","sourceRoot":"","sources":["../../src/admin/admin.module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAU,MAAM,gBAAgB,CAAC;AAOvD,MAAM,WAAW,kBAAkB;IACjC,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAWD,qBAMa,WAAW;IACtB,MAAM,CAAC,QAAQ,CAAC,OAAO,GAAE,kBAAuB,GAAG,aAAa;CASjE"}

package/dist/admin/admin.module.js

@@ -0,0 +1,36 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var AdminModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AdminModule = void 0;
+const common_1 = require("@nestjs/common");
+const auth_module_1 = require("../auth/auth.module");
+const tenant_module_1 = require("../tenant/tenant.module");
+const es6_classes_1 = require("./es6.classes");
+const [AdminAccessService] = es6_classes_1.es6Classes.services;
+let AdminModule = AdminModule_1 = class AdminModule {
+    static register(options = {}) {
+        return {
+            module: AdminModule_1,
+            imports: [auth_module_1.AuthModule.register(options), tenant_module_1.TenantModule.register(options)],
+            controllers: [...es6_classes_1.es6Classes.controllers],
+            providers: [...es6_classes_1.es6Classes.services],
+            exports: [...es6_classes_1.es6Classes.services],
+        };
+    }
+};
+exports.AdminModule = AdminModule;
+exports.AdminModule = AdminModule = AdminModule_1 = __decorate([
+    (0, common_1.Module)({
+        imports: [auth_module_1.AuthModule, tenant_module_1.TenantModule],
+        controllers: [...es6_classes_1.es6Classes.controllers],
+        providers: [...es6_classes_1.es6Classes.services],
+        exports: [...es6_classes_1.es6Classes.services],
+    })
+], AdminModule);
+//# sourceMappingURL=admin.module.js.map

package/dist/admin/admin.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.module.js","sourceRoot":"","sources":["../../src/admin/admin.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAAuD;AACvD,qDAAiD;AACjD,2DAAuD;AACvD,+CAA2C;AAE3C,MAAM,CAAC,kBAAkB,CAAC,GAAG,wBAAU,CAAC,QAAQ,CAAC;AAqB1C,IAAM,WAAW,mBAAjB,MAAM,WAAW;IACtB,MAAM,CAAC,QAAQ,CAAC,UAA8B,EAAE;QAC9C,OAAO;YACL,MAAM,EAAE,aAAW;YACnB,OAAO,EAAE,CAAC,wBAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,4BAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACvE,WAAW,EAAE,CAAC,GAAG,wBAAU,CAAC,WAAW,CAAC;YACxC,SAAS,EAAE,CAAC,GAAG,wBAAU,CAAC,QAAQ,CAAC;YACnC,OAAO,EAAE,CAAC,GAAG,wBAAU,CAAC,QAAQ,CAAC;SAClC,CAAC;IACJ,CAAC;CACF,CAAA;AAVY,kCAAW;sBAAX,WAAW;IANvB,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,wBAAU,EAAE,4BAAY,CAAC;QACnC,WAAW,EAAE,CAAC,GAAG,wBAAU,CAAC,WAAW,CAAC;QACxC,SAAS,EAAE,CAAC,GAAG,wBAAU,CAAC,QAAQ,CAAC;QACnC,OAAO,EAAE,CAAC,GAAG,wBAAU,CAAC,QAAQ,CAAC;KAClC,CAAC;GACW,WAAW,CAUvB"}

package/dist/admin/controllers/admin.scheduled.task.controller.d.ts

@@ -0,0 +1,18 @@
+import { SqlService } from '../../common/services/sql.service';
+import { AdminAccessService } from '../services/admin.access.service';
+import { AddScheduledTaskDto } from '../dtos/add.scheduled.task.dto';
+import { ScheduledTaskListDto } from '../dtos/scheduled.task.list.dto';
+export declare class AdminScheduledTaskController {
+    private readonly adminAccessService;
+    private readonly sqlService;
+    constructor(adminAccessService: AdminAccessService, sqlService: SqlService);
+    add(dto: AddScheduledTaskDto): Promise<import("../..").SystemScheduledTaskEntity>;
+    list(dto: ScheduledTaskListDto): Promise<{
+        records: import("../..").SqlRow[];
+        total: number;
+        page: number;
+        limit: number;
+        total_pages: number;
+    }>;
+}
+//# sourceMappingURL=admin.scheduled.task.controller.d.ts.map

package/dist/admin/controllers/admin.scheduled.task.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.scheduled.task.controller.d.ts","sourceRoot":"","sources":["../../../src/admin/controllers/admin.scheduled.task.controller.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAGtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAEvE,qBAGa,4BAA4B;IAErC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU;gBADV,kBAAkB,EAAE,kBAAkB,EACtC,UAAU,EAAE,UAAU;IAQnC,GAAG,CAAS,GAAG,EAAE,mBAAmB;IAUpC,IAAI,CAAS,GAAG,EAAE,oBAAoB;;;;;;;CAI7C"}

package/dist/admin/controllers/admin.scheduled.task.controller.js

@@ -0,0 +1,68 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AdminScheduledTaskController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const sql_service_1 = require("../../common/services/sql.service");
+const admin_access_service_1 = require("../services/admin.access.service");
+const scheduled_task_data_processor_1 = require("../libraries/scheduled.task.data.processor");
+const scheduled_task_list_processor_1 = require("../libraries/scheduled.task.list.processor");
+const add_scheduled_task_dto_1 = require("../dtos/add.scheduled.task.dto");
+const scheduled_task_list_dto_1 = require("../dtos/scheduled.task.list.dto");
+let AdminScheduledTaskController = class AdminScheduledTaskController {
+    constructor(adminAccessService, sqlService) {
+        this.adminAccessService = adminAccessService;
+        this.sqlService = sqlService;
+    }
+    async add(dto) {
+        const { user } = await this.adminAccessService.validateContentManager();
+        return new scheduled_task_data_processor_1.ScheduledTaskDataProcessor(user).process(dto);
+    }
+    async list(dto) {
+        await this.adminAccessService.validateContentReader();
+        return new scheduled_task_list_processor_1.ScheduledTaskListProcessor(this.sqlService).process(dto);
+    }
+};
+exports.AdminScheduledTaskController = AdminScheduledTaskController;
+__decorate([
+    (0, common_1.Post)(),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Add a scheduled task.',
+        description: 'Requires at least the global content manager role.',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [add_scheduled_task_dto_1.AddScheduledTaskDto]),
+    __metadata("design:returntype", Promise)
+], AdminScheduledTaskController.prototype, "add", null);
+__decorate([
+    (0, common_1.Post)('list'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'List, search and filter scheduled tasks.',
+        description: 'Requires at least the global content reader role.',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [scheduled_task_list_dto_1.ScheduledTaskListDto]),
+    __metadata("design:returntype", Promise)
+], AdminScheduledTaskController.prototype, "list", null);
+exports.AdminScheduledTaskController = AdminScheduledTaskController = __decorate([
+    (0, swagger_1.ApiTags)('Admin - Scheduled Tasks'),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.Controller)('admin/scheduled-tasks'),
+    __metadata("design:paramtypes", [admin_access_service_1.AdminAccessService,
+        sql_service_1.SqlService])
+], AdminScheduledTaskController);
+//# sourceMappingURL=admin.scheduled.task.controller.js.map

package/dist/admin/controllers/admin.scheduled.task.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.scheduled.task.controller.js","sourceRoot":"","sources":["../../../src/admin/controllers/admin.scheduled.task.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAwD;AACxD,6CAAuE;AACvE,mEAA+D;AAC/D,2EAAsE;AACtE,8FAAwF;AACxF,8FAAwF;AACxF,2EAAqE;AACrE,6EAAuE;AAKhE,IAAM,4BAA4B,GAAlC,MAAM,4BAA4B;IACvC,YACmB,kBAAsC,EACtC,UAAsB;QADtB,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,eAAU,GAAV,UAAU,CAAY;IACtC,CAAC;IAOE,AAAN,KAAK,CAAC,GAAG,CAAS,GAAwB;QACxC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,EAAE,CAAC;QACxE,OAAO,IAAI,0DAA0B,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3D,CAAC;IAOK,AAAN,KAAK,CAAC,IAAI,CAAS,GAAyB;QAC1C,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACtD,OAAO,IAAI,0DAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtE,CAAC;CACF,CAAA;AAzBY,oEAA4B;AAWjC;IALL,IAAA,aAAI,GAAE;IACN,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,uBAAuB;QAChC,WAAW,EAAE,oDAAoD;KAClE,CAAC;IACS,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,4CAAmB;;uDAGzC;AAOK;IALL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0CAA0C;QACnD,WAAW,EAAE,mDAAmD;KACjE,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,8CAAoB;;wDAG3C;uCAxBU,4BAA4B;IAHxC,IAAA,iBAAO,EAAC,yBAAyB,CAAC;IAClC,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,uBAAuB,CAAC;qCAGK,yCAAkB;QAC1B,wBAAU;GAH9B,4BAA4B,CAyBxC"}

package/dist/admin/controllers/admin.tenant.controller.d.ts

@@ -0,0 +1,18 @@
+import { SqlService } from '../../common/services/sql.service';
+import { AdminAccessService } from '../services/admin.access.service';
+import { AddTenantDto } from '../dtos/add.tenant.dto';
+import { TenantListDto } from '../dtos/tenant.list.dto';
+export declare class AdminTenantController {
+    private readonly adminAccessService;
+    private readonly sqlService;
+    constructor(adminAccessService: AdminAccessService, sqlService: SqlService);
+    onboard(dto: AddTenantDto): Promise<import("../..").TenantEntity>;
+    list(dto: TenantListDto): Promise<{
+        records: import("../..").SqlRow[];
+        total: number;
+        page: number;
+        limit: number;
+        total_pages: number;
+    }>;
+}
+//# sourceMappingURL=admin.tenant.controller.d.ts.map

package/dist/admin/controllers/admin.tenant.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.tenant.controller.d.ts","sourceRoot":"","sources":["../../../src/admin/controllers/admin.tenant.controller.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAGtE,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,qBAGa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU;gBADV,kBAAkB,EAAE,kBAAkB,EACtC,UAAU,EAAE,UAAU;IAQnC,OAAO,CAAS,GAAG,EAAE,YAAY;IAUjC,IAAI,CAAS,GAAG,EAAE,aAAa;;;;;;;CAItC"}

package/dist/admin/controllers/admin.tenant.controller.js

@@ -0,0 +1,68 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AdminTenantController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const sql_service_1 = require("../../common/services/sql.service");
+const admin_access_service_1 = require("../services/admin.access.service");
+const tenant_data_processor_1 = require("../libraries/tenant.data.processor");
+const tenant_list_processor_1 = require("../libraries/tenant.list.processor");
+const add_tenant_dto_1 = require("../dtos/add.tenant.dto");
+const tenant_list_dto_1 = require("../dtos/tenant.list.dto");
+let AdminTenantController = class AdminTenantController {
+    constructor(adminAccessService, sqlService) {
+        this.adminAccessService = adminAccessService;
+        this.sqlService = sqlService;
+    }
+    async onboard(dto) {
+        const { user } = await this.adminAccessService.validateSuperAdmin();
+        return new tenant_data_processor_1.TenantDataProcessor(user).process(dto);
+    }
+    async list(dto) {
+        await this.adminAccessService.validateAdmin();
+        return new tenant_list_processor_1.TenantListProcessor(this.sqlService).process(dto);
+    }
+};
+exports.AdminTenantController = AdminTenantController;
+__decorate([
+    (0, common_1.Post)(),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Onboard (register) a new client tenant.',
+        description: 'Requires the global super admin role.',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [add_tenant_dto_1.AddTenantDto]),
+    __metadata("design:returntype", Promise)
+], AdminTenantController.prototype, "onboard", null);
+__decorate([
+    (0, common_1.Post)('list'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'List, search and filter tenants.',
+        description: 'Requires at least the global admin role.',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [tenant_list_dto_1.TenantListDto]),
+    __metadata("design:returntype", Promise)
+], AdminTenantController.prototype, "list", null);
+exports.AdminTenantController = AdminTenantController = __decorate([
+    (0, swagger_1.ApiTags)('Admin - Tenants'),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.Controller)('admin/tenants'),
+    __metadata("design:paramtypes", [admin_access_service_1.AdminAccessService,
+        sql_service_1.SqlService])
+], AdminTenantController);
+//# sourceMappingURL=admin.tenant.controller.js.map

package/dist/admin/controllers/admin.tenant.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.tenant.controller.js","sourceRoot":"","sources":["../../../src/admin/controllers/admin.tenant.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAwD;AACxD,6CAAuE;AACvE,mEAA+D;AAC/D,2EAAsE;AACtE,8EAAyE;AACzE,8EAAyE;AACzE,2DAAsD;AACtD,6DAAwD;AAKjD,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAChC,YACmB,kBAAsC,EACtC,UAAsB;QADtB,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,eAAU,GAAV,UAAU,CAAY;IACtC,CAAC;IAOE,AAAN,KAAK,CAAC,OAAO,CAAS,GAAiB;QACrC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,CAAC;QACpE,OAAO,IAAI,2CAAmB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpD,CAAC;IAOK,AAAN,KAAK,CAAC,IAAI,CAAS,GAAkB;QACnC,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC9C,OAAO,IAAI,2CAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/D,CAAC;CACF,CAAA;AAzBY,sDAAqB;AAW1B;IALL,IAAA,aAAI,GAAE;IACN,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,yCAAyC;QAClD,WAAW,EAAE,uCAAuC;KACrD,CAAC;IACa,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,6BAAY;;oDAGtC;AAOK;IALL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EAAE,0CAA0C;KACxD,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,+BAAa;;iDAGpC;gCAxBU,qBAAqB;IAHjC,IAAA,iBAAO,EAAC,iBAAiB,CAAC;IAC1B,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,eAAe,CAAC;qCAGa,yCAAkB;QAC1B,wBAAU;GAH9B,qBAAqB,CAyBjC"}

package/dist/admin/controllers/admin.user.controller.d.ts

@@ -0,0 +1,14 @@
+import { TenantService } from '../../tenant/services/tenant.service';
+import { AdminAccessService } from '../services/admin.access.service';
+import { AddClientUserDto } from '../dtos/add.client.user.dto';
+import { AddBulkUsersDto } from '../dtos/add.bulk.users.dto';
+import { AddAdminUserDto } from '../dtos/add.admin.user.dto';
+export declare class AdminUserController {
+    private readonly adminAccessService;
+    private readonly tenantService;
+    constructor(adminAccessService: AdminAccessService, tenantService: TenantService);
+    addClientUser(dto: AddClientUserDto): Promise<import("../..").UserEntity>;
+    addClientUsersBulk(dto: AddBulkUsersDto): Promise<import("../libraries/bulk.user.data.processor").BulkUserResult>;
+    addAdminUser(dto: AddAdminUserDto): Promise<import("../..").UserEntity>;
+}
+//# sourceMappingURL=admin.user.controller.d.ts.map