@neohm/nestend 4.1.1 → 5.0.0

package/dist/auth/utilities/duration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"duration.js","sourceRoot":"","sources":["../../../src/auth/utilities/duration.ts"],"names":[],"mappings":";;;AAAA,MAAM,OAAO,GAA2B;IACtC,EAAE,EAAE,CAAC;IACL,IAAI,EAAE,CAAC;IACP,KAAK,EAAE,CAAC;IACR,WAAW,EAAE,CAAC;IACd,YAAY,EAAE,CAAC;IACf,CAAC,EAAE,IAAI;IACP,GAAG,EAAE,IAAI;IACT,IAAI,EAAE,IAAI;IACV,MAAM,EAAE,IAAI;IACZ,OAAO,EAAE,IAAI;IACb,CAAC,EAAE,MAAM;IACT,GAAG,EAAE,MAAM;IACX,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,MAAM;IACd,OAAO,EAAE,MAAM;IACf,CAAC,EAAE,SAAS;IACZ,EAAE,EAAE,SAAS;IACb,GAAG,EAAE,SAAS;IACd,IAAI,EAAE,SAAS;IACf,KAAK,EAAE,SAAS;IAChB,CAAC,EAAE,UAAU;IACb,GAAG,EAAE,UAAU;IACf,IAAI,EAAE,UAAU;IAChB,CAAC,EAAE,WAAW;IACd,IAAI,EAAE,WAAW;IACjB,KAAK,EAAE,WAAW;CACnB,CAAC;AAEF,MAAM,OAAO,GAAG,qCAAqC,CAAC;AAStD,MAAa,QAAQ;IACnB,MAAM,CAAC,IAAI,CAAC,KAAsB;QAChC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAC3B,OAAO,QAAQ,CAAC,QAAQ,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,CAAC,CAAC;QAEhD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEnE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3C,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,KAAK,CAAC,0BAA0B,KAAK,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC,CAAC;QAEvE,OAAO,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IACzE,CAAC;IAGD,MAAM,CAAC,SAAS,CAAC,KAAsB;QACrC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;IAChD,CAAC;IAEO,MAAM,CAAC,QAAQ,CAAC,EAAU,EAAE,GAAoB;QACtD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,EAAE,CAAC;IACZ,CAAC;CACF;AA1BD,4BA0BC"}

package/dist/auth/utilities/request.credentials.d.ts

@@ -0,0 +1,8 @@
+import type { Request } from 'express';
+import type { TokenIssueContext } from '../types/auth.types';
+export declare class RequestCredentials {
+    static bearerToken(request: Request): string | undefined;
+    static apiKey(request: Request, headerName: string): string | null;
+    static issueContext(request: Request): TokenIssueContext;
+}
+//# sourceMappingURL=request.credentials.d.ts.map

package/dist/auth/utilities/request.credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.credentials.d.ts","sourceRoot":"","sources":["../../../src/auth/utilities/request.credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAG7D,qBAAa,kBAAkB;IAE7B,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS;IASxD,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAYlE,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,iBAAiB;CAOzD"}

package/dist/auth/utilities/request.credentials.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RequestCredentials = void 0;
+class RequestCredentials {
+    static bearerToken(request) {
+        const header = request.headers.authorization;
+        if (typeof header !== 'string')
+            return undefined;
+        const [scheme, value] = header.trim().split(/\s+/);
+        if (scheme?.toLowerCase() !== 'bearer' || !value)
+            return undefined;
+        return value;
+    }
+    static apiKey(request, headerName) {
+        const headerKey = request.headers[headerName.toLowerCase()];
+        const fromHeader = Array.isArray(headerKey) ? headerKey[0] : headerKey;
+        if (fromHeader)
+            return fromHeader.trim();
+        const authorization = request.headers.authorization;
+        if (authorization?.toLowerCase().startsWith('apikey '))
+            return authorization.slice('apikey '.length).trim() || null;
+        return null;
+    }
+    static issueContext(request) {
+        const userAgent = request.headers['user-agent'];
+        return {
+            ip_address: request.ip,
+            ...(userAgent ? { user_agent: userAgent.slice(0, 1000) } : {}),
+        };
+    }
+}
+exports.RequestCredentials = RequestCredentials;
+//# sourceMappingURL=request.credentials.js.map

package/dist/auth/utilities/request.credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.credentials.js","sourceRoot":"","sources":["../../../src/auth/utilities/request.credentials.ts"],"names":[],"mappings":";;;AAIA,MAAa,kBAAkB;IAE7B,MAAM,CAAC,WAAW,CAAC,OAAgB;QACjC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACjD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,MAAM,EAAE,WAAW,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QACnE,OAAO,KAAK,CAAC;IACf,CAAC;IAGD,MAAM,CAAC,MAAM,CAAC,OAAgB,EAAE,UAAkB;QAChD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC,IAAI,EAAE,CAAC;QAEzC,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACpD,IAAI,aAAa,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YACpD,OAAO,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IAGD,MAAM,CAAC,YAAY,CAAC,OAAgB;QAClC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAChD,OAAO;YACL,UAAU,EAAE,OAAO,CAAC,EAAE;YACtB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC;IACJ,CAAC;CACF;AA9BD,gDA8BC"}

package/dist/auth/utilities/scope.cascade.d.ts

@@ -0,0 +1,12 @@
+import { EntityManager } from 'typeorm';
+import { ScopeEntity } from '../entities/scope.entity';
+import { KeyScopeGrant } from '../types/api.key.types';
+export declare class ScopeCascade {
+    static staleGrantIds(keyGrants: KeyScopeGrant[], effective: Pick<ScopeEntity, 'id' | 'identifier'>[]): string[];
+    static expand(manager: EntityManager, granted: ScopeEntity[]): Promise<ScopeEntity[]>;
+    static tenantEffective(manager: EntityManager, tenantId: string): Promise<ScopeEntity[]>;
+    static pruneTenantKeys(manager: EntityManager, tenantId: string, revokedBy?: string): Promise<number>;
+    static setTenantScopes(manager: EntityManager, tenantId: string, scopeIds: string[], actorId?: string): Promise<void>;
+    static retire(manager: EntityManager, grantIds: string[], revokedBy?: string): Promise<number>;
+}
+//# sourceMappingURL=scope.cascade.d.ts.map

package/dist/auth/utilities/scope.cascade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.cascade.d.ts","sourceRoot":"","sources":["../../../src/auth/utilities/scope.cascade.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAM,MAAM,SAAS,CAAC;AAG5C,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGvD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAMvD,qBAAa,YAAY;IAKvB,MAAM,CAAC,aAAa,CAClB,SAAS,EAAE,aAAa,EAAE,EAC1B,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,YAAY,CAAC,EAAE,GAClD,MAAM,EAAE;WAcE,MAAM,CACjB,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,WAAW,EAAE,GACrB,OAAO,CAAC,WAAW,EAAE,CAAC;WAgBZ,eAAe,CAC1B,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,WAAW,EAAE,CAAC;WAiBZ,eAAe,CAC1B,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;WAkBL,eAAe,CAC1B,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAAE,EAClB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;WAyCH,MAAM,CACjB,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,MAAM,EAAE,EAClB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;CAWnB"}

package/dist/auth/utilities/scope.cascade.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScopeCascade = void 0;
+const typeorm_1 = require("typeorm");
+const not_found_exception_1 = require("../../global/exceptions/not.found.exception");
+const api_scope_entity_1 = require("../entities/api.scope.entity");
+const scope_entity_1 = require("../entities/scope.entity");
+const tenant_scope_entity_1 = require("../entities/tenant.scope.entity");
+const api_key_default_enum_1 = require("../enums/api.key.default.enum");
+class ScopeCascade {
+    static staleGrantIds(keyGrants, effective) {
+        if (effective.some((scope) => scope.identifier === String(api_key_default_enum_1.ApiKeyDefault.WILDCARD_SCOPE)))
+            return [];
+        const allowed = new Set(effective.map((scope) => scope.id));
+        return keyGrants
+            .filter((grant) => !allowed.has(grant.scope_id))
+            .map((grant) => grant.id);
+    }
+    static async expand(manager, granted) {
+        if (!granted.length)
+            return [];
+        const parentIds = granted
+            .filter((scope) => !scope.parent_id)
+            .map((scope) => scope.id);
+        const children = parentIds.length
+            ? await manager.find(scope_entity_1.ScopeEntity, { where: { parent_id: (0, typeorm_1.In)(parentIds) } })
+            : [];
+        return [
+            ...new Map([...granted, ...children].map((scope) => [scope.id, scope])).values(),
+        ];
+    }
+    static async tenantEffective(manager, tenantId) {
+        const grants = await manager.find(tenant_scope_entity_1.TenantScopeEntity, {
+            where: { tenant_id: tenantId },
+            relations: { scope: true },
+        });
+        return ScopeCascade.expand(manager, grants
+            .map((grant) => grant.scope)
+            .filter((scope) => !!scope));
+    }
+    static async pruneTenantKeys(manager, tenantId, revokedBy) {
+        const keyGrants = await manager.find(api_scope_entity_1.ApiScopeEntity, {
+            where: { apiKey: { tenant_id: tenantId } },
+            select: { id: true, scope_id: true },
+        });
+        if (!keyGrants.length)
+            return 0;
+        const stale = ScopeCascade.staleGrantIds(keyGrants, await ScopeCascade.tenantEffective(manager, tenantId));
+        return ScopeCascade.retire(manager, stale, revokedBy);
+    }
+    static async setTenantScopes(manager, tenantId, scopeIds, actorId) {
+        await manager.query('select pg_advisory_xact_lock(hashtext($1))', [
+            `tenant-scopes:${tenantId}`,
+        ]);
+        const wanted = new Set(scopeIds);
+        if (wanted.size) {
+            const found = await manager.countBy(scope_entity_1.ScopeEntity, { id: (0, typeorm_1.In)([...wanted]) });
+            if (found !== wanted.size)
+                throw new not_found_exception_1.NotFoundException('One or more scopes do not exist');
+        }
+        const existing = await manager.findBy(tenant_scope_entity_1.TenantScopeEntity, {
+            tenant_id: tenantId,
+        });
+        const held = new Set(existing.map((grant) => grant.scope_id));
+        const removed = existing.filter((grant) => !wanted.has(grant.scope_id));
+        if (removed.length)
+            await manager.softDelete(tenant_scope_entity_1.TenantScopeEntity, {
+                id: (0, typeorm_1.In)(removed.map((grant) => grant.id)),
+            });
+        const added = [...wanted].filter((scopeId) => !held.has(scopeId));
+        if (added.length)
+            await manager.save(added.map((scope_id) => manager.create(tenant_scope_entity_1.TenantScopeEntity, {
+                tenant_id: tenantId,
+                scope_id,
+                ...(actorId ? { created_by: actorId } : {}),
+            })));
+        if (removed.length)
+            await ScopeCascade.pruneTenantKeys(manager, tenantId, actorId);
+    }
+    static async retire(manager, grantIds, revokedBy) {
+        if (!grantIds.length)
+            return 0;
+        if (revokedBy)
+            await manager.update(api_scope_entity_1.ApiScopeEntity, { id: (0, typeorm_1.In)(grantIds) }, { revoked_by: revokedBy });
+        await manager.softDelete(api_scope_entity_1.ApiScopeEntity, { id: (0, typeorm_1.In)(grantIds) });
+        return grantIds.length;
+    }
+}
+exports.ScopeCascade = ScopeCascade;
+//# sourceMappingURL=scope.cascade.js.map

package/dist/auth/utilities/scope.cascade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.cascade.js","sourceRoot":"","sources":["../../../src/auth/utilities/scope.cascade.ts"],"names":[],"mappings":";;;AAAA,qCAA4C;AAC5C,qFAAgF;AAChF,mEAA8D;AAC9D,2DAAuD;AACvD,yEAAoE;AACpE,wEAA8D;AAO9D,MAAa,YAAY;IAKvB,MAAM,CAAC,aAAa,CAClB,SAA0B,EAC1B,SAAmD;QAEnD,IACE,SAAS,CAAC,IAAI,CACZ,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC,oCAAa,CAAC,cAAc,CAAC,CACrE;YAED,OAAO,EAAE,CAAC;QACZ,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5D,OAAO,SAAS;aACb,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;aAC/C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC;IAGD,MAAM,CAAC,KAAK,CAAC,MAAM,CACjB,OAAsB,EACtB,OAAsB;QAEtB,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,OAAO;aACtB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;aACnC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM;YAC/B,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,0BAAW,EAAE,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,IAAA,YAAE,EAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAC1E,CAAC,CAAC,EAAE,CAAC;QACP,OAAO;YACL,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAC5D,CAAC,MAAM,EAAE;SACX,CAAC;IACJ,CAAC;IAGD,MAAM,CAAC,KAAK,CAAC,eAAe,CAC1B,OAAsB,EACtB,QAAgB;QAEhB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,uCAAiB,EAAE;YACnD,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE;YAC9B,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;SAC3B,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,MAAM,CACxB,OAAO,EACP,MAAM;aACH,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;aAC3B,MAAM,CAAC,CAAC,KAAK,EAAwB,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CACpD,CAAC;IACJ,CAAC;IAMD,MAAM,CAAC,KAAK,CAAC,eAAe,CAC1B,OAAsB,EACtB,QAAgB,EAChB,SAAkB;QAElB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,iCAAc,EAAE;YACnD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE;YAC1C,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC;QAEhC,MAAM,KAAK,GAAG,YAAY,CAAC,aAAa,CACtC,SAAS,EACT,MAAM,YAAY,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CACtD,CAAC;QACF,OAAO,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IACxD,CAAC;IAMD,MAAM,CAAC,KAAK,CAAC,eAAe,CAC1B,OAAsB,EACtB,QAAgB,EAChB,QAAkB,EAClB,OAAgB;QAGhB,MAAM,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE;YAChE,iBAAiB,QAAQ,EAAE;SAC5B,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,0BAAW,EAAE,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;YAC1E,IAAI,KAAK,KAAK,MAAM,CAAC,IAAI;gBACvB,MAAM,IAAI,uCAAiB,CAAC,iCAAiC,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,uCAAiB,EAAE;YACvD,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAE9D,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxE,IAAI,OAAO,CAAC,MAAM;YAChB,MAAM,OAAO,CAAC,UAAU,CAAC,uCAAiB,EAAE;gBAC1C,EAAE,EAAE,IAAA,YAAE,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;aACzC,CAAC,CAAC;QAEL,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAClE,IAAI,KAAK,CAAC,MAAM;YACd,MAAM,OAAO,CAAC,IAAI,CAChB,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CACrB,OAAO,CAAC,MAAM,CAAC,uCAAiB,EAAE;gBAChC,SAAS,EAAE,QAAQ;gBACnB,QAAQ;gBACR,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5C,CAAC,CACH,CACF,CAAC;QAEJ,IAAI,OAAO,CAAC,MAAM;YAChB,MAAM,YAAY,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnE,CAAC;IAGD,MAAM,CAAC,KAAK,CAAC,MAAM,CACjB,OAAsB,EACtB,QAAkB,EAClB,SAAkB;QAElB,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC;QAC/B,IAAI,SAAS;YACX,MAAM,OAAO,CAAC,MAAM,CAClB,iCAAc,EACd,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,QAAQ,CAAC,EAAE,EACpB,EAAE,UAAU,EAAE,SAAS,EAAE,CAC1B,CAAC;QACJ,MAAM,OAAO,CAAC,UAAU,CAAC,iCAAc,EAAE,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC/D,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC;CACF;AAhJD,oCAgJC"}

package/dist/auth/utilities/tenant.access.d.ts

@@ -1,8 +1,14 @@
 import { EntityManager } from 'typeorm';
+import { SystemRoleEntity } from '../entities/system.role.entity';
 export declare class TenantAccess {
     static join(manager: EntityManager, userId: string, tenantId: string, roleIds: string[], actorId?: string): Promise<void>;
     static reconcileRoles(manager: EntityManager, userId: string, tenantId: string, roleIds: string[], actorId?: string): Promise<void>;
-    static remove(manager: EntityManager, userId: string, tenantId: string): Promise<void>;
-    private static liveRoleIds;
+    static remove(manager: EntityManager, userId: string, tenantId: string, actorId?: string): Promise<void>;
+    static revokeInvitationsBy(manager: EntityManager, userId: string, tenantId: string, actorId?: string): Promise<void>;
+    static activeRoles(manager: EntityManager, userId: string, tenantId: string | null | undefined): Promise<SystemRoleEntity[]>;
+    static adminRoleIds(manager: EntityManager): Promise<string[]>;
+    static assertAdminRemains(manager: EntityManager, tenantId: string, userId: string, nextRoleIds?: string[]): Promise<void>;
+    static orphansTenant(activeAdminIds: string[], userId: string, remainsAdmin: boolean): boolean;
+    static liveRoleIds(manager: EntityManager, roleIds: string[]): Promise<string[]>;
 }
 //# sourceMappingURL=tenant.access.d.ts.map

package/dist/auth/utilities/tenant.access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.access.d.ts","sourceRoot":"","sources":["../../../src/auth/utilities/tenant.access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAM,MAAM,SAAS,CAAC;AAa5C,qBAAa,YAAY;WAEV,IAAI,CACf,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;WA6BH,cAAc,CACzB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;WA8BH,MAAM,CACjB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;mBAQK,WAAW;CAajC"}
+{"version":3,"file":"tenant.access.d.ts","sourceRoot":"","sources":["../../../src/auth/utilities/tenant.access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAM,MAAM,SAAS,CAAC;AAE5C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAgBlE,qBAAa,YAAY;WAEV,IAAI,CACf,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;WAuCH,cAAc,CACzB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;WAuCH,MAAM,CACjB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;WASH,mBAAmB,CAC9B,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;WAgBH,WAAW,CACtB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAClC,OAAO,CAAC,gBAAgB,EAAE,CAAC;WAgBjB,YAAY,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;WAavD,kBAAkB,CAC7B,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,WAAW,CAAC,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,IAAI,CAAC;IAyChB,MAAM,CAAC,aAAa,CAClB,cAAc,EAAE,MAAM,EAAE,EACxB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,OAAO,GACpB,OAAO;WAQG,WAAW,CACtB,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,MAAM,EAAE,CAAC;CAUrB"}

package/dist/auth/utilities/tenant.access.js

@@ -2,27 +2,41 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TenantAccess = void 0;
 const typeorm_1 = require("typeorm");
+const operation_exception_1 = require("../../global/exceptions/operation.exception");
 const system_role_entity_1 = require("../entities/system.role.entity");
+const tenant_invitation_entity_1 = require("../entities/tenant.invitation.entity");
 const tenant_user_entity_1 = require("../entities/tenant.user.entity");
+const user_entity_1 = require("../entities/user.entity");
 const user_role_entity_1 = require("../entities/user.role.entity");
+const tenant_invitation_status_enum_1 = require("../enums/tenant.invitation.status.enum");
+const tenant_role_enum_1 = require("../enums/tenant.role.enum");
 const access_revocation_1 = require("./access.revocation");
 class TenantAccess {
     static async join(manager, userId, tenantId, roleIds, actorId) {
         const membership = { user_id: userId, tenant_id: tenantId };
         if (!(await manager.existsBy(tenant_user_entity_1.TenantUserEntity, membership)))
-            await manager.save(manager.create(tenant_user_entity_1.TenantUserEntity, {
-                ...membership,
-                created_by: actorId,
-            }));
+            await manager
+                .createQueryBuilder()
+                .insert()
+                .into(tenant_user_entity_1.TenantUserEntity)
+                .values({ ...membership, created_by: actorId })
+                .orIgnore()
+                .execute();
         const held = await manager.findBy(user_role_entity_1.UserRoleEntity, membership);
         const heldRoleIds = new Set(held.map((grant) => grant.role_id));
         const missing = (await TenantAccess.liveRoleIds(manager, roleIds)).filter((roleId) => !heldRoleIds.has(roleId));
         if (missing.length)
-            await manager.save(missing.map((roleId) => manager.create(user_role_entity_1.UserRoleEntity, {
+            await manager
+                .createQueryBuilder()
+                .insert()
+                .into(user_role_entity_1.UserRoleEntity)
+                .values(missing.map((roleId) => ({
                 ...membership,
                 role_id: roleId,
                 created_by: actorId,
-            })));
+            })))
+                .orIgnore()
+                .execute();
     }
     static async reconcileRoles(manager, userId, tenantId, roleIds, actorId) {
         const membership = { user_id: userId, tenant_id: tenantId };
@@ -39,12 +53,77 @@ class TenantAccess {
                 role_id: roleId,
                 created_by: actorId,
             })));
+        const adminRoleIds = await TenantAccess.adminRoleIds(manager);
+        if (!adminRoleIds.some((roleId) => wanted.has(roleId)))
+            await TenantAccess.revokeInvitationsBy(manager, userId, tenantId, actorId);
     }
-    static async remove(manager, userId, tenantId) {
+    static async remove(manager, userId, tenantId, actorId) {
         const membership = { user_id: userId, tenant_id: tenantId };
         await manager.softDelete(user_role_entity_1.UserRoleEntity, membership);
         await manager.softDelete(tenant_user_entity_1.TenantUserEntity, membership);
         await access_revocation_1.AccessRevocation.revokeTenant(manager, userId, tenantId);
+        await TenantAccess.revokeInvitationsBy(manager, userId, tenantId, actorId);
+    }
+    static async revokeInvitationsBy(manager, userId, tenantId, actorId) {
+        await manager.update(tenant_invitation_entity_1.TenantInvitationEntity, {
+            tenant_id: tenantId,
+            created_by: userId,
+            status: tenant_invitation_status_enum_1.TenantInvitationStatus.PENDING,
+        }, {
+            status: tenant_invitation_status_enum_1.TenantInvitationStatus.REVOKED,
+            ...(actorId ? { updated_by: actorId } : {}),
+        });
+    }
+    static async activeRoles(manager, userId, tenantId) {
+        if (!tenantId)
+            return [];
+        const grants = await manager.find(user_role_entity_1.UserRoleEntity, {
+            where: {
+                user_id: userId,
+                tenant_id: tenantId,
+                role: { is_active: true },
+            },
+            relations: { role: true },
+        });
+        return grants
+            .map((grant) => grant.role)
+            .filter((role) => !!role);
+    }
+    static async adminRoleIds(manager) {
+        const roles = await manager.findBy(system_role_entity_1.SystemRoleEntity, {
+            identifier: tenant_role_enum_1.TenantRole.GLOBAL_ADMIN,
+            is_active: true,
+        });
+        return roles.map((role) => role.id);
+    }
+    static async assertAdminRemains(manager, tenantId, userId, nextRoleIds) {
+        await manager.query('select pg_advisory_xact_lock(hashtext($1))', [
+            `tenant-admins:${tenantId}`,
+        ]);
+        const adminRoleIds = await TenantAccess.adminRoleIds(manager);
+        if (!adminRoleIds.length)
+            return;
+        const admins = await manager
+            .getRepository(user_role_entity_1.UserRoleEntity)
+            .createQueryBuilder('ur')
+            .innerJoin(tenant_user_entity_1.TenantUserEntity, 'tu', 'tu.user_id = ur.user_id and tu.tenant_id = ur.tenant_id and tu.deleted_at is null and tu.is_active = true')
+            .innerJoin(user_entity_1.UserEntity, 'u', 'u.id = ur.user_id and u.deleted_at is null and u.active = true')
+            .select('ur.user_id', 'user_id')
+            .where('ur.tenant_id = :tenantId', { tenantId })
+            .andWhere('ur.role_id in (:...roleIds)', { roleIds: adminRoleIds })
+            .distinct(true)
+            .getRawMany();
+        const remainsAdmin = !!nextRoleIds?.some((id) => adminRoleIds.includes(id));
+        if (TenantAccess.orphansTenant(admins.map((admin) => admin.user_id), userId, remainsAdmin))
+            throw new operation_exception_1.OperationException('The organization needs at least one global.admin.');
+    }
+    static orphansTenant(activeAdminIds, userId, remainsAdmin) {
+        if (remainsAdmin)
+            return false;
+        const admins = new Set(activeAdminIds);
+        if (!admins.has(userId))
+            return false;
+        return admins.size <= 1;
     }
     static async liveRoleIds(manager, roleIds) {
         const unique = [...new Set(roleIds)];

package/dist/auth/utilities/tenant.access.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.access.js","sourceRoot":"","sources":["../../../src/auth/utilities/tenant.access.ts"],"names":[],"mappings":";;;AAAA,qCAA4C;AAC5C,uEAAkE;AAClE,uEAAkE;AAClE,mEAA8D;AAC9D,2DAAuD;AASvD,MAAa,YAAY;IAEvB,MAAM,CAAC,KAAK,CAAC,IAAI,CACf,OAAsB,EACtB,MAAc,EACd,QAAgB,EAChB,OAAiB,EACjB,OAAgB;QAEhB,MAAM,UAAU,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAE5D,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,qCAAgB,EAAE,UAAU,CAAC,CAAC;YACzD,MAAM,OAAO,CAAC,IAAI,CAChB,OAAO,CAAC,MAAM,CAAC,qCAAgB,EAAE;gBAC/B,GAAG,UAAU;gBACb,UAAU,EAAE,OAAO;aACpB,CAAC,CACH,CAAC;QAEJ,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,iCAAc,EAAE,UAAU,CAAC,CAAC;QAC9D,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,CAAC,MAAM,YAAY,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CACvE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CACrC,CAAC;QACF,IAAI,OAAO,CAAC,MAAM;YAChB,MAAM,OAAO,CAAC,IAAI,CAChB,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACrB,OAAO,CAAC,MAAM,CAAC,iCAAc,EAAE;gBAC7B,GAAG,UAAU;gBACb,OAAO,EAAE,MAAM;gBACf,UAAU,EAAE,OAAO;aACpB,CAAC,CACH,CACF,CAAC;IACN,CAAC;IAGD,MAAM,CAAC,KAAK,CAAC,cAAc,CACzB,OAAsB,EACtB,MAAc,EACd,QAAgB,EAChB,OAAiB,EACjB,OAAgB;QAEhB,MAAM,UAAU,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,iCAAc,EAAE,UAAU,CAAC,CAAC;QAE9D,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACnE,IAAI,OAAO,CAAC,MAAM;YAChB,MAAM,OAAO,CAAC,UAAU,CACtB,iCAAc,EACd,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CACjC,CAAC;QAEJ,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACzE,IAAI,OAAO,CAAC,MAAM;YAChB,MAAM,OAAO,CAAC,IAAI,CAChB,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACrB,OAAO,CAAC,MAAM,CAAC,iCAAc,EAAE;gBAC7B,GAAG,UAAU;gBACb,OAAO,EAAE,MAAM;gBACf,UAAU,EAAE,OAAO;aACpB,CAAC,CACH,CACF,CAAC;IACN,CAAC;IAMD,MAAM,CAAC,KAAK,CAAC,MAAM,CACjB,OAAsB,EACtB,MAAc,EACd,QAAgB;QAEhB,MAAM,UAAU,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAC5D,MAAM,OAAO,CAAC,UAAU,CAAC,iCAAc,EAAE,UAAU,CAAC,CAAC;QACrD,MAAM,OAAO,CAAC,UAAU,CAAC,qCAAgB,EAAE,UAAU,CAAC,CAAC;QACvD,MAAM,oCAAgB,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACjE,CAAC;IAGO,MAAM,CAAC,KAAK,CAAC,WAAW,CAC9B,OAAsB,EACtB,OAAiB;QAEjB,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QAE9B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,qCAAgB,EAAE;YACnD,EAAE,EAAE,IAAA,YAAE,EAAC,MAAM,CAAC;YACd,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;CACF;AAlGD,oCAkGC"}
+{"version":3,"file":"tenant.access.js","sourceRoot":"","sources":["../../../src/auth/utilities/tenant.access.ts"],"names":[],"mappings":";;;AAAA,qCAA4C;AAC5C,qFAAiF;AACjF,uEAAkE;AAClE,mFAA8E;AAC9E,uEAAkE;AAClE,yDAAqD;AACrD,mEAA8D;AAC9D,0FAAgF;AAChF,gEAAuD;AACvD,2DAAuD;AASvD,MAAa,YAAY;IAEvB,MAAM,CAAC,KAAK,CAAC,IAAI,CACf,OAAsB,EACtB,MAAc,EACd,QAAgB,EAChB,OAAiB,EACjB,OAAgB;QAEhB,MAAM,UAAU,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAG5D,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,qCAAgB,EAAE,UAAU,CAAC,CAAC;YACzD,MAAM,OAAO;iBACV,kBAAkB,EAAE;iBACpB,MAAM,EAAE;iBACR,IAAI,CAAC,qCAAgB,CAAC;iBACtB,MAAM,CAAC,EAAE,GAAG,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;iBAC9C,QAAQ,EAAE;iBACV,OAAO,EAAE,CAAC;QAEf,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,iCAAc,EAAE,UAAU,CAAC,CAAC;QAC9D,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,CAAC,MAAM,YAAY,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CACvE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CACrC,CAAC;QAEF,IAAI,OAAO,CAAC,MAAM;YAChB,MAAM,OAAO;iBACV,kBAAkB,EAAE;iBACpB,MAAM,EAAE;iBACR,IAAI,CAAC,iCAAc,CAAC;iBACpB,MAAM,CACL,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBACvB,GAAG,UAAU;gBACb,OAAO,EAAE,MAAM;gBACf,UAAU,EAAE,OAAO;aACpB,CAAC,CAAC,CACJ;iBACA,QAAQ,EAAE;iBACV,OAAO,EAAE,CAAC;IACjB,CAAC;IAMD,MAAM,CAAC,KAAK,CAAC,cAAc,CACzB,OAAsB,EACtB,MAAc,EACd,QAAgB,EAChB,OAAiB,EACjB,OAAgB;QAEhB,MAAM,UAAU,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,iCAAc,EAAE,UAAU,CAAC,CAAC;QAE9D,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACnE,IAAI,OAAO,CAAC,MAAM;YAChB,MAAM,OAAO,CAAC,UAAU,CACtB,iCAAc,EACd,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CACjC,CAAC;QAEJ,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACzE,IAAI,OAAO,CAAC,MAAM;YAChB,MAAM,OAAO,CAAC,IAAI,CAChB,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACrB,OAAO,CAAC,MAAM,CAAC,iCAAc,EAAE;gBAC7B,GAAG,UAAU;gBACb,OAAO,EAAE,MAAM;gBACf,UAAU,EAAE,OAAO;aACpB,CAAC,CACH,CACF,CAAC;QAEJ,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC9D,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpD,MAAM,YAAY,CAAC,mBAAmB,CACpC,OAAO,EACP,MAAM,EACN,QAAQ,EACR,OAAO,CACR,CAAC;IACN,CAAC;IAMD,MAAM,CAAC,KAAK,CAAC,MAAM,CACjB,OAAsB,EACtB,MAAc,EACd,QAAgB,EAChB,OAAgB;QAEhB,MAAM,UAAU,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAC5D,MAAM,OAAO,CAAC,UAAU,CAAC,iCAAc,EAAE,UAAU,CAAC,CAAC;QACrD,MAAM,OAAO,CAAC,UAAU,CAAC,qCAAgB,EAAE,UAAU,CAAC,CAAC;QACvD,MAAM,oCAAgB,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC/D,MAAM,YAAY,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7E,CAAC;IAGD,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAC9B,OAAsB,EACtB,MAAc,EACd,QAAgB,EAChB,OAAgB;QAEhB,MAAM,OAAO,CAAC,MAAM,CAClB,iDAAsB,EACtB;YACE,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,MAAM;YAClB,MAAM,EAAE,sDAAsB,CAAC,OAAO;SACvC,EACD;YACE,MAAM,EAAE,sDAAsB,CAAC,OAAO;YACtC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CACF,CAAC;IACJ,CAAC;IAGD,MAAM,CAAC,KAAK,CAAC,WAAW,CACtB,OAAsB,EACtB,MAAc,EACd,QAAmC;QAEnC,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,iCAAc,EAAE;YAChD,KAAK,EAAE;gBACL,OAAO,EAAE,MAAM;gBACf,SAAS,EAAE,QAAQ;gBACnB,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;aAC1B;YACD,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;SAC1B,CAAC,CAAC;QACH,OAAO,MAAM;aACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;aAC1B,MAAM,CAAC,CAAC,IAAI,EAA4B,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxD,CAAC;IAGD,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,OAAsB;QAC9C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,qCAAgB,EAAE;YACnD,UAAU,EAAE,6BAAU,CAAC,YAAY;YACnC,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;IAOD,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAC7B,OAAsB,EACtB,QAAgB,EAChB,MAAc,EACd,WAAsB;QAEtB,MAAM,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE;YAChE,iBAAiB,QAAQ,EAAE;SAC5B,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC9D,IAAI,CAAC,YAAY,CAAC,MAAM;YAAE,OAAO;QAEjC,MAAM,MAAM,GAAG,MAAM,OAAO;aACzB,aAAa,CAAC,iCAAc,CAAC;aAC7B,kBAAkB,CAAC,IAAI,CAAC;aACxB,SAAS,CACR,qCAAgB,EAChB,IAAI,EACJ,2GAA2G,CAC5G;aACA,SAAS,CACR,wBAAU,EACV,GAAG,EACH,gEAAgE,CACjE;aACA,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC;aAC/B,KAAK,CAAC,0BAA0B,EAAE,EAAE,QAAQ,EAAE,CAAC;aAC/C,QAAQ,CAAC,6BAA6B,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;aAClE,QAAQ,CAAC,IAAI,CAAC;aACd,UAAU,EAAuB,CAAC;QAErC,MAAM,YAAY,GAAG,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5E,IACE,YAAY,CAAC,aAAa,CACxB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EACpC,MAAM,EACN,YAAY,CACb;YAED,MAAM,IAAI,wCAAkB,CAC1B,mDAAmD,CACpD,CAAC;IACN,CAAC;IAGD,MAAM,CAAC,aAAa,CAClB,cAAwB,EACxB,MAAc,EACd,YAAqB;QAErB,IAAI,YAAY;YAAE,OAAO,KAAK,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QACtC,OAAO,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;IAC1B,CAAC;IAGD,MAAM,CAAC,KAAK,CAAC,WAAW,CACtB,OAAsB,EACtB,OAAiB;QAEjB,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QAE9B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,qCAAgB,EAAE;YACnD,EAAE,EAAE,IAAA,YAAE,EAAC,MAAM,CAAC;YACd,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;CACF;AAvOD,oCAuOC"}

package/dist/common/adapters/sentry.monitoring.adapter.d.ts

@@ -1,8 +1,10 @@
-import { MonitoringAdapter, MonitoringContext } from '../types/monitoring.types';
+import { MonitoringAdapter, MonitoringContext, SentryEventLike } from '../types/monitoring.types';
 export declare class SentryMonitoringAdapter implements MonitoringAdapter {
     readonly name = "sentry";
     private readonly sentry;
     constructor();
+    static sampleRate(): number;
+    static scrubEvent<E extends SentryEventLike>(event: E): E;
     static isAvailable(): boolean;
     captureException(error: Error, context?: MonitoringContext): void;
     captureMessage(message: string, context?: MonitoringContext): void;

package/dist/common/adapters/sentry.monitoring.adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sentry.monitoring.adapter.d.ts","sourceRoot":"","sources":["../../../src/common/adapters/sentry.monitoring.adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EAElB,MAAM,2BAA2B,CAAC;AAOnC,qBAAa,uBAAwB,YAAW,iBAAiB;IAC/D,QAAQ,CAAC,IAAI,YAAY;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;;IAiBpC,MAAM,CAAC,WAAW,IAAI,OAAO;IAU7B,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,IAAI;IAIjE,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,IAAI;CAMnE"}
+{"version":3,"file":"sentry.monitoring.adapter.d.ts","sourceRoot":"","sources":["../../../src/common/adapters/sentry.monitoring.adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EAEhB,MAAM,2BAA2B,CAAC;AASnC,qBAAa,uBAAwB,YAAW,iBAAiB;IAC/D,QAAQ,CAAC,IAAI,YAAY;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;;IAmBpC,MAAM,CAAC,UAAU,IAAI,MAAM;IAM3B,MAAM,CAAC,UAAU,CAAC,CAAC,SAAS,eAAe,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC;IAgCzD,MAAM,CAAC,WAAW,IAAI,OAAO;IAU7B,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,IAAI;IAIjE,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,IAAI;CAMnE"}

package/dist/common/adapters/sentry.monitoring.adapter.js

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SentryMonitoringAdapter = void 0;
+const monitoring_default_enum_1 = require("../enums/monitoring.default.enum");
 const server_environment_enum_1 = require("../enums/server.environment.enum");
+const redaction_util_1 = require("../../global/utilities/redaction.util");
 class SentryMonitoringAdapter {
     constructor() {
         this.name = 'sentry';
@@ -10,10 +12,48 @@ class SentryMonitoringAdapter {
             this.sentry.init({
                 dsn: process.env.SENTRY_DSN,
                 environment: process.env.SERVER_ENV || server_environment_enum_1.ServerEnvironmentEnum.DEVELOPMENT,
-                tracesSampleRate: parseFloat(process.env.SENTRY_TRACES_SAMPLE_RATE || '0'),
+                tracesSampleRate: SentryMonitoringAdapter.sampleRate(),
+                sendDefaultPii: false,
+                beforeSend: (event) => SentryMonitoringAdapter.scrubEvent(event),
             });
         }
     }
+    static sampleRate() {
+        const rate = parseFloat(process.env.SENTRY_TRACES_SAMPLE_RATE || '0');
+        return Number.isFinite(rate) ? Math.min(Math.max(rate, 0), 1) : 0;
+    }
+    static scrubEvent(event) {
+        const request = event?.request;
+        if (request) {
+            if (request.headers)
+                for (const header of Object.keys(request.headers))
+                    if (monitoring_default_enum_1.MonitoringPattern.SENSITIVE_HEADER.test(header))
+                        delete request.headers[header];
+            delete request.cookies;
+            delete request.data;
+            delete request.query_string;
+            if (typeof request.url === 'string')
+                request.url = request.url.split('?')[0];
+        }
+        if (event?.extra)
+            event.extra = redaction_util_1.Redaction.redact(event.extra).value;
+        const crumbs = Array.isArray(event?.breadcrumbs)
+            ? event.breadcrumbs
+            : event?.breadcrumbs?.values;
+        for (const crumb of crumbs ?? []) {
+            if (crumb.data) {
+                const data = redaction_util_1.Redaction.redact(crumb.data).value;
+                if (typeof data.url === 'string')
+                    data.url = data.url.split('?')[0];
+                delete data['http.query'];
+                delete data['http.fragment'];
+                crumb.data = data;
+            }
+            if (typeof crumb.message === 'string')
+                crumb.message = crumb.message.replace(/\?[^\s]*/g, '');
+        }
+        return event;
+    }
     static isAvailable() {
         if (!process.env.SENTRY_DSN)
             return false;

package/dist/common/adapters/sentry.monitoring.adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"sentry.monitoring.adapter.js","sourceRoot":"","sources":["../../../src/common/adapters/sentry.monitoring.adapter.ts"],"names":[],"mappings":";;;AAKA,8EAAyE;AAMzE,MAAa,uBAAuB;IAIlC;QAHS,SAAI,GAAG,QAAQ,CAAC;QAKvB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,cAAc,CAAe,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;gBAC3B,WAAW,EACT,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,+CAAqB,CAAC,WAAW;gBAC7D,gBAAgB,EAAE,UAAU,CAC1B,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,GAAG,CAC7C;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,CAAC,WAAW;QAChB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC;QAC1C,IAAI,CAAC;YACH,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,gBAAgB,CAAC,KAAY,EAAE,OAA2B;QACxD,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,cAAc,CAAC,OAAe,EAAE,OAA2B;QACzD,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE;YAClC,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,OAAO;SACf,CAAC,CAAC;IACL,CAAC;CACF;AAvCD,0DAuCC"}
+{"version":3,"file":"sentry.monitoring.adapter.js","sourceRoot":"","sources":["../../../src/common/adapters/sentry.monitoring.adapter.ts"],"names":[],"mappings":";;;AAMA,8EAAqE;AACrE,8EAAyE;AACzE,0EAAkE;AAMlE,MAAa,uBAAuB;IAIlC;QAHS,SAAI,GAAG,QAAQ,CAAC;QAKvB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,cAAc,CAAe,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;gBAC3B,WAAW,EACT,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,+CAAqB,CAAC,WAAW;gBAC7D,gBAAgB,EAAE,uBAAuB,CAAC,UAAU,EAAE;gBACtD,cAAc,EAAE,KAAK;gBACrB,UAAU,EAAE,CAAC,KAAsB,EAAE,EAAE,CACrC,uBAAuB,CAAC,UAAU,CAAC,KAAK,CAAC;aAC5C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAGD,MAAM,CAAC,UAAU;QACf,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,GAAG,CAAC,CAAC;QACtE,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;IAGD,MAAM,CAAC,UAAU,CAA4B,KAAQ;QACnD,MAAM,OAAO,GAAG,KAAK,EAAE,OAAO,CAAC;QAC/B,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,OAAO,CAAC,OAAO;gBACjB,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;oBAC/C,IAAI,2CAAiB,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC;wBACjD,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACrC,OAAO,OAAO,CAAC,OAAO,CAAC;YACvB,OAAO,OAAO,CAAC,IAAI,CAAC;YACpB,OAAO,OAAO,CAAC,YAAY,CAAC;YAC5B,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;gBACjC,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,KAAK,EAAE,KAAK;YAAE,KAAK,CAAC,KAAK,GAAG,0BAAS,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;QACpE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC;YAC9C,CAAC,CAAC,KAAK,CAAC,WAAW;YACnB,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC;QAE/B,KAAK,MAAM,KAAK,IAAI,MAAM,IAAI,EAAE,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBACf,MAAM,IAAI,GAAG,0BAAS,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC;gBAChD,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;oBAAE,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACpE,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC1B,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;gBAC7B,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;YACpB,CAAC;YACD,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;gBACnC,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,CAAC,WAAW;QAChB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC;QAC1C,IAAI,CAAC;YACH,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,gBAAgB,CAAC,KAAY,EAAE,OAA2B;QACxD,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,cAAc,CAAC,OAAe,EAAE,OAA2B;QACzD,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE;YAClC,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,OAAO;SACf,CAAC,CAAC;IACL,CAAC;CACF;AA/ED,0DA+EC"}

package/dist/common/bootstrap/secure.bootstrap.d.ts

@@ -0,0 +1,6 @@
+import type { NestExpressApplication } from '@nestjs/platform-express';
+import type { SecureDefaultsOptions } from '../types/bootstrap.types';
+export declare function resolveTrustProxy(value?: string | undefined): boolean | number | string;
+export declare function resolveCorsOrigins(value?: string | undefined): string[];
+export declare function applySecureDefaults(app: NestExpressApplication, options?: SecureDefaultsOptions): void;
+//# sourceMappingURL=secure.bootstrap.d.ts.map

package/dist/common/bootstrap/secure.bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure.bootstrap.d.ts","sourceRoot":"","sources":["../../../src/common/bootstrap/secure.bootstrap.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAYvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAKtE,wBAAgB,iBAAiB,CAC/B,KAAK,GAAE,MAAM,GAAG,SAAmC,GAClD,OAAO,GAAG,MAAM,GAAG,MAAM,CAM3B;AAGD,wBAAgB,kBAAkB,CAChC,KAAK,GAAE,MAAM,GAAG,SAAoC,GACnD,MAAM,EAAE,CAQV;AAOD,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,sBAAsB,EAC3B,OAAO,GAAE,qBAA0B,GAClC,IAAI,CAiDN"}

package/dist/common/bootstrap/secure.bootstrap.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveTrustProxy = resolveTrustProxy;
+exports.resolveCorsOrigins = resolveCorsOrigins;
+exports.applySecureDefaults = applySecureDefaults;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const global_exception_filter_1 = require("../../global/filters/global.exception.filter");
+const environment_util_1 = require("../../global/utilities/environment.util");
+const logging_interceptor_1 = require("../interceptors/logging.interceptor");
+const monitoring_interceptor_1 = require("../interceptors/monitoring.interceptor");
+const security_headers_middleware_1 = require("../middlewares/security.headers.middleware");
+const strict_validation_pipe_1 = require("../pipes/strict.validation.pipe");
+const bootstrap_default_enum_1 = require("../enums/bootstrap.default.enum");
+const logger = new common_1.Logger('Bootstrap');
+function resolveTrustProxy(value = process.env.TRUST_PROXY) {
+    const raw = (value ?? '').trim();
+    if (!raw || raw === 'false')
+        return false;
+    if (raw === 'true')
+        return true;
+    if (/^\d+$/.test(raw))
+        return Number(raw);
+    return raw;
+}
+function resolveCorsOrigins(value = process.env.CORS_ORIGINS) {
+    const origins = (value ?? '')
+        .split(',')
+        .map((origin) => origin.trim())
+        .filter(Boolean);
+    if (origins.includes('*'))
+        throw new Error('CORS_ORIGINS must list explicit origins, not "*"');
+    return origins;
+}
+function applySecureDefaults(app, options = {}) {
+    const swagger = (0, environment_util_1.envBool)(process.env.ENABLE_SWAGGER);
+    app.disable('x-powered-by');
+    app.set('trust proxy', resolveTrustProxy());
+    app.set('query parser', 'simple');
+    app.use((0, security_headers_middleware_1.securityHeaders)({
+        relaxedCspPaths: swagger ? [`/${bootstrap_default_enum_1.BootstrapDefault.DOCS_PATH}`] : [],
+    }));
+    const limit = process.env.HTTP_BODY_LIMIT || bootstrap_default_enum_1.BootstrapDefault.HTTP_BODY_LIMIT;
+    app.useBodyParser('json', { limit });
+    app.useBodyParser('urlencoded', { limit, extended: false });
+    const origins = resolveCorsOrigins();
+    if (origins.length)
+        app.enableCors({
+            origin: origins,
+            credentials: true,
+            maxAge: bootstrap_default_enum_1.BootstrapLimit.CORS_MAX_AGE_SECONDS,
+        });
+    app.useGlobalPipes(new strict_validation_pipe_1.StrictValidationPipe());
+    app.useGlobalFilters(new global_exception_filter_1.GlobalExceptionFilter());
+    if (!options.skipInterceptors)
+        app.useGlobalInterceptors(app.get(logging_interceptor_1.LoggingInterceptor), app.get(monitoring_interceptor_1.MonitoringInterceptor));
+    app.enableShutdownHooks();
+    if (swagger) {
+        const config = new swagger_1.DocumentBuilder()
+            .setTitle(options.swaggerTitle ?? 'API')
+            .setDescription(options.swaggerDescription ?? '')
+            .setVersion('1.0')
+            .addBearerAuth()
+            .build();
+        swagger_1.SwaggerModule.setup(bootstrap_default_enum_1.BootstrapDefault.DOCS_PATH, app, swagger_1.SwaggerModule.createDocument(app, config));
+        logger.warn(`Swagger docs exposed at /${bootstrap_default_enum_1.BootstrapDefault.DOCS_PATH} (ENABLE_SWAGGER=true).`);
+    }
+}
+//# sourceMappingURL=secure.bootstrap.js.map

package/dist/common/bootstrap/secure.bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure.bootstrap.js","sourceRoot":"","sources":["../../../src/common/bootstrap/secure.bootstrap.ts"],"names":[],"mappings":";;AAkBA,8CAQC;AAGD,gDAUC;AAOD,kDAoDC;AAlGD,2CAAwC;AAExC,6CAAiE;AACjE,0FAAqF;AACrF,8EAAkE;AAClE,6EAAyE;AACzE,mFAA+E;AAC/E,4FAA6E;AAC7E,4EAAuE;AACvE,4EAGyC;AAGzC,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,WAAW,CAAC,CAAC;AAGvC,SAAgB,iBAAiB,CAC/B,QAA4B,OAAO,CAAC,GAAG,CAAC,WAAW;IAEnD,MAAM,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1C,OAAO,GAAG,CAAC;AACb,CAAC;AAGD,SAAgB,kBAAkB,CAChC,QAA4B,OAAO,CAAC,GAAG,CAAC,YAAY;IAEpD,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;SAC1B,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;SAC9B,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,OAAO,OAAO,CAAC;AACjB,CAAC;AAOD,SAAgB,mBAAmB,CACjC,GAA2B,EAC3B,UAAiC,EAAE;IAEnC,MAAM,OAAO,GAAG,IAAA,0BAAO,EAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAEpD,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5B,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC5C,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;IAClC,GAAG,CAAC,GAAG,CACL,IAAA,6CAAe,EAAC;QACd,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,yCAAgB,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;KACnE,CAAC,CACH,CAAC;IAEF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,yCAAgB,CAAC,eAAe,CAAC;IAC9E,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACrC,GAAG,CAAC,aAAa,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAE5D,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;IACrC,IAAI,OAAO,CAAC,MAAM;QAChB,GAAG,CAAC,UAAU,CAAC;YACb,MAAM,EAAE,OAAO;YACf,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,uCAAc,CAAC,oBAAoB;SAC5C,CAAC,CAAC;IAEL,GAAG,CAAC,cAAc,CAAC,IAAI,6CAAoB,EAAE,CAAC,CAAC;IAC/C,GAAG,CAAC,gBAAgB,CAAC,IAAI,+CAAqB,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO,CAAC,gBAAgB;QAC3B,GAAG,CAAC,qBAAqB,CACvB,GAAG,CAAC,GAAG,CAAC,wCAAkB,CAAC,EAC3B,GAAG,CAAC,GAAG,CAAC,8CAAqB,CAAC,CAC/B,CAAC;IACJ,GAAG,CAAC,mBAAmB,EAAE,CAAC;IAE1B,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,IAAI,yBAAe,EAAE;aACjC,QAAQ,CAAC,OAAO,CAAC,YAAY,IAAI,KAAK,CAAC;aACvC,cAAc,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC;aAChD,UAAU,CAAC,KAAK,CAAC;aACjB,aAAa,EAAE;aACf,KAAK,EAAE,CAAC;QACX,uBAAa,CAAC,KAAK,CACjB,yCAAgB,CAAC,SAAS,EAC1B,GAAG,EACH,uBAAa,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAC1C,CAAC;QACF,MAAM,CAAC,IAAI,CACT,4BAA4B,yCAAgB,CAAC,SAAS,yBAAyB,CAChF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/common/common.module.d.ts

@@ -1,4 +1,5 @@
 import { RedisOptions } from 'ioredis';
+export declare function createCacheConnection(): RedisOptions;
 export declare class CommonModule {
     static withCacheConnection(connection: RedisOptions): typeof CommonModule;
 }

package/dist/common/common.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"common.module.d.ts","sourceRoot":"","sources":["../../src/common/common.module.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAiEvC,qBAKa,YAAY;IAWvB,MAAM,CAAC,mBAAmB,CAAC,UAAU,EAAE,YAAY,GAAG,OAAO,YAAY;CAI1E"}
+{"version":3,"file":"common.module.d.ts","sourceRoot":"","sources":["../../src/common/common.module.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AA0BvC,wBAAgB,qBAAqB,IAAI,YAAY,CAsBpD;AAiCD,qBAKa,YAAY;IAWvB,MAAM,CAAC,mBAAmB,CAAC,UAAU,EAAE,YAAY,GAAG,OAAO,YAAY;CAI1E"}

package/dist/common/common.module.js

@@ -8,6 +8,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var CommonModule_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CommonModule = void 0;
+exports.createCacheConnection = createCacheConnection;
 const common_1 = require("@nestjs/common");
 const logging_interceptor_1 = require("./interceptors/logging.interceptor");
 const monitoring_interceptor_1 = require("./interceptors/monitoring.interceptor");
@@ -18,15 +19,28 @@ const list_filter_service_1 = require("./services/list.filter.service");
 const monitoring_service_1 = require("./services/monitoring.service");
 const remote_request_service_1 = require("./services/remote.request.service");
 const sql_service_1 = require("./services/sql.service");
+const environment_util_1 = require("../global/utilities/environment.util");
 let providedCacheConnection;
 function createCacheConnection() {
     if (providedCacheConnection)
         return providedCacheConnection;
     return {
         host: process.env.CACHE_REDIS_HOST || 'localhost',
-        port: parseInt(process.env.CACHE_REDIS_PORT || '6379', 10),
+        port: (0, environment_util_1.envInt)(process.env.CACHE_REDIS_PORT, 6379, { min: 1, max: 65535 }),
         password: process.env.CACHE_REDIS_PASSWORD || undefined,
-        db: parseInt(process.env.CACHE_REDIS_DB || '0', 10),
+        db: (0, environment_util_1.envInt)(process.env.CACHE_REDIS_DB, 1, { max: 15 }),
+        ...((0, environment_util_1.envBool)(process.env.CACHE_REDIS_TLS)
+            ? {
+                tls: {
+                    rejectUnauthorized: process.env.CACHE_REDIS_TLS_REJECT_UNAUTHORIZED !== 'false',
+                },
+            }
+            : {}),
+        maxRetriesPerRequest: 1,
+        commandTimeout: (0, environment_util_1.envInt)(process.env.CACHE_REDIS_COMMAND_TIMEOUT_MS, 2000, {
+            min: 1,
+        }),
+        connectTimeout: 5000,
     };
 }
 const cacheProvider = {

package/dist/common/common.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"common.module.js","sourceRoot":"","sources":["../../src/common/common.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAA0D;AAE1D,4EAAwE;AACxE,kFAA8E;AAC9E,4DAAwD;AACxD,4DAAwD;AACxD,sEAAkE;AAClE,wEAAmE;AACnE,sEAAkE;AAClE,8EAAyE;AACzE,wDAAoD;AAapD,IAAI,uBAAiD,CAAC;AAEtD,SAAS,qBAAqB;IAC5B,IAAI,uBAAuB;QAAE,OAAO,uBAAuB,CAAC;IAC5D,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,WAAW;QACjD,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,MAAM,EAAE,EAAE,CAAC;QAC1D,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,SAAS;QACvD,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,GAAG,EAAE,EAAE,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAa;IAC9B,OAAO,EAAE,4BAAY;IACrB,UAAU,EAAE,CAAC,iBAAoC,EAAE,EAAE,CACnD,IAAI,4BAAY,CAAC,iBAAiB,EAAE,qBAAqB,EAAE,CAAC;IAC9D,MAAM,EAAE,CAAC,sCAAiB,CAAC;CAC5B,CAAC;AAEF,MAAM,eAAe,GAAG;IACtB,4BAAY;IACZ,aAAa;IACb,sCAAiB;IACjB,uCAAiB;IACjB,sCAAiB;IACjB,6CAAoB;IACpB,wBAAU;IACV,wCAAkB;IAClB,8CAAqB;CACtB,CAAC;AAEF,MAAM,aAAa,GAAG;IACpB,4BAAY;IACZ,4BAAY;IACZ,sCAAiB;IACjB,uCAAiB;IACjB,sCAAiB;IACjB,6CAAoB;IACpB,wBAAU;IACV,wCAAkB;IAClB,8CAAqB;CACtB,CAAC;AAOK,IAAM,YAAY,oBAAlB,MAAM,YAAY;IAWvB,MAAM,CAAC,mBAAmB,CAAC,UAAwB;QACjD,uBAAuB,GAAG,UAAU,CAAC;QACrC,OAAO,cAAY,CAAC;IACtB,CAAC;CACF,CAAA;AAfY,oCAAY;uBAAZ,YAAY;IALxB,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACN,SAAS,EAAE,eAAe;QAC1B,OAAO,EAAE,aAAa;KACvB,CAAC;GACW,YAAY,CAexB"}
+{"version":3,"file":"common.module.js","sourceRoot":"","sources":["../../src/common/common.module.ts"],"names":[],"mappings":";;;;;;;;;;AA2BA,sDAsBC;AAjDD,2CAA0D;AAE1D,4EAAwE;AACxE,kFAA8E;AAC9E,4DAAwD;AACxD,4DAAwD;AACxD,sEAAkE;AAClE,wEAAmE;AACnE,sEAAkE;AAClE,8EAAyE;AACzE,wDAAoD;AACpD,2EAAuE;AAavE,IAAI,uBAAiD,CAAC;AAGtD,SAAgB,qBAAqB;IACnC,IAAI,uBAAuB;QAAE,OAAO,uBAAuB,CAAC;IAC5D,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,WAAW;QACjD,IAAI,EAAE,IAAA,yBAAM,EAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QACxE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,SAAS;QACvD,EAAE,EAAE,IAAA,yBAAM,EAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;QACtD,GAAG,CAAC,IAAA,0BAAO,EAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;YACtC,CAAC,CAAC;gBACE,GAAG,EAAE;oBACH,kBAAkB,EAChB,OAAO,CAAC,GAAG,CAAC,mCAAmC,KAAK,OAAO;iBAC9D;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QAEP,oBAAoB,EAAE,CAAC;QACvB,cAAc,EAAE,IAAA,yBAAM,EAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,IAAI,EAAE;YACvE,GAAG,EAAE,CAAC;SACP,CAAC;QACF,cAAc,EAAE,IAAI;KACrB,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAa;IAC9B,OAAO,EAAE,4BAAY;IACrB,UAAU,EAAE,CAAC,iBAAoC,EAAE,EAAE,CACnD,IAAI,4BAAY,CAAC,iBAAiB,EAAE,qBAAqB,EAAE,CAAC;IAC9D,MAAM,EAAE,CAAC,sCAAiB,CAAC;CAC5B,CAAC;AAEF,MAAM,eAAe,GAAG;IACtB,4BAAY;IACZ,aAAa;IACb,sCAAiB;IACjB,uCAAiB;IACjB,sCAAiB;IACjB,6CAAoB;IACpB,wBAAU;IACV,wCAAkB;IAClB,8CAAqB;CACtB,CAAC;AAEF,MAAM,aAAa,GAAG;IACpB,4BAAY;IACZ,4BAAY;IACZ,sCAAiB;IACjB,uCAAiB;IACjB,sCAAiB;IACjB,6CAAoB;IACpB,wBAAU;IACV,wCAAkB;IAClB,8CAAqB;CACtB,CAAC;AAOK,IAAM,YAAY,oBAAlB,MAAM,YAAY;IAWvB,MAAM,CAAC,mBAAmB,CAAC,UAAwB;QACjD,uBAAuB,GAAG,UAAU,CAAC;QACrC,OAAO,cAAY,CAAC;IACtB,CAAC;CACF,CAAA;AAfY,oCAAY;uBAAZ,YAAY;IALxB,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACN,SAAS,EAAE,eAAe;QAC1B,OAAO,EAAE,aAAa;KACvB,CAAC;GACW,YAAY,CAexB"}

package/dist/common/consumers/job.consumer.d.ts

@@ -14,6 +14,7 @@ export declare class JobConsumer extends WorkerHost implements OnApplicationBoot
     private lastWorkerErrorAt;
     private readonly onUnhandledRejection;
     private readonly onUncaughtException;
+    private crashing;
     constructor(queueService: QueueService);
     onApplicationBootstrap(): void;
     private resolveReadiness;
@@ -34,6 +35,7 @@ export declare class JobConsumer extends WorkerHost implements OnApplicationBoot
     onError(error: Error): void;
     onReady(): void;
     private enrolScheduledEventDriver;
+    private enrolFailedJobPurge;
     private persistFinalFailure;
     private persistFailure;
     private elapsed;