@neohm/nestend 6.4.0 → 6.5.0

package/README.md

@@ -115,9 +115,11 @@ these are free to change without a breaking release.
 | Audit             | `AuditService`                                                                                                                       | `saveAuditLog(old, new)` with changed-value diffing into `sys_audit_logs`                                                                                                                                                                                                                                                                                                                                                                                                                               |
 | Cache             | `CacheService`                                                                                                                       | Redis, TTL objects (`{days, hours, min}`), transparent encryption                                                                                                                                                                                                                                                                                                                                                                                                                                       |
 | Encryption        | `EncryptionService`                                                                                                                  | AES-256-GCM, scrypt-derived keys                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| One-time codes    | `OtpService`, `OtpActivity`, `SystemOtpEntity`                                                                                       | 6-digit codes per activity on one row (`sys_otps`, activities are `sys_constants` rows); keyed digest only, single use, expiry, 5 guesses; always `000000` when `SERVER_ENV` is set and not `production` |
 | System properties | `SystemPropertyModule`, `SystemPropertyService`                                                                                      | cached + optionally encrypted key/value settings in `sys_properties`                                                                                                                                                                                                                                                                                                                                                                                                                                    |
 | Documents         | `DocumentModule`, `DocumentService`, `S3BucketDocumentService`, `MinioBucketDocumentService`                                         | `POST /api/documents/upload` (multipart) or `uploadDocument(multerFiles) → links[]`; driver chosen via `DOCUMENT_STORAGE_DRIVER`; `sys_document_uploads` is the file, `sys_documents` the link to one of your records (`system_generated` marks the ones the backend produced itself)                                                                                                                                                                                                                    |
 | PDF documents     | `PdfService`, `PdfTemplateService`, `ProcessPdfDocument`, `PdfTemplateEntity`, `PdfRenderOptions`                                     | templates in `sys_pdf_templates` rendered to HTML by a remote service, rasterized by headless Chromium (`renderHtmlToPdf(html) → Buffer`, honours the document's own `@page` rules and paginates to any length), then stored — `ProcessPdfDocument` writes both rows and flags the `sys_documents` one `system_generated`; optional peer dep `puppeteer`                                                                                                                                                  |
+| Reports           | `ReportModule`, `ReportService`, `ReportDetailEntity`, `TenantReportEntity`, `GenerateTenantReportJob`                                | SQL reports per tenant, gated by scope (plan) and permission: live `summary` / `drilldown`, or generative Excel workbooks stored as documents; optional peer dep `exceljs` — see [Reports](#reports) |
 | HTTP              | `CommonController`, `GlobalExceptionFilter`, common DTOs                                                                             | health endpoint base controller, uniform error envelope                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
 | Raw SQL           | `SqlService`, `SqlTarget`                                                                                                            | named `:key` placeholders always bound as driver params, `:...key` array expansion; runs on the read replica (`DB_READ_*`) with transparent primary fallback; `fetchOne`/`fetchScalar`/`exists`/`count`/`paginate` helpers                                                                                                                                                                                                                                                                              |
 | List endpoints    | `CommonListProcessor`, `CommonListFilterDto`, `FilterDto`, `CommonListFilterConfig`                                                  | allowlisted columns, parameterised operators (`eq`…`isNull`), typed value casting (`str`/`num`/`date`/`bool`/`null`), multi-sort + paginated on the read replica                                                                                                                                                                                                                                                                                                                                        |
@@ -135,7 +137,7 @@ unless marked **required**.
 
 | Variable     | Default       | Description                                                                                                                                          |
 | ------------ | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `SERVER_ENV` | `development` | Runtime environment (`development` / `staging` / `production` / `test`). Swagger docs at `/docs` are mounted in every value **except** `production`. |
+| `SERVER_ENV` | `development` | Runtime environment (`development` / `staging` / `production` / `test`). Swagger docs at `/docs` are mounted in every value **except** `production`. Set and not `production` → every OTP is `000000`. |
 | `PORT`       | `8000`        | HTTP port the server listens on                                                                                                                      |
 
 ### Database (PostgreSQL)
@@ -229,8 +231,12 @@ const { user } = await this.authService.validateAccess(
 
 `AuthController` (mounted at `/auth`) exposes the ready-made flows: `POST
 /auth/login`, `/auth/google`, `/auth/register`, `/auth/refresh`, `/auth/logout`,
-`/auth/change-password`, and `GET /auth/me` (user, roles in the session's
-organization, `organizations` to switch to, pending `invitations`). Passwords are hashed/verified via
+`/auth/change-password/request` + `/auth/change-password`, and `GET /auth/me` (user, roles in the session's
+organization, `organizations` to switch to, pending `invitations`). A password change is
+confirmed by a mailed code: `/request` checks `current_password` and mails a 6-digit OTP
+(template `password-change-otp` — seed it), then `/change-password` takes
+`current_password`, `new_password` and `otp`. Replacing the initial one-time password
+needs no `otp`. Passwords are hashed/verified via
 `AuthUtility` (bcrypt); the write flows use the processor lifecycle. Credential
 misses spend the same bcrypt work as a wrong password
 (`AuthUtility.compareAgainstDummy()`), so response timing does not reveal
@@ -1076,6 +1082,38 @@ comma-separated values and cast each part; `isNull` reads its value truthily
 Invalid identifiers, operators, or values raise `OperationException` before any
 SQL runs. Results come back as `{ records, total, page, limit, total_pages }`.
 
+## Reports
+
+`ReportModule` serves SQL reports to tenant members at `api/reports`, and their generated workbooks at `api/tenant-reports`;
+the back office manages them through `AdminModule`.
+
+```ts
+imports: [DocumentModule, ReportModule]   // generation stores workbooks as documents
+```
+
+- **Catalogue** (`sys_report_details`): `is_generative`, a script (`sys_scripts`),
+  `scope_id` (the tenant must hold it — through its plan or a grant), `permission_id`
+  (the member must hold it), drilldown `columns`, and for generative reports
+  `sys_report_sheets` (one workbook sheet each, optionally with its own script).
+- **Per tenant** (`tn_report_details`): which reports a tenant gets, with `parameters`
+  bound into the scripts.
+- **Scripts** are one SELECT that must use `:tenant_id` (always the session tenant,
+  never overridable); they run on the read replica wrapped in a subquery.
+- **Run-time parameters** (custom predicates such as a date range): a report declares
+  them (`name`, `type` — `date`, `datetime`, `number`, `string`, `boolean` —,
+  `required`, `default`), its scripts use them as `:from_date` / `:to_date`, and
+  `summary`, `drilldown` and `generate` take `parameters: { from_date, to_date }`.
+  Values are type-checked and bound; neither `tenant_id` nor the tenant's back-office
+  parameters can be overridden. A generation keeps the values it used.
+- **Live reports**: `POST :id/summary` (≤ 1000 rows) and `POST :id/drilldown`
+  (paged/filtered/sorted over the declared columns).
+- **Generative reports**: `POST :id/generate` inserts a `tn_tenant_reports` row; its
+  subscriber queues `GenerateTenantReportJob`, which builds the `.xlsx` (needs
+  `yarn add exceljs`) and stores it privately attached to the row. The new
+  `sys_documents` row queues `LinkTenantReportDocumentJob`, which sets
+  `document_id` / `is_generated`. `GET /api/tenant-reports/:id` returns a short-lived
+  `download_url`.
+
 ## Admin Module
 
 `AdminModule` is the back-office surface — tenant onboarding, client/admin user
@@ -1122,6 +1160,9 @@ pass the actor to a processor.
 | `POST   /admin/tenant-users/:id/memberships/:tenantId/deactivate` · `/reactivate` | admin | `TenantMembershipService.setMemberActive` |
 | `POST   /admin/system-users`         | super admin     | `SystemUserDataProcessor` (upsert — send `id` to update)        |
 | `POST   /admin/system-users/list`    | content reader  | `SystemUserListProcessor` (scoped to `user_type = system.user`) |
+| `POST   /admin/reports` · `/list` · `GET`/`DELETE /:id` | super admin / content reader | `ReportDataProcessor` (sheets replace), `ReportCatalogueListProcessor` |
+| `POST   /admin/reports/:id/script` · `/:id/sheets/:sheetId/script` | super admin | `ReportScriptDataProcessor` — add or edit; needs `:tenant_id`, dry-run on save |
+| `POST   /admin/tenant-reports` · `/list` · `DELETE /:id` | admin / content reader | `TenantReportDataProcessor` — enable a report for a tenant with its `parameters` |
 | `GET    /admin/system-users/:id`     | content reader  | the row                                                         |
 | `DELETE /admin/system-users/:id`     | super admin     | `SystemUserService.delete` (revokes live sessions)              |
 | `POST   /admin/users`                | super admin     | `AdminUserDataProcessor`                                        |
@@ -1319,6 +1360,7 @@ its remediation status live outside the package (`security-audit/`).
   `GET /api/admin/scheduled-tasks/jobs`), ≥ 60 s period, 5-field cron.
 - `sendMail` throws when `AWS_SES_FROM_ADDRESS` is unset outside development/test.
 - Impersonation login returns no refresh token; OTP accounts are limited to change-password until it is replaced.
+- `POST /auth/change-password` needs `otp` from `POST /auth/change-password/request` (except when replacing a one-time password).
 
 ## License
 

package/dist/admin/controllers/admin.report.controller.d.ts

@@ -0,0 +1,25 @@
+import { ListFilterService } from '../../common/services/list.filter.service';
+import { SqlService } from '../../common/services/sql.service';
+import { ScriptEntity } from '../../report/entities/script.entity';
+import type { ReportDetail } from '../../report/types/report.types';
+import { AddReportDto } from '../dtos/add.report.dto';
+import { ReportCatalogueListDto } from '../dtos/report.catalogue.list.dto';
+import { SetReportScriptDto } from '../dtos/set.report.script.dto';
+import { AdminAccessService } from '../services/admin.access.service';
+import { AdminReportService } from '../services/admin.report.service';
+export declare class AdminReportController {
+    private readonly adminAccessService;
+    private readonly listFilterService;
+    private readonly sqlService;
+    private readonly adminReportService;
+    constructor(adminAccessService: AdminAccessService, listFilterService: ListFilterService, sqlService: SqlService, adminReportService: AdminReportService);
+    save(dto: AddReportDto): Promise<ReportDetail>;
+    list(dto: ReportCatalogueListDto): Promise<import("../..").CommonListResult>;
+    detail(id: string): Promise<ReportDetail>;
+    setScript(id: string, dto: SetReportScriptDto): Promise<ScriptEntity>;
+    setSheetScript(id: string, sheetId: string, dto: SetReportScriptDto): Promise<ScriptEntity>;
+    remove(id: string): Promise<{
+        success: boolean;
+    }>;
+}
+//# sourceMappingURL=admin.report.controller.d.ts.map

package/dist/admin/controllers/admin.report.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.report.controller.d.ts","sourceRoot":"","sources":["../../../src/admin/controllers/admin.report.controller.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAE/D,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAEpE,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAInE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAOtE,qBAIa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;gBAHlB,kBAAkB,EAAE,kBAAkB,EACtC,iBAAiB,EAAE,iBAAiB,EACpC,UAAU,EAAE,UAAU,EACtB,kBAAkB,EAAE,kBAAkB;IASnD,IAAI,CAAS,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IAetD,IAAI,CAAS,GAAG,EAAE,sBAAsB;IAaxC,MAAM,CAA6B,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAcrE,SAAS,CACe,EAAE,EAAE,MAAM,EAC9B,GAAG,EAAE,kBAAkB,GAC9B,OAAO,CAAC,YAAY,CAAC;IAelB,cAAc,CACU,EAAE,EAAE,MAAM,EACL,OAAO,EAAE,MAAM,EACxC,GAAG,EAAE,kBAAkB,GAC9B,OAAO,CAAC,YAAY,CAAC;IAelB,MAAM,CAA6B,EAAE,EAAE,MAAM;;;CAKpD"}

package/dist/admin/controllers/admin.report.controller.js

@@ -0,0 +1,145 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AdminReportController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const strict_validation_pipe_1 = require("../../common/pipes/strict.validation.pipe");
+const list_filter_service_1 = require("../../common/services/list.filter.service");
+const sql_service_1 = require("../../common/services/sql.service");
+const report_detail_entity_1 = require("../../report/entities/report.detail.entity");
+const report_catalogue_1 = require("../../report/utilities/report.catalogue");
+const add_report_dto_1 = require("../dtos/add.report.dto");
+const report_catalogue_list_dto_1 = require("../dtos/report.catalogue.list.dto");
+const set_report_script_dto_1 = require("../dtos/set.report.script.dto");
+const report_catalogue_list_processor_1 = require("../libraries/report.catalogue.list.processor");
+const report_data_processor_1 = require("../libraries/report.data.processor");
+const report_script_data_processor_1 = require("../libraries/report.script.data.processor");
+const admin_access_service_1 = require("../services/admin.access.service");
+const admin_report_service_1 = require("../services/admin.report.service");
+let AdminReportController = class AdminReportController {
+    constructor(adminAccessService, listFilterService, sqlService, adminReportService) {
+        this.adminAccessService = adminAccessService;
+        this.listFilterService = listFilterService;
+        this.sqlService = sqlService;
+        this.adminReportService = adminReportService;
+    }
+    async save(dto) {
+        const access = await this.adminAccessService.validateSuperAdmin();
+        const report = await new report_data_processor_1.ReportDataProcessor(access).process(dto);
+        return report_catalogue_1.ReportCatalogue.detail(report_detail_entity_1.ReportDetailEntity.getRepository().manager, report.id);
+    }
+    async list(dto) {
+        await this.adminAccessService.validateContentReader();
+        return new report_catalogue_list_processor_1.ReportCatalogueListProcessor(this.listFilterService).process(dto);
+    }
+    async detail(id) {
+        await this.adminAccessService.validateContentReader();
+        return report_catalogue_1.ReportCatalogue.detail(report_detail_entity_1.ReportDetailEntity.getRepository().manager, id);
+    }
+    async setScript(id, dto) {
+        const access = await this.adminAccessService.validateSuperAdmin();
+        return new report_script_data_processor_1.ReportScriptDataProcessor(access, this.sqlService).process(id, null, dto);
+    }
+    async setSheetScript(id, sheetId, dto) {
+        const access = await this.adminAccessService.validateSuperAdmin();
+        return new report_script_data_processor_1.ReportScriptDataProcessor(access, this.sqlService).process(id, sheetId, dto);
+    }
+    async remove(id) {
+        const { user } = await this.adminAccessService.validateSuperAdmin();
+        await this.adminReportService.deleteReport(id, user);
+        return { success: true };
+    }
+};
+exports.AdminReportController = AdminReportController;
+__decorate([
+    (0, common_1.Post)(),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Define a report, or update an existing one.',
+        description: "Send an `id` to edit; omit it to define one. `identifier` is fixed once created. `sheets`, when sent, replace the report's sheets (send a sheet's `id` to keep it and its script). Scripts are set through `POST :id/script`. Requires the global super admin role.",
+    }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [add_report_dto_1.AddReportDto]),
+    __metadata("design:returntype", Promise)
+], AdminReportController.prototype, "save", null);
+__decorate([
+    (0, common_1.Post)('list'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'List, search and filter reports.',
+        description: 'Rows carry `has_script`, `sheets` and `tenants` (tenants it is enabled for). Requires at least the global content reader role.',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [report_catalogue_list_dto_1.ReportCatalogueListDto]),
+    __metadata("design:returntype", Promise)
+], AdminReportController.prototype, "list", null);
+__decorate([
+    (0, common_1.Get)(':id'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'One report, in full.',
+        description: "With its `script`, `scope`, `permission`, `sheets` (each with its own `script`, null = the report's) and `tenant_count`. Requires at least the global content reader role.",
+    }),
+    __param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], AdminReportController.prototype, "detail", null);
+__decorate([
+    (0, common_1.Post)(':id/script'),
+    (0, swagger_1.ApiOperation)({
+        summary: "Add the report's script, or edit it.",
+        description: "One SELECT that narrows by `:tenant_id`; other `:name` placeholders take the tenant's parameters. It is dry-run on save, so syntax and column errors come back on `script`. Requires the global super admin role.",
+    }),
+    __param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    __param(1, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, set_report_script_dto_1.SetReportScriptDto]),
+    __metadata("design:returntype", Promise)
+], AdminReportController.prototype, "setScript", null);
+__decorate([
+    (0, common_1.Post)(':id/sheets/:sheetId/script'),
+    (0, swagger_1.ApiOperation)({
+        summary: "Add a sheet's own script, or edit it.",
+        description: "Same rules as the report's script. A sheet without one runs the report's. Requires the global super admin role.",
+    }),
+    __param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    __param(1, (0, common_1.Param)('sheetId', common_1.ParseUUIDPipe)),
+    __param(2, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, String, set_report_script_dto_1.SetReportScriptDto]),
+    __metadata("design:returntype", Promise)
+], AdminReportController.prototype, "setSheetScript", null);
+__decorate([
+    (0, common_1.Delete)(':id'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Delete a report.',
+        description: 'Soft delete, with its sheets. Refused while any tenant has it enabled — remove those first. Requires the global super admin role.',
+    }),
+    __param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], AdminReportController.prototype, "remove", null);
+exports.AdminReportController = AdminReportController = __decorate([
+    (0, swagger_1.ApiTags)('Admin - Reports'),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.UsePipes)(strict_validation_pipe_1.StrictValidationPipe),
+    (0, common_1.Controller)('api/admin/reports'),
+    __metadata("design:paramtypes", [admin_access_service_1.AdminAccessService,
+        list_filter_service_1.ListFilterService,
+        sql_service_1.SqlService,
+        admin_report_service_1.AdminReportService])
+], AdminReportController);
+//# sourceMappingURL=admin.report.controller.js.map

package/dist/admin/controllers/admin.report.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.report.controller.js","sourceRoot":"","sources":["../../../src/admin/controllers/admin.report.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CASwB;AACxB,6CAAuE;AACvE,sFAAiF;AACjF,mFAA8E;AAC9E,mEAA+D;AAC/D,qFAAgF;AAGhF,8EAA0E;AAC1E,2DAAsD;AACtD,iFAA2E;AAC3E,yEAAmE;AACnE,kGAA4F;AAC5F,8EAAyE;AACzE,4FAAsF;AACtF,2EAAsE;AACtE,2EAAsE;AAW/D,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAChC,YACmB,kBAAsC,EACtC,iBAAoC,EACpC,UAAsB,EACtB,kBAAsC;QAHtC,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,eAAU,GAAV,UAAU,CAAY;QACtB,uBAAkB,GAAlB,kBAAkB,CAAoB;IACtD,CAAC;IAQE,AAAN,KAAK,CAAC,IAAI,CAAS,GAAiB;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,CAAC;QAClE,MAAM,MAAM,GAAG,MAAM,IAAI,2CAAmB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClE,OAAO,kCAAe,CAAC,MAAM,CAC3B,yCAAkB,CAAC,aAAa,EAAE,CAAC,OAAO,EAC1C,MAAM,CAAC,EAAE,CACV,CAAC;IACJ,CAAC;IAQK,AAAN,KAAK,CAAC,IAAI,CAAS,GAA2B;QAC5C,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACtD,OAAO,IAAI,8DAA4B,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CACrE,GAAG,CACJ,CAAC;IACJ,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAA6B,EAAU;QACjD,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACtD,OAAO,kCAAe,CAAC,MAAM,CAC3B,yCAAkB,CAAC,aAAa,EAAE,CAAC,OAAO,EAC1C,EAAE,CACH,CAAC;IACJ,CAAC;IAQK,AAAN,KAAK,CAAC,SAAS,CACe,EAAU,EAC9B,GAAuB;QAE/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,CAAC;QAClE,OAAO,IAAI,wDAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CACnE,EAAE,EACF,IAAI,EACJ,GAAG,CACJ,CAAC;IACJ,CAAC;IAQK,AAAN,KAAK,CAAC,cAAc,CACU,EAAU,EACL,OAAe,EACxC,GAAuB;QAE/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,CAAC;QAClE,OAAO,IAAI,wDAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CACnE,EAAE,EACF,OAAO,EACP,GAAG,CACJ,CAAC;IACJ,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAA6B,EAAU;QACjD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,CAAC;QACpE,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACrD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;CACF,CAAA;AAlGY,sDAAqB;AAc1B;IANL,IAAA,aAAI,GAAE;IACN,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,6CAA6C;QACtD,WAAW,EACT,qQAAqQ;KACxQ,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,6BAAY;;iDAOnC;AAQK;IANL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EACT,gIAAgI;KACnI,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,kDAAsB;;iDAK7C;AAQK;IANL,IAAA,YAAG,EAAC,KAAK,CAAC;IACV,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,sBAAsB;QAC/B,WAAW,EACT,4KAA4K;KAC/K,CAAC;IACY,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;mDAMvC;AAQK;IANL,IAAA,aAAI,EAAC,YAAY,CAAC;IAClB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,sCAAsC;QAC/C,WAAW,EACT,mNAAmN;KACtN,CAAC;IAEC,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;IAC1B,WAAA,IAAA,aAAI,GAAE,CAAA;;6CAAM,0CAAkB;;sDAQhC;AAQK;IANL,IAAA,aAAI,EAAC,4BAA4B,CAAC;IAClC,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,uCAAuC;QAChD,WAAW,EACT,iHAAiH;KACpH,CAAC;IAEC,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;IAC1B,WAAA,IAAA,cAAK,EAAC,SAAS,EAAE,sBAAa,CAAC,CAAA;IAC/B,WAAA,IAAA,aAAI,GAAE,CAAA;;qDAAM,0CAAkB;;2DAQhC;AAQK;IANL,IAAA,eAAM,EAAC,KAAK,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kBAAkB;QAC3B,WAAW,EACT,mIAAmI;KACtI,CAAC;IACY,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;mDAIvC;gCAjGU,qBAAqB;IAJjC,IAAA,iBAAO,EAAC,iBAAiB,CAAC;IAC1B,IAAA,uBAAa,GAAE;IACf,IAAA,iBAAQ,EAAC,6CAAoB,CAAC;IAC9B,IAAA,mBAAU,EAAC,mBAAmB,CAAC;qCAGS,yCAAkB;QACnB,uCAAiB;QACxB,wBAAU;QACF,yCAAkB;GAL9C,qBAAqB,CAkGjC"}

package/dist/admin/controllers/admin.tenant.report.controller.d.ts

@@ -0,0 +1,20 @@
+import { ListFilterService } from '../../common/services/list.filter.service';
+import { SqlService } from '../../common/services/sql.service';
+import { TenantReportDetailEntity } from '../../report/entities/tenant.report.detail.entity';
+import { AssignTenantReportDto } from '../dtos/assign.tenant.report.dto';
+import { TenantReportListDto } from '../dtos/tenant.report.list.dto';
+import { AdminAccessService } from '../services/admin.access.service';
+import { AdminReportService } from '../services/admin.report.service';
+export declare class AdminTenantReportController {
+    private readonly adminAccessService;
+    private readonly listFilterService;
+    private readonly sqlService;
+    private readonly adminReportService;
+    constructor(adminAccessService: AdminAccessService, listFilterService: ListFilterService, sqlService: SqlService, adminReportService: AdminReportService);
+    save(dto: AssignTenantReportDto): Promise<TenantReportDetailEntity>;
+    list(dto: TenantReportListDto): Promise<import("../..").CommonListResult>;
+    remove(id: string): Promise<{
+        success: boolean;
+    }>;
+}
+//# sourceMappingURL=admin.tenant.report.controller.d.ts.map

package/dist/admin/controllers/admin.tenant.report.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.tenant.report.controller.d.ts","sourceRoot":"","sources":["../../../src/admin/controllers/admin.tenant.report.controller.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,mDAAmD,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAGrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAMtE,qBAIa,2BAA2B;IAEpC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;gBAHlB,kBAAkB,EAAE,kBAAkB,EACtC,iBAAiB,EAAE,iBAAiB,EACpC,UAAU,EAAE,UAAU,EACtB,kBAAkB,EAAE,kBAAkB;IASnD,IAAI,CACA,GAAG,EAAE,qBAAqB,GACjC,OAAO,CAAC,wBAAwB,CAAC;IAW9B,IAAI,CAAS,GAAG,EAAE,mBAAmB;IAarC,MAAM,CAA6B,EAAE,EAAE,MAAM;;;CAKpD"}

package/dist/admin/controllers/admin.tenant.report.controller.js

@@ -0,0 +1,92 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AdminTenantReportController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const strict_validation_pipe_1 = require("../../common/pipes/strict.validation.pipe");
+const list_filter_service_1 = require("../../common/services/list.filter.service");
+const sql_service_1 = require("../../common/services/sql.service");
+const assign_tenant_report_dto_1 = require("../dtos/assign.tenant.report.dto");
+const tenant_report_list_dto_1 = require("../dtos/tenant.report.list.dto");
+const tenant_report_data_processor_1 = require("../libraries/tenant.report.data.processor");
+const tenant_report_list_processor_1 = require("../libraries/tenant.report.list.processor");
+const admin_access_service_1 = require("../services/admin.access.service");
+const admin_report_service_1 = require("../services/admin.report.service");
+let AdminTenantReportController = class AdminTenantReportController {
+    constructor(adminAccessService, listFilterService, sqlService, adminReportService) {
+        this.adminAccessService = adminAccessService;
+        this.listFilterService = listFilterService;
+        this.sqlService = sqlService;
+        this.adminReportService = adminReportService;
+    }
+    async save(dto) {
+        const access = await this.adminAccessService.validateAdmin();
+        return new tenant_report_data_processor_1.TenantReportDataProcessor(access, this.sqlService).process(dto);
+    }
+    async list(dto) {
+        await this.adminAccessService.validateContentReader();
+        return new tenant_report_list_processor_1.AdminTenantReportListProcessor(this.listFilterService).process(dto);
+    }
+    async remove(id) {
+        const { user } = await this.adminAccessService.validateAdmin();
+        await this.adminReportService.disableTenantReport(id, user);
+        return { success: true };
+    }
+};
+exports.AdminTenantReportController = AdminTenantReportController;
+__decorate([
+    (0, common_1.Post)(),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Enable a report for a tenant, or edit that enablement.',
+        description: "Send an `id` to edit; `tenant_id` and `report_id` are fixed once created, and a report is enabled at most once per tenant. `parameters` must bind every placeholder of the report's scripts besides `:tenant_id`. Members still need the report's scope and permission. Requires the global admin role.",
+    }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [assign_tenant_report_dto_1.AssignTenantReportDto]),
+    __metadata("design:returntype", Promise)
+], AdminTenantReportController.prototype, "save", null);
+__decorate([
+    (0, common_1.Post)('list'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'List reports enabled per tenant.',
+        description: 'Send `tenant_id` or `report_id` to narrow to one tenant or one report. Requires at least the global content reader role.',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [tenant_report_list_dto_1.TenantReportListDto]),
+    __metadata("design:returntype", Promise)
+], AdminTenantReportController.prototype, "list", null);
+__decorate([
+    (0, common_1.Delete)(':id'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Disable a report for a tenant.',
+        description: 'Soft delete; its generated workbooks stay stored but can no longer be opened. Requires the global admin role.',
+    }),
+    __param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], AdminTenantReportController.prototype, "remove", null);
+exports.AdminTenantReportController = AdminTenantReportController = __decorate([
+    (0, swagger_1.ApiTags)('Admin - Tenant Reports'),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.UsePipes)(strict_validation_pipe_1.StrictValidationPipe),
+    (0, common_1.Controller)('api/admin/tenant-reports'),
+    __metadata("design:paramtypes", [admin_access_service_1.AdminAccessService,
+        list_filter_service_1.ListFilterService,
+        sql_service_1.SqlService,
+        admin_report_service_1.AdminReportService])
+], AdminTenantReportController);
+//# sourceMappingURL=admin.tenant.report.controller.js.map

package/dist/admin/controllers/admin.tenant.report.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.tenant.report.controller.js","sourceRoot":"","sources":["../../../src/admin/controllers/admin.tenant.report.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAQwB;AACxB,6CAAuE;AACvE,sFAAiF;AACjF,mFAA8E;AAC9E,mEAA+D;AAE/D,+EAAyE;AACzE,2EAAqE;AACrE,4FAAsF;AACtF,4FAA2F;AAC3F,2EAAsE;AACtE,2EAAsE;AAU/D,IAAM,2BAA2B,GAAjC,MAAM,2BAA2B;IACtC,YACmB,kBAAsC,EACtC,iBAAoC,EACpC,UAAsB,EACtB,kBAAsC;QAHtC,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,eAAU,GAAV,UAAU,CAAY;QACtB,uBAAkB,GAAlB,kBAAkB,CAAoB;IACtD,CAAC;IAQE,AAAN,KAAK,CAAC,IAAI,CACA,GAA0B;QAElC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC7D,OAAO,IAAI,wDAAyB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7E,CAAC;IAQK,AAAN,KAAK,CAAC,IAAI,CAAS,GAAwB;QACzC,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACtD,OAAO,IAAI,6DAA8B,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CACvE,GAAG,CACJ,CAAC;IACJ,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAA6B,EAAU;QACjD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC/D,MAAM,IAAI,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC5D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;CACF,CAAA;AA7CY,kEAA2B;AAchC;IANL,IAAA,aAAI,GAAE;IACN,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,wDAAwD;QACjE,WAAW,EACT,ySAAyS;KAC5S,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,gDAAqB;;uDAInC;AAQK;IANL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EACT,0HAA0H;KAC7H,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,4CAAmB;;uDAK1C;AAQK;IANL,IAAA,eAAM,EAAC,KAAK,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,+GAA+G;KAClH,CAAC;IACY,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;yDAIvC;sCA5CU,2BAA2B;IAJvC,IAAA,iBAAO,EAAC,wBAAwB,CAAC;IACjC,IAAA,uBAAa,GAAE;IACf,IAAA,iBAAQ,EAAC,6CAAoB,CAAC;IAC9B,IAAA,mBAAU,EAAC,0BAA0B,CAAC;qCAGE,yCAAkB;QACnB,uCAAiB;QACxB,wBAAU;QACF,yCAAkB;GAL9C,2BAA2B,CA6CvC"}

package/dist/admin/dtos/add.report.dto.d.ts

@@ -0,0 +1,35 @@
+import { CommonDataDto } from '../../common/dtos/common.data.dto';
+import { FilterValueTypeEnum } from '../../common/enums/filter.value.type.enum';
+import { ReportParameterType } from '../../report/enums/report.default.enum';
+export declare class ReportColumnDto {
+    identifier: string;
+    name?: string;
+    type?: FilterValueTypeEnum;
+    searchable?: boolean;
+}
+export declare class ReportParameterDefinitionDto {
+    name: string;
+    label?: string;
+    type: ReportParameterType;
+    required?: boolean;
+    default?: string | number | boolean | null;
+}
+export declare class ReportSheetItemDto {
+    id?: string;
+    name: string;
+    sort_order?: number;
+}
+export declare class AddReportDto extends CommonDataDto {
+    identifier: string;
+    name: string;
+    description?: string;
+    is_generative?: boolean;
+    scope_id?: string | null;
+    permission_id?: string | null;
+    columns?: ReportColumnDto[];
+    parameters?: ReportParameterDefinitionDto[];
+    is_active?: boolean;
+    sort_order?: number;
+    sheets?: ReportSheetItemDto[];
+}
+//# sourceMappingURL=add.report.dto.d.ts.map

package/dist/admin/dtos/add.report.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"add.report.dto.d.ts","sourceRoot":"","sources":["../../../src/admin/dtos/add.report.dto.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2CAA2C,CAAC;AAChF,OAAO,EAEL,mBAAmB,EACpB,MAAM,wCAAwC,CAAC;AAQhD,qBAAa,eAAe;IAM1B,UAAU,EAAE,MAAM,CAAC;IAMnB,IAAI,CAAC,EAAE,MAAM,CAAC;IAKd,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAK3B,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAGD,qBAAa,4BAA4B;IAMvC,IAAI,EAAE,MAAM,CAAC;IAMb,KAAK,CAAC,EAAE,MAAM,CAAC;IAIf,IAAI,EAAE,mBAAmB,CAAC;IAK1B,QAAQ,CAAC,EAAE,OAAO,CAAC;IASnB,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;CAC5C;AAGD,qBAAa,kBAAkB;IAI7B,EAAE,CAAC,EAAE,MAAM,CAAC;IAMZ,IAAI,EAAE,MAAM,CAAC;IAOb,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAOD,qBAAa,YAAa,SAAQ,aAAa;IAS7C,UAAU,EAAE,MAAM,CAAC;IAMnB,IAAI,EAAE,MAAM,CAAC;IAMb,WAAW,CAAC,EAAE,MAAM,CAAC;IAQrB,aAAa,CAAC,EAAE,OAAO,CAAC;IASxB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IASzB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAS9B,OAAO,CAAC,EAAE,eAAe,EAAE,CAAC;IAa5B,UAAU,CAAC,EAAE,4BAA4B,EAAE,CAAC;IAK5C,SAAS,CAAC,EAAE,OAAO,CAAC;IAOpB,UAAU,CAAC,EAAE,MAAM,CAAC;IAWpB,MAAM,CAAC,EAAE,kBAAkB,EAAE,CAAC;CAC/B"}