@open-rlb/nestjs-amqp 2.1.1 → 2.2.0

package/schematics/add-gateway/index.ts

@@ -0,0 +1,141 @@
+import { apply, chain, MergeStrategy, mergeWith, move, noop, Rule, SchematicContext, Tree, url } from '@angular-devkit/schematics';
+import { normalize } from 'path';
+import { ensureExchange, ensureQueue, ensureTopic } from '../utils/broker-yaml.util';
+import { addDeps, configureMainForGateway, createConfigLoader, wireAppModule } from '../utils/nest-wiring.util';
+import { findConfigYaml, readConfigDoc, setIn, upsertSeqItemByKey, writeConfigDoc } from '../utils/yaml-config.util';
+import { aclManagementPaths, adminManagementPaths } from './paths';
+import { AddGatewayOptions } from './schema';
+import { GwFeatures, importLines, libSymbols, moduleEntries } from './wiring';
+
+/**
+ * `add-gateway` — promote a plain microservice into a working gateway. It edits config.yaml (drop
+ * publisher route-discovery; declare the acl/admin/control + route-sync infra; seed the `gateway:`
+ * section AND its management routes) AND wires the app: AppModule (Broker/Proxy/Http/Acl/GatewayAdmin
+ * modules), main.ts (rawBody + WsAdapter), the config loader, in-memory repositories, and package.json
+ * deps. Every step is idempotent, so re-running (or running on an already-partly-wired app) is safe.
+ */
+export function main(options: AddGatewayOptions): Rule {
+  const r = resolveFlags(options);
+  return chain([
+    // Config edits + TypeScript wiring (directly unit-testable — no engine/url source needed).
+    configAndWireRule(options),
+    // In-memory starter repositories referenced by the wiring (Overwrite = idempotent re-copy).
+    copyAsset('db-core'),
+    r.acl ? copyAsset('acl') : noop(),
+    r.anyAdmin ? copyAsset('gateway-admin') : noop(),
+  ]);
+}
+
+interface Resolved {
+  exchange: string;
+  aclQueue: string;
+  adminQueue: string;
+  controlTopic: string;
+  routeExchange: string;
+  routeQueue: string;
+  acl: boolean;
+  admin: boolean;
+  routeReception: boolean;
+  anyAdmin: boolean;
+  features: GwFeatures;
+}
+
+function resolveFlags(options: AddGatewayOptions): Resolved {
+  const exchange = options.exchange || 'rlb';
+  const aclQueue = options.aclQueue || 'rlb-acl';
+  const adminQueue = options.adminQueue || 'rlb-gateway-admin';
+  const controlTopic = options.controlTopic || 'rlb-gateway-control';
+  const routeExchange = options.routeExchange || 'rlb-route-discovery';
+  const routeQueue = options.routeQueue || 'rlb-route-sync';
+  const acl = options.acl ?? true;
+  const admin = options.admin ?? true;
+  const routeReception = options.routeReception ?? true;
+  const anyAdmin = admin || routeReception;
+  const features: GwFeatures = { acl, admin, routeReception, routeExchange, routeQueue };
+  return { exchange, aclQueue, adminQueue, controlTopic, routeExchange, routeQueue, acl, admin, routeReception, anyAdmin, features };
+}
+
+/** The config.yaml edits + config-loader/AppModule/main.ts/package.json wiring — everything except the
+ *  url()-based asset copy, so it can be invoked directly against a Tree in unit tests. */
+export function configAndWireRule(options: AddGatewayOptions): Rule {
+  return (tree: Tree, context: SchematicContext) => {
+    const r = resolveFlags(options);
+    const opts = { overwrite: options.overwrite };
+    const configPath = findConfigYaml(tree, options.config);
+    const { doc, existed } = readConfigDoc(tree, configPath);
+    if (!existed) context.logger.info(`[rlb-amqp] ${configPath} not found — creating it.`);
+
+    // 1. A gateway consumes routes, it does not publish its own → drop publisher route-discovery.
+    if (doc.hasIn(['broker', 'routeDiscovery'])) {
+      doc.deleteIn(['broker', 'routeDiscovery']);
+      context.logger.info('[rlb-amqp] removed broker.routeDiscovery (a gateway consumes routes, it does not publish its own).');
+    }
+
+    // 2. Main exchange backing the acl/admin queues.
+    ensureExchange(doc, { name: r.exchange, type: 'direct' }, opts);
+
+    // 3. ACL infra — topic name is FIXED 'rlb-acl' (decorator-bound in the lib).
+    if (r.acl) {
+      ensureQueue(doc, { name: r.aclQueue, exchange: r.exchange, routingKey: r.aclQueue, durable: true }, opts);
+      ensureTopic(doc, { name: 'rlb-acl', mode: 'rpc', queue: r.aclQueue, exchange: r.exchange, routingKey: r.aclQueue }, opts);
+    }
+
+    // 4. Gateway-admin infra — 'rlb-gateway-admin' is decorator-bound; controlTopic is a broadcast.
+    if (r.anyAdmin) {
+      ensureQueue(doc, { name: r.adminQueue, exchange: r.exchange, routingKey: r.adminQueue, durable: true }, opts);
+      ensureTopic(doc, { name: 'rlb-gateway-admin', mode: 'rpc', queue: r.adminQueue, exchange: r.exchange, routingKey: r.adminQueue }, opts);
+      ensureTopic(doc, { name: r.controlTopic, mode: 'broadcast', exchange: r.exchange, routingKey: r.controlTopic }, opts);
+    }
+
+    // 5. Consumer-side route-sync infra (fanout exchange + durable sync queue).
+    if (r.routeReception) {
+      ensureExchange(doc, { name: r.routeExchange, type: 'fanout' }, opts);
+      ensureQueue(doc, { name: r.routeQueue, exchange: r.routeExchange, durable: true }, opts);
+    }
+
+    // 6. gateway: section — set each key ONLY if absent, so user edits are never clobbered.
+    if (!doc.hasIn(['gateway', 'events'])) setIn(doc, ['gateway', 'events'], []);
+    if (!doc.hasIn(['gateway', 'ws'])) setIn(doc, ['gateway', 'ws'], { heartbeatIntervalMs: 30000 });
+    if (r.anyAdmin) {
+      if (!doc.hasIn(['gateway', 'reloadTopic'])) setIn(doc, ['gateway', 'reloadTopic'], r.controlTopic);
+      if (!doc.hasIn(['gateway', 'metrics'])) setIn(doc, ['gateway', 'metrics'], { topic: 'rlb-gateway-admin', action: 'gw-metrics-track' });
+      if (!doc.hasIn(['gateway', 'loadConfig'])) setIn(doc, ['gateway', 'loadConfig'], { paths: { topic: 'rlb-gateway-admin', action: 'gw-path-export' } });
+    }
+
+    // 7. Management routes so the wired ACL / gateway-admin modules are reachable over HTTP.
+    if (!doc.hasIn(['gateway', 'paths'])) setIn(doc, ['gateway', 'paths'], []);
+    const paths = [...(r.acl ? aclManagementPaths() : []), ...(r.anyAdmin ? adminManagementPaths(r.controlTopic) : [])];
+    for (const p of paths) upsertSeqItemByKey(doc, ['gateway', 'paths'], 'name', p as unknown as Record<string, unknown>, opts);
+
+    writeConfigDoc(tree, configPath, doc);
+
+    // 8. TypeScript wiring: config loader, AppModule modules, main.ts, package.json deps.
+    createConfigLoader(tree);
+    const modulePath = wireAppModule(tree, {
+      libSymbols: libSymbols(r.features),
+      importLines: importLines(r.features),
+      entries: moduleEntries(r.features),
+    });
+    if (!modulePath) {
+      context.logger.warn('[rlb-amqp] app.module.ts not found — module wiring skipped. Wire Broker/Proxy/Http' + (r.acl ? '/Acl' : '') + (r.anyAdmin ? '/GatewayAdmin' : '') + ' modules manually.');
+    }
+    if (!configureMainForGateway(tree)) {
+      context.logger.warn('[rlb-amqp] main.ts not found — enable rawBody + WsAdapter manually.');
+    }
+    addDeps(tree, {
+      '@nestjs/config': '^4.0.4',
+      'js-yaml': '^4.1.0',
+      '@nestjs/axios': '^4.0.1',
+      '@nestjs/platform-ws': '^11.0.1',
+      '@nestjs/websockets': '^11.0.1',
+      ws: '^8.21.0',
+    });
+
+    return tree;
+  };
+}
+
+/** Copy a static in-memory-repository asset tree under ./files/<name> to the project root. */
+function copyAsset(name: string): Rule {
+  return mergeWith(apply(url(`./files/${name}`), [move(normalize('.'))]), MergeStrategy.Overwrite);
+}

package/schematics/add-gateway/paths.d.ts

@@ -0,0 +1,12 @@
+export interface GatewayPath {
+    name: string;
+    method: string;
+    path: string;
+    dataSource: string;
+    topic: string;
+    action: string;
+    mode: string;
+    headers?: Record<string, string>;
+}
+export declare function aclManagementPaths(): GatewayPath[];
+export declare function adminManagementPaths(controlTopic: string): GatewayPath[];

package/schematics/add-gateway/paths.js

@@ -0,0 +1,87 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.aclManagementPaths = aclManagementPaths;
+exports.adminManagementPaths = adminManagementPaths;
+function aclManagementPaths() {
+    const rpc = (name, method, path, dataSource, action) => ({
+        name,
+        method,
+        path,
+        dataSource,
+        topic: 'rlb-acl',
+        action,
+        mode: 'rpc',
+    });
+    return [
+        rpc('acl-action-list', 'GET', '/acl/actions', 'query', 'acl-action-list'),
+        rpc('acl-action-get', 'GET', '/acl/actions/get', 'query', 'acl-action-get'),
+        rpc('acl-action-upsert', 'PUT', '/acl/actions', 'body', 'acl-action-update'),
+        rpc('acl-action-delete', 'DELETE', '/acl/actions', 'body', 'acl-action-delete'),
+        rpc('acl-action-search', 'GET', '/acl/actions/search', 'query', 'acl-action-search'),
+        rpc('acl-role-list', 'GET', '/acl/roles', 'query', 'acl-role-list'),
+        rpc('acl-role-get', 'GET', '/acl/roles/get', 'query', 'acl-role-get'),
+        rpc('acl-role-upsert', 'PUT', '/acl/roles', 'body', 'acl-role-update'),
+        rpc('acl-role-delete', 'DELETE', '/acl/roles', 'body', 'acl-role-delete'),
+        rpc('acl-role-search', 'GET', '/acl/roles/search', 'query', 'acl-role-search'),
+        rpc('acl-grant', 'POST', '/acl/grants', 'body', 'acl-grant'),
+        rpc('acl-revoke', 'DELETE', '/acl/grants', 'body', 'acl-revoke'),
+        rpc('acl-grant-search', 'GET', '/acl/grants/search', 'query', 'acl-grant-search'),
+        rpc('acl-check-action', 'GET', '/acl/check', 'query', 'acl-check-action'),
+        rpc('acl-list-resources-by-user', 'GET', '/acl/resources', 'query', 'acl-list-resources-by-user'),
+    ];
+}
+function adminManagementPaths(controlTopic) {
+    const rpc = (name, method, path, dataSource, action) => ({
+        name,
+        method,
+        path,
+        dataSource,
+        topic: 'rlb-gateway-admin',
+        action,
+        mode: 'rpc',
+    });
+    return [
+        rpc('health', 'GET', '/health', 'query', 'gw-health'),
+        rpc('gw-path-create', 'POST', '/admin/paths', 'body', 'gw-path-create'),
+        rpc('gw-path-list', 'GET', '/admin/paths', 'query', 'gw-path-list'),
+        rpc('gw-path-search', 'GET', '/admin/paths/search', 'query', 'gw-path-search'),
+        rpc('gw-path-export', 'GET', '/admin/paths/export', 'query', 'gw-path-export'),
+        rpc('gw-path-update', 'PUT', '/admin/paths', 'body', 'gw-path-update'),
+        rpc('gw-path-get', 'GET', '/admin/paths/get', 'query', 'gw-path-get'),
+        rpc('gw-path-delete', 'DELETE', '/admin/paths', 'body', 'gw-path-delete'),
+        rpc('gw-route-log-list', 'GET', '/admin/route-log', 'query', 'gw-route-log-list'),
+        rpc('gw-route-log-search', 'GET', '/admin/route-log/search', 'query', 'gw-route-log-search'),
+        rpc('gw-auth-list', 'GET', '/admin/auth', 'query', 'gw-auth-list'),
+        rpc('gw-auth-search', 'GET', '/admin/auth/search', 'query', 'gw-auth-search'),
+        rpc('gw-auth-upsert', 'PUT', '/admin/auth', 'body', 'gw-auth-update'),
+        rpc('gw-auth-get', 'GET', '/admin/auth/get', 'query', 'gw-auth-get'),
+        rpc('gw-auth-delete', 'DELETE', '/admin/auth', 'body', 'gw-auth-delete'),
+        rpc('gw-metrics-get', 'GET', '/admin/metrics', 'query', 'gw-metrics-get'),
+        rpc('gw-metrics-series', 'GET', '/admin/metrics/series', 'query', 'gw-metrics-series'),
+        rpc('gw-metrics-points', 'GET', '/admin/metrics/points', 'query', 'gw-metrics-points'),
+        rpc('gw-metrics-summary', 'GET', '/admin/metrics/summary', 'query', 'gw-metrics-summary'),
+        {
+            name: 'gw-metrics-prometheus',
+            method: 'GET',
+            path: '/admin/metrics/prometheus',
+            dataSource: 'query',
+            topic: 'rlb-gateway-admin',
+            action: 'gw-metrics-prometheus',
+            mode: 'rpc',
+            headers: { 'Content-Type': 'text/plain; version=0.0.4' },
+        },
+        rpc('gw-metrics-rollups', 'GET', '/admin/metrics/rollups', 'query', 'gw-metrics-rollups'),
+        {
+            name: 'gw-metrics-track',
+            method: 'POST',
+            path: '/admin/metrics/track',
+            dataSource: 'body',
+            topic: 'rlb-gateway-admin',
+            action: 'gw-metrics-track',
+            mode: 'event',
+        },
+        { name: 'gw-reload', method: 'POST', path: '/admin/reload', dataSource: 'body', topic: controlTopic, action: 'gw-reload', mode: 'event' },
+        { name: 'gw-auth-reload', method: 'POST', path: '/admin/auth/reload', dataSource: 'body', topic: controlTopic, action: 'gw-auth-reload', mode: 'event' },
+    ];
+}
+//# sourceMappingURL=paths.js.map

package/schematics/add-gateway/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../../libs/rlb-nestjs-amqp/src/schematics/add-gateway/paths.ts"],"names":[],"mappings":";;AAmBA,gDA2BC;AAGD,oDAqDC;AAnFD,SAAgB,kBAAkB;IAChC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,MAAc,EAAE,IAAY,EAAE,UAAkB,EAAE,MAAc,EAAe,EAAE,CAAC,CAAC;QAC5G,IAAI;QACJ,MAAM;QACN,IAAI;QACJ,UAAU;QACV,KAAK,EAAE,SAAS;QAChB,MAAM;QACN,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,OAAO;QACL,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,CAAC;QACzE,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,gBAAgB,CAAC;QAC3E,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,mBAAmB,CAAC;QAC5E,GAAG,CAAC,mBAAmB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,mBAAmB,CAAC;QAC/E,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,qBAAqB,EAAE,OAAO,EAAE,mBAAmB,CAAC;QACpF,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,eAAe,CAAC;QACnE,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,cAAc,CAAC;QACrE,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,iBAAiB,CAAC;QACtE,GAAG,CAAC,iBAAiB,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,iBAAiB,CAAC;QACzE,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,CAAC;QAC9E,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,CAAC;QAC5D,GAAG,CAAC,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,CAAC;QAChE,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,kBAAkB,CAAC;QACjF,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,kBAAkB,CAAC;QACzE,GAAG,CAAC,4BAA4B,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,4BAA4B,CAAC;KAClG,CAAC;AACJ,CAAC;AAGD,SAAgB,oBAAoB,CAAC,YAAoB;IACvD,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,MAAc,EAAE,IAAY,EAAE,UAAkB,EAAE,MAAc,EAAe,EAAE,CAAC,CAAC;QAC5G,IAAI;QACJ,MAAM;QACN,IAAI;QACJ,UAAU;QACV,KAAK,EAAE,mBAAmB;QAC1B,MAAM;QACN,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,OAAO;QACL,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC;QACrD,GAAG,CAAC,gBAAgB,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,gBAAgB,CAAC;QACvE,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,CAAC;QACnE,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,qBAAqB,EAAE,OAAO,EAAE,gBAAgB,CAAC;QAC9E,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,qBAAqB,EAAE,OAAO,EAAE,gBAAgB,CAAC;QAC9E,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,gBAAgB,CAAC;QACtE,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,aAAa,CAAC;QACrE,GAAG,CAAC,gBAAgB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,gBAAgB,CAAC;QACzE,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,mBAAmB,CAAC;QACjF,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,yBAAyB,EAAE,OAAO,EAAE,qBAAqB,CAAC;QAC5F,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,CAAC;QAClE,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,gBAAgB,CAAC;QAC7E,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,CAAC;QACrE,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,aAAa,CAAC;QACpE,GAAG,CAAC,gBAAgB,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,CAAC;QACxE,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,CAAC;QACzE,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,uBAAuB,EAAE,OAAO,EAAE,mBAAmB,CAAC;QACtF,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,uBAAuB,EAAE,OAAO,EAAE,mBAAmB,CAAC;QACtF,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,wBAAwB,EAAE,OAAO,EAAE,oBAAoB,CAAC;QACzF;YACE,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,2BAA2B;YACjC,UAAU,EAAE,OAAO;YACnB,KAAK,EAAE,mBAAmB;YAC1B,MAAM,EAAE,uBAAuB;YAC/B,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE;SACzD;QACD,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,wBAAwB,EAAE,OAAO,EAAE,oBAAoB,CAAC;QACzF;YACE,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,sBAAsB;YAC5B,UAAU,EAAE,MAAM;YAClB,KAAK,EAAE,mBAAmB;YAC1B,MAAM,EAAE,kBAAkB;YAC1B,IAAI,EAAE,OAAO;SACd;QACD,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE;QACzI,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,EAAE;KACzJ,CAAC;AACJ,CAAC"}

package/schematics/add-gateway/paths.ts

@@ -0,0 +1,103 @@
+/**
+ * The management HTTP routes a gateway exposes so the ACL and gateway-admin RPC surfaces are
+ * reachable over HTTP. Seeded into `gateway.paths[]` (idempotent upsert by `name`) so the wired
+ * AclModule / GatewayAdminModule are actually usable — a gateway with the modules but no routes
+ * is inert. Name-keyed resources use PUT-upsert (no POST); `acl-grant`/`acl-revoke` are the exception.
+ */
+
+export interface GatewayPath {
+  name: string;
+  method: string;
+  path: string;
+  dataSource: string;
+  topic: string;
+  action: string;
+  mode: string;
+  headers?: Record<string, string>;
+}
+
+/** ACL management + check routes (topic `rlb-acl`). */
+export function aclManagementPaths(): GatewayPath[] {
+  const rpc = (name: string, method: string, path: string, dataSource: string, action: string): GatewayPath => ({
+    name,
+    method,
+    path,
+    dataSource,
+    topic: 'rlb-acl',
+    action,
+    mode: 'rpc',
+  });
+  return [
+    rpc('acl-action-list', 'GET', '/acl/actions', 'query', 'acl-action-list'),
+    rpc('acl-action-get', 'GET', '/acl/actions/get', 'query', 'acl-action-get'),
+    rpc('acl-action-upsert', 'PUT', '/acl/actions', 'body', 'acl-action-update'),
+    rpc('acl-action-delete', 'DELETE', '/acl/actions', 'body', 'acl-action-delete'),
+    rpc('acl-action-search', 'GET', '/acl/actions/search', 'query', 'acl-action-search'),
+    rpc('acl-role-list', 'GET', '/acl/roles', 'query', 'acl-role-list'),
+    rpc('acl-role-get', 'GET', '/acl/roles/get', 'query', 'acl-role-get'),
+    rpc('acl-role-upsert', 'PUT', '/acl/roles', 'body', 'acl-role-update'),
+    rpc('acl-role-delete', 'DELETE', '/acl/roles', 'body', 'acl-role-delete'),
+    rpc('acl-role-search', 'GET', '/acl/roles/search', 'query', 'acl-role-search'),
+    rpc('acl-grant', 'POST', '/acl/grants', 'body', 'acl-grant'),
+    rpc('acl-revoke', 'DELETE', '/acl/grants', 'body', 'acl-revoke'),
+    rpc('acl-grant-search', 'GET', '/acl/grants/search', 'query', 'acl-grant-search'),
+    rpc('acl-check-action', 'GET', '/acl/check', 'query', 'acl-check-action'),
+    rpc('acl-list-resources-by-user', 'GET', '/acl/resources', 'query', 'acl-list-resources-by-user'),
+  ];
+}
+
+/** Gateway-admin routes (topic `rlb-gateway-admin`; the two reloads publish on `controlTopic`). */
+export function adminManagementPaths(controlTopic: string): GatewayPath[] {
+  const rpc = (name: string, method: string, path: string, dataSource: string, action: string): GatewayPath => ({
+    name,
+    method,
+    path,
+    dataSource,
+    topic: 'rlb-gateway-admin',
+    action,
+    mode: 'rpc',
+  });
+  return [
+    rpc('health', 'GET', '/health', 'query', 'gw-health'),
+    rpc('gw-path-create', 'POST', '/admin/paths', 'body', 'gw-path-create'),
+    rpc('gw-path-list', 'GET', '/admin/paths', 'query', 'gw-path-list'),
+    rpc('gw-path-search', 'GET', '/admin/paths/search', 'query', 'gw-path-search'),
+    rpc('gw-path-export', 'GET', '/admin/paths/export', 'query', 'gw-path-export'),
+    rpc('gw-path-update', 'PUT', '/admin/paths', 'body', 'gw-path-update'),
+    rpc('gw-path-get', 'GET', '/admin/paths/get', 'query', 'gw-path-get'),
+    rpc('gw-path-delete', 'DELETE', '/admin/paths', 'body', 'gw-path-delete'),
+    rpc('gw-route-log-list', 'GET', '/admin/route-log', 'query', 'gw-route-log-list'),
+    rpc('gw-route-log-search', 'GET', '/admin/route-log/search', 'query', 'gw-route-log-search'),
+    rpc('gw-auth-list', 'GET', '/admin/auth', 'query', 'gw-auth-list'),
+    rpc('gw-auth-search', 'GET', '/admin/auth/search', 'query', 'gw-auth-search'),
+    rpc('gw-auth-upsert', 'PUT', '/admin/auth', 'body', 'gw-auth-update'),
+    rpc('gw-auth-get', 'GET', '/admin/auth/get', 'query', 'gw-auth-get'),
+    rpc('gw-auth-delete', 'DELETE', '/admin/auth', 'body', 'gw-auth-delete'),
+    rpc('gw-metrics-get', 'GET', '/admin/metrics', 'query', 'gw-metrics-get'),
+    rpc('gw-metrics-series', 'GET', '/admin/metrics/series', 'query', 'gw-metrics-series'),
+    rpc('gw-metrics-points', 'GET', '/admin/metrics/points', 'query', 'gw-metrics-points'),
+    rpc('gw-metrics-summary', 'GET', '/admin/metrics/summary', 'query', 'gw-metrics-summary'),
+    {
+      name: 'gw-metrics-prometheus',
+      method: 'GET',
+      path: '/admin/metrics/prometheus',
+      dataSource: 'query',
+      topic: 'rlb-gateway-admin',
+      action: 'gw-metrics-prometheus',
+      mode: 'rpc',
+      headers: { 'Content-Type': 'text/plain; version=0.0.4' },
+    },
+    rpc('gw-metrics-rollups', 'GET', '/admin/metrics/rollups', 'query', 'gw-metrics-rollups'),
+    {
+      name: 'gw-metrics-track',
+      method: 'POST',
+      path: '/admin/metrics/track',
+      dataSource: 'body',
+      topic: 'rlb-gateway-admin',
+      action: 'gw-metrics-track',
+      mode: 'event',
+    },
+    { name: 'gw-reload', method: 'POST', path: '/admin/reload', dataSource: 'body', topic: controlTopic, action: 'gw-reload', mode: 'event' },
+    { name: 'gw-auth-reload', method: 'POST', path: '/admin/auth/reload', dataSource: 'body', topic: controlTopic, action: 'gw-auth-reload', mode: 'event' },
+  ];
+}

package/schematics/add-gateway/schema.d.ts

@@ -0,0 +1,13 @@
+export interface AddGatewayOptions {
+    exchange?: string;
+    aclQueue?: string;
+    adminQueue?: string;
+    controlTopic?: string;
+    routeExchange?: string;
+    routeQueue?: string;
+    acl?: boolean;
+    admin?: boolean;
+    routeReception?: boolean;
+    overwrite?: boolean;
+    config?: string;
+}

package/schematics/add-gateway/schema.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=schema.js.map

package/schematics/add-gateway/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../libs/rlb-nestjs-amqp/src/schematics/add-gateway/schema.ts"],"names":[],"mappings":""}

package/schematics/add-gateway/schema.json

@@ -0,0 +1,63 @@
+{
+  "$schema": "http://json-schema.org/schema",
+  "$id": "SchematicsRlbAmqpAddGateway",
+  "title": "Promote a microservice config to a gateway (config.yaml only)",
+  "type": "object",
+  "properties": {
+    "exchange": {
+      "type": "string",
+      "default": "rlb",
+      "description": "Main AMQP exchange backing the acl/admin queues."
+    },
+    "aclQueue": {
+      "type": "string",
+      "default": "rlb-acl",
+      "description": "Queue backing the fixed rlb-acl topic."
+    },
+    "adminQueue": {
+      "type": "string",
+      "default": "rlb-gateway-admin",
+      "description": "Queue backing the fixed rlb-gateway-admin topic."
+    },
+    "controlTopic": {
+      "type": "string",
+      "default": "rlb-gateway-control",
+      "description": "Broadcast control/reload topic name."
+    },
+    "routeExchange": {
+      "type": "string",
+      "default": "rlb-route-discovery",
+      "description": "Route-discovery fanout exchange (consumer side)."
+    },
+    "routeQueue": {
+      "type": "string",
+      "default": "rlb-route-sync",
+      "description": "Route-sync durable queue (consumer side)."
+    },
+    "acl": {
+      "type": "boolean",
+      "default": true,
+      "description": "Include ACL infra (rlb-acl topic/queue)."
+    },
+    "admin": {
+      "type": "boolean",
+      "default": true,
+      "description": "Include gateway-admin infra (rlb-gateway-admin topic/queue + control topic)."
+    },
+    "routeReception": {
+      "type": "boolean",
+      "default": true,
+      "description": "Consume routes auto-published by microservices (route-sync infra)."
+    },
+    "overwrite": {
+      "type": "boolean",
+      "default": false,
+      "description": "Update entries that already exist (default: leave them untouched)."
+    },
+    "config": {
+      "type": "string",
+      "description": "Path to config.yaml (default: auto-detected)."
+    }
+  },
+  "required": []
+}

package/schematics/add-gateway/schema.ts

@@ -0,0 +1,24 @@
+export interface AddGatewayOptions {
+  /** Main AMQP exchange backing the acl/admin queues. Default: 'rlb'. */
+  exchange?: string;
+  /** Queue backing the fixed rlb-acl topic. Default: 'rlb-acl'. */
+  aclQueue?: string;
+  /** Queue backing the fixed rlb-gateway-admin topic. Default: 'rlb-gateway-admin'. */
+  adminQueue?: string;
+  /** Broadcast control/reload topic name. Default: 'rlb-gateway-control'. */
+  controlTopic?: string;
+  /** Route-discovery fanout exchange (consumer side). Default: 'rlb-route-discovery'. */
+  routeExchange?: string;
+  /** Route-sync durable queue (consumer side). Default: 'rlb-route-sync'. */
+  routeQueue?: string;
+  /** Include ACL infra (rlb-acl topic/queue). Default: true. */
+  acl?: boolean;
+  /** Include gateway-admin infra (rlb-gateway-admin topic/queue + control topic). Default: true. */
+  admin?: boolean;
+  /** Consume routes auto-published by microservices (route-sync infra). Default: true. */
+  routeReception?: boolean;
+  /** Update entries that already exist (default: leave them untouched). */
+  overwrite?: boolean;
+  /** Path to config.yaml (default: auto-detected, typically config/config.yaml). */
+  config?: string;
+}

package/schematics/add-gateway/wiring.d.ts

@@ -0,0 +1,14 @@
+import { WireEntry } from '../utils/nest-wiring.util';
+export interface GwFeatures {
+    acl: boolean;
+    admin: boolean;
+    routeReception: boolean;
+    routeExchange: string;
+    routeQueue: string;
+}
+export declare function libSymbols(f: GwFeatures): string[];
+export declare function importLines(f: GwFeatures): {
+    line: string;
+    marker: string;
+}[];
+export declare function moduleEntries(f: GwFeatures): WireEntry[];

package/schematics/add-gateway/wiring.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.libSymbols = libSymbols;
+exports.importLines = importLines;
+exports.moduleEntries = moduleEntries;
+const nest_wiring_util_1 = require("../utils/nest-wiring.util");
+function libSymbols(f) {
+    const s = ['AppConfig', 'BrokerModule', 'BrokerTopic', 'GatewayConfig', 'HandlerAuthConfig', 'ProxyModule', 'RabbitMQConfig'];
+    if (f.acl)
+        s.push('AclActionRepository', 'AclGrantRepository', 'AclModule', 'AclRoleRepository', 'AclService', 'RLB_ACL_CACHE_STORE', 'RLB_GTW_ACL_ROLE_SERVICE');
+    if (f.admin || f.routeReception)
+        s.push('AuthProviderRepository', 'GatewayAdminModule', 'HttpMetricRepository', 'HttpPathRepository', 'RouteSyncLogRepository');
+    if (f.admin)
+        s.push('RLB_GTW_AUTH_PROVIDER_SOURCE');
+    return s;
+}
+function importLines(f) {
+    const lines = [
+        { line: `import { ConfigModule, ConfigService } from '@nestjs/config';`, marker: '@nestjs/config' },
+        { line: `import yamlConfig from './config/config.loader';`, marker: './config/config.loader' },
+        { line: `import { HttpModule } from '@nestjs/axios';`, marker: '@nestjs/axios' },
+    ];
+    if (f.acl) {
+        lines.push({ line: `import { InMemoryAclActionRepository, InMemoryAclGrantRepository, InMemoryAclRoleRepository } from './modules/database/repository/acl.repository';`, marker: './modules/database/repository/acl.repository' });
+        lines.push({ line: `import { InMemoryAclStore } from './cache/in-memory-acl-store';`, marker: './cache/in-memory-acl-store' });
+    }
+    if (f.admin || f.routeReception) {
+        lines.push({ line: `import { InMemoryAuthProviderRepository, InMemoryHttpMetricRepository, InMemoryHttpPathRepository } from './modules/database/repository/gateway.repository';`, marker: './modules/database/repository/gateway.repository' });
+        lines.push({ line: `import { InMemoryRouteSyncLogRepository } from './modules/database/repository/route-sync.repository';`, marker: './modules/database/repository/route-sync.repository' });
+    }
+    return lines;
+}
+const GATEWAY_SENTINEL = 'ProxyModule.forRootAsync';
+function moduleEntries(f) {
+    const entries = [
+        (0, nest_wiring_util_1.configModuleEntry)(),
+        (0, nest_wiring_util_1.brokerModuleEntry)(),
+        { code: `HttpModule`, sentinel: GATEWAY_SENTINEL },
+        { code: proxyForRootAsync(f), sentinel: GATEWAY_SENTINEL },
+    ];
+    if (f.acl)
+        entries.push({ code: aclForRoot(), sentinel: 'AclModule.forRoot' });
+    if (f.admin || f.routeReception)
+        entries.push({ code: gatewayAdminForRoot(f), sentinel: 'GatewayAdminModule.forRoot' });
+    return entries;
+}
+function proxyForRootAsync(f) {
+    const provs = [];
+    if (f.acl)
+        provs.push(`        // Action-gated paths resolve the caller's identity via AclService (in-process, no broker hop).
+        { provide: RLB_GTW_ACL_ROLE_SERVICE, useExisting: AclService },`);
+    if (f.admin)
+        provs.push(`        // DB auth-provider source for the runtime registry; activated by a deliberate gw-auth-reload.
+        { provide: RLB_GTW_AUTH_PROVIDER_SOURCE, useExisting: InMemoryAuthProviderRepository },`);
+    const providers = provs.length ? `[\n${provs.join('\n')}\n      ]` : `[]`;
+    return `ProxyModule.forRootAsync({
+      imports: [ConfigModule],
+      inject: [ConfigService],
+      useFactory: (configService: ConfigService) => ({
+        authOptions: configService.get<HandlerAuthConfig[]>('auth-providers'),
+        gatewayOptions: configService.get<GatewayConfig>('gateway'),
+      }),
+      providers: ${providers},
+    })`;
+}
+function aclForRoot() {
+    return `AclModule.forRoot(
+      [
+        InMemoryAclActionRepository,
+        { provide: AclActionRepository, useExisting: InMemoryAclActionRepository },
+        InMemoryAclRoleRepository,
+        { provide: AclRoleRepository, useExisting: InMemoryAclRoleRepository },
+        InMemoryAclGrantRepository,
+        { provide: AclGrantRepository, useExisting: InMemoryAclGrantRepository },
+        InMemoryAclStore,
+        { provide: RLB_ACL_CACHE_STORE, useExisting: InMemoryAclStore },
+      ],
+      { cache: { ramTtlMs: 30000, l2TtlSec: 600 } },
+    )`;
+}
+function gatewayAdminForRoot(f) {
+    const options = f.routeReception
+        ? `,
+      {
+        // Consumer-side route-discovery — names MUST match the publishers' broker.routeDiscovery.
+        routeDiscovery: { exchange: '${f.routeExchange}', queue: '${f.routeQueue}' },
+      }`
+        : '';
+    return `GatewayAdminModule.forRoot(
+      [
+        InMemoryHttpPathRepository,
+        { provide: HttpPathRepository, useExisting: InMemoryHttpPathRepository },
+        InMemoryAuthProviderRepository,
+        { provide: AuthProviderRepository, useExisting: InMemoryAuthProviderRepository },
+        InMemoryHttpMetricRepository,
+        { provide: HttpMetricRepository, useExisting: InMemoryHttpMetricRepository },
+        InMemoryRouteSyncLogRepository,
+        { provide: RouteSyncLogRepository, useExisting: InMemoryRouteSyncLogRepository },
+      ]${options},
+    )`;
+}
+//# sourceMappingURL=wiring.js.map

package/schematics/add-gateway/wiring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wiring.js","sourceRoot":"","sources":["../../../libs/rlb-nestjs-amqp/src/schematics/add-gateway/wiring.ts"],"names":[],"mappings":";;AAkBA,gCAMC;AAED,kCAeC;AAID,sCAWC;AAxDD,gEAA4F;AAkB5F,SAAgB,UAAU,CAAC,CAAa;IACtC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC;IAC9H,IAAI,CAAC,CAAC,GAAG;QAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,WAAW,EAAE,mBAAmB,EAAE,YAAY,EAAE,qBAAqB,EAAE,0BAA0B,CAAC,CAAC;IAClK,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,cAAc;QAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,wBAAwB,CAAC,CAAC;IAChK,IAAI,CAAC,CAAC,KAAK;QAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACpD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAgB,WAAW,CAAC,CAAa;IACvC,MAAM,KAAK,GAAG;QACZ,EAAE,IAAI,EAAE,+DAA+D,EAAE,MAAM,EAAE,gBAAgB,EAAE;QACnG,EAAE,IAAI,EAAE,kDAAkD,EAAE,MAAM,EAAE,wBAAwB,EAAE;QAC9F,EAAE,IAAI,EAAE,6CAA6C,EAAE,MAAM,EAAE,eAAe,EAAE;KACjF,CAAC;IACF,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;QACV,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oJAAoJ,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC,CAAC;QACnO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iEAAiE,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC,CAAC;IACjI,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,8JAA8J,EAAE,MAAM,EAAE,kDAAkD,EAAE,CAAC,CAAC;QACjP,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uGAAuG,EAAE,MAAM,EAAE,qDAAqD,EAAE,CAAC,CAAC;IAC/L,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AAEpD,SAAgB,aAAa,CAAC,CAAa;IAEzC,MAAM,OAAO,GAAgB;QAC3B,IAAA,oCAAiB,GAAE;QACnB,IAAA,oCAAiB,GAAE;QACnB,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,gBAAgB,EAAE;QAClD,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE;KAC3D,CAAC;IACF,IAAI,CAAC,CAAC,GAAG;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,cAAc;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,4BAA4B,EAAE,CAAC,CAAC;IACxH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAa;IACtC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,CAAC,GAAG;QACP,KAAK,CAAC,IAAI,CAAC;wEACyD,CAAC,CAAC;IACxE,IAAI,CAAC,CAAC,KAAK;QACT,KAAK,CAAC,IAAI,CAAC;gGACiF,CAAC,CAAC;IAChG,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,OAAO;;;;;;;mBAOU,SAAS;OACrB,CAAC;AACR,CAAC;AAED,SAAS,UAAU;IACjB,OAAO;;;;;;;;;;;;MAYH,CAAC;AACP,CAAC;AAED,SAAS,mBAAmB,CAAC,CAAa;IACxC,MAAM,OAAO,GAAG,CAAC,CAAC,cAAc;QAC9B,CAAC,CAAC;;;uCAGiC,CAAC,CAAC,aAAa,cAAc,CAAC,CAAC,UAAU;QACxE;QACJ,CAAC,CAAC,EAAE,CAAC;IACP,OAAO;;;;;;;;;;SAUA,OAAO;MACV,CAAC;AACP,CAAC"}