@podosoft/podokit 0.17.4 → 1.0.2

package/dist/templates/fullstack-nest-svelte/dot-claude/skills/podokit-nest-endpoint/SKILL.md

@@ -1,23 +0,0 @@
----
-name: podokit-nest-endpoint
-description: Use when adding or changing a NestJS REST endpoint in apps/api — a controller/service with DTO validation, the standard error envelope, and a test. Follow this for any new backend route in a PodoKit project.
----
-
-# Add a NestJS endpoint (PodoKit conventions)
-
-1. **Module**: create/extend a Nest module under `apps/api/src/<feature>/`
-   (`<feature>.module.ts`, `.controller.ts`, `.service.ts`, `dto/`). Register the
-   module in `apps/api/src/app.module.ts` — add it **inside** the
-   `// podokit:begin:module-imports … end` fence, never outside it.
-2. **DTOs**: validate every input with `class-validator` decorators on a DTO
-   class. No `any`; give explicit return types.
-3. **Errors**: throw `AppException("STABLE_CODE", "message", statusCode)` (from
-   `@podosoft/podokit-contracts` / the app's `common/`). The global filter renders
-   it as `{ success: false, error: { code, message, statusCode, path, timestamp } }`.
-   Pick a stable, UPPER_SNAKE `code` — the frontend branches on it.
-4. **Auth**: if the `auth` module is installed the API is secure by default; mark
-   public routes with `@Public()` and read the user with `@Session()`.
-5. **Swagger**: annotate with `@ApiTags` so it shows under `/api-docs`.
-6. **Test**: add an e2e/unit test under `apps/api` or the `tests/` workspace
-   (Nest e2e or Vitest + supertest). Verify with
-   `npm run build -w {{projectName}}-api` and the test.

package/dist/templates/fullstack-nest-svelte/dot-claude/skills/podokit-sveltekit-route/SKILL.md

@@ -1,23 +0,0 @@
----
-name: podokit-sveltekit-route
-description: Use when adding or changing a SvelteKit page/route in apps/web — pages that call the API, use shadcn-svelte components, and localize text. Follow this for any new frontend screen in a PodoKit project.
----
-
-# Add a SvelteKit route (PodoKit conventions)
-
-1. **Route**: add a folder under `apps/web/src/routes/`. Load data in
-   `+page.server.ts` / `+layout.server.ts` (SSR), not in the browser.
-2. **Call the API only through the server proxy** — never a direct browser
-   `fetch` to `:5002`. Use the app's `ApiClient`: `$lib/api.ts` (browser,
-   same-origin `/api/*` proxy) and `$lib/server/api.ts` (SSR, internal URL +
-   cookie forwarding). It throws `ApiError` — branch on `err.code`.
-3. **Svelte 5 runes only**: `$state`, `$derived`, `$effect`, `$props`. Never `$:`.
-4. **UI**: use shadcn-svelte components (`$lib/components/ui/*`) over raw HTML.
-   Do **not** edit `ui/**` — wrap it if you need to customize. Semantic Tailwind
-   classes (`bg-background`, `text-foreground`); responsive (`sm:`/`md:`/`lg:`).
-   For any list/table, use the shared `DataTable` (see the podokit-data-table
-   skill, added with the admin-dashboard module).
-5. **i18n**: no hardcoded user-facing strings — add keys to
-   `apps/web/src/lib/i18n/messages.ts` for **every** locale.
-6. **Verify**: `npm run build -w {{projectName}}-web` (includes `svelte-check`)
-   and add/adjust a Playwright test in `tests/`.

package/dist/templates/fullstack-nest-svelte/dot-devcontainer/devcontainer.json

@@ -1,20 +0,0 @@
-{
-  "name": "{{projectName}} (containerized dev)",
-  "dockerComposeFile": ["../compose.dev.yaml"],
-  "service": "api",
-  "workspaceFolder": "/app",
-  "runServices": ["traefik", "web", "api", "worker", "postgres", "redis", "minio", "minio-init"],
-  "shutdownAction": "stopCompose",
-  "customizations": {
-    "vscode": {
-      "extensions": [
-        "svelte.svelte-vscode",
-        "dbaeumer.vscode-eslint",
-        "esbenp.prettier-vscode",
-        "bradlc.vscode-tailwindcss"
-      ]
-    }
-  },
-  "forwardPorts": [],
-  "remoteUser": "node"
-}

package/dist/templates/fullstack-nest-svelte/dot-github/workflows/release.yml

@@ -1,142 +0,0 @@
-# Build and publish the release images for a tag.
-#
-# `podo deploy` consumes images; it does not build them. This is the other half:
-# tagging a commit produces the two images that `podo deploy apply` then rolls out.
-# It stops at the push, because rolling out requires confirming a plan hash and that
-# approval belongs to a person.
-#
-# ── Which runner, and what it costs ──────────────────────────────────────────────
-#
-# GitHub-hosted runners are free for PUBLIC repositories only. In a PRIVATE
-# repository every minute is metered against the account's included Actions minutes
-# and billed beyond them -- and image builds are the most expensive job most
-# projects run. A self-hosted runner consumes no Actions minutes at all, whatever
-# the repository's visibility.
-#
-# So the runner is a variable rather than a constant:
-#
-#   PODOKIT_RUNNER   repository or organization variable, a JSON array of labels.
-#                    Unset -> ["ubuntu-latest"], which is right for a public
-#                    repository and costs money in a private one.
-#                    Self-hosted example: ["self-hosted","Linux","X64"]
-#
-# Set it before the first tag if this repository is private. Nothing here warns you
-# when you have not: the workflow succeeds either way, and the difference shows up
-# on a bill.
-#
-# ── The other two variables ──────────────────────────────────────────────────────
-#
-#   PODOKIT_DEPLOY_PROFILE   which .podokit/deploy/<name>.json names the image
-#                            repositories. Unset -> production.
-#   PODOKIT_IMAGE_PLATFORM   the architecture the deployment target runs.
-#                            Unset -> linux/amd64. Building for the wrong one
-#                            produces "exec format error" at rollout, after the
-#                            migration has already run.
-#
-# ── Secrets ──────────────────────────────────────────────────────────────────────
-#
-#   REGISTRY_USERNAME / REGISTRY_PASSWORD   credentials for the registry named by
-#   the profile. A robot or deploy account is enough, but note that some registries
-#   refuse to let a robot CREATE a repository -- push the first tag of a new
-#   repository with an account that can, or create it in the registry first.
-
-name: release
-
-on:
-  push:
-    tags:
-      - "v*.*.*"
-
-concurrency:
-  group: release-${{ github.ref }}
-  cancel-in-progress: false
-
-jobs:
-  images:
-    # One job builds both images rather than a matrix of two. A self-hosted pool is
-    # usually small, and fanning out here takes runners away from every other
-    # repository that shares it for no wall-clock gain on a multi-core machine.
-    runs-on: ${{ fromJSON(vars.PODOKIT_RUNNER || '["ubuntu-latest"]') }}
-    steps:
-      - uses: actions/checkout@v5
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 22
-          cache: npm
-
-      - run: npm ci --no-audit --no-fund
-
-      # Verify before publishing. An image built from a commit that never passed is
-      # indistinguishable from one that did, once it is in the registry.
-      - run: npm run lint
-      - run: npm test
-
-      - name: Read the release target from the deployment profile
-        id: profile
-        run: |
-          node --input-type=module -e '
-            import { readFileSync } from "node:fs";
-            const name = process.env.PROFILE || "production";
-            const path = `.podokit/deploy/${name}.json`;
-            let profile;
-            try {
-              profile = JSON.parse(readFileSync(path, "utf8"));
-            } catch {
-              throw new Error(`No deployment profile at ${path}. Run podo deploy init first.`);
-            }
-            const { apiRepository, webRepository } = profile.release ?? {};
-            if (!apiRepository || !webRepository) {
-              throw new Error(`${path} does not declare release.apiRepository and release.webRepository.`);
-            }
-            // Everything before the first slash is a registry host only when it
-            // looks like one; otherwise the reference is a Docker Hub short name.
-            const first = apiRepository.split("/")[0];
-            const registry = /[.:]/.test(first) ? first : "";
-            const out = [
-              `api=${apiRepository}`,
-              `web=${webRepository}`,
-              `registry=${registry}`,
-              `tag=${process.env.GITHUB_REF_NAME}`,
-            ].join("\n");
-            process.stdout.write(out + "\n");
-          ' >> "$GITHUB_OUTPUT"
-        env:
-          PROFILE: ${{ vars.PODOKIT_DEPLOY_PROFILE }}
-
-      - uses: docker/setup-buildx-action@v3
-
-      - uses: docker/login-action@v3
-        with:
-          registry: ${{ steps.profile.outputs.registry }}
-          username: ${{ secrets.REGISTRY_USERNAME }}
-          password: ${{ secrets.REGISTRY_PASSWORD }}
-
-      - name: Build and push the API image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: apps/api/Dockerfile
-          platforms: ${{ vars.PODOKIT_IMAGE_PLATFORM || 'linux/amd64' }}
-          push: true
-          tags: ${{ steps.profile.outputs.api }}:${{ steps.profile.outputs.tag }}
-          cache-from: type=gha,scope=api
-          cache-to: type=gha,scope=api,mode=max
-
-      - name: Build and push the web image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: apps/web/Dockerfile
-          platforms: ${{ vars.PODOKIT_IMAGE_PLATFORM || 'linux/amd64' }}
-          push: true
-          tags: ${{ steps.profile.outputs.web }}:${{ steps.profile.outputs.tag }}
-          cache-from: type=gha,scope=web
-          cache-to: type=gha,scope=web,mode=max
-
-      - name: Report what to deploy
-        run: |
-          echo "Pushed ${{ steps.profile.outputs.api }}:${{ steps.profile.outputs.tag }}" >> "$GITHUB_STEP_SUMMARY"
-          echo "Pushed ${{ steps.profile.outputs.web }}:${{ steps.profile.outputs.tag }}" >> "$GITHUB_STEP_SUMMARY"
-          echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo 'Roll out with `podo deploy plan --profile <name> --release ${{ steps.profile.outputs.tag }}`, then apply the printed hash.' >> "$GITHUB_STEP_SUMMARY"

package/dist/templates/fullstack-nest-svelte/dot-mcp.json

@@ -1,8 +0,0 @@
-{
-  "mcpServers": {
-    "podokit": {
-      "command": "npx",
-      "args": ["-y", "@podosoft/podokit-mcp"]
-    }
-  }
-}

package/dist/templates/fullstack-nest-svelte/dot-podokit/dev.json

@@ -1,4 +0,0 @@
-{
-  "schemaVersion": 1,
-  "hostname": "{{projectName}}.localhost"
-}

package/dist/templates/fullstack-nest-svelte/package.json

@@ -1,21 +0,0 @@
-{
-  "name": "{{projectName}}",
-  "version": "0.0.0",
-  "private": true,
-  "engines": {
-    "node": ">=22.22.1"
-  },
-  "workspaces": [
-    "apps/*",
-    "tests"
-  ],
-  "scripts": {
-    "dev": "npm run dev --workspaces --if-present",
-    "build": "npm run build --workspaces --if-present",
-    "lint": "npm run lint --workspaces --if-present",
-    "test": "npm run test --workspaces --if-present",
-    "test:e2e": "npm run test:e2e -w tests",
-    "test:e2e:ui": "npm run test:e2e:ui -w tests",
-    "test:e2e:api": "npm run test:e2e:api -w tests"
-  }
-}

package/dist/templates/fullstack-nest-svelte/tests/package.json

@@ -1,15 +0,0 @@
-{
-  "name": "{{projectName}}-tests",
-  "version": "0.0.0",
-  "private": true,
-  "scripts": {
-    "test:e2e": "playwright test",
-    "test:e2e:ui": "playwright test --project=ui",
-    "test:e2e:api": "playwright test --project=api",
-    "test:e2e:report": "playwright show-report"
-  },
-  "devDependencies": {
-    "@playwright/test": "^1.61.1",
-    "otpauth": "^9.5.1"
-  }
-}

package/dist/templates/modules/admin-dashboard/files/apps/api/src/profile-image/profile-image-upload.interceptor.ts

@@ -1,39 +0,0 @@
-import {
-  type CallHandler,
-  type ExecutionContext,
-  Injectable,
-  PayloadTooLargeException,
-} from "@nestjs/common";
-import { FileInterceptor } from "@nestjs/platform-express";
-import {
-  AppException,
-  PROFILE_IMAGE_POLICY,
-  PROFILE_IMAGE_TOO_LARGE,
-} from "@podosoft/podokit-contracts";
-import type { Observable } from "rxjs";
-
-const ProfileImageFileInterceptor = FileInterceptor("file", {
-  limits: { fileSize: PROFILE_IMAGE_POLICY.maxBytes },
-});
-
-/** Preserve a stable error code when Multer rejects an oversized request. */
-@Injectable()
-export class ProfileImageUploadInterceptor extends ProfileImageFileInterceptor {
-  override async intercept(
-    context: ExecutionContext,
-    next: CallHandler,
-  ): Promise<Observable<unknown>> {
-    try {
-      return await super.intercept(context, next);
-    } catch (error: unknown) {
-      if (error instanceof PayloadTooLargeException) {
-        throw new AppException(
-          PROFILE_IMAGE_TOO_LARGE,
-          "Profile image must be 2 MB or smaller.",
-          413,
-        );
-      }
-      throw error;
-    }
-  }
-}

package/dist/templates/modules/admin-dashboard/files/apps/api/src/profile-image/profile-image.controller.ts

@@ -1,73 +0,0 @@
-/// <reference types="multer" />
-import {
-  Controller,
-  Delete,
-  Get,
-  Param,
-  Post,
-  Req,
-  Res,
-  StreamableFile,
-  UploadedFile,
-  UseInterceptors,
-} from "@nestjs/common";
-import { ApiConsumes, ApiTags } from "@nestjs/swagger";
-import { Public, Session, type UserSession } from "@thallesp/nestjs-better-auth";
-import {
-  AppException,
-  PROFILE_IMAGE_REQUIRED,
-  type ProfileImageResponse,
-} from "@podosoft/podokit-contracts";
-import { fromNodeHeaders } from "better-auth/node";
-import type { Request, Response } from "express";
-import { ProfileImageService } from "./profile-image.service";
-import { ProfileImageUploadInterceptor } from "./profile-image-upload.interceptor";
-
-@ApiTags("account")
-@Controller()
-export class ProfileImageController {
-  constructor(private readonly profileImages: ProfileImageService) {}
-
-  @Post("account/profile-image")
-  @ApiConsumes("multipart/form-data")
-  @UseInterceptors(ProfileImageUploadInterceptor)
-  async upload(
-    @Session() session: UserSession,
-    @Req() req: Request,
-    @UploadedFile() file?: Express.Multer.File,
-  ): Promise<ProfileImageResponse> {
-    if (!file) {
-      throw new AppException(
-        PROFILE_IMAGE_REQUIRED,
-        "A profile image file is required.",
-      );
-    }
-    return this.profileImages.upload(
-      session.user.image ?? null,
-      file,
-      fromNodeHeaders(req.headers),
-    );
-  }
-
-  @Delete("account/profile-image")
-  async remove(
-    @Session() session: UserSession,
-    @Req() req: Request,
-  ): Promise<ProfileImageResponse> {
-    return this.profileImages.remove(
-      session.user.image ?? null,
-      fromNodeHeaders(req.headers),
-    );
-  }
-
-  @Public()
-  @Get("profile-images/:fileName")
-  async get(
-    @Param("fileName") fileName: string,
-    @Res({ passthrough: true }) response: Response,
-  ): Promise<StreamableFile> {
-    const image = await this.profileImages.get(fileName);
-    response.setHeader("Cache-Control", "public, max-age=31536000, immutable");
-    return new StreamableFile(image.body, { type: image.contentType });
-  }
-}

package/dist/templates/modules/admin-dashboard/files/apps/api/src/profile-image/profile-image.module.ts

@@ -1,9 +0,0 @@
-import { Module } from "@nestjs/common";
-import { ProfileImageController } from "./profile-image.controller";
-import { ProfileImageService } from "./profile-image.service";
-
-@Module({
-  controllers: [ProfileImageController],
-  providers: [ProfileImageService],
-})
-export class ProfileImageModule {}

package/dist/templates/modules/admin-dashboard/files/apps/api/src/site-settings/site-settings.controller.ts

@@ -1,155 +0,0 @@
-/// <reference types="multer" />
-import {
-  BadRequestException,
-  Body,
-  Controller,
-  ForbiddenException,
-  Get,
-  Post,
-  Put,
-  StreamableFile,
-  UploadedFile,
-  UseInterceptors,
-} from "@nestjs/common";
-import { FileInterceptor } from "@nestjs/platform-express";
-import { ApiConsumes, ApiTags } from "@nestjs/swagger";
-import { Public, Session, type UserSession } from "@thallesp/nestjs-better-auth";
-import { PUBLIC_SITE_KEYS, SiteSettingsService } from "./site-settings.service";
-
-function isAdmin(session: UserSession): boolean {
-  const role = session.user?.role;
-  const roles = Array.isArray(role) ? role : (role ?? "").split(",").map((r: string) => r.trim());
-  return roles.includes("admin");
-}
-
-const ALLOWED = new Set<string>(PUBLIC_SITE_KEYS);
-const MAX_ICON_BYTES = 1024 * 1024; // 1 MB
-const ICON_TYPES = new Set(["image/svg+xml", "image/png", "image/x-icon", "image/vnd.microsoft.icon"]);
-
-// Theme values are injected into a client-side <style>, so validate them to
-// prevent CSS injection. Colors must be hex, radius a bounded rem number,
-// preset a slug, and overrides a JSON map of hex colors under known token keys.
-const HEX = /^#(?:[0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$/;
-const PRESET = /^[a-z0-9-]{1,32}$/;
-const LOCALE = /^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{2,8})*$/;
-const THEME_TOKEN_KEYS = new Set([
-  "background",
-  "card",
-  "foreground",
-  "mutedForeground",
-  "border",
-  "secondary",
-  "accent",
-  "primary",
-  "primaryForeground",
-]);
-
-/** Validate/normalize a single theme setting value. Empty string clears it. */
-function validateThemeValue(key: string, value: string): string {
-  if (value === "") return "";
-  if (key === "locale") {
-    if (!LOCALE.test(value)) throw new BadRequestException("locale must be a valid BCP 47 language tag");
-    try {
-      return Intl.getCanonicalLocales(value)[0] ?? value;
-    } catch {
-      throw new BadRequestException("locale must be a valid BCP 47 language tag");
-    }
-  }
-  if (key === "brandColor") {
-    if (!HEX.test(value)) throw new BadRequestException("brandColor must be a hex color");
-    return value;
-  }
-  if (key === "themePreset") {
-    if (!PRESET.test(value)) throw new BadRequestException("Invalid themePreset");
-    return value;
-  }
-  if (key === "themeRadius") {
-    const n = Number(value);
-    if (!Number.isFinite(n) || n < 0 || n > 4) throw new BadRequestException("themeRadius must be 0–4");
-    return String(n);
-  }
-  if (key === "themeOverrides") {
-    let parsed: unknown;
-    try {
-      parsed = JSON.parse(value);
-    } catch {
-      throw new BadRequestException("themeOverrides must be valid JSON");
-    }
-    if (!parsed || typeof parsed !== "object") throw new BadRequestException("themeOverrides must be an object");
-    const out: Record<string, Record<string, string>> = {};
-    for (const mode of ["light", "dark"] as const) {
-      const block = (parsed as Record<string, unknown>)[mode];
-      if (block === undefined) continue;
-      if (!block || typeof block !== "object") throw new BadRequestException(`themeOverrides.${mode} must be an object`);
-      const clean: Record<string, string> = {};
-      for (const [k, v] of Object.entries(block as Record<string, unknown>)) {
-        if (!THEME_TOKEN_KEYS.has(k)) throw new BadRequestException(`Unknown theme token: ${k}`);
-        if (typeof v !== "string" || !HEX.test(v)) throw new BadRequestException(`themeOverrides.${mode}.${k} must be a hex color`);
-        clean[k] = v;
-      }
-      if (Object.keys(clean).length) out[mode] = clean;
-    }
-    return JSON.stringify(out);
-  }
-  return value;
-}
-
-@ApiTags("site")
-@Controller("site")
-export class SiteSettingsController {
-  constructor(private readonly site: SiteSettingsService) {}
-
-  /** Public: the site branding every page needs (title, favicon presence, …). */
-  @Public()
-  @Get("settings")
-  async settings(): Promise<Record<string, string | boolean | null>> {
-    const all = await this.site.getAll();
-    const out: Record<string, string | boolean | null> = {};
-    for (const key of PUBLIC_SITE_KEYS) out[key] = all[key] ?? null;
-    out.hasFavicon = (await this.site.get("faviconContentType")) !== null;
-    out.faviconVersion = await this.site.faviconVersion();
-    return out;
-  }
-
-  /** Admin: update one or more site settings. Unknown keys are rejected. */
-  @Put("settings")
-  async update(
-    @Session() session: UserSession,
-    @Body() body: Record<string, string>,
-  ): Promise<Record<string, string>> {
-    if (!isAdmin(session)) throw new ForbiddenException("Admins only");
-    const update: Record<string, string> = {};
-    for (const [key, value] of Object.entries(body ?? {})) {
-      if (!ALLOWED.has(key)) throw new BadRequestException(`Unknown setting: ${key}`);
-      update[key] = validateThemeValue(key, String(value ?? ""));
-    }
-    return this.site.setMany(update);
-  }
-
-  /** Admin: upload the browser icon. Stored in object storage; served below. */
-  @Post("favicon")
-  @ApiConsumes("multipart/form-data")
-  @UseInterceptors(FileInterceptor("file"))
-  async uploadFavicon(
-    @Session() session: UserSession,
-    @UploadedFile() file?: Express.Multer.File,
-  ): Promise<{ version: string | null }> {
-    if (!isAdmin(session)) throw new ForbiddenException("Admins only");
-    if (!file) throw new BadRequestException("A file field is required (multipart/form-data)");
-    if (!ICON_TYPES.has(file.mimetype)) {
-      throw new BadRequestException("Icon must be SVG, PNG, or ICO");
-    }
-    if (file.size > MAX_ICON_BYTES) throw new BadRequestException("Icon must be 1 MB or smaller");
-    await this.site.setFavicon(file.buffer, file.mimetype);
-    return { version: await this.site.faviconVersion() };
-  }
-
-  /** Public: serve the current favicon from object storage (stable URL, no expiry). */
-  @Public()
-  @Get("favicon")
-  async favicon(): Promise<StreamableFile> {
-    const icon = await this.site.getFavicon();
-    if (!icon) throw new BadRequestException("No favicon set");
-    return new StreamableFile(icon.body, { type: icon.contentType });
-  }
-}

package/dist/templates/modules/admin-dashboard/files/apps/api/src/site-settings/site-settings.module.ts

@@ -1,14 +0,0 @@
-import { Module } from "@nestjs/common";
-import { TypeOrmModule } from "@nestjs/typeorm";
-import { AppSetting } from "../settings/app-setting.entity";
-import { SiteSettingsController } from "./site-settings.controller";
-import { SiteSettingsService } from "./site-settings.service";
-
-// StorageService comes from the global StorageModule (object-storage-s3).
-@Module({
-  imports: [TypeOrmModule.forFeature([AppSetting])],
-  controllers: [SiteSettingsController],
-  providers: [SiteSettingsService],
-  exports: [SiteSettingsService],
-})
-export class SiteSettingsModule {}

package/dist/templates/modules/api-key-auth/files/apps/api/src/api-key/api-key.decorator.ts

@@ -1,9 +0,0 @@
-import { applyDecorators, UseGuards } from "@nestjs/common";
-import { Public } from "@thallesp/nestjs-better-auth";
-import { ApiKeyGuard } from "./api-key.guard";
-
-// Opens a route to API-key holders: skips the user-session guard and
-// requires a valid X-API-Key instead. For machine/service clients.
-export function ApiKeyProtected(): ReturnType<typeof applyDecorators> {
-  return applyDecorators(Public(), UseGuards(ApiKeyGuard));
-}

package/dist/templates/modules/api-key-auth/files/apps/api/src/api-key/api-key.guard.spec.ts

@@ -1,49 +0,0 @@
-import { describe, expect, it, jest } from "@jest/globals";
-import { type ExecutionContext, UnauthorizedException } from "@nestjs/common";
-import type { ApiKeyVerifier } from "./api-key-verifier";
-import { ApiKeyGuard } from "./api-key.guard";
-
-function requestContext(apiKey?: string): ExecutionContext {
-  return {
-    switchToHttp: () => ({
-      getRequest: () => ({
-        header: (name: string) => (name === "x-api-key" ? apiKey : undefined),
-      }),
-    }),
-  } as unknown as ExecutionContext;
-}
-
-describe("ApiKeyGuard", () => {
-  it("delegates a supplied key to the shared verifier", () => {
-    const verifier = {
-      isValid: jest.fn<(provided: string) => boolean>(() => true),
-    };
-    const guard = new ApiKeyGuard(verifier as unknown as ApiKeyVerifier);
-
-    expect(guard.canActivate(requestContext("service-key"))).toBe(true);
-    expect(verifier.isValid).toHaveBeenCalledWith("service-key");
-  });
-
-  it("rejects a missing key without invoking the verifier", () => {
-    const verifier = {
-      isValid: jest.fn<(provided: string) => boolean>(() => true),
-    };
-    const guard = new ApiKeyGuard(verifier as unknown as ApiKeyVerifier);
-
-    expect(() => guard.canActivate(requestContext())).toThrow(
-      new UnauthorizedException("Missing X-API-Key"),
-    );
-    expect(verifier.isValid).not.toHaveBeenCalled();
-  });
-
-  it("rejects a key that the verifier does not recognize", () => {
-    const verifier = {
-      isValid: jest.fn<(provided: string) => boolean>(() => false),
-    };
-    const guard = new ApiKeyGuard(verifier as unknown as ApiKeyVerifier);
-
-    expect(() => guard.canActivate(requestContext("invalid-key"))).toThrow(
-      new UnauthorizedException("Invalid API key"),
-    );
-  });
-});

package/dist/templates/modules/api-key-auth/files/apps/api/src/api-key/api-key.guard.ts

@@ -1,21 +0,0 @@
-import { type CanActivate, type ExecutionContext, Injectable, UnauthorizedException } from "@nestjs/common";
-import type { Request } from "express";
-import { ApiKeyVerifier } from "./api-key-verifier";
-
-// Validates the X-API-Key header against the API_KEYS allowlist.
-@Injectable()
-export class ApiKeyGuard implements CanActivate {
-  constructor(private readonly verifier: ApiKeyVerifier) {}
-
-  canActivate(context: ExecutionContext): boolean {
-    const request = context.switchToHttp().getRequest<Request>();
-    const provided = request.header("x-api-key");
-    if (!provided) {
-      throw new UnauthorizedException("Missing X-API-Key");
-    }
-    if (!this.verifier.isValid(provided)) {
-      throw new UnauthorizedException("Invalid API key");
-    }
-    return true;
-  }
-}

package/dist/templates/modules/api-key-auth/files/apps/api/src/machine/machine.controller.ts

@@ -1,14 +0,0 @@
-import { Controller, Get } from "@nestjs/common";
-import { ApiTags } from "@nestjs/swagger";
-import { ApiKeyProtected } from "../api-key/api-key.decorator";
-
-@ApiTags("machine")
-@Controller("machine")
-export class MachineController {
-  // Reachable with a valid X-API-Key, no user session required.
-  @ApiKeyProtected()
-  @Get("ping")
-  ping(): { ok: true; via: "api-key" } {
-    return { ok: true, via: "api-key" };
-  }
-}