@postxl/generators 1.18.0 → 1.20.0

package/dist/backend-actions/generators/execution-interface.generator.js

@@ -11,7 +11,8 @@ function generateActionExecutionInterface({ actions, types }) {
         .from(execution.interface.location)
         .addType(actions.summary.action)
         .addType(types.modelNames)
-        .addType(types.user);
+        .addType(types.user)
+        .addType(types.userRoles);
     return /* ts */ `
 ${imports.generate()}
 
@@ -28,7 +29,8 @@ export const ${execution.interface.toBrandedActionOperationId.name} = (id: strin
 export interface ${execution.interface.name} {
   name: string
   user: User
-  init({ action, user }: { action: Action; user: User }): Promise<void>
+  userRoles: UserRoles
+  init({ action, user, userRoles }: { action: Action; user: User; userRoles: UserRoles }): Promise<void>
 
   /**
    * Marks the ActionExecution as finished successfully.

package/dist/backend-actions/generators/execution-interface.generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"execution-interface.generator.js","sourceRoot":"","sources":["../../../src/backend-actions/generators/execution-interface.generator.ts"],"names":[],"mappings":";;AAIA,4EAyOC;AA7OD,iDAAmD;AAInD,SAAgB,gCAAgC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAiB;IAChF,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;IAC7B,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,SAAS,CAAA;IAC/D,MAAM,EAAE,GAAG,SAAS,CAAC,SAAS,CAAC,iBAAiB,CAAC,IAAI,CAAA;IAErD,MAAM,OAAO,GAAG,2BAAe;QAC7B,EAAE;SACD,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC;SAClC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;SAC/B,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC;SACzB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAEtB,OAAO,QAAQ,CAAC;EAChB,OAAO,CAAC,QAAQ,EAAE;;cAEN,EAAE;;;iCAGiB,EAAE;;eAEpB,SAAS,CAAC,SAAS,CAAC,0BAA0B,CAAC,IAAI,oBAAoB,EAAE,aAAa,EAAE;;;;;mBAKpF,SAAS,CAAC,SAAS,CAAC,IAAI;;;;;;;;;;;;;;;;;;;IAmBvC,SAAS,CAAC,MAAM,CAAC,KAAK;;;;;;gBAMV,EAAE;;IAEd,SAAS,CAAC,UAAU,CAAC,KAAK;;;;;;gBAMd,EAAE;;IAEd,SAAS,CAAC,MAAM,CAAC,KAAK;;;;;;;;;;gBAUV,EAAE;;IAEd,SAAS,CAAC,UAAU,CAAC,KAAK;;;;;;;;gBAQd,EAAE;;IAEd,SAAS,CAAC,MAAM,CAAC,KAAK;;;;;;;;gBAQV,EAAE;;IAEd,SAAS,CAAC,UAAU,CAAC,KAAK;;;;;;;;gBAQd,EAAE;;IAEd,SAAS,CAAC,KAAK,CAAC,KAAK;;;;;;;;gBAQT,EAAE;;IAEd,SAAS,CAAC,MAAM,CAAC,MAAM;;;;;yBAKF,EAAE;;;;;IAKvB,SAAS,CAAC,UAAU,CAAC,MAAM;;;;;yBAKN,EAAE;;;;;IAKvB,SAAS,CAAC,MAAM,CAAC,MAAM,+DAA+D,EAAE;;IAExF,SAAS,CAAC,UAAU,CAAC,MAAM,gEAAgE,EAAE;;IAE7F,SAAS,CAAC,MAAM,CAAC,MAAM,gDAAgD,EAAE;;IAEzE,SAAS,CAAC,UAAU,CAAC,MAAM,gDAAgD,EAAE;;IAE7E,SAAS,CAAC,KAAK,CAAC,MAAM,8DAA8D,EAAE;;IAEtF,cAAc,CAAC,eAAe;;;;IAI9B,cAAc,CAAC,eAAe;;;;;;;IAO9B,cAAc,CAAC,eAAe;;;;;;;;IAQ9B,cAAc,CAAC,eAAe;;;;;;;;;IAS9B,cAAc,CAAC,eAAe;;;;;;;;;;IAU9B,cAAc,CAAC,eAAe;;;;;;;;;;;IAW9B,cAAc,CAAC,eAAe;;;;;;;;;;;;;IAa9B,cAAc,CAAC,aAAa;;;;;;;;;;IAU5B,cAAc,CAAC,KAAK;;;;;;gBAMR,EAAE;;IAEd,cAAc,CAAC,MAAM;;;;yBAIA,EAAE;;;;IAIvB,cAAc,uDAAuD,EAAE;;CAE1E,CAAA;AACD,CAAC"}
+{"version":3,"file":"execution-interface.generator.js","sourceRoot":"","sources":["../../../src/backend-actions/generators/execution-interface.generator.ts"],"names":[],"mappings":";;AAIA,4EA2OC;AA/OD,iDAAmD;AAInD,SAAgB,gCAAgC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAiB;IAChF,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;IAC7B,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,SAAS,CAAA;IAC/D,MAAM,EAAE,GAAG,SAAS,CAAC,SAAS,CAAC,iBAAiB,CAAC,IAAI,CAAA;IAErD,MAAM,OAAO,GAAG,2BAAe;QAC7B,EAAE;SACD,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC;SAClC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;SAC/B,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC;SACzB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;SACnB,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAE3B,OAAO,QAAQ,CAAC;EAChB,OAAO,CAAC,QAAQ,EAAE;;cAEN,EAAE;;;iCAGiB,EAAE;;eAEpB,SAAS,CAAC,SAAS,CAAC,0BAA0B,CAAC,IAAI,oBAAoB,EAAE,aAAa,EAAE;;;;;mBAKpF,SAAS,CAAC,SAAS,CAAC,IAAI;;;;;;;;;;;;;;;;;;;;IAoBvC,SAAS,CAAC,MAAM,CAAC,KAAK;;;;;;gBAMV,EAAE;;IAEd,SAAS,CAAC,UAAU,CAAC,KAAK;;;;;;gBAMd,EAAE;;IAEd,SAAS,CAAC,MAAM,CAAC,KAAK;;;;;;;;;;gBAUV,EAAE;;IAEd,SAAS,CAAC,UAAU,CAAC,KAAK;;;;;;;;gBAQd,EAAE;;IAEd,SAAS,CAAC,MAAM,CAAC,KAAK;;;;;;;;gBAQV,EAAE;;IAEd,SAAS,CAAC,UAAU,CAAC,KAAK;;;;;;;;gBAQd,EAAE;;IAEd,SAAS,CAAC,KAAK,CAAC,KAAK;;;;;;;;gBAQT,EAAE;;IAEd,SAAS,CAAC,MAAM,CAAC,MAAM;;;;;yBAKF,EAAE;;;;;IAKvB,SAAS,CAAC,UAAU,CAAC,MAAM;;;;;yBAKN,EAAE;;;;;IAKvB,SAAS,CAAC,MAAM,CAAC,MAAM,+DAA+D,EAAE;;IAExF,SAAS,CAAC,UAAU,CAAC,MAAM,gEAAgE,EAAE;;IAE7F,SAAS,CAAC,MAAM,CAAC,MAAM,gDAAgD,EAAE;;IAEzE,SAAS,CAAC,UAAU,CAAC,MAAM,gDAAgD,EAAE;;IAE7E,SAAS,CAAC,KAAK,CAAC,MAAM,8DAA8D,EAAE;;IAEtF,cAAc,CAAC,eAAe;;;;IAI9B,cAAc,CAAC,eAAe;;;;;;;IAO9B,cAAc,CAAC,eAAe;;;;;;;;IAQ9B,cAAc,CAAC,eAAe;;;;;;;;;IAS9B,cAAc,CAAC,eAAe;;;;;;;;;;IAU9B,cAAc,CAAC,eAAe;;;;;;;;;;;IAW9B,cAAc,CAAC,eAAe;;;;;;;;;;;;;IAa9B,cAAc,CAAC,aAAa;;;;;;;;;;IAU5B,cAAc,CAAC,KAAK;;;;;;gBAMR,EAAE;;IAEd,cAAc,CAAC,MAAM;;;;yBAIA,EAAE;;;;IAIvB,cAAc,uDAAuD,EAAE;;CAE1E,CAAA;AACD,CAAC"}

package/dist/backend-ai/generators/ai-route.generator.js

@@ -14,15 +14,15 @@ export const ai = router({
   ask: procedure
     .use(authMiddleware)
     .input(zAskTaskInput)
-    .mutation(async ({ input, ctx }) => ctx.aiAgent.startExecution(input, ctx.user.id)),
+    .mutation(async ({ input, ctx }) => ctx.aiAgent.startExecution(input, ctx.viewer.user.id)),
   step: procedure
     .use(authMiddleware)
     .input(zAskStepInput)
-    .mutation(async ({ input, ctx }) => ctx.aiAgent.continueExecution(input, ctx.user.id)),
+    .mutation(async ({ input, ctx }) => ctx.aiAgent.continueExecution(input, ctx.viewer.user.id)),
   cancel: procedure
     .use(authMiddleware)
     .input(z.object({ conversation: z.string() }))
-    .mutation(({ input, ctx }) => ctx.aiAgent.cancelExecution(input.conversation, ctx.user.id)),
+    .mutation(({ input, ctx }) => ctx.aiAgent.cancelExecution(input.conversation, ctx.viewer.user.id)),
 })
 `;
 }

package/dist/backend-authentication/authentication.generator.js

@@ -63,6 +63,7 @@ exports.generator = {
                 code: Generator.ts(`AuthenticationModule.forRoot(config.auth)`),
             },
             envConfig: {
+                imports: [Generator.ts(`import { parseStringList } from '@authentication/utils'`)],
                 decoder: Generator.ts(`
           AUTH: zEnvBoolean.optional().default(true),
           KEYCLOAK_URL: z.string().url().transform((val) => new URL(val)),
@@ -70,10 +71,17 @@ exports.generator = {
           KEYCLOAK_CLIENT_SECRET: z.string(),
           KEYCLOAK_REALM: z.string(),
           KEYCLOAK_REDIRECT_URL: z.string().url().transform((val) => new URL(val)),
-          KEYCLOAK_LOGOUT_REDIRECT_URL: z.string().url().transform((val) => new URL(val)),`),
+          KEYCLOAK_LOGOUT_REDIRECT_URL: z.string().url().transform((val) => new URL(val)),
+          AUTH_MOCK_SUB: z.string().optional(),
+          AUTH_MOCK_NAME: z.string().optional(),
+          AUTH_MOCK_EMAIL: z.string().optional(),
+          AUTH_MOCK_ROLES: z.string().optional(),
+          AUTH_MOCK_GROUPS: z.string().optional(),
+          AUTH_TEST_OVERRIDES: zEnvBoolean.optional().default(false),`),
                 transformer: Generator.ts(`
           auth: val.AUTH ? {
             enableAuthentication: true as const,
+            roleClaimPath: ${JSON.stringify(context.schema.auth?.roleClaimPath ?? 'realm_access.roles')},
             url: val.API_URL,
             urlPrefix: val.API_PREFIX,
             
@@ -89,6 +97,14 @@ exports.generator = {
             postLogoutRedirectUrl: val.KEYCLOAK_LOGOUT_REDIRECT_URL,
           } : {
             enableAuthentication: false as const,
+            mockIdentity: {
+              sub: val.AUTH_MOCK_SUB ?? 'test',
+              name: val.AUTH_MOCK_NAME ?? 'Test User',
+              email: val.AUTH_MOCK_EMAIL ?? 'test@postxl.com',
+              roles: parseStringList(val.AUTH_MOCK_ROLES, ['viewer']),
+              groups: parseStringList(val.AUTH_MOCK_GROUPS),
+            },
+            allowTestOverrides: val.AUTH_TEST_OVERRIDES,
           }`),
                 dotEnvExample: `
           KEYCLOAK_URL=http://localhost:8080
@@ -97,6 +113,11 @@ exports.generator = {
           KEYCLOAK_REALM=postxl
           KEYCLOAK_REDIRECT_URL=\${API_URL}/auth/callback
           KEYCLOAK_LOGOUT_REDIRECT_URL=\${FRONTEND_URL}
+          AUTH_MOCK_SUB=test
+          AUTH_MOCK_NAME="Test User"
+          AUTH_MOCK_EMAIL=test@postxl.com
+          AUTH_MOCK_GROUPS=
+          AUTH_TEST_OVERRIDES=false
           `,
             },
         };

package/dist/backend-authentication/authentication.generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"authentication.generator.js","sourceRoot":"","sources":["../../src/backend-authentication/authentication.generator.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,yCAAmC;AAEnC,6DAA8C;AAE9C,wDAA2E;AAC3E,kDAA+E;AAC/E,kDAAkE;AAClE,kCAAmD;AAGnD,4EAAqE;AACrE,kGAA2F;AAC3F,oGAA6F;AAC7F,gGAAyF;AAiB5E,QAAA,WAAW,GAAG,SAAS,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,CAAA;AAExE,QAAA,SAAS,GAAiC;IACrD,EAAE,EAAE,mBAAW;IACf,QAAQ,EAAE,CAAC,iCAAkB,EAAE,sBAAe,EAAE,qCAAsB,EAAE,2CAAyB,CAAC;IAElG,QAAQ,EAAE,CAAsC,OAAgB,EAAiB,EAAE;QACjF,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,qBAAqB,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC3G,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAC3C,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO,EAAE,QAAQ,EAAE,EACrD,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,EACnD,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO,EAAE,QAAQ,EAAE,EACrD,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,EACjD,EAAE,WAAW,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,CACpD,CAAA;QAED,MAAM,MAAM,GAAiE;YAC3E,IAAI,EAAE,SAAS,CAAC,WAAW,CAAC,sBAAsB,CAAC;YACnD,QAAQ,EAAE,SAAS,CAAC,uBAAuB,CAAC,uCAAuC,CAAC;YACpF,SAAS,EAAE,SAAS,CAAC,UAAU,CAAC,yBAAyB,CAAC;SAC3D,CAAA;QACD,MAAM,oBAAoB,GAAiB;YACzC,IAAI,EAAE,SAAS,CAAC,mBAAmB,CAAC,gBAAgB,CAAC;YACrD,WAAW,EAAE,MAAM;YACnB,qBAAqB,EAAE;gBACrB,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC,2CAA2C,CAAC;aAChE;YACD,SAAS,EAAE;gBACT,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;;;;;;;2FAO6D,CAAC;gBAEpF,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;;;;;;;;;;;;;;;;;;YAkBtB,CAAC;gBACL,aAAa,EAAE;;;;;;;WAOZ;aACJ;SACF,CAAA;QACD,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;QAElD,MAAM,OAAO,GAAkE;YAC7E,IAAI,EAAE,SAAS,CAAC,WAAW,CAAC,uBAAuB,CAAC;YACpD,QAAQ,EAAE,SAAS,CAAC,uBAAuB,CAAC,wCAAwC,CAAC;YACrF,SAAS,EAAE,SAAS,CAAC,UAAU,CAAC,6BAA6B,CAAC;SAC/D,CAAA;QACD,MAAM,KAAK,GAAkE;YAC3E,IAAI,EAAE,SAAS,CAAC,WAAW,CAAC,WAAW,CAAC;YACxC,QAAQ,EAAE,SAAS,CAAC,uBAAuB,CAAC,4BAA4B,CAAC;YACzE,SAAS,EAAE,SAAS,CAAC,UAAU,CAAC,iBAAiB,CAAC;SACnD,CAAA;QAED,MAAM,qBAAqB,GAA0B;YACnD,MAAM;YACN,OAAO;YACP,KAAK;YACL,KAAK,EAAE;gBACL,QAAQ,EAAE;oBACR,IAAI,EAAE,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC;oBACtC,QAAQ,EAAE,SAAS,CAAC,uBAAuB,CAAC,sCAAsC,CAAC;iBACpF;gBACD,SAAS,EAAE;oBACT,IAAI,EAAE,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC;oBACvC,QAAQ,EAAE,SAAS,CAAC,uBAAuB,CAAC,sCAAsC,CAAC;iBACpF;aACF;SACF,CAAA;QACD,OAAO,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,CAAA;IAC9D,CAAC;IAED,QAAQ,EAAE,KAAK,EAAiC,OAAgB,EAAoB,EAAE;QACpF,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,iBAAiB,EAAE,CAAA;QAChD,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,IAAA,8DAA4B,EAAC,OAAO,CAAC,CAAC,CAAA;QACzG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,IAAA,wCAAiB,EAAC,OAAO,CAAC,CAAC,CAAA;QAChF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,IAAA,gEAA6B,EAAC,OAAO,CAAC,CAAC,CAAA;QAC9F,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAA,4DAA2B,EAAC,OAAO,CAAC,CAAC,CAAA;QAEhH,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,iBAAiB,EAAE,CAAA;QAC7C,GAAG,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;QAErD,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAA,mBAAO,EAAC,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC,CAAA;QAEpE,GAAG,CAAC,KAAK,CAAC,oBAAoB,EAAE,SAAS,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,CAAA;QAE7E,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,6BAA6B,EAAE,GAAG,EAAE,CAAC,CAAA;QAE7E,OAAO,OAAO,CAAA;IAChB,CAAC;CACF,CAAA"}
+{"version":3,"file":"authentication.generator.js","sourceRoot":"","sources":["../../src/backend-authentication/authentication.generator.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,yCAAmC;AAEnC,6DAA8C;AAE9C,wDAA2E;AAC3E,kDAA+E;AAC/E,kDAAkE;AAClE,kCAAmD;AAGnD,4EAAqE;AACrE,kGAA2F;AAC3F,oGAA6F;AAC7F,gGAAyF;AAiB5E,QAAA,WAAW,GAAG,SAAS,CAAC,sBAAsB,CAAC,wBAAwB,CAAC,CAAA;AAExE,QAAA,SAAS,GAAiC;IACrD,EAAE,EAAE,mBAAW;IACf,QAAQ,EAAE,CAAC,iCAAkB,EAAE,sBAAe,EAAE,qCAAsB,EAAE,2CAAyB,CAAC;IAElG,QAAQ,EAAE,CAAsC,OAAgB,EAAiB,EAAE;QACjF,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,qBAAqB,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC3G,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAC3C,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO,EAAE,QAAQ,EAAE,EACrD,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,EACnD,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO,EAAE,QAAQ,EAAE,EACrD,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,EACjD,EAAE,WAAW,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,CACpD,CAAA;QAED,MAAM,MAAM,GAAiE;YAC3E,IAAI,EAAE,SAAS,CAAC,WAAW,CAAC,sBAAsB,CAAC;YACnD,QAAQ,EAAE,SAAS,CAAC,uBAAuB,CAAC,uCAAuC,CAAC;YACpF,SAAS,EAAE,SAAS,CAAC,UAAU,CAAC,yBAAyB,CAAC;SAC3D,CAAA;QACD,MAAM,oBAAoB,GAAiB;YACzC,IAAI,EAAE,SAAS,CAAC,mBAAmB,CAAC,gBAAgB,CAAC;YACrD,WAAW,EAAE,MAAM;YACnB,qBAAqB,EAAE;gBACrB,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC,2CAA2C,CAAC;aAChE;YACD,SAAS,EAAE;gBACT,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,yDAAyD,CAAC,CAAC;gBAClF,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;;;;;;;;;;;;;sEAawC,CAAC;gBAE/D,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC;;;6BAGL,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,IAAI,oBAAoB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;YAwB3F,CAAC;gBACL,aAAa,EAAE;;;;;;;;;;;;WAYZ;aACJ;SACF,CAAA;QACD,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAA;QAElD,MAAM,OAAO,GAAkE;YAC7E,IAAI,EAAE,SAAS,CAAC,WAAW,CAAC,uBAAuB,CAAC;YACpD,QAAQ,EAAE,SAAS,CAAC,uBAAuB,CAAC,wCAAwC,CAAC;YACrF,SAAS,EAAE,SAAS,CAAC,UAAU,CAAC,6BAA6B,CAAC;SAC/D,CAAA;QACD,MAAM,KAAK,GAAkE;YAC3E,IAAI,EAAE,SAAS,CAAC,WAAW,CAAC,WAAW,CAAC;YACxC,QAAQ,EAAE,SAAS,CAAC,uBAAuB,CAAC,4BAA4B,CAAC;YACzE,SAAS,EAAE,SAAS,CAAC,UAAU,CAAC,iBAAiB,CAAC;SACnD,CAAA;QAED,MAAM,qBAAqB,GAA0B;YACnD,MAAM;YACN,OAAO;YACP,KAAK;YACL,KAAK,EAAE;gBACL,QAAQ,EAAE;oBACR,IAAI,EAAE,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC;oBACtC,QAAQ,EAAE,SAAS,CAAC,uBAAuB,CAAC,sCAAsC,CAAC;iBACpF;gBACD,SAAS,EAAE;oBACT,IAAI,EAAE,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC;oBACvC,QAAQ,EAAE,SAAS,CAAC,uBAAuB,CAAC,sCAAsC,CAAC;iBACpF;aACF;SACF,CAAA;QACD,OAAO,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,CAAA;IAC9D,CAAC;IAED,QAAQ,EAAE,KAAK,EAAiC,OAAgB,EAAoB,EAAE;QACpF,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,iBAAiB,EAAE,CAAA;QAChD,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,IAAA,8DAA4B,EAAC,OAAO,CAAC,CAAC,CAAA;QACzG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,IAAA,wCAAiB,EAAC,OAAO,CAAC,CAAC,CAAA;QAChF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,IAAA,gEAA6B,EAAC,OAAO,CAAC,CAAC,CAAA;QAC9F,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAA,4DAA2B,EAAC,OAAO,CAAC,CAAC,CAAA;QAEhH,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,iBAAiB,EAAE,CAAA;QAC7C,GAAG,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;QAErD,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,IAAA,mBAAO,EAAC,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC,CAAA;QAEpE,GAAG,CAAC,KAAK,CAAC,oBAAoB,EAAE,SAAS,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,CAAA;QAE7E,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,6BAA6B,EAAE,GAAG,EAAE,CAAC,CAAA;QAE7E,OAAO,OAAO,CAAA;IAChB,CAAC;CACF,CAAA"}

package/dist/backend-authentication/generators/auth-guard.generator.js

@@ -39,7 +39,6 @@ function generateAuthGuard(context) {
     const imports = Generator.ImportGenerator.from(context.authentication.guard._filePath);
     imports.add(context.view.service);
     imports.add(context.actions.dispatcher);
-    imports.add(context.types.user);
     imports.add({ name: context.authentication.service.name, location: context.authentication.service._filePath });
     return /* ts */ `
   import { CanActivate, ExecutionContext, Injectable } from '@nestjs/common'
@@ -48,9 +47,10 @@ import { FastifyRequest } from 'fastify'
 
 ${imports.generate()}
 
-import { UserInfo, UserRoles } from './authentication.types'
+import type { AuthorizationContext } from '@types'
+import { UserInfo } from './authentication.types'
 
-export type Viewer = { userInfo: UserInfo; userRoles: UserRoles; user: User; isAuthorized: boolean }
+export type Viewer = AuthorizationContext
 
 export type FastifyRequestWithViewer = FastifyRequest & { viewer: Viewer }
 @Injectable()
@@ -68,10 +68,7 @@ export class ${context.authentication.guard.name} implements CanActivate {
     let viewer: Viewer | null = null
 
     let userInfo: UserInfo | null = null
-    let userRoles: UserRoles = []
-
-    // TODO: Add authorization check
-    const isAuthorized = true
+    let userRoles: Viewer['userRoles'] = []
 
     const associatedUserInfo = await this.authService.getUserInfoFromRequest(req)
 
@@ -105,7 +102,7 @@ export class ${context.authentication.guard.name} implements CanActivate {
         }
       }
 
-      viewer = { userInfo, userRoles, user, isAuthorized }
+      viewer = { userRoles, user }
     }
 
     if (!viewer) {

package/dist/backend-authentication/generators/auth-guard.generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-guard.generator.js","sourceRoot":"","sources":["../../../src/backend-authentication/generators/auth-guard.generator.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAIA,8CAmFC;AAvFD,6DAA8C;AAI9C,SAAgB,iBAAiB,CAAC,OAAsB;IACtD,MAAM,OAAO,GAAG,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAEtF,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACjC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IACvC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC/B,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;IAC9G,OAAO,QAAQ,CAAC;;;;;EAKhB,OAAO,CAAC,QAAQ,EAAE;;;;;;;;eAQL,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI;;oCAEZ,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI;oCACnC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI;0CACnB,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0DvE,CAAA;AACF,CAAC"}
+{"version":3,"file":"auth-guard.generator.js","sourceRoot":"","sources":["../../../src/backend-authentication/generators/auth-guard.generator.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAIA,8CAgFC;AApFD,6DAA8C;AAI9C,SAAgB,iBAAiB,CAAC,OAAsB;IACtD,MAAM,OAAO,GAAG,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAEtF,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACjC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IACvC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAA;IAC9G,OAAO,QAAQ,CAAC;;;;;EAKhB,OAAO,CAAC,QAAQ,EAAE;;;;;;;;;eASL,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI;;oCAEZ,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI;oCACnC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI;0CACnB,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuDvE,CAAA;AACF,CAAC"}

package/dist/backend-authentication/generators/authentication-module.generator.js

@@ -63,7 +63,7 @@ export class ${context.authentication.module.name} {
           }
         : {
             provide: ${context.authentication.service.name},
-            useClass: MockAuthenticationService,
+            useValue: new MockAuthenticationService(config),
           }        
 
     return {

package/dist/backend-authentication/generators/authentication-service.generator.js

@@ -14,9 +14,12 @@ import jwt from 'jsonwebtoken'
 import { JwksClient } from 'jwks-rsa'
 import { OidcClient } from 'oidc-client-ts'
 
+import { USER_ROLES } from '@types'
+import type { UserRole, UserRoles } from '@types'
+
 import type { AuthenticationConfig_EnabledKeycloak } from './authentication.config'
-import { authenticationCookieName, UserInfo, UserRoles, zUserInfo, zUserRoles } from './authentication.types'
-import { unknownToErrorMessage } from './utils'
+import { authenticationCookieName, UserInfo, zUserInfo } from './authentication.types'
+import { getByPath, parseStringList, unknownToErrorMessage } from './utils'
 
 /**
  * State object for the authentication service.
@@ -282,14 +285,14 @@ export class ${context.authentication.service.name} implements OnModuleInit {
       const decoded = await _jwtVerify(accessToken, getKey, { algorithms: ['RS256'] })
 
       if (typeof decoded === 'object' && decoded !== null) {
-        const rawUserRoles = decoded.realm_access?.roles || []
+        const rawUserRoles = getByPath(decoded, this.config.roleClaimPath)
+        const normalizedUserRoles = Array.isArray(rawUserRoles) ? rawUserRoles : parseStringList(rawUserRoles)
 
-        const userRoles = zUserRoles.safeParse(rawUserRoles)
-        if (userRoles.success) {
-          return { ok: true, userRoles: userRoles.data }
-        }
+        const filteredRoles = normalizedUserRoles.filter(
+          (role): role is UserRole => typeof role === 'string' && USER_ROLES.includes(role as UserRole),
+        )
 
-        return { ok: false }
+        return { ok: true, userRoles: filteredRoles }
       }
 
       return { ok: true, userRoles: [] }

package/dist/backend-authentication/generators/authentication-service.generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"authentication-service.generator.js","sourceRoot":"","sources":["../../../src/backend-authentication/generators/authentication-service.generator.ts"],"names":[],"mappings":";;AAEA,sEAoYC;AApYD,SAAgB,6BAA6B,CAAC,OAAsB;IAClE,OAAO,QAAQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eA6BH,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI;yCACT,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoW1E,CAAA;AACF,CAAC"}
+{"version":3,"file":"authentication-service.generator.js","sourceRoot":"","sources":["../../../src/backend-authentication/generators/authentication-service.generator.ts"],"names":[],"mappings":";;AAEA,sEAuYC;AAvYD,SAAgB,6BAA6B,CAAC,OAAsB;IAClE,OAAO,QAAQ,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAgCH,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI;yCACT,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoW1E,CAAA;AACF,CAAC"}

package/dist/backend-authentication/generators/authentication-types.generator.js

@@ -5,6 +5,7 @@ function generateAuthenticationTypes(context) {
     return /* ts */ `
 import { z } from 'zod'
 import { Result } from '@postxl/utils'
+import { USER_ROLES } from '@types'
 import { Viewer } from '@authentication/auth.guard'
 
 /**
@@ -42,12 +43,12 @@ export const z${context.authentication.types.userInfo.name} = z.object({
  */
 export type ${context.authentication.types.userInfo.name} = z.infer<typeof z${context.authentication.types.userInfo.name}>
 
-export const z${context.authentication.types.userRoles.name} = z.array(z.enum(['admin', 'user', 'unauthorized']))
+export const zUserRole = z.enum(USER_ROLES)
 
-export type ${context.authentication.types.userRoles.name} = z.infer<typeof z${context.authentication.types.userRoles.name}>
+export const z${context.authentication.types.userRoles.name} = z.array(zUserRole)
 
 export type ViewerResult = Result<
-  Omit<Viewer, 'userInfo'>,
+  Viewer,
   | {
       type: 'redirect'
       redirectUrl: string

package/dist/backend-authentication/generators/authentication-types.generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"authentication-types.generator.js","sourceRoot":"","sources":["../../../src/backend-authentication/generators/authentication-types.generator.ts"],"names":[],"mappings":";;AAEA,kEA2DC;AA3DD,SAAgB,2BAA2B,CAAC,OAAsB;IAChE,OAAO,QAAQ,CAAC;;;;;;KAMb,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI;;;gBAG/B,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;KA2BrD,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI;;cAEjC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,sBAAsB,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI;;gBAExG,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI;;cAE7C,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,sBAAsB,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI;;;;;;;;;;;;;;;CAezH,CAAA;AACD,CAAC"}
+{"version":3,"file":"authentication-types.generator.js","sourceRoot":"","sources":["../../../src/backend-authentication/generators/authentication-types.generator.ts"],"names":[],"mappings":";;AAEA,kEA4DC;AA5DD,SAAgB,2BAA2B,CAAC,OAAsB;IAChE,OAAO,QAAQ,CAAC;;;;;;;KAOb,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI;;;gBAG/B,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;KA2BrD,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI;;cAEjC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,sBAAsB,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI;;;;gBAIxG,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI;;;;;;;;;;;;;;;CAe1D,CAAA;AACD,CAAC"}

package/dist/backend-authentication/template/src/authentication.config.ts

@@ -1,9 +1,18 @@
 export type AuthenticationConfig = AuthenticationConfig_Disabled | AuthenticationConfig_EnabledKeycloak
 export type AuthenticationConfig_Disabled = {
   enableAuthentication: false
+  mockIdentity: {
+    sub: string
+    name: string
+    email: string
+    roles: string[]
+    groups: string[]
+  }
+  allowTestOverrides: boolean
 }
 export type AuthenticationConfig_EnabledKeycloak = {
   enableAuthentication: true
+  roleClaimPath: string
   /**
    * The URL of the backend server.
    */

package/dist/backend-authentication/template/src/authentication.mock.service.ts

@@ -1,7 +1,14 @@
 // We import Fastify cookie here to ensure that the cookie plugin and its types are registered.
 import '@fastify/cookie'
 
-import type { UserInfo, UserRoles } from './authentication.types'
+import type { FastifyRequest } from 'fastify'
+
+import type { UserRoles } from '@types'
+
+import type { AuthenticationConfig_Disabled } from './authentication.config'
+import { zUserRoles } from './authentication.types'
+import type { UserInfo } from './authentication.types'
+import { parseStringList } from './utils'
 
 type MockAuthenticationResult = {
   /**
@@ -49,6 +56,54 @@ const mockResult: MockAuthenticationResult = {
 
 export class MockAuthenticationService {
   public readonly cookieDomain = 'localhost'
+  private readonly mockResult: MockAuthenticationResult
+
+  constructor(private readonly config: AuthenticationConfig_Disabled) {
+    const parsedConfigRoles = zUserRoles.safeParse(config.mockIdentity.roles)
+
+    this.mockResult = {
+      ...mockResult,
+      userInfo: {
+        ...mockResult.userInfo,
+        sub: config.mockIdentity.sub,
+        name: config.mockIdentity.name,
+        preferred_username: config.mockIdentity.email,
+        given_name: config.mockIdentity.name.split(' ').at(0) ?? config.mockIdentity.name,
+        family_name: config.mockIdentity.name.split(' ').slice(1).join(' ') || config.mockIdentity.name,
+        email: config.mockIdentity.email,
+        groups: config.mockIdentity.groups,
+      },
+      userRoles: parsedConfigRoles.success ? parsedConfigRoles.data : mockResult.userRoles,
+    }
+  }
+
+  private parseHeaderRoles(raw: unknown): UserRoles {
+    const parsed = zUserRoles.safeParse(parseStringList(raw, this.mockResult.userRoles))
+    return parsed.success ? parsed.data : this.mockResult.userRoles
+  }
+
+  private getTestOverrideRoles(req: FastifyRequest | undefined): UserRoles | null {
+    // Test override headers are only honored when:
+    // - authentication is disabled (`AUTH=false`) and
+    // - explicit test overrides are enabled (`AUTH_TEST_OVERRIDES=true`) and
+    // - runtime is test (`NODE_ENV=test`)
+    if (!this.config.allowTestOverrides || process.env.NODE_ENV !== 'test' || !req) {
+      return null
+    }
+    const rawRoles = req.headers['x-pxl-test-roles']
+    return this.parseHeaderRoles(rawRoles)
+  }
+
+  private getTestOverrideSub(req: FastifyRequest | undefined): string | undefined {
+    if (!this.config.allowTestOverrides || process.env.NODE_ENV !== 'test' || !req) {
+      return undefined
+    }
+    const rawSub = req.headers['x-pxl-test-sub']
+    if (typeof rawSub !== 'string' || rawSub.trim().length === 0) {
+      return undefined
+    }
+    return rawSub.trim()
+  }
 
   public refreshAccessToken(): Promise<
     | {
@@ -62,7 +117,7 @@ export class MockAuthenticationService {
         error: unknown
       }
   > {
-    return Promise.resolve({ ok: true, accessToken: mockResult.accessToken, state: null }) // NOSONAR - We want to adhere to the interface
+    return Promise.resolve({ ok: true, accessToken: this.mockResult.accessToken, state: null }) // NOSONAR - We want to adhere to the interface
   }
   public getAccessTokenFromURL(): Promise<
     | {
@@ -75,36 +130,45 @@ export class MockAuthenticationService {
         error: unknown
       }
   > {
-    return Promise.resolve({ ok: true, accessToken: mockResult.accessToken, state: null }) // NOSONAR - We want to adhere to the interface
+    return Promise.resolve({ ok: true, accessToken: this.mockResult.accessToken, state: null }) // NOSONAR - We want to adhere to the interface
   }
   public getAuthenticationUrl(): Promise<string> {
-    return Promise.resolve(mockResult.authRedirectUrl) // NOSONAR - We want to adhere to the interface
+    return Promise.resolve(this.mockResult.authRedirectUrl) // NOSONAR - We want to adhere to the interface
   }
 
-  public async getUserInfoFromRequest(): Promise<{ ok: true; userInfo: UserInfo } | { ok: false }> {
-    const info = await this.getUserInfo()
+  public async getUserInfoFromRequest(req?: FastifyRequest): Promise<{ ok: true; userInfo: UserInfo } | { ok: false }> {
+    const info = await this.getUserInfo(req)
 
     return info
   }
 
-  public getUserInfo(): Promise<{ ok: true; userInfo: UserInfo } | { ok: false }> {
+  public getUserInfo(req?: FastifyRequest): Promise<{ ok: true; userInfo: UserInfo } | { ok: false }> {
+    const overrideSub = this.getTestOverrideSub(req)
     // NOSONAR - We want to keep all validations async to adhere to the same interface
     return Promise.resolve({
       ok: true,
-      userInfo: mockResult.userInfo,
+      userInfo: {
+        ...this.mockResult.userInfo,
+        sub: overrideSub ?? this.mockResult.userInfo.sub,
+      },
     })
   }
 
-  public async getUserRolesFromRequest(): Promise<{ ok: true; userRoles: UserRoles } | { ok: false }> {
-    const roles = await this.getUserRoles()
+  public async getUserRolesFromRequest(
+    req?: FastifyRequest,
+  ): Promise<{ ok: true; userRoles: UserRoles } | { ok: false }> {
+    const roles = await this.getUserRoles(req)
 
     return roles
   }
 
-  public getUserRoles(): Promise<{ ok: true; userRoles: UserRoles } | { ok: false }> {
-    return Promise.resolve({ ok: true, userRoles: mockResult.userRoles }) // NOSONAR - We want to adhere to the interface
+  public getUserRoles(req?: FastifyRequest): Promise<{ ok: true; userRoles: UserRoles } | { ok: false }> {
+    return Promise.resolve({
+      ok: true,
+      userRoles: this.getTestOverrideRoles(req) ?? this.mockResult.userRoles,
+    }) // NOSONAR - We want to adhere to the interface
   }
   public getLogoutUrl(): Promise<string> {
-    return Promise.resolve(mockResult.logoutRedirectUrl) // NOSONAR - We want to adhere to the interface
+    return Promise.resolve(this.mockResult.logoutRedirectUrl) // NOSONAR - We want to adhere to the interface
   }
 }

package/dist/backend-authentication/template/src/utils.ts

@@ -11,3 +11,48 @@ export function unknownToErrorMessage(error: unknown, message: string): string {
 export const normalizeUrl = (url: string): string => {
   return url.endsWith('/') ? url : `${url}/`
 }
+
+/**
+ * Parses role/group lists from JSON-array or CSV strings.
+ */
+export function parseStringList(raw: unknown, fallback: string[] = []): string[] {
+  if (typeof raw !== 'string' || raw.trim().length === 0) {
+    return fallback
+  }
+
+  try {
+    const parsed = JSON.parse(raw)
+    if (Array.isArray(parsed)) {
+      return parsed
+        .filter((entry): entry is string => typeof entry === 'string')
+        .map((entry) => entry.trim())
+        .filter(Boolean)
+    }
+  } catch {
+    // ignore and use csv fallback
+  }
+
+  return raw
+    .split(',')
+    .map((entry) => entry.trim())
+    .filter(Boolean)
+}
+
+/**
+ * Resolves a nested value by dot-path (e.g. "realm_access.roles").
+ */
+export function getByPath(input: unknown, path: string): unknown {
+  if (!path) {
+    return undefined
+  }
+
+  let current: unknown = input
+  for (const segment of path.split('.').filter(Boolean)) {
+    if (typeof current !== 'object' || current === null || !(segment in current)) {
+      return undefined
+    }
+    current = (current as Record<string, unknown>)[segment]
+  }
+
+  return current
+}

package/dist/backend-core/backend.generator.js

@@ -78,7 +78,23 @@ const baseScripts = [
     { name: 'start', command: 'node ./dist/apps/api/apps/api/src/main.js' },
     {
         name: 'dev',
-        command: 'dotenvx run -f ./apps/api/.env --env STATEFUL=false --env AUTH=false -- nest start --debug --watch',
+        command: 'dotenvx run -f ./apps/api/.env --env STATEFUL=false --env AUTH=false --env AUTH_MOCK_ROLES=admin -- nest start --debug --watch',
+    },
+    {
+        name: 'dev:viewer',
+        command: 'dotenvx run -f ./apps/api/.env --env STATEFUL=false --env AUTH=false --env AUTH_MOCK_ROLES=viewer -- nest start --debug --watch',
+    },
+    {
+        name: 'dev:editor',
+        command: 'dotenvx run -f ./apps/api/.env --env STATEFUL=false --env AUTH=false --env AUTH_MOCK_ROLES=editor -- nest start --debug --watch',
+    },
+    {
+        name: 'dev:admin',
+        command: 'dotenvx run -f ./apps/api/.env --env STATEFUL=false --env AUTH=false --env AUTH_MOCK_ROLES=admin -- nest start --debug --watch',
+    },
+    {
+        name: 'dev:superadmin',
+        command: 'dotenvx run -f ./apps/api/.env --env STATEFUL=false --env AUTH=false --env AUTH_MOCK_ROLES=superadmin -- nest start --debug --watch',
     },
     {
         name: 'dev:auth',

package/dist/backend-core/backend.generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"backend.generator.js","sourceRoot":"","sources":["../../src/backend-core/backend.generator.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,gDAAiC;AAEjC,6DAA8C;AAE9C,4EAAqE;AACrE,4EAAqE;AACrE,oFAA6E;AAC7E,8EAAuE;AACvE,gEAA0D;AAC1D,wEAAkE;AAGlE,MAAM,gBAAgB,GAAkC;IACtD,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO,EAAE,QAAQ,EAAE;IACrD,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE;IACnD,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO,EAAE,QAAQ,EAAE;IACrD,EAAE,WAAW,EAAE,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE;IACrD,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE;IACnD,EAAE,WAAW,EAAE,0BAA0B,EAAE,OAAO,EAAE,SAAS,EAAE;IAC/D,EAAE,WAAW,EAAE,oBAAoB,EAAE,OAAO,EAAE,QAAQ,EAAE;IACxD,EAAE,WAAW,EAAE,SAAS,CAAC,mBAAmB,CAAC,eAAe,CAAC,EAAE;IAC/D,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE;IAC3C,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE;IACjD,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE;IAC7C,8FAA8F;IAC9F,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE;IACpD,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE;IACxC,EAAE,WAAW,EAAE,sBAAsB,EAAE,OAAO,EAAE,OAAO,EAAE;CAC1D,CAAA;AACD,MAAM,mBAAmB,GAAkC;IACzD,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE;IAC5C,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE;IAC5C,EAAE,WAAW,EAAE,kBAAkB,EAAE,OAAO,EAAE,QAAQ,EAAE;IACtD,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE;IACnD,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE;IAClD,EAAE,WAAW,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE;IACnD,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE;IACjD,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE;IAC1C,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE;IAC7C,EAAE,WAAW,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE;IACnD,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE;IAC/C,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE;CAC/C,CAAA;AAED,MAAM,WAAW,GAA8B;IAC7C,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE;IACxC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,2CAA2C,EAAE;IACvE;QACE,IAAI,EAAE,KAAK;QACX,OAAO,EAAE,oGAAoG;KAC9G;IACD;QACE,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,mGAAmG;KAC7G;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,mGAAmG;KAC7G;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,kGAAkG;KAC5G;IACD,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE;IACrC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE;IACtC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE;CAChD,CAAA;AAEY,QAAA,kBAAkB,GAAG,SAAS,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAA;AAErE,QAAA,gBAAgB,GAAiC;IAC5D,EAAE,EAAE,0BAAkB;IAEtB,QAAQ,EAAE,CAAC,OAA4B,EAAE,EAAE;QACzC,MAAM,OAAO,GAAwB;YACnC,OAAO,EAAE,EAAE;YACX,WAAW,EAAE;gBACX,IAAI,EAAE,SAAS,CAAC,mBAAmB,CAAC,WAAW,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;gBACzE,WAAW,EAAE,eAAe,OAAO,CAAC,MAAM,CAAC,IAAI,UAAU;gBACzD,YAAY,EAAE,gBAAgB;gBAC9B,eAAe,EAAE,mBAAmB;gBACpC,OAAO,EAAE,WAAW;gBACpB,mBAAmB,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,KAAK,WAAW;aAChE;YACD,kBAAkB,EAAE,CAAC,OAAO,CAAC;SAC9B,CAAA;QACD,OAAO;YACL,GAAG,OAAO;YACV,OAAO;SACR,CAAA;IACH,CAAC;IAED,QAAQ,EAAE,KAAK,EAAqC,GAAyB,EAAE,EAAE;QAC/E,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,iBAAiB,EAAE,CAAA;QAE7C,oBAAoB;QACpB,MAAM,GAAG,CAAC,UAAU,CAAC;YACnB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC;YAC/C,iDAAiD;YACjD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;SAC5C,CAAC,CAAA;QAEF,2BAA2B;QAC3B,MAAM,GAAG,CAAC,UAAU,CAAC;YACnB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,uBAAuB,CAAC;YAC1D,UAAU,EAAE,YAAY;SACzB,CAAC,CAAA;QAEF,sBAAsB;QACtB,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,SAAS,CAAC,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAA;QAClF,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,IAAA,qCAAgB,EAAC,GAAG,CAAC,CAAC,CAAA;QAClD,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,IAAA,0CAAkB,EAAC,GAAG,CAAC,CAAC,CAAA;QACrD,GAAG,CAAC,KAAK,CAAC,6BAA6B,EAAE,IAAA,wCAAiB,EAAC,GAAG,CAAC,CAAC,CAAA;QAChE,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,IAAA,6BAAY,EAAC,GAAG,CAAC,CAAC,CAAA;QACrD,GAAG,CAAC,KAAK,CAAC,6BAA6B,EAAE,IAAA,wCAAiB,EAAC,GAAG,CAAC,CAAC,CAAA;QAEhE,MAAM,GAAG,GAAG,IAAA,gDAAqB,EAAC,GAAG,CAAC,CAAA;QACtC,GAAG,CAAC,KAAK,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAA;QAExC,0BAA0B;QAC1B,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACzC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;gBACf,GAAG,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;YACxC,CAAC;QACH,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAA;QACtD,OAAO,GAAG,CAAA;IACZ,CAAC;CACF,CAAA"}
+{"version":3,"file":"backend.generator.js","sourceRoot":"","sources":["../../src/backend-core/backend.generator.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,gDAAiC;AAEjC,6DAA8C;AAE9C,4EAAqE;AACrE,4EAAqE;AACrE,oFAA6E;AAC7E,8EAAuE;AACvE,gEAA0D;AAC1D,wEAAkE;AAGlE,MAAM,gBAAgB,GAAkC;IACtD,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO,EAAE,QAAQ,EAAE;IACrD,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE;IACnD,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO,EAAE,QAAQ,EAAE;IACrD,EAAE,WAAW,EAAE,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE;IACrD,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE;IACnD,EAAE,WAAW,EAAE,0BAA0B,EAAE,OAAO,EAAE,SAAS,EAAE;IAC/D,EAAE,WAAW,EAAE,oBAAoB,EAAE,OAAO,EAAE,QAAQ,EAAE;IACxD,EAAE,WAAW,EAAE,SAAS,CAAC,mBAAmB,CAAC,eAAe,CAAC,EAAE;IAC/D,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE;IAC3C,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE;IACjD,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE;IAC7C,8FAA8F;IAC9F,EAAE,WAAW,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE;IACpD,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE;IACxC,EAAE,WAAW,EAAE,sBAAsB,EAAE,OAAO,EAAE,OAAO,EAAE;CAC1D,CAAA;AACD,MAAM,mBAAmB,GAAkC;IACzD,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE;IAC5C,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE;IAC5C,EAAE,WAAW,EAAE,kBAAkB,EAAE,OAAO,EAAE,QAAQ,EAAE;IACtD,EAAE,WAAW,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE;IACnD,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE;IAClD,EAAE,WAAW,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE;IACnD,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE;IACjD,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE;IAC1C,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE;IAC7C,EAAE,WAAW,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE;IACnD,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE;IAC/C,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE;CAC/C,CAAA;AAED,MAAM,WAAW,GAA8B;IAC7C,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE;IACxC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,2CAA2C,EAAE;IACvE;QACE,IAAI,EAAE,KAAK;QACX,OAAO,EACL,gIAAgI;KACnI;IACD;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EACL,iIAAiI;KACpI;IACD;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EACL,iIAAiI;KACpI;IACD;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EACL,gIAAgI;KACnI;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,OAAO,EACL,qIAAqI;KACxI;IACD;QACE,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,mGAAmG;KAC7G;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,mGAAmG;KAC7G;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,kGAAkG;KAC5G;IACD,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE;IACrC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE;IACtC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE;CAChD,CAAA;AAEY,QAAA,kBAAkB,GAAG,SAAS,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAA;AAErE,QAAA,gBAAgB,GAAiC;IAC5D,EAAE,EAAE,0BAAkB;IAEtB,QAAQ,EAAE,CAAC,OAA4B,EAAE,EAAE;QACzC,MAAM,OAAO,GAAwB;YACnC,OAAO,EAAE,EAAE;YACX,WAAW,EAAE;gBACX,IAAI,EAAE,SAAS,CAAC,mBAAmB,CAAC,WAAW,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;gBACzE,WAAW,EAAE,eAAe,OAAO,CAAC,MAAM,CAAC,IAAI,UAAU;gBACzD,YAAY,EAAE,gBAAgB;gBAC9B,eAAe,EAAE,mBAAmB;gBACpC,OAAO,EAAE,WAAW;gBACpB,mBAAmB,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,KAAK,WAAW;aAChE;YACD,kBAAkB,EAAE,CAAC,OAAO,CAAC;SAC9B,CAAA;QACD,OAAO;YACL,GAAG,OAAO;YACV,OAAO;SACR,CAAA;IACH,CAAC;IAED,QAAQ,EAAE,KAAK,EAAqC,GAAyB,EAAE,EAAE;QAC/E,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,iBAAiB,EAAE,CAAA;QAE7C,oBAAoB;QACpB,MAAM,GAAG,CAAC,UAAU,CAAC;YACnB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC;YAC/C,iDAAiD;YACjD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;SAC5C,CAAC,CAAA;QAEF,2BAA2B;QAC3B,MAAM,GAAG,CAAC,UAAU,CAAC;YACnB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,uBAAuB,CAAC;YAC1D,UAAU,EAAE,YAAY;SACzB,CAAC,CAAA;QAEF,sBAAsB;QACtB,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,SAAS,CAAC,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAA;QAClF,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,IAAA,qCAAgB,EAAC,GAAG,CAAC,CAAC,CAAA;QAClD,GAAG,CAAC,KAAK,CAAC,iBAAiB,EAAE,IAAA,0CAAkB,EAAC,GAAG,CAAC,CAAC,CAAA;QACrD,GAAG,CAAC,KAAK,CAAC,6BAA6B,EAAE,IAAA,wCAAiB,EAAC,GAAG,CAAC,CAAC,CAAA;QAChE,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,IAAA,6BAAY,EAAC,GAAG,CAAC,CAAC,CAAA;QACrD,GAAG,CAAC,KAAK,CAAC,6BAA6B,EAAE,IAAA,wCAAiB,EAAC,GAAG,CAAC,CAAC,CAAA;QAEhE,MAAM,GAAG,GAAG,IAAA,gDAAqB,EAAC,GAAG,CAAC,CAAA;QACtC,GAAG,CAAC,KAAK,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAA;QAExC,0BAA0B;QAC1B,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACzC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;gBACf,GAAG,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;YACxC,CAAC;QACH,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAA;QACtD,OAAO,GAAG,CAAA;IACZ,CAAC;CACF,CAAA"}

package/dist/backend-core/generators/api-config.generator.js

@@ -2,8 +2,13 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.generateApiConfig = generateApiConfig;
 function generateApiConfig({ backend: { modules } }) {
+    const envConfigImports = Array.from(new Set(modules
+        .flatMap((module) => module.envConfig?.imports ?? [])
+        .map((statement) => statement.trim())
+        .filter(Boolean)));
     return /*ts*/ `
 import z from 'zod'
+${envConfigImports.join('\n')}
 
 const zEnvBoolean = z.union([
   //

package/dist/backend-core/generators/api-config.generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-config.generator.js","sourceRoot":"","sources":["../../../src/backend-core/generators/api-config.generator.ts"],"names":[],"mappings":";;AAEA,8CAgEC;AAhED,SAAgB,iBAAiB,CAAC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAe;IACrE,OAAO,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MA8BV,OAAO;SACN,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;SAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,mBAAmB,CAAC,CAAC,CAAC,SAAU,CAAC,OAAO,CAAC,EAAE,CAAC;SAC1D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;SACvB,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;MAeZ,OAAO;SACN,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;SAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,mBAAmB,CAAC,CAAC,CAAC,SAAU,CAAC,WAAW,CAAC,EAAE,CAAC;SAC9D,IAAI,CAAC,KAAK,CAAC;;;;;;EAMhB,OAAO;SACN,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC;SAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,mBAAmB,CAAC,CAAC,CAAC,SAAU,CAAC,IAAK,CAAC,EAAE,CAAC,CAAC,qDAAqD;SAC9G,IAAI,CAAC,IAAI,CAAC;CACZ,CAAA;AACD,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;AACnC,CAAC"}
+{"version":3,"file":"api-config.generator.js","sourceRoot":"","sources":["../../../src/backend-core/generators/api-config.generator.ts"],"names":[],"mappings":";;AAEA,8CA0EC;AA1ED,SAAgB,iBAAiB,CAAC,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAe;IACrE,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CACjC,IAAI,GAAG,CACL,OAAO;SACJ,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,IAAI,EAAE,CAAC;SACpD,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;SACpC,MAAM,CAAC,OAAO,CAAC,CACnB,CACF,CAAA;IAED,OAAO,MAAM,CAAC;;EAEd,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MA6BvB,OAAO;SACN,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;SAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,mBAAmB,CAAC,CAAC,CAAC,SAAU,CAAC,OAAO,CAAC,EAAE,CAAC;SAC1D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;SACvB,IAAI,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;MAeZ,OAAO;SACN,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;SAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,mBAAmB,CAAC,CAAC,CAAC,SAAU,CAAC,WAAW,CAAC,EAAE,CAAC;SAC9D,IAAI,CAAC,KAAK,CAAC;;;;;;EAMhB,OAAO;SACN,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC;SAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,mBAAmB,CAAC,CAAC,CAAC,SAAU,CAAC,IAAK,CAAC,EAAE,CAAC,CAAC,qDAAqD;SAC9G,IAAI,CAAC,IAAI,CAAC;CACZ,CAAA;AACD,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;AACnC,CAAC"}

package/dist/backend-core/types.d.ts

@@ -100,6 +100,10 @@ export type NestJSModule = {
     vfs?: Generator.VirtualFileSystem;
 };
 export type EnvConfig = {
+    /**
+     * Optional import statements required by decoder/transformer code.
+     */
+    imports?: Generator.Typescript[];
     /**
      * Example:
      *    AWS_ACCESS_KEY: z.string(),