@pxp-nd/core 1.2.88 → 1.2.90

package/README.md

@@ -1,2 +1,63 @@
 # PXP-ND core
-- Core module for pxp-nd
+- Core module for pxp-nd
+
+## 1.2.90
+
+Release de resiliencia de conexiones a base de datos. **Sin configurar nada, el comportamiento es idéntico a 1.2.89**: todas las opciones nuevas son opt-in.
+
+### `db.acquireTimeoutMs` (opcional)
+
+Tiempo máximo, en milisegundos, que una ruta no-readonly espera para obtener una conexión del pool antes de fallar.
+
+```ts
+new PxpApp({
+  // ...
+  db: { acquireTimeoutMs: 5000 },
+});
+```
+
+- Si vence, la request responde **503** con el mensaje `Database acquire timeout after N ms`.
+- Solo se dispara cuando el pool está agotado; con conexiones libres no agrega latencia.
+- `undefined` o `0` = comportamiento legacy (espera indefinida).
+
+### Decorador `@Timeout(ms)` y opción de ruta `timeoutMs`
+
+Límite de duración por ruta. Se puede usar el decorador o la opción en la definición de la ruta:
+
+```ts
+@Post('/save')
+@Timeout(30000)
+async save(params: any) { /* ... */ }
+
+// o bien
+@Post('/save', { timeoutMs: 30000 })
+```
+
+Al vencer el tiempo:
+- La request responde **503**.
+- La conexión física se destruye, por lo que MySQL hace rollback de la transacción abierta.
+- El handler puede seguir ejecutándose en segundo plano, pero ya sin acceso a la base de datos.
+- Se registra la línea de log `[pxp-core] timeout-abandoned <transactionCode>`.
+
+Sin decorador ni `timeoutMs`, la ruta no tiene límite (igual que 1.2.89).
+
+### Fix: fuga de conexiones si falla `startTransaction()`
+
+Antes, si `startTransaction()` lanzaba un error, la conexión obtenida del pool nunca se liberaba y con el tiempo el pool quedaba agotado. Ahora la conexión se libera siempre.
+
+### Clon del controlador por request (`controllerForRequest`)
+
+Portado desde 1.2.89: cada request trabaja sobre un clon del controlador, de modo que requests concurrentes ya no se pisan `user`, `headers` ni `transactionCode`.
+
+### Proyectos afectados
+
+Dependen de core con `^1.2.x`, así que tomarán esta versión en su próximo `npm install`:
+
+- tempo
+- conductor-nd
+- go-pxp-nd
+- Api_Boa_ND
+- electrica360_nd
+- cleaners-pxp-nd
+
+Sin configurar `db.acquireTimeoutMs` ni `@Timeout`/`timeoutMs`, ninguno de ellos cambia de comportamiento respecto a 1.2.89.

package/dist/interfaces.d.ts

@@ -49,5 +49,10 @@ export interface IConfigPxpApp {
     expressJsonConfig?: IConfigExpress;
     expressUrlEncodedConfig?: IConfigExpress;
     permissionFunction?: boolean | ((user: any, transaction: string) => Promise<boolean>);
+    /** Database safety options. All optional; when omitted the behaviour is identical to <=1.2.89. */
+    db?: {
+        /** Max ms to wait for a pool connection before a non-readonly route fails with 503. Undefined/0 = wait forever (legacy). */
+        acquireTimeoutMs?: number;
+    };
 }
 export {};

package/dist/lib/pxp/Controller.d.ts

@@ -12,6 +12,8 @@
  * Last modified  : 2020-10-13 15:36:31
  * Last modified  : 2021-03-10 15:36:31 - Favio Figueroa
  * Last modified  : 2021-05-01 18:35:31 - Favio Figueroa
+ * Last modified  : 2026-10-08 - Favio Figueroa - EF-23 per-request controller clone (from 1.2.89), startTransaction inside try
+ * Last modified  : 2026-10-08 - Favio Figueroa - EF-23 acquire timeout + @Timeout decorator
  */
 import { EntityManager } from 'typeorm';
 import { Request, Response, NextFunction } from 'express';
@@ -37,8 +39,8 @@ export declare class Controller implements ControllerInterface {
     private basicReadOnly;
     constructor(module: string, Entity?: any, config?: IConfigPxpApp, io?: any);
     private initializeRoutes;
-    genericMethodWrapper(params: Record<string, unknown>, req: Request, next: NextFunction, res: Response, methodName: string, dbsettings: string, readonly: boolean, permission: boolean, log: boolean, logConfig: {}, isHtml: boolean, isFile: boolean): Promise<void>;
-    ormMethodWrapper(params: Record<string, unknown>, req: Request | any, next: NextFunction, res: Response, methodName: string, readonly: boolean, permission?: boolean, log?: boolean, logConfig?: {}, isHtml?: boolean, isFile?: boolean): Promise<void>;
+    genericMethodWrapper(params: Record<string, unknown>, req: Request, next: NextFunction, res: Response, methodName: string, dbsettings: string, readonly: boolean, permission: boolean, log: boolean, logConfig: {}, isHtml: boolean, isFile: boolean, timeoutMs?: number): Promise<void>;
+    ormMethodWrapper(params: Record<string, unknown>, req: Request | any, next: NextFunction, res: Response, methodName: string, readonly: boolean, permission?: boolean, log?: boolean, logConfig?: {}, isHtml?: boolean, isFile?: boolean, timeoutMs?: number): Promise<void>;
     list(params: Record<string, unknown>): Promise<unknown>;
     add(params: Record<string, unknown>, manager: EntityManager): Promise<unknown>;
     edit(params: Record<string, unknown>, manager: EntityManager): Promise<unknown>;

package/dist/lib/pxp/Controller.js

@@ -37,6 +37,8 @@ exports.Controller = void 0;
  * Last modified  : 2020-10-13 15:36:31
  * Last modified  : 2021-03-10 15:36:31 - Favio Figueroa
  * Last modified  : 2021-05-01 18:35:31 - Favio Figueroa
+ * Last modified  : 2026-10-08 - Favio Figueroa - EF-23 per-request controller clone (from 1.2.89), startTransaction inside try
+ * Last modified  : 2026-10-08 - Favio Figueroa - EF-23 acquire timeout + @Timeout decorator
  */
 const typeorm_1 = require("typeorm");
 const class_validator_1 = require("class-validator");
@@ -51,6 +53,7 @@ const ParseParams_1 = require("./middlewares/ParseParams");
 const isReportMiddleware_1 = require("./middlewares/isReportMiddleware");
 const pdf_1 = require("../reports/pdf");
 const xlsx_1 = require("../reports/xlsx");
+const DbTimeouts_1 = require("./utils/DbTimeouts");
 // import * as entities from '@pxp-nd/entities';
 // const pxpEntities: any = entities;
 class Controller {
@@ -128,6 +131,8 @@ class Controller {
         // get type return
         let ishtml = Reflect.getMetadata('ishtml', this.constructor) || {};
         let isfile = Reflect.getMetadata('isfile', this.constructor) || {};
+        // get request timeouts (@Timeout)
+        const timeouts = Reflect.getMetadata('timeout', this.constructor) || {};
         const defaultConfig = Reflect.getMetadata('optionsRoute', this.constructor) || {};
         // define basic routes
         if (this.modelString !== '') {
@@ -146,6 +151,8 @@ class Controller {
             const isHtmlMethod = ishtml[route.methodName] !== undefined ? ishtml[route.methodName] : (defaultConfig[route.methodName] ? defaultConfig[route.methodName].ishtml : false);
             // is file
             const isFileMethod = isfile[route.methodName] !== undefined ? isfile[route.methodName] : (defaultConfig[route.methodName] ? defaultConfig[route.methodName].isfile : false);
+            // request timeout (ms), undefined = no timeout
+            const timeoutMethod = timeouts[route.methodName] !== undefined ? timeouts[route.methodName] : (defaultConfig[route.methodName] ? defaultConfig[route.methodName].timeoutMs : undefined);
             if (readOnlyMethod === null || readOnlyMethod === undefined) {
                 throw new index_1.PxpError(500, 'ReadOnly decorator was not defined for ' +
                     route.methodName +
@@ -164,7 +171,8 @@ class Controller {
                     // Execute our method for this path and pass our express request and response object.
                     // const params = { ...req.query, ...req.body, ...req.params };
                     const params = Object.assign(Object.assign({}, req.files), req.paramasMerge);
-                    const controllerForRequest = Object.assign({}, this);
+                    const controllerForRequest = Object.create(Object.getPrototypeOf(this));
+                    Object.assign(controllerForRequest, this);
                     controllerForRequest.user = req.user || null;
                     controllerForRequest.headers = req.headers;
                     controllerForRequest.pxpParams = req.pxpParams;
@@ -174,13 +182,13 @@ class Controller {
                         .toLowerCase();
                     controllerForRequest.validated = false;
                     try {
-                        await index_1.__(this.genericMethodWrapper.call(controllerForRequest, params, req, next, res, route.methodName, methodDbSettings, readOnlyMethod, false, logKey, logValue, isHtmlMethod, isFileMethod));
+                        await index_1.__(controllerForRequest.genericMethodWrapper(params, req, next, res, route.methodName, methodDbSettings, readOnlyMethod, false, logKey, logValue, isHtmlMethod, isFileMethod, timeoutMethod));
                     }
                     catch (ex) {
                         const now = new Date();
                         const iniAt = req.start;
                         const endsAt = now.valueOf() - iniAt.valueOf();
-                        res.logId = await index_1.__(index_1.insertLog('nouser', 'mac', req.ip, 'error', ex.tecMessage, this.module, this.transactionCode, '', // query
+                        res.logId = await index_1.__(index_1.insertLog('nouser', 'mac', req.ip, 'error', ex.tecMessage, controllerForRequest.module, controllerForRequest.transactionCode, '', // query
                         params, ex.stack, ex.statusCode, endsAt, logValue));
                         index_1.errorMiddleware(ex, req, res);
                     }
@@ -197,7 +205,8 @@ class Controller {
                 ], async (req, res, next) => {
                     // Execute our method for this path and pass our express request and response object.
                     const params = Object.assign(Object.assign({}, req.files), req.paramasMerge);
-                    const controllerForRequest = Object.assign({}, this);
+                    const controllerForRequest = Object.create(Object.getPrototypeOf(this));
+                    Object.assign(controllerForRequest, this);
                     controllerForRequest.user = req.user || null;
                     controllerForRequest.headers = req.headers;
                     controllerForRequest.pxpParams = req.pxpParams;
@@ -207,13 +216,13 @@ class Controller {
                         .toLowerCase();
                     controllerForRequest.validated = false;
                     try {
-                        await index_1.__(this.genericMethodWrapper.call(controllerForRequest, params, req, next, res, route.methodName, methodDbSettings, readOnlyMethod, permission[route.methodName], logKey, logValue, isHtmlMethod, isFileMethod));
+                        await index_1.__(controllerForRequest.genericMethodWrapper(params, req, next, res, route.methodName, methodDbSettings, readOnlyMethod, permission[route.methodName], logKey, logValue, isHtmlMethod, isFileMethod, timeoutMethod));
                     }
                     catch (ex) {
                         const now = new Date();
                         const iniAt = req.start;
                         const endsAt = now.valueOf() - iniAt.valueOf();
-                        res.logId = (await index_1.__(index_1.insertLog(controllerForRequest.user && controllerForRequest.user.username ? controllerForRequest.user.username : 'nouser', 'mac', req.ip, 'error', ex.tecMessage, this.module, this.transactionCode, '', // query
+                        res.logId = (await index_1.__(index_1.insertLog(controllerForRequest.user && controllerForRequest.user.username ? controllerForRequest.user.username : 'nouser', 'mac', req.ip, 'error', ex.tecMessage, controllerForRequest.module, controllerForRequest.transactionCode, '', // query
                         params, ex.stack, ex.statusCode, endsAt, logValue)));
                         index_1.errorMiddleware(ex, req, res);
                     }
@@ -221,9 +230,9 @@ class Controller {
             }
         });
     }
-    async genericMethodWrapper(params, req, next, res, methodName, dbsettings, readonly, permission = true, log = true, logConfig = {}, isHtml, isFile) {
+    async genericMethodWrapper(params, req, next, res, methodName, dbsettings, readonly, permission = true, log = true, logConfig = {}, isHtml, isFile, timeoutMs) {
         if (dbsettings === 'Orm') {
-            await index_1.__(this.ormMethodWrapper(params, req, next, res, methodName, readonly, permission, log, logConfig, isHtml, isFile));
+            await index_1.__(this.ormMethodWrapper(params, req, next, res, methodName, readonly, permission, log, logConfig, isHtml, isFile, timeoutMs));
         }
         else if (dbsettings === 'Procedure') {
             await index_1.__(this.procedureMethodWrapper(params, next, res, methodName, readonly, permission, log, logConfig));
@@ -232,7 +241,8 @@ class Controller {
             await this.sqlMethodWrapper(params, next, res, methodName, readonly, permission, log, logConfig);
         }
     }
-    async ormMethodWrapper(params, req, next, res, methodName, readonly, permission = true, log = true, logConfig = {}, isHtml = false, isFile = false) {
+    async ormMethodWrapper(params, req, next, res, methodName, readonly, permission = true, log = true, logConfig = {}, isHtml = false, isFile = false, timeoutMs) {
+        var _a;
         let metResponse;
         if (permission) {
             if (this.user) {
@@ -248,19 +258,55 @@ class Controller {
         else {
             const connection = typeorm_1.getConnection(process.env.DB_WRITE_CONNECTION_NAME);
             const queryRunner = connection.createQueryRunner();
-            // establish real database connection using our new query runner
-            await index_1.__(queryRunner.connect());
-            await index_1.__(queryRunner.startTransaction());
+            // establish real database connection using our new query runner.
+            // `db` is added to IConfigPxpApp by a later change; without it this is a plain connect().
+            const acquireTimeoutMs = (_a = this.config.db) === null || _a === void 0 ? void 0 : _a.acquireTimeoutMs;
+            await index_1.__(DbTimeouts_1.connectWithTimeout(queryRunner, acquireTimeoutMs, this.transactionCode));
+            let timedOut = false;
+            let timer;
             try {
-                metResponse = (await eval(`this.${methodName}(params, queryRunner.manager, res, req)`));
+                // Start the transaction inside try so a failure here still releases the connection
+                await index_1.__(queryRunner.startTransaction());
+                const work = Promise.resolve(eval(`this.${methodName}(params, queryRunner.manager, res, req)`));
+                if (timeoutMs && timeoutMs > 0) {
+                    metResponse = await Promise.race([
+                        work,
+                        new Promise((_, reject) => {
+                            timer = setTimeout(() => {
+                                timedOut = true;
+                                reject(new DbTimeouts_1.DbTimeoutError('request', timeoutMs, this.transactionCode));
+                            }, timeoutMs);
+                        })
+                    ]);
+                }
+                else {
+                    metResponse = await work;
+                }
                 await queryRunner.commitTransaction();
             }
             catch (err) {
-                await queryRunner.rollbackTransaction();
+                // On request timeout skip rollback: it would queue behind the abandoned statement and delay the 503 (destroy rolls back server-side).
+                if (!timedOut && queryRunner.isTransactionActive) {
+                    try {
+                        await queryRunner.rollbackTransaction();
+                    }
+                    catch (_) {
+                        // keep the original error; the connection is released or destroyed below
+                    }
+                }
                 throw err;
             }
             finally {
-                await index_1.__(queryRunner.release());
+                if (timer)
+                    clearTimeout(timer);
+                if (timedOut) {
+                    // The handler may keep running in background; its connection is destroyed so it cannot commit.
+                    console.warn(`[pxp-core] timeout-abandoned ${this.transactionCode}`);
+                    await DbTimeouts_1.destroyQueryRunner(queryRunner);
+                }
+                else {
+                    await index_1.__(queryRunner.release());
+                }
             }
         }
         if (log) {

package/dist/lib/pxp/Decorators.d.ts

@@ -8,6 +8,7 @@ export declare interface IOptionsRoute {
     dbSettings?: 'Procedure' | 'Orm' | 'Query';
     authentication?: boolean;
     log?: boolean | ILog;
+    timeoutMs?: number;
 }
 declare const Get: (path?: string, options?: IOptionsRoute) => (target: any, propertyKey: string) => void;
 declare const Post: (path?: string, options?: IOptionsRoute) => (target: any, propertyKey: string) => void;
@@ -19,9 +20,10 @@ declare const Model: (model: string) => ClassDecorator;
 declare const StoredProcedure: (storedProcedure: string) => ClassDecorator;
 declare const Authentication: (authentication?: boolean) => (target: any, propertyKey: string) => void;
 declare const ReadOnly: (ronly?: boolean) => (target: any, propertyKey: string) => void;
+declare const Timeout: (ms: number) => (target: any, propertyKey: string) => void;
 declare const IsHtml: (ishtml?: boolean) => (target: any, propertyKey: string) => void;
 declare const IsFile: (isFile?: boolean) => (target: any, propertyKey: string) => void;
 declare const DbSettings: (modelType: 'Procedure' | 'Orm' | 'Query') => (target: any, propertyKey: string) => void;
 declare const Permission: (permission?: boolean) => (target: any, propertyKey: string) => void;
 declare const Log: (log?: boolean, config?: Record<string, unknown>) => (target: any, propertyKey: string) => void;
-export { Get, Post, Put, Delete, Patch, Route, Authentication, Log, Permission, DbSettings, ReadOnly, IsHtml, IsFile, Model, StoredProcedure };
+export { Get, Post, Put, Delete, Patch, Route, Authentication, Log, Permission, DbSettings, ReadOnly, Timeout, IsHtml, IsFile, Model, StoredProcedure };

package/dist/lib/pxp/Decorators.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.StoredProcedure = exports.Model = exports.IsFile = exports.IsHtml = exports.ReadOnly = exports.DbSettings = exports.Permission = exports.Log = exports.Authentication = exports.Route = exports.Patch = exports.Delete = exports.Put = exports.Post = exports.Get = void 0;
+exports.StoredProcedure = exports.Model = exports.IsFile = exports.IsHtml = exports.Timeout = exports.ReadOnly = exports.DbSettings = exports.Permission = exports.Log = exports.Authentication = exports.Route = exports.Patch = exports.Delete = exports.Put = exports.Post = exports.Get = void 0;
 /**
  * Kplian Ltda 2020
  *
@@ -13,6 +13,7 @@ exports.StoredProcedure = exports.Model = exports.IsFile = exports.IsHtml = expo
  *
  * Created at     : 2020-06-13 18:09:48
  * Last modified  : 2020-09-17 18:29:51
+ * Last modified  : 2026-10-08 - Favio Figueroa - EF-23 acquire timeout + @Timeout decorator
  */
 const RouteDefinition_1 = require("./RouteDefinition");
 ;
@@ -102,6 +103,10 @@ const Authentication = (authentication = true) => (target, propertyKey) => setPr
 exports.Authentication = Authentication;
 const ReadOnly = (ronly = true) => (target, propertyKey) => setProperty(target, propertyKey)(ronly, 'readonly');
 exports.ReadOnly = ReadOnly;
+// Request timeout (ms) for a write transaction: on expiry the request fails with 503,
+// the transaction is rolled back and the physical connection is destroyed.
+const Timeout = (ms) => (target, propertyKey) => setProperty(target, propertyKey)(ms, 'timeout');
+exports.Timeout = Timeout;
 const IsHtml = (ishtml = false) => (target, propertyKey) => setProperty(target, propertyKey)(ishtml, 'ishtml');
 exports.IsHtml = IsHtml;
 const IsFile = (isFile = false) => (target, propertyKey) => setProperty(target, propertyKey)(isFile, 'isfile');

package/dist/lib/pxp/utils/DbTimeouts.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Kplian Ltda 2020
+ *
+ * MIT
+ *
+ * Database timeout helpers.
+ *
+ * @summary Connection acquire timeout, request timeout error and physical connection destroy.
+ * @author Favio Figueroa
+ *
+ * Created at     : 2026-10-08 - Favio Figueroa - EF-23 acquire timeout + @Timeout decorator
+ */
+import { QueryRunner } from 'typeorm';
+import { PxpError } from '../PxpError';
+export declare class DbTimeoutError extends PxpError {
+    kind: 'acquire' | 'request';
+    timeoutMs: number;
+    transactionCode: string | undefined;
+    constructor(kind: 'acquire' | 'request', ms: number, transactionCode?: string);
+}
+/**
+ * Destroys the physical driver connection behind the query runner (so it never
+ * goes back to the pool with an open transaction) and then releases the runner.
+ * mysql2 removes a destroyed connection from its pool on its own.
+ */
+export declare function destroyQueryRunner(queryRunner: QueryRunner): Promise<void>;
+/**
+ * Acquires the query runner connection with an upper bound.
+ * When ms is undefined or <= 0 this is exactly `await queryRunner.connect()`.
+ */
+export declare function connectWithTimeout(queryRunner: QueryRunner, ms: number | undefined, transactionCode?: string): Promise<void>;

package/dist/lib/pxp/utils/DbTimeouts.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.connectWithTimeout = exports.destroyQueryRunner = exports.DbTimeoutError = void 0;
+const PxpError_1 = require("../PxpError");
+class DbTimeoutError extends PxpError_1.PxpError {
+    constructor(kind, ms, transactionCode) {
+        super(503, `Database ${kind} timeout after ${ms} ms`);
+        this.kind = kind;
+        this.timeoutMs = ms;
+        this.transactionCode = transactionCode;
+    }
+}
+exports.DbTimeoutError = DbTimeoutError;
+/**
+ * Destroys the physical driver connection behind the query runner (so it never
+ * goes back to the pool with an open transaction) and then releases the runner.
+ * mysql2 removes a destroyed connection from its pool on its own.
+ */
+async function destroyQueryRunner(queryRunner) {
+    const databaseConnection = queryRunner.databaseConnection;
+    if (databaseConnection && typeof databaseConnection.destroy === 'function') {
+        databaseConnection.destroy();
+    }
+    try {
+        await queryRunner.release();
+    }
+    catch (_) {
+        // the connection was already destroyed; release failures are expected here
+    }
+}
+exports.destroyQueryRunner = destroyQueryRunner;
+/**
+ * Acquires the query runner connection with an upper bound.
+ * When ms is undefined or <= 0 this is exactly `await queryRunner.connect()`.
+ */
+async function connectWithTimeout(queryRunner, ms, transactionCode) {
+    if (!ms || ms <= 0) {
+        await queryRunner.connect();
+        return;
+    }
+    let timer;
+    let timedOut = false;
+    const connectPromise = queryRunner.connect();
+    const timeoutPromise = new Promise((_, reject) => {
+        timer = setTimeout(() => {
+            timedOut = true;
+            reject(new DbTimeoutError('acquire', ms, transactionCode));
+        }, ms);
+    });
+    try {
+        await Promise.race([connectPromise, timeoutPromise]);
+    }
+    catch (err) {
+        if (timedOut) {
+            // A late connection must be destroyed, not leaked into the pool.
+            connectPromise.then(() => destroyQueryRunner(queryRunner)).catch(() => { });
+        }
+        throw err;
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+exports.connectWithTimeout = connectWithTimeout;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pxp-nd/core",
-  "version": "1.2.88",
+  "version": "1.2.90",
   "description": "Contains main files for pxp-nd",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",