@saasicat/nest 0.8.0 → 0.10.0

package/dist/chunk-TXDH4FUA.js

@@ -0,0 +1,211 @@
+import {
+  DiscoverySnapshotNotFoundError,
+  loadDiscoverySnapshotFromFile
+} from "./chunk-ABB2CRAS.js";
+import {
+  ADVISORY_STRICT_MODE_CODES,
+  validateBundleDraft,
+  validatePlanDraft
+} from "./chunk-33TP26MR.js";
+import {
+  __name
+} from "./chunk-SHUYVCID.js";
+
+// src/catalog/preflight.ts
+function runPreflight(input) {
+  const findings = [];
+  const approved = input.approved ?? null;
+  for (const pv of input.planVersions) {
+    const warns = validatePlanDraft({
+      features: pv.features,
+      quotas: pv.quotas ?? {}
+    }, input.snapshot, /* @__PURE__ */ new Set(), approved);
+    for (const w of warns) {
+      findings.push({
+        kind: "plan",
+        versionId: pv.id,
+        entityKey: pv.planId,
+        version: pv.version,
+        warning: w
+      });
+    }
+  }
+  for (const bv of input.bundleVersions) {
+    const warns = validateBundleDraft({
+      features: bv.features,
+      quotas: bv.quotas ?? {}
+    }, input.snapshot, null, /* @__PURE__ */ new Set(), approved);
+    for (const w of warns) {
+      findings.push({
+        kind: "bundle",
+        versionId: bv.id,
+        entityKey: bv.bundleKey,
+        version: bv.version,
+        warning: w
+      });
+    }
+  }
+  findings.sort((a, b) => {
+    if (a.kind !== b.kind) return a.kind.localeCompare(b.kind);
+    if (a.entityKey !== b.entityKey) return a.entityKey.localeCompare(b.entityKey);
+    if (a.version !== b.version) return a.version - b.version;
+    return a.warning.code.localeCompare(b.warning.code);
+  });
+  const counts = {
+    planFindings: findings.filter((f) => f.kind === "plan").length,
+    bundleFindings: findings.filter((f) => f.kind === "bundle").length,
+    total: findings.length
+  };
+  const hasBlockingFinding = findings.some((f) => !ADVISORY_STRICT_MODE_CODES.has(f.warning.code));
+  return {
+    overall: hasBlockingFinding ? "error" : "ok",
+    counts,
+    findings
+  };
+}
+__name(runPreflight, "runPreflight");
+function formatPreflightReport(report) {
+  const lines = [];
+  lines.push(`Preflight (Status: ${report.overall.toUpperCase()})`, `  Plans: ${report.counts.planFindings} \xB7 Bundles: ${report.counts.bundleFindings} \xB7 Gesamt: ${report.counts.total}`, "");
+  if (report.findings.length === 0) {
+    lines.push("  \u2713 Keine Strict-Mode-Verst\xF6\xDFe gefunden.");
+    return lines.join("\n");
+  }
+  let lastEntity = "";
+  for (const f of report.findings) {
+    const entityHeader = `${f.kind} ${f.entityKey} v${f.version}`;
+    if (entityHeader !== lastEntity) {
+      lines.push(`  \u2717 ${entityHeader} (${f.versionId})`);
+      lastEntity = entityHeader;
+    }
+    const fieldHint = f.warning.field ? ` [${f.warning.field}]` : "";
+    lines.push(`      ${f.warning.code}${fieldHint}: ${f.warning.message}`);
+  }
+  return lines.join("\n");
+}
+__name(formatPreflightReport, "formatPreflightReport");
+function preflightExitCode(report) {
+  return report.overall === "error" ? 4 : 0;
+}
+__name(preflightExitCode, "preflightExitCode");
+
+// src/catalog/seed-gate.ts
+function validateSeedAgainstSnapshot(input) {
+  const findings = [];
+  for (const plan of input.plans ?? []) {
+    const warns = validatePlanDraft({
+      features: plan.features,
+      quotas: plan.quotas ?? {}
+    }, input.snapshot, /* @__PURE__ */ new Set(), input.approved ?? null);
+    for (const warning of warns) {
+      findings.push({
+        kind: "plan",
+        entityKey: plan.planKey,
+        warning
+      });
+    }
+  }
+  for (const bundle of input.bundles ?? []) {
+    const warns = validateBundleDraft({
+      features: bundle.features,
+      quotas: bundle.quotas ?? {}
+    }, input.snapshot, null, /* @__PURE__ */ new Set(), input.approved ?? null);
+    for (const warning of warns) {
+      findings.push({
+        kind: "bundle",
+        entityKey: bundle.bundleKey,
+        warning
+      });
+    }
+  }
+  findings.sort((a, b) => {
+    if (a.kind !== b.kind) return a.kind.localeCompare(b.kind);
+    if (a.entityKey !== b.entityKey) return a.entityKey.localeCompare(b.entityKey);
+    return a.warning.code.localeCompare(b.warning.code);
+  });
+  const counts = {
+    planFindings: findings.filter((f) => f.kind === "plan").length,
+    bundleFindings: findings.filter((f) => f.kind === "bundle").length,
+    total: findings.length
+  };
+  const hasBlockingFinding = findings.some((f) => !ADVISORY_STRICT_MODE_CODES.has(f.warning.code));
+  return {
+    overall: hasBlockingFinding ? "error" : "ok",
+    counts,
+    findings
+  };
+}
+__name(validateSeedAgainstSnapshot, "validateSeedAgainstSnapshot");
+function formatSeedGateReport(report) {
+  const lines = [];
+  lines.push(`Seed-Gate (Status: ${report.overall.toUpperCase()})`, `  Plans: ${report.counts.planFindings} \xB7 Bundles: ${report.counts.bundleFindings} \xB7 Gesamt: ${report.counts.total}`, "");
+  if (report.findings.length === 0) {
+    lines.push("  \u2713 Alle geseedeten Plan-/Bundle-Features sind discovered (und, sofern gepr\xFCft, approved).");
+    return lines.join("\n");
+  }
+  let lastEntity = "";
+  for (const f of report.findings) {
+    const entityHeader = `${f.kind} ${f.entityKey}`;
+    if (entityHeader !== lastEntity) {
+      lines.push(`  \u2717 ${entityHeader}`);
+      lastEntity = entityHeader;
+    }
+    const fieldHint = f.warning.field ? ` [${f.warning.field}]` : "";
+    lines.push(`      ${f.warning.code}${fieldHint}: ${f.warning.message}`);
+  }
+  return lines.join("\n");
+}
+__name(formatSeedGateReport, "formatSeedGateReport");
+function seedGateExitCode(report) {
+  return report.overall === "error" ? 4 : 0;
+}
+__name(seedGateExitCode, "seedGateExitCode");
+
+// src/catalog/seed-gate-runner.ts
+function runSeedGateFromFile(options) {
+  const mode = options.mode ?? "report-only";
+  const log = options.log ?? ((line) => console.log(line));
+  const warn = options.warn ?? ((line) => console.warn(line));
+  const error = options.error ?? ((line) => console.error(line));
+  const exit = options.exit ?? ((code) => process.exit(code));
+  let snapshot;
+  try {
+    snapshot = loadDiscoverySnapshotFromFile(options.snapshotPath);
+  } catch (err) {
+    if (err instanceof DiscoverySnapshotNotFoundError) {
+      if (mode === "blocking") {
+        error(`[seed-gate] FEHLER: Kein Discovery-Snapshot unter ${options.snapshotPath} \u2014 im blocking-Modus Pflicht (Headless-Scan vor dem Seed ausf\xFChren, #23).`);
+        return exit(4);
+      }
+      warn(`[seed-gate] Kein Discovery-Snapshot unter ${options.snapshotPath} \u2014 \xFCbersprungen (report-only).`);
+      return null;
+    }
+    throw err;
+  }
+  const report = validateSeedAgainstSnapshot({
+    snapshot,
+    plans: options.plans,
+    bundles: options.bundles,
+    approved: options.approved ?? null
+  });
+  log(formatSeedGateReport(report));
+  if (report.overall === "error") {
+    if (mode === "blocking") {
+      error("[seed-gate] blocking: Verst\xF6\xDFe gefunden \u2014 Seed wird abgebrochen (#23).");
+      return exit(seedGateExitCode(report));
+    }
+    warn("[seed-gate] report-only: Verst\xF6\xDFe gefunden, Seed l\xE4uft trotzdem weiter.");
+  }
+  return report;
+}
+__name(runSeedGateFromFile, "runSeedGateFromFile");
+
+export {
+  runPreflight,
+  formatPreflightReport,
+  preflightExitCode,
+  validateSeedAgainstSnapshot,
+  formatSeedGateReport,
+  seedGateExitCode,
+  runSeedGateFromFile
+};

package/dist/{chunk-AJ3EPELS.js → chunk-V34AA7C7.js}

@@ -2,7 +2,7 @@ import {
   DISCOVERY_APP_INFO_TOKEN,
   DISCOVERY_SNAPSHOT_PATH_TOKEN,
   DiscoveryScanner
-} from "./chunk-M6CZQYPY.js";
+} from "./chunk-Z3FWN3HJ.js";
 import {
   DISCOVERY_SNAPSHOT_TOKEN
 } from "./chunk-L4SUWH5B.js";

package/dist/chunk-WJ6BMDL3.js

@@ -0,0 +1,313 @@
+import {
+  MfaService
+} from "./chunk-FVT7KTUI.js";
+import {
+  asProvider
+} from "./chunk-SABTXESR.js";
+import {
+  __name
+} from "./chunk-SHUYVCID.js";
+
+// src/setup/tokens.ts
+var SETUP_PROVISIONING_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/SetupProvisioningPort");
+var SETUP_CONFIG_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/SetupConfig");
+
+// src/setup/setup.service.ts
+import { BadRequestException, ConflictException, ForbiddenException, Inject, Injectable, UnauthorizedException } from "@nestjs/common";
+import { isPlatformUserExistsError, SETUP_ERROR_CODES } from "@saasicat/types";
+import { randomBytes, timingSafeEqual } from "crypto";
+import QRCode from "qrcode";
+function _ts_decorate(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate, "_ts_decorate");
+function _ts_metadata(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata, "_ts_metadata");
+function _ts_param(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param, "_ts_param");
+var GENERATED_PASSWORD_BYTES = 12;
+function timingSafeEqualStr(a, b) {
+  const ab = Buffer.from(a, "utf8");
+  const bb = Buffer.from(b, "utf8");
+  if (ab.length !== bb.length) return false;
+  return timingSafeEqual(ab, bb);
+}
+__name(timingSafeEqualStr, "timingSafeEqualStr");
+var SetupService = class {
+  static {
+    __name(this, "SetupService");
+  }
+  users;
+  config;
+  mfa;
+  constructor(users, config, mfa) {
+    this.users = users;
+    this.config = config;
+    this.mfa = mfa;
+  }
+  async status() {
+    return {
+      needsSetup: await this.users.countSuperAdmins() === 0
+    };
+  }
+  async setup(req) {
+    this.assertToken(req.token);
+    await this.assertNoSuperAdmin();
+    const email = req.email.trim().toLowerCase();
+    if (!email.includes("@")) {
+      throw new BadRequestException({
+        code: SETUP_ERROR_CODES.INVALID_EMAIL
+      });
+    }
+    const generated = !req.password;
+    const password = req.password ?? randomBytes(GENERATED_PASSWORD_BYTES).toString("base64url");
+    let user;
+    try {
+      user = await this.users.createSuperAdmin({
+        email,
+        password
+      });
+    } catch (err) {
+      if (isPlatformUserExistsError(err)) {
+        throw new ConflictException({
+          code: SETUP_ERROR_CODES.EMAIL_EXISTS,
+          message: err.message
+        });
+      }
+      throw err;
+    }
+    const totp = await this.mfa.setup(user.id, user.email, this.config.mfaIssuer);
+    const qrDataUrl = await QRCode.toDataURL(totp.otpauthUri, {
+      width: 220,
+      margin: 1
+    });
+    return {
+      userId: user.id,
+      email: user.email,
+      otpauthUri: totp.otpauthUri,
+      qrDataUrl,
+      secret: totp.secret,
+      ...generated ? {
+        generatedPassword: password
+      } : {}
+    };
+  }
+  async confirmMfa(req) {
+    this.assertToken(req.token);
+    const ok = await this.mfa.verify({
+      userId: req.userId,
+      code: req.code
+    });
+    return {
+      ok
+    };
+  }
+  assertToken(token) {
+    const expected = process.env[this.config.setupTokenEnvVar]?.trim();
+    if (!expected) {
+      throw new ForbiddenException({
+        code: SETUP_ERROR_CODES.SETUP_DISABLED,
+        message: `${this.config.setupTokenEnvVar} ist nicht gesetzt \u2014 Setup ist deaktiviert.`
+      });
+    }
+    if (!token || !timingSafeEqualStr(token, expected)) {
+      throw new UnauthorizedException({
+        code: SETUP_ERROR_CODES.INVALID_SETUP_TOKEN
+      });
+    }
+  }
+  async assertNoSuperAdmin() {
+    if (await this.users.countSuperAdmins() > 0) {
+      throw new ConflictException({
+        code: SETUP_ERROR_CODES.SETUP_ALREADY_DONE
+      });
+    }
+  }
+};
+SetupService = _ts_decorate([
+  Injectable(),
+  _ts_param(0, Inject(SETUP_PROVISIONING_PORT_TOKEN)),
+  _ts_param(1, Inject(SETUP_CONFIG_TOKEN)),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof SuperAdminProvisioningPort === "undefined" ? Object : SuperAdminProvisioningPort,
+    typeof SetupConfig === "undefined" ? Object : SetupConfig,
+    typeof MfaService === "undefined" ? Object : MfaService
+  ])
+], SetupService);
+
+// src/setup/setup.controller.ts
+import { Body, Controller, Get, Post } from "@nestjs/common";
+import { IsEmail, IsNotEmpty, IsOptional, IsString, MinLength } from "class-validator";
+function _ts_decorate2(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate2, "_ts_decorate");
+function _ts_metadata2(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata2, "_ts_metadata");
+function _ts_param2(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param2, "_ts_param");
+var SetupDto = class SetupDto2 {
+  static {
+    __name(this, "SetupDto");
+  }
+  token;
+  email;
+  password;
+};
+_ts_decorate2([
+  IsString(),
+  IsNotEmpty(),
+  _ts_metadata2("design:type", String)
+], SetupDto.prototype, "token", void 0);
+_ts_decorate2([
+  IsEmail(),
+  _ts_metadata2("design:type", String)
+], SetupDto.prototype, "email", void 0);
+_ts_decorate2([
+  IsOptional(),
+  IsString(),
+  MinLength(8),
+  _ts_metadata2("design:type", String)
+], SetupDto.prototype, "password", void 0);
+var SetupConfirmMfaDto = class SetupConfirmMfaDto2 {
+  static {
+    __name(this, "SetupConfirmMfaDto");
+  }
+  token;
+  userId;
+  code;
+};
+_ts_decorate2([
+  IsString(),
+  IsNotEmpty(),
+  _ts_metadata2("design:type", String)
+], SetupConfirmMfaDto.prototype, "token", void 0);
+_ts_decorate2([
+  IsString(),
+  IsNotEmpty(),
+  _ts_metadata2("design:type", String)
+], SetupConfirmMfaDto.prototype, "userId", void 0);
+_ts_decorate2([
+  IsString(),
+  IsNotEmpty(),
+  _ts_metadata2("design:type", String)
+], SetupConfirmMfaDto.prototype, "code", void 0);
+var SetupController = class {
+  static {
+    __name(this, "SetupController");
+  }
+  setup;
+  constructor(setup) {
+    this.setup = setup;
+  }
+  status() {
+    return this.setup.status();
+  }
+  run(dto) {
+    return this.setup.setup(dto);
+  }
+  confirm(dto) {
+    return this.setup.confirmMfa(dto);
+  }
+};
+_ts_decorate2([
+  Get("status"),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", []),
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+], SetupController.prototype, "status", null);
+_ts_decorate2([
+  Post(),
+  _ts_param2(0, Body()),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
+    typeof SetupDto === "undefined" ? Object : SetupDto
+  ]),
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+], SetupController.prototype, "run", null);
+_ts_decorate2([
+  Post("confirm-mfa"),
+  _ts_param2(0, Body()),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
+    typeof SetupConfirmMfaDto === "undefined" ? Object : SetupConfirmMfaDto
+  ]),
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+], SetupController.prototype, "confirm", null);
+SetupController = _ts_decorate2([
+  Controller("admin/setup"),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
+    typeof SetupService === "undefined" ? Object : SetupService
+  ])
+], SetupController);
+
+// src/setup/setup.module.ts
+import { Module } from "@nestjs/common";
+function _ts_decorate3(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate3, "_ts_decorate");
+var DEFAULT_SETUP_TOKEN_ENV_VAR = "SETUP_TOKEN";
+var DEFAULT_MFA_ISSUER = "SuperAdmin";
+var SetupModule = class _SetupModule {
+  static {
+    __name(this, "SetupModule");
+  }
+  static forRoot(options) {
+    return {
+      module: _SetupModule,
+      global: options.global ?? false,
+      controllers: [
+        SetupController
+      ],
+      providers: [
+        asProvider(SETUP_PROVISIONING_PORT_TOKEN, options.provisioningPort),
+        {
+          provide: SETUP_CONFIG_TOKEN,
+          useValue: {
+            setupTokenEnvVar: options.setupTokenEnvVar ?? DEFAULT_SETUP_TOKEN_ENV_VAR,
+            mfaIssuer: options.mfaIssuer ?? DEFAULT_MFA_ISSUER
+          }
+        },
+        SetupService
+      ],
+      exports: [
+        SetupService
+      ]
+    };
+  }
+};
+SetupModule = _ts_decorate3([
+  Module({})
+], SetupModule);
+
+export {
+  SETUP_PROVISIONING_PORT_TOKEN,
+  SETUP_CONFIG_TOKEN,
+  SetupService,
+  SetupController,
+  SetupModule
+};

package/dist/{chunk-M6CZQYPY.js → chunk-Z3FWN3HJ.js}

@@ -34,8 +34,8 @@ var DEFAULT_APP_INFO = {
   key: "unknown",
   version: "0.0.0"
 };
-var DISCOVERY_APP_INFO_TOKEN = /* @__PURE__ */ Symbol("DISCOVERY_APP_INFO");
-var DISCOVERY_SNAPSHOT_PATH_TOKEN = /* @__PURE__ */ Symbol("DISCOVERY_SNAPSHOT_PATH");
+var DISCOVERY_APP_INFO_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/DiscoveryAppInfo");
+var DISCOVERY_SNAPSHOT_PATH_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/DiscoverySnapshotPath");
 var DiscoveryScanner = class _DiscoveryScanner {
   static {
     __name(this, "DiscoveryScanner");