@saasicat/nest 0.9.0 → 0.10.0

package/dist/{chunk-WGVTXSYW.js → chunk-LZHLGUQI.js}

@@ -1,6 +1,6 @@
 import {
   SuperAdminGuard
-} from "./chunk-3M6VLT5N.js";
+} from "./chunk-FVT7KTUI.js";
 import {
   asProvider
 } from "./chunk-SABTXESR.js";

package/dist/{chunk-ZZMAHX22.js → chunk-PUXLPUVH.js}

@@ -1,29 +1,29 @@
 import {
   PromoCodesModule
-} from "./chunk-OFBDEO45.js";
+} from "./chunk-IRWZC3GC.js";
 import {
   AdminManifestModule,
   AdminManifestService,
   AdminModule,
   AdminResourcesModule,
   SuperAdminGuard
-} from "./chunk-3M6VLT5N.js";
+} from "./chunk-FVT7KTUI.js";
 import {
   PublicCatalogModule,
   REQUIRE_FEATURE_KEY,
   SubscriptionBundleModule,
   TenantBillingModule
-} from "./chunk-HXAWPPFW.js";
+} from "./chunk-F3VV6EXG.js";
 import {
   CatalogModule
-} from "./chunk-PBQRPDO2.js";
+} from "./chunk-33TP26MR.js";
 import {
   DiscoveryModule
-} from "./chunk-AJ3EPELS.js";
+} from "./chunk-V34AA7C7.js";
 import {
   EntitlementModule,
   LimitExceededError
-} from "./chunk-GW2I3JZD.js";
+} from "./chunk-GBDUH6DO.js";
 import {
   PLAN_CATALOG_TOKEN,
   PlanCatalogModule
@@ -695,6 +695,7 @@ var SaasPlatformModule = class _SaasPlatformModule {
       }),
       AdminManifestModule.forRoot({
         config: options.adminManifestConfig ?? buildMinimalManifestConfig(),
+        includeManifestController: options.includeManifestController,
         guards: options.controller.guards,
         reloadGuards: options.reloadGuards,
         imports: options.imports,
@@ -763,7 +764,7 @@ var SaasPlatformModule = class _SaasPlatformModule {
     if (promoCodesConfig) {
       const config = promoCodesConfig === true ? {} : promoCodesConfig;
       const promo = persistence?.promo;
-      const { firstTimeCustomerCheck, adminGuards, imports: promoImports, includePublicController, ...promoOptions } = config;
+      const { firstTimeCustomerCheck, adminGuards, imports: promoImports, includePublicController, adminController, ...promoOptions } = config;
       imports.push(PromoCodesModule.forRoot({
         ...promoOptions,
         promoCodeRepository: promo.promoCodeRepository,
@@ -776,7 +777,7 @@ var SaasPlatformModule = class _SaasPlatformModule {
           hasExistingCustomerForEmail: /* @__PURE__ */ __name(async () => false, "hasExistingCustomerForEmail")
         },
         includePublicController: includePublicController ?? false,
-        adminController: {
+        adminController: adminController === false ? false : {
           guards: adminGuards ?? [
             ...options.controller.guards,
             SuperAdminGuard
@@ -865,10 +866,12 @@ var SaasPlatformModule = class _SaasPlatformModule {
         provide: QUOTA_PROVIDERS_TOKEN,
         useFactory: /* @__PURE__ */ __name((...providers) => providers, "useFactory"),
         inject: options.quotaProviders ?? []
-      }, {
-        provide: APP_GUARD,
-        useExisting: StaticFeatureGuard
-      }, {
+      }, ...options.globalFeatureGuard === false ? [] : [
+        {
+          provide: APP_GUARD,
+          useExisting: StaticFeatureGuard
+        }
+      ], {
         provide: APP_INTERCEPTOR,
         useExisting: EnforceQuotaInterceptor
       });

package/dist/{chunk-7K5PT2LX.js → chunk-TXDH4FUA.js}

@@ -6,7 +6,7 @@ import {
   ADVISORY_STRICT_MODE_CODES,
   validateBundleDraft,
   validatePlanDraft
-} from "./chunk-PBQRPDO2.js";
+} from "./chunk-33TP26MR.js";
 import {
   __name
 } from "./chunk-SHUYVCID.js";

package/dist/{chunk-AJ3EPELS.js → chunk-V34AA7C7.js}

@@ -2,7 +2,7 @@ import {
   DISCOVERY_APP_INFO_TOKEN,
   DISCOVERY_SNAPSHOT_PATH_TOKEN,
   DiscoveryScanner
-} from "./chunk-M6CZQYPY.js";
+} from "./chunk-Z3FWN3HJ.js";
 import {
   DISCOVERY_SNAPSHOT_TOKEN
 } from "./chunk-L4SUWH5B.js";

package/dist/chunk-WJ6BMDL3.js

@@ -0,0 +1,313 @@
+import {
+  MfaService
+} from "./chunk-FVT7KTUI.js";
+import {
+  asProvider
+} from "./chunk-SABTXESR.js";
+import {
+  __name
+} from "./chunk-SHUYVCID.js";
+
+// src/setup/tokens.ts
+var SETUP_PROVISIONING_PORT_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/SetupProvisioningPort");
+var SETUP_CONFIG_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/SetupConfig");
+
+// src/setup/setup.service.ts
+import { BadRequestException, ConflictException, ForbiddenException, Inject, Injectable, UnauthorizedException } from "@nestjs/common";
+import { isPlatformUserExistsError, SETUP_ERROR_CODES } from "@saasicat/types";
+import { randomBytes, timingSafeEqual } from "crypto";
+import QRCode from "qrcode";
+function _ts_decorate(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate, "_ts_decorate");
+function _ts_metadata(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata, "_ts_metadata");
+function _ts_param(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param, "_ts_param");
+var GENERATED_PASSWORD_BYTES = 12;
+function timingSafeEqualStr(a, b) {
+  const ab = Buffer.from(a, "utf8");
+  const bb = Buffer.from(b, "utf8");
+  if (ab.length !== bb.length) return false;
+  return timingSafeEqual(ab, bb);
+}
+__name(timingSafeEqualStr, "timingSafeEqualStr");
+var SetupService = class {
+  static {
+    __name(this, "SetupService");
+  }
+  users;
+  config;
+  mfa;
+  constructor(users, config, mfa) {
+    this.users = users;
+    this.config = config;
+    this.mfa = mfa;
+  }
+  async status() {
+    return {
+      needsSetup: await this.users.countSuperAdmins() === 0
+    };
+  }
+  async setup(req) {
+    this.assertToken(req.token);
+    await this.assertNoSuperAdmin();
+    const email = req.email.trim().toLowerCase();
+    if (!email.includes("@")) {
+      throw new BadRequestException({
+        code: SETUP_ERROR_CODES.INVALID_EMAIL
+      });
+    }
+    const generated = !req.password;
+    const password = req.password ?? randomBytes(GENERATED_PASSWORD_BYTES).toString("base64url");
+    let user;
+    try {
+      user = await this.users.createSuperAdmin({
+        email,
+        password
+      });
+    } catch (err) {
+      if (isPlatformUserExistsError(err)) {
+        throw new ConflictException({
+          code: SETUP_ERROR_CODES.EMAIL_EXISTS,
+          message: err.message
+        });
+      }
+      throw err;
+    }
+    const totp = await this.mfa.setup(user.id, user.email, this.config.mfaIssuer);
+    const qrDataUrl = await QRCode.toDataURL(totp.otpauthUri, {
+      width: 220,
+      margin: 1
+    });
+    return {
+      userId: user.id,
+      email: user.email,
+      otpauthUri: totp.otpauthUri,
+      qrDataUrl,
+      secret: totp.secret,
+      ...generated ? {
+        generatedPassword: password
+      } : {}
+    };
+  }
+  async confirmMfa(req) {
+    this.assertToken(req.token);
+    const ok = await this.mfa.verify({
+      userId: req.userId,
+      code: req.code
+    });
+    return {
+      ok
+    };
+  }
+  assertToken(token) {
+    const expected = process.env[this.config.setupTokenEnvVar]?.trim();
+    if (!expected) {
+      throw new ForbiddenException({
+        code: SETUP_ERROR_CODES.SETUP_DISABLED,
+        message: `${this.config.setupTokenEnvVar} ist nicht gesetzt \u2014 Setup ist deaktiviert.`
+      });
+    }
+    if (!token || !timingSafeEqualStr(token, expected)) {
+      throw new UnauthorizedException({
+        code: SETUP_ERROR_CODES.INVALID_SETUP_TOKEN
+      });
+    }
+  }
+  async assertNoSuperAdmin() {
+    if (await this.users.countSuperAdmins() > 0) {
+      throw new ConflictException({
+        code: SETUP_ERROR_CODES.SETUP_ALREADY_DONE
+      });
+    }
+  }
+};
+SetupService = _ts_decorate([
+  Injectable(),
+  _ts_param(0, Inject(SETUP_PROVISIONING_PORT_TOKEN)),
+  _ts_param(1, Inject(SETUP_CONFIG_TOKEN)),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof SuperAdminProvisioningPort === "undefined" ? Object : SuperAdminProvisioningPort,
+    typeof SetupConfig === "undefined" ? Object : SetupConfig,
+    typeof MfaService === "undefined" ? Object : MfaService
+  ])
+], SetupService);
+
+// src/setup/setup.controller.ts
+import { Body, Controller, Get, Post } from "@nestjs/common";
+import { IsEmail, IsNotEmpty, IsOptional, IsString, MinLength } from "class-validator";
+function _ts_decorate2(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate2, "_ts_decorate");
+function _ts_metadata2(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata2, "_ts_metadata");
+function _ts_param2(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param2, "_ts_param");
+var SetupDto = class SetupDto2 {
+  static {
+    __name(this, "SetupDto");
+  }
+  token;
+  email;
+  password;
+};
+_ts_decorate2([
+  IsString(),
+  IsNotEmpty(),
+  _ts_metadata2("design:type", String)
+], SetupDto.prototype, "token", void 0);
+_ts_decorate2([
+  IsEmail(),
+  _ts_metadata2("design:type", String)
+], SetupDto.prototype, "email", void 0);
+_ts_decorate2([
+  IsOptional(),
+  IsString(),
+  MinLength(8),
+  _ts_metadata2("design:type", String)
+], SetupDto.prototype, "password", void 0);
+var SetupConfirmMfaDto = class SetupConfirmMfaDto2 {
+  static {
+    __name(this, "SetupConfirmMfaDto");
+  }
+  token;
+  userId;
+  code;
+};
+_ts_decorate2([
+  IsString(),
+  IsNotEmpty(),
+  _ts_metadata2("design:type", String)
+], SetupConfirmMfaDto.prototype, "token", void 0);
+_ts_decorate2([
+  IsString(),
+  IsNotEmpty(),
+  _ts_metadata2("design:type", String)
+], SetupConfirmMfaDto.prototype, "userId", void 0);
+_ts_decorate2([
+  IsString(),
+  IsNotEmpty(),
+  _ts_metadata2("design:type", String)
+], SetupConfirmMfaDto.prototype, "code", void 0);
+var SetupController = class {
+  static {
+    __name(this, "SetupController");
+  }
+  setup;
+  constructor(setup) {
+    this.setup = setup;
+  }
+  status() {
+    return this.setup.status();
+  }
+  run(dto) {
+    return this.setup.setup(dto);
+  }
+  confirm(dto) {
+    return this.setup.confirmMfa(dto);
+  }
+};
+_ts_decorate2([
+  Get("status"),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", []),
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+], SetupController.prototype, "status", null);
+_ts_decorate2([
+  Post(),
+  _ts_param2(0, Body()),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
+    typeof SetupDto === "undefined" ? Object : SetupDto
+  ]),
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+], SetupController.prototype, "run", null);
+_ts_decorate2([
+  Post("confirm-mfa"),
+  _ts_param2(0, Body()),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
+    typeof SetupConfirmMfaDto === "undefined" ? Object : SetupConfirmMfaDto
+  ]),
+  _ts_metadata2("design:returntype", typeof Promise === "undefined" ? Object : Promise)
+], SetupController.prototype, "confirm", null);
+SetupController = _ts_decorate2([
+  Controller("admin/setup"),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
+    typeof SetupService === "undefined" ? Object : SetupService
+  ])
+], SetupController);
+
+// src/setup/setup.module.ts
+import { Module } from "@nestjs/common";
+function _ts_decorate3(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate3, "_ts_decorate");
+var DEFAULT_SETUP_TOKEN_ENV_VAR = "SETUP_TOKEN";
+var DEFAULT_MFA_ISSUER = "SuperAdmin";
+var SetupModule = class _SetupModule {
+  static {
+    __name(this, "SetupModule");
+  }
+  static forRoot(options) {
+    return {
+      module: _SetupModule,
+      global: options.global ?? false,
+      controllers: [
+        SetupController
+      ],
+      providers: [
+        asProvider(SETUP_PROVISIONING_PORT_TOKEN, options.provisioningPort),
+        {
+          provide: SETUP_CONFIG_TOKEN,
+          useValue: {
+            setupTokenEnvVar: options.setupTokenEnvVar ?? DEFAULT_SETUP_TOKEN_ENV_VAR,
+            mfaIssuer: options.mfaIssuer ?? DEFAULT_MFA_ISSUER
+          }
+        },
+        SetupService
+      ],
+      exports: [
+        SetupService
+      ]
+    };
+  }
+};
+SetupModule = _ts_decorate3([
+  Module({})
+], SetupModule);
+
+export {
+  SETUP_PROVISIONING_PORT_TOKEN,
+  SETUP_CONFIG_TOKEN,
+  SetupService,
+  SetupController,
+  SetupModule
+};

package/dist/{chunk-M6CZQYPY.js → chunk-Z3FWN3HJ.js}

@@ -34,8 +34,8 @@ var DEFAULT_APP_INFO = {
   key: "unknown",
   version: "0.0.0"
 };
-var DISCOVERY_APP_INFO_TOKEN = /* @__PURE__ */ Symbol("DISCOVERY_APP_INFO");
-var DISCOVERY_SNAPSHOT_PATH_TOKEN = /* @__PURE__ */ Symbol("DISCOVERY_SNAPSHOT_PATH");
+var DISCOVERY_APP_INFO_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/DiscoveryAppInfo");
+var DISCOVERY_SNAPSHOT_PATH_TOKEN = /* @__PURE__ */ Symbol.for("saas-platform/DiscoverySnapshotPath");
 var DiscoveryScanner = class _DiscoveryScanner {
   static {
     __name(this, "DiscoveryScanner");