@simitgroup/simpleapp-generator 1.6.7-o-alpha → 2.0.0-a-alpha

package/templates/nest/src/simple-app/.core/features/mini-app/mini-app-manager/mini-app-manager.service.ts.eta

@@ -0,0 +1,346 @@
+import { BadRequestException, Injectable, NotFoundException } from '@nestjs/common';
+
+import { UserContext } from 'src/simple-app/.core/features/user-context/user.context';
+import { CategorizedMiniAppDetail, DynamicParam, InstalledMiniAppDetail, MiniApp, MiniAppDetail, MiniAppInstallation } from '../dto';
+import { MiniAppService } from 'src/simple-app/.core/resources/mini-app/mini-app.service';
+
+import { MiniAppEnvEnum, MiniAppStatusEnum } from 'src/simple-app/.core/resources/mini-app/mini-app.enum';
+import { MiniAppInstallationService } from 'src/simple-app/.core/resources/mini-app-installation/mini-app-installation.service';
+import _ from 'lodash';
+import { MiniAppManagerPolicyService } from './mini-app-manager-policy.service';
+import { MiniAppError } from './mini-app-manager.error';
+
+@Injectable()
+export class MiniAppManagerService {
+  constructor(
+    private readonly miniAppService: MiniAppService,
+    private readonly miniAppInstallationService: MiniAppInstallationService,
+    private readonly policyService: MiniAppManagerPolicyService,
+  ) {}
+
+  // ==================================== API Function ====================================
+
+  async runInstallMiniApp(appUser: UserContext, miniAppCode: string) {
+    this.assertHasMiniAppFeature(appUser);
+
+    const miniApp = await this.findMiniAppOrFail(appUser, miniAppCode);
+
+    this.assertPrivateAppPermission(appUser, miniApp);
+
+    this.assertHasRequiredPlan(appUser, miniApp);
+
+    this.assertIsMiniAppReleased(miniApp);
+
+    return await this.installMiniApp(appUser, miniAppCode, miniApp);
+  }
+
+  async runUninstallMiniApp(appUser: UserContext, miniAppCode: string) {
+    this.assertHasMiniAppFeature(appUser);
+
+    await this.findMiniAppOrFail(appUser, miniAppCode);
+
+    return await this.uninstallMiniApp(appUser, miniAppCode);
+  }
+
+  async runUpdateMiniAppSetting(appUser: UserContext, miniAppCode: string, data: DynamicParam) {
+    this.assertHasMiniAppFeature(appUser);
+
+    const miniApp = await this.findMiniAppOrFail(appUser, miniAppCode);
+
+    this.assertHasRequiredPlan(appUser, miniApp);
+
+    this.assertIsMiniAppReleased(miniApp);
+
+    return await this.updateMiniAppSetting(appUser, miniAppCode, data);
+  }
+
+  async runSystemDefaultMiniAppMigration(appUser: UserContext) {
+    // const result = [];
+    // for (const item of DEFAULT_MINI_APPS) {
+    //   const miniApps = await this.miniAppService.search(appUser, {
+    //     code: item.code,
+    //   });
+    //   if (miniApps && miniApps.length > 0) {
+    //     const miniApp = miniApps[0];
+    //     const id = miniApp._id;
+    //     const resp = await this.miniAppService.findIdThenUpdate(appUser, id, item);
+    //     result.push(resp);
+    //   } else {
+    //     const resp = await this.miniAppService.create(appUser, item);
+    //     result.push(resp);
+    //   }
+    // }
+    // return result;
+  }
+
+  async runGetInstalledMiniApps(appUser: UserContext): Promise<InstalledMiniAppDetail> {
+    // Find Mini App Installation Record With Mini App Detail
+    const miniAppInstallations = await this.findMiniAppInstallations(appUser);
+    const installationMap = new Map(miniAppInstallations.map((inst) => [inst.miniApp._id.toString(), inst]));
+    const miniApps = await this.miniAppService.search(appUser, {
+      _id: { $in: Array.from(installationMap.keys()) },
+    });
+
+    const permissions = this.getMiniAppActionAccess(appUser);
+
+    const installedMiniApps = miniAppInstallations.map((installation) => {
+      const miniApp = miniApps.find((miniApp) => miniApp._id === installation.miniApp._id);
+      if (!miniApp) {
+        return null;
+      }
+
+      // @ts-ignore
+      const miniAppObj = miniApp.toObject();
+      return {
+        ...miniAppObj,
+        hasRequiredPlan: this.policyService.hasRequiredPlan(appUser, miniApp),
+        // @ts-ignore
+        miniAppInstallation: installation ? installation.toObject() : undefined,
+      };
+    });
+
+    return { installedMiniApps: installedMiniApps, permissions };
+  }
+
+  async runGetCategorizedMiniApps(appUser: UserContext): Promise<CategorizedMiniAppDetail> {
+    const isDevEnv = this.isDevEnv(appUser);
+
+    const result = {
+      upcomingMiniApps: [],
+      availableMiniApps: [],
+    };
+
+    const miniAppInstallations = await this.findMiniAppInstallations(appUser);
+
+    const installedMiniAppIdArr = miniAppInstallations.map((inst) => inst.miniApp._id);
+
+    let filter = {
+      _id: { $nin: installedMiniAppIdArr },
+      env: MiniAppEnvEnum.PROD,
+      status: {
+        $in: [MiniAppStatusEnum.PUBLISHED, MiniAppStatusEnum.UPCOMING, MiniAppStatusEnum.BETA],
+      },
+    };
+
+    if (isDevEnv) {
+      filter = {
+        _id: { $nin: installedMiniAppIdArr },
+        env: MiniAppEnvEnum.DEV,
+        status: {
+          $in: [MiniAppStatusEnum.DRAFT],
+        },
+      };
+    }
+
+    const miniApps = await this.miniAppService.search(appUser, filter);
+
+    miniApps.forEach((miniApp) => {
+      if (miniApp.status === MiniAppStatusEnum.UPCOMING) {
+        result.upcomingMiniApps.push({
+          // @ts-ignore
+          ...miniApp.toObject(),
+          hasRequiredPlan: this.policyService.hasRequiredPlan(appUser, miniApp),
+        });
+      } else {
+        // MiniApp Not Public, Not Allow To List To User
+        if (miniApp.access.visibility === 'private' && !isDevEnv) {
+          if (!(miniApp.access.allowEmails ?? []).includes(appUser.getEmail())) {
+            // Private App, and not allowed current user to install
+            return;
+          }
+        }
+
+        result.availableMiniApps.push({
+          // @ts-ignore
+          ...miniApp.toObject(),
+          hasRequiredPlan: this.policyService.hasRequiredPlan(appUser, miniApp),
+        });
+      }
+    });
+
+    return result;
+  }
+
+  async runGetMiniAppDetail(appUser: UserContext, miniAppCode: string): Promise<MiniAppDetail> {
+    const miniApp = await this.findMiniAppOrFail(appUser, miniAppCode);
+    const miniAppInstallation = await this.findMiniAppInstallation(appUser, miniAppCode);
+
+    this.assertPrivateAppPermission(appUser, miniApp);
+
+    return {
+      // @ts-ignore
+      ...miniApp.toObject(),
+      hasRequiredPlan: this.policyService.hasRequiredPlan(appUser, miniApp),
+      miniAppInstallation,
+    };
+  }
+
+  private getMiniAppActionAccess(appUser: UserContext) {
+    return {
+      hasMiniAppFeature: this.policyService.hasFeature(appUser),
+      canInstall: this.policyService.canInstall(appUser),
+      canUninstall: this.policyService.canUninstall(appUser),
+      canUpdateSetting: this.policyService.canUpdateSetting(appUser),
+    };
+  }
+
+  // =================================== Finder Function ==================================
+
+  async findMiniAppOrFail(appUser: UserContext, miniAppCode: string): Promise<MiniApp> {
+    const isDevEnv = this.isDevEnv(appUser);
+    const miniApps = await this.miniAppService.search(appUser, {
+      code: miniAppCode,
+      env: isDevEnv ? MiniAppEnvEnum.DEV : MiniAppEnvEnum.PROD,
+    });
+
+    if (miniApps && miniApps.length > 0) {
+      return miniApps[0];
+    }
+
+    const msg = MiniAppError.format(MiniAppError.ERR.NOT_FOUND);
+    throw new NotFoundException(msg);
+  }
+
+  async findMiniAppInstallations(appUser: UserContext) {
+    const miniAppInstallations = await this.miniAppInstallationService.search(
+      appUser,
+      {
+        isActive: true,
+      },
+      undefined,
+      {
+        seqNo: 1,
+      },
+    );
+
+    return miniAppInstallations;
+  }
+
+  async findMiniAppInstallation(appUser: UserContext, miniAppCode: string): Promise<MiniAppInstallation | undefined> {
+    const miniAppInstallations = await this.miniAppInstallationService.search(appUser, {
+      'miniApp.code': miniAppCode,
+    });
+
+    return miniAppInstallations?.[0];
+  }
+
+  async findIsMiniAppInstalledOrFail(appUser: UserContext, miniAppCode: string) {
+    const miniAppInstallation = await this.findMiniAppInstallation(appUser, miniAppCode);
+    if (!miniAppInstallation) {
+      const msg = MiniAppError.format(MiniAppError.ERR.NOT_INSTALLED);
+      throw new NotFoundException(msg);
+    }
+
+    if (!miniAppInstallation.isActive) {
+      // Already inactive, previously already uninstall
+      const msg = MiniAppError.format(MiniAppError.ERR.NOT_INSTALLED);
+      throw new NotFoundException(msg);
+    }
+
+    return miniAppInstallation;
+  }
+
+  // ================================= Validation Function ================================
+
+  assertHasMiniAppFeature(appUser: UserContext) {
+    if (!this.policyService.hasFeature(appUser)) {
+      const msg = MiniAppError.format(MiniAppError.ERR.NO_FEATURE);
+      throw new BadRequestException(msg);
+    }
+  }
+
+  assertIsMiniAppReleased(miniApp: MiniApp) {
+    if (!this.policyService.isMiniAppRealeased(miniApp.status as MiniAppStatusEnum)) {
+      const msg = MiniAppError.format(MiniAppError.ERR.NOT_RELEASED, { status: miniApp.status });
+      throw new BadRequestException(msg);
+    }
+  }
+
+  assertHasRequiredPlan(appUser: UserContext, miniApp: MiniApp) {
+    if (!this.policyService.hasRequiredPlan(appUser, miniApp)) {
+      const msg = MiniAppError.format(MiniAppError.ERR.PLAN_REQUIRED, { miniAppName: miniApp.name, requiredPlans: miniApp.access.requiredPlans.join(', ') });
+      throw new BadRequestException(msg);
+    }
+  }
+
+  assertPrivateAppPermission(appUser: UserContext, miniApp: MiniApp) {
+    if (miniApp.access.visibility === 'private') {
+      if (!(miniApp.access.allowEmails ?? []).includes(appUser.getEmail())) {
+        const msg = MiniAppError.format(MiniAppError.ERR.PRIVATE_APP);
+        throw new BadRequestException(msg);
+      }
+    }
+  }
+
+  // =================================== Action Function ==================================
+
+  private async installMiniApp(appUser: UserContext, miniAppCode: string, miniApp: MiniApp): Promise<MiniAppInstallation> {
+    const miniAppInstallation = await this.findMiniAppInstallation(appUser, miniAppCode);
+    if (!miniAppInstallation) {
+      // Install MiniApp
+      return await this.createMiniAppInstallation(appUser, miniApp);
+    }
+
+    if (miniAppInstallation.isActive) {
+      const msg = MiniAppError.format(MiniAppError.ERR.ALREADY_INSTALLED);
+      throw new BadRequestException(msg);
+    }
+
+    // Reactivate MiniApp
+    return await this.reactivateInstalledMiniApp(appUser, miniAppInstallation);
+  }
+
+  private async uninstallMiniApp(appUser: UserContext, miniAppCode: string) {
+    const miniAppInstallation = await this.findIsMiniAppInstalledOrFail(appUser, miniAppCode);
+    return await this.deactiveInstalledMiniApp(appUser, miniAppInstallation);
+  }
+
+  private async updateMiniAppSetting(appUser: UserContext, miniAppCode: string, data: DynamicParam) {
+    const miniAppInstallation = await this.findIsMiniAppInstalledOrFail(appUser, miniAppCode);
+    return await this.setMiniAppInstallationSetting(appUser, miniAppInstallation, data);
+  }
+
+  private async setMiniAppInstallationSetting(appUser: UserContext, miniAppInstallation: MiniAppInstallation, data: DynamicParam) {
+    return await this.miniAppInstallationService.findIdThenPatch(appUser, miniAppInstallation._id, {
+      settings: data,
+    } as MiniAppInstallation);
+  }
+
+  private async createMiniAppInstallation(appUser: UserContext, miniApp: MiniApp) {
+    return await this.miniAppInstallationService.create(appUser, {
+      apiKey: crypto.randomUUID(),
+      isActive: true,
+      miniApp: {
+        _id: miniApp._id,
+        code: miniApp.code,
+        label: miniApp.name,
+        developerPortalAppId: miniApp.developerPortal.appId,
+      },
+      miniApiUser: {
+        _id: appUser.getId(),
+        uid: appUser.getUid(),
+        name: appUser.getFullname(),
+        email: appUser.getEmail(),
+      },
+      settings: {},
+    });
+  }
+
+  private async reactivateInstalledMiniApp(appUser: UserContext, miniAppInstallation: MiniAppInstallation) {
+    return this.setMiniAppInstallationActiveStatus(appUser, miniAppInstallation, true);
+  }
+
+  private async deactiveInstalledMiniApp(appUser: UserContext, miniAppInstallation: MiniAppInstallation) {
+    return this.setMiniAppInstallationActiveStatus(appUser, miniAppInstallation, false);
+  }
+
+  private async setMiniAppInstallationActiveStatus(appUser: UserContext, miniAppInstallation: MiniAppInstallation, isActive: boolean) {
+    return await this.miniAppInstallationService.findIdThenPatch(appUser, miniAppInstallation._id, {
+      isActive,
+    } as MiniAppInstallation);
+  }
+
+  private isDevEnv(appUser: UserContext) {
+    return appUser.getXOrg() === process.env.DEMO_COMPANY_XORG;
+  }
+}

package/templates/nest/src/simple-app/.core/features/mini-app/mini-app-scope/mini-app-scope.decorator.ts.eta

@@ -0,0 +1,5 @@
+import { SetMetadata } from '@nestjs/common';
+
+export const MINIAPP_SCOPE_KEY = 'miniapp_required_scope';
+
+export const MiniAppScope = (scope: string) => SetMetadata(MINIAPP_SCOPE_KEY, scope);

package/templates/nest/src/simple-app/.core/features/mini-app/mini-app-scope/mini-app-scope.guard.ts.eta

@@ -0,0 +1,43 @@
+import { CanActivate, ExecutionContext, Injectable, ForbiddenException, UnauthorizedException, BadRequestException } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { UserContext } from 'src/simpleapp/generate/commons/user.context';
+import { MINIAPP_SCOPE_KEY } from './mini-app-scope.decorator';
+import { MiniAppScopeService } from './mini-app-scope.service';
+import { TUserType } from 'src/simpleapp/types';
+import { GqlContextType } from '@nestjs/graphql';
+
+@Injectable()
+export class MiniAppScopeGuard implements CanActivate {
+  private readonly _miniAppUserTypes: TUserType[] = ['miniApi', 'miniAppSdk'];
+  constructor(
+    private readonly reflector: Reflector,
+    private readonly miniAppScopeService: MiniAppScopeService,
+  ) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    if (context.getType<GqlContextType>() === 'graphql') {
+      return true;
+    }
+
+    const req = context.switchToHttp().getRequest();
+    const appUser: UserContext = req?.sessionuser;
+    if (!appUser) {
+      throw new BadRequestException('User Context Not Found');
+    }
+
+    // Not Mini API Request, Allow To Proceed
+    if (!this._miniAppUserTypes.includes(appUser.getUserType())) {
+      return true;
+    }
+
+    const requiredScope = this.reflector.get<string>(MINIAPP_SCOPE_KEY, context.getHandler());
+    if (!requiredScope) {
+      // Not Defined @MiniAppScope('xxx'), Not Allowed To Call This API
+      throw new ForbiddenException('You are not allowed to call this protected api.');
+    }
+
+    await this.miniAppScopeService.assertHasScope(appUser, requiredScope, req);
+
+    return true;
+  }
+}

package/templates/nest/src/simple-app/.core/features/mini-app/mini-app-scope/mini-app-scope.service.ts.eta

@@ -0,0 +1,101 @@
+import { BadRequestException, ForbiddenException, Injectable } from '@nestjs/common';
+import { InjectModel } from '@nestjs/mongoose';
+import { Model } from 'mongoose';
+import { UserContext } from 'src/simpleapp/generate/commons/user.context';
+import { Miniapp } from 'src/simpleapp/generate/types';
+import { getEnvironment, getEnvironmentWithApp } from '../utils/mini-app.util';
+import { MiniAppManagerEnvEnum } from '../mini-app-manager/mini-app-manager.enum';
+import { Request } from 'express';
+import _ from 'lodash';
+
+@Injectable()
+export class MiniAppScopeService {
+  constructor(@InjectModel('Miniapp') private readonly miniAppModel: Model<Miniapp>) {}
+
+  /**
+   * Find Mini App From Dev To See Is This A Custom Demo Company
+   * Only env: 'dev' will have development.demoXOrg field
+   * @param developerPortalAppId
+   */
+  async isMiniAppHaveCustomDemoCompany(developerPortalAppId: string) {
+    const miniApp = await this.miniAppModel.findOne({
+      'developerPortal.appId': developerPortalAppId,
+      'development.demoXOrg': { $exists: true, $ne: null },
+      env: MiniAppManagerEnvEnum.DEV,
+    });
+
+    return miniApp;
+  }
+
+  async findMiniAppOrFail(developerPortalAppId: string, env: MiniAppManagerEnvEnum) {
+    const miniApp = await this.miniAppModel.findOne({
+      'developerPortal.appId': developerPortalAppId,
+      env,
+    });
+
+    if (!miniApp) {
+      throw new BadRequestException('Mini App Not Found');
+    }
+
+    return miniApp;
+  }
+
+  getDeveloperPortalAppId(appUser: UserContext, req: Request) {
+    const userType = appUser.getUserType();
+    let developerPortalAppId = '';
+
+    if (userType === 'miniApi') {
+      developerPortalAppId = appUser.getMiniApiTokenInfo().miniAppId;
+    } else if (userType === 'miniAppSdk') {
+      developerPortalAppId = req.headers['x-mini-app-dev-portal-app-id'] as string;
+    }
+
+    if (_.isEmpty(developerPortalAppId)) {
+      throw new BadRequestException('Unknow Mini App App Id');
+    }
+
+    return developerPortalAppId;
+  }
+
+  async assertHasScope(appUser: UserContext, requiredScope: string, req: Request) {
+    const developerPortalAppId = this.getDeveloperPortalAppId(appUser, req);
+
+    const scopes = await this.getScopes(appUser, developerPortalAppId);
+
+    if (!scopes.includes(requiredScope)) {
+      throw new ForbiddenException(`Missing required scope: ${requiredScope}`);
+    }
+  }
+
+  assertEnabledFeature(appUser: UserContext, miniApp: Miniapp) {
+    const userType = appUser.getUserType();
+
+    if (userType === 'miniApi') {
+      if (!miniApp.integration.enabled.miniApi) {
+        throw new BadRequestException('Not enabled api feature');
+      }
+    } else if (userType === 'miniAppSdk') {
+      if (!miniApp.integration.enabled.customPage) {
+        throw new BadRequestException('Not enabled custom page feature');
+      }
+    }
+  }
+
+  async getScopes(appUser: UserContext, developerPortalAppId: string) {
+    let env = getEnvironment(appUser);
+    if (env === MiniAppManagerEnvEnum.PROD) {
+      const customDemoMiniApp = await this.isMiniAppHaveCustomDemoCompany(developerPortalAppId);
+      if (customDemoMiniApp) {
+        // Check Is Current In Custom Demo XOrg
+        env = getEnvironmentWithApp(appUser, customDemoMiniApp);
+      }
+    }
+
+    const miniApp = await this.findMiniAppOrFail(developerPortalAppId, env);
+    this.assertEnabledFeature(appUser, miniApp);
+
+    const scopes = miniApp.integration?.scopes ?? [];
+
+    return scopes;
+  }
+}

package/templates/nest/src/simple-app/.core/features/mini-app/mini-app.module.ts.eta

@@ -0,0 +1,24 @@
+/**
+ * This file was automatically generated by simpleapp generator. Every
+ * MODIFICATION OVERRIDE BY GENERATEOR
+ * last change 2024-04-02
+ * Author: Ks Tan
+ */
+import { Module } from '@nestjs/common';
+import { MiniAppManagerController } from './mini-app-manager/mini-app-manager.controller';
+import { MiniAppManagerService } from './mini-app-manager/mini-app-manager.service';
+import { MiniAppManagerPolicyService } from './mini-app-manager/mini-app-manager-policy.service';
+import { MiniAppInstallationModule } from '../../resources/mini-app-installation/mini-app-installation.module';
+import { MiniAppModule } from '../../resources/mini-app/mini-app.module';
+import { SimpleAppSoftwarePolicyModule } from '../policy/policy.module';
+import { MiniAppManagerBridgeService } from './mini-app-manager/mini-app-manager-bridge.service';
+import { MiniAppManagerEnvProductionService } from './mini-app-manager/mini-app-manager-env-production.service';
+import { MiniAppManagerEnvDevelopmentService } from './mini-app-manager/mini-app-manager-env-development.service';
+
+@Module({
+  imports: [SimpleAppSoftwarePolicyModule,MiniAppInstallationModule,MiniAppModule],
+  controllers: [MiniAppManagerController],
+  providers: [MiniAppManagerService,MiniAppManagerPolicyService,MiniAppManagerEnvProductionService,MiniAppManagerEnvDevelopmentService,MiniAppManagerBridgeService],
+  exports: [MiniAppManagerService,MiniAppManagerPolicyService,MiniAppManagerEnvProductionService,MiniAppManagerEnvDevelopmentService,MiniAppManagerBridgeService],
+})
+export class SimpleAppMiniAppModule {}

package/templates/nest/src/simple-app/.core/features/mini-app/types/miniApp.ts.eta

@@ -0,0 +1,23 @@
+import { Miniapp, Miniappinstallation } from '../../../simpleapp/generate/types';
+
+export type MiniAppDetailPermission = {
+  hasMiniAppFeature: boolean;
+  canInstall: boolean;
+  canUninstall: boolean;
+  canUpdateSetting: boolean;
+};
+
+export type MiniAppDetail = Miniapp & {
+  hasRequiredPlan: boolean;
+  miniAppInstallation?: Miniappinstallation;
+};
+
+export type CategorizedMiniAppDetail = {
+  upcomingMiniApps: MiniAppDetail[];
+  availableMiniApps: MiniAppDetail[];
+};
+
+export type InstalledMiniAppDetail = {
+  installedMiniApps: MiniAppDetail[];
+  permissions: MiniAppDetailPermission;
+};

package/templates/nest/src/simple-app/.core/features/mini-app/utils/mini-app.util.ts.eta

@@ -0,0 +1,26 @@
+import { UserContext } from 'src/simple-app/.core/features/user-context/user.context';
+import { MiniAppManagerEnvEnum } from '../mini-app-manager/mini-app-manager.enum';
+import { MiniApp } from '../dto';
+
+export function isDemoCompany(xOrg: string): boolean {
+  return xOrg === process.env.DEMO_COMPANY_XORG;
+}
+
+export function isSemiDevOrg(xOrg: string, miniApp: MiniApp): boolean {
+  return xOrg === miniApp?.development?.demoXOrg;
+}
+
+export function getEnvironment(appUser: UserContext) {
+  const currentXOrg = appUser.getXOrg();
+  if (isDemoCompany(currentXOrg)) return MiniAppManagerEnvEnum.DEV;
+
+  return MiniAppManagerEnvEnum.PROD;
+}
+
+export function getEnvironmentWithApp(appUser: UserContext, miniApp: MiniApp) {
+  const currentXOrg = appUser.getXOrg();
+  if (isDemoCompany(currentXOrg)) return MiniAppManagerEnvEnum.DEV;
+  if (isSemiDevOrg(currentXOrg, miniApp)) return MiniAppManagerEnvEnum.DEV;
+
+  return MiniAppManagerEnvEnum.PROD;
+}

package/templates/nest/src/simple-app/.core/features/policy/policy.module.ts.eta

@@ -0,0 +1,12 @@
+
+import { Module } from '@nestjs/common';
+import {PolicyService} from './policy.service'
+@Module({
+  imports: [
+    
+  ],
+  controllers: [],
+  providers: [PolicyService],
+  exports: [PolicyService],
+})
+export class SimpleAppSoftwarePolicyModule {}

package/templates/nest/src/simple-app/.core/features/policy/policy.service.ts.eta

@@ -0,0 +1,45 @@
+import { Injectable } from '@nestjs/common';
+import { Role } from 'src/simple-app/.core/features/auth/role-guard/roles.enum';
+import { UserContext } from 'src/simple-app/.core/features/user-context/user.context';
+
+@Injectable()
+export class PolicyService {
+  private readonly _HIGH_PRIVILEGE_ROLES = [Role.SuperAdmin, Role.SuperUser, Role.TenantOwner];
+
+  private readonly _FEATURES = {
+    miniApp: ['lite', 'pro', 'enterprise'],
+  };
+
+  hasHighPrivilege(roles: Role[]): boolean {
+    return this._HIGH_PRIVILEGE_ROLES.some((role) => roles.includes(role));
+  }
+
+  hasRole(roles: Role[], role: Role) {
+    return roles.includes(role);
+  }
+
+  /**
+   * Check if user's current plan has access to a specific feature.
+   *
+   * TODO: In the future, migrate to individual plan definition files:
+   * - plans/free.ts
+   * - plans/lite.ts
+   * - plans/pro.ts
+   * - plans/enterprise.ts
+   */
+  hasFeature(appUser: UserContext, feature: keyof typeof this._FEATURES): boolean {
+    const appPackage = appUser.getPackage();
+    const allowedPlans = this._FEATURES[feature];
+
+    return allowedPlans.includes(appPackage);
+  }
+
+  can(appUser: UserContext, role: Role) {
+    const roles = appUser.getRoles();
+
+    const hasHighPrivilege = this.hasHighPrivilege(roles);
+    if (hasHighPrivilege) return hasHighPrivilege;
+
+    return this.hasRole(roles, role);
+  }
+}