@spinajs/configuration-http 2.0.481 → 2.0.482

package/lib/cjs/validation.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VALUE_SCHEMAS = void 0;
+exports.valueSchema = valueSchema;
+/**
+ * Base JSON Schema per configuration `Type`. These shapes are constant - the
+ * per-entry `Meta` ( bounds / allowed values ) is folded on top at request time
+ * by {@link valueSchema}.
+ *
+ * Validation only - it asserts the incoming value is acceptable. Coercion into
+ * the typed / canonical stored form is the converter's job ( see
+ * DbConfigValueConverter ), so eg. a `date` is just a `format: date` string
+ * here, not a luxon DateTime.
+ */
+exports.VALUE_SCHEMAS = {
+    string: { type: 'string' },
+    file: { type: 'string' },
+    oneOf: { type: 'string' },
+    manyOf: { type: 'array', uniqueItems: true, items: { type: 'string' } },
+    number: { type: 'integer' },
+    float: { type: 'number' },
+    range: { type: 'number' },
+    // a real boolean or the canonical / numeric string forms the converter understands
+    boolean: { anyOf: [{ type: 'boolean' }, { type: 'string', enum: ['0', '1', 'true', 'false'] }] },
+    date: { type: 'string', format: 'date' },
+    time: { type: 'string', format: 'time' },
+    datetime: { type: 'string', format: 'date-time' },
+    'date-range': { type: 'array', items: { type: 'string', format: 'date' } },
+    'time-range': { type: 'array', items: { type: 'string', format: 'time' } },
+    'datetime-range': { type: 'array', items: { type: 'string', format: 'date-time' } },
+    json: {},
+};
+/**
+ * Resolves the value schema for an entry: the constant base schema for its
+ * `Type` with the entry `Meta` constraints applied.
+ *
+ * The constraints target the schema "leaf" - the `items` schema for array types
+ * ( manyOf / *-range ), otherwise the schema itself - so allowed values and
+ * bounds land on the element being validated regardless of arity.
+ *
+ * Fed to `DataValidator` ( ajv ) in the controller, after the entry - and so its
+ * Type / Meta - has been loaded from the db. It can't live on the request DTO
+ * schema, which is validated before that lookup when the type is still unknown.
+ */
+function valueSchema(type, meta) {
+    const schema = structuredClone(exports.VALUE_SCHEMAS[type]);
+    if (!meta) {
+        return schema;
+    }
+    const leaf = schema.items ?? schema;
+    // oneOf / manyOf both restrict the string element to an allowed set
+    const allowed = meta.oneOf ?? meta.manyOf;
+    if (allowed) {
+        leaf.enum = allowed;
+    }
+    if (meta.min !== undefined) {
+        leaf.minimum = meta.min;
+    }
+    if (meta.max !== undefined) {
+        leaf.maximum = meta.max;
+    }
+    // minDate / maxDate are ISO strings in the JSON Meta; ajv-formats
+    // formatMinimum / formatMaximum compare date / time / date-time formats
+    if (meta.minDate !== undefined) {
+        leaf.formatMinimum = meta.minDate;
+    }
+    if (meta.maxDate !== undefined) {
+        leaf.formatMaximum = meta.maxDate;
+    }
+    return schema;
+}
+//# sourceMappingURL=validation.js.map

package/lib/cjs/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../src/validation.ts"],"names":[],"mappings":";;;AA8CA,kCA8BC;AAvED;;;;;;;;;GASG;AACU,QAAA,aAAa,GAA+C;IACvE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;IACvE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACzB,mFAAmF;IACnF,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE;IAChG,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;IACxC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;IACxC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE;IACjD,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;IAC1E,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;IAC1E,gBAAgB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE;IACnF,IAAI,EAAE,EAAE;CACT,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,SAAgB,WAAW,CAAC,IAA4B,EAAE,IAA8B;IACtF,MAAM,MAAM,GAAG,eAAe,CAAC,qBAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAEpD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,IAAI,GAAI,MAAM,CAAC,KAAoB,IAAI,MAAM,CAAC;IAEpD,oEAAoE;IACpE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC;IAC1C,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC;IACtB,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC;IAC1B,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC;IAC1B,CAAC;IACD,kEAAkE;IAClE,wEAAwE;IACxE,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC;IACpC,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC;IACpC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/lib/mjs/bootstrap.d.ts

@@ -0,0 +1,20 @@
+import { Bootstrapper } from '@spinajs/di';
+/**
+ * Ties the `DbConfig` model to the `configuration` RBAC resource.
+ *
+ * `DbConfig` lives in the persistence-only `@spinajs/configuration-db-source`
+ * package, which intentionally does not depend on rbac. Its `@Model('configuration')`
+ * only names the database table - that is NOT the RBAC resource. Set the model's
+ * `RbacResource` here ( this http package already depends on rbac ) so the
+ * `RbacModelPermissionMiddleware` enforces `configuration` grants on every
+ * DbConfig query, matching the route-level `@Resource('configuration')` on the
+ * controller.
+ *
+ * Without this the model descriptor has no `RbacResource`, so model-level
+ * permission checks are silently skipped ( the middleware's table-name fallback
+ * is disabled ) and only the route-level policy would guard the data.
+ */
+export declare class ConfigurationHttpBootstrapper extends Bootstrapper {
+    bootstrap(): void;
+}
+//# sourceMappingURL=bootstrap.d.ts.map

package/lib/mjs/bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../src/bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAc,MAAM,aAAa,CAAC;AAKvD;;;;;;;;;;;;;;GAcG;AACH,qBACa,6BAA8B,SAAQ,YAAY;IACtD,SAAS,IAAI,IAAI;CAMzB"}

package/lib/mjs/bootstrap.js

@@ -0,0 +1,37 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Bootstrapper, Injectable } from '@spinajs/di';
+import { extractModelDescriptor } from '@spinajs/orm';
+import { DbConfig } from '@spinajs/configuration-db-source';
+/**
+ * Ties the `DbConfig` model to the `configuration` RBAC resource.
+ *
+ * `DbConfig` lives in the persistence-only `@spinajs/configuration-db-source`
+ * package, which intentionally does not depend on rbac. Its `@Model('configuration')`
+ * only names the database table - that is NOT the RBAC resource. Set the model's
+ * `RbacResource` here ( this http package already depends on rbac ) so the
+ * `RbacModelPermissionMiddleware` enforces `configuration` grants on every
+ * DbConfig query, matching the route-level `@Resource('configuration')` on the
+ * controller.
+ *
+ * Without this the model descriptor has no `RbacResource`, so model-level
+ * permission checks are silently skipped ( the middleware's table-name fallback
+ * is disabled ) and only the route-level policy would guard the data.
+ */
+let ConfigurationHttpBootstrapper = class ConfigurationHttpBootstrapper extends Bootstrapper {
+    bootstrap() {
+        const descriptor = extractModelDescriptor(DbConfig);
+        if (descriptor) {
+            descriptor.RbacResource = 'configuration';
+        }
+    }
+};
+ConfigurationHttpBootstrapper = __decorate([
+    Injectable(Bootstrapper)
+], ConfigurationHttpBootstrapper);
+export { ConfigurationHttpBootstrapper };
+//# sourceMappingURL=bootstrap.js.map

package/lib/mjs/bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/bootstrap.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAG5D;;;;;;;;;;;;;;GAcG;AAEI,IAAM,6BAA6B,GAAnC,MAAM,6BAA8B,SAAQ,YAAY;IACtD,SAAS;QACd,MAAM,UAAU,GAAG,sBAAsB,CAAC,QAAQ,CAAyB,CAAC;QAC5E,IAAI,UAAU,EAAE,CAAC;YACf,UAAU,CAAC,YAAY,GAAG,eAAe,CAAC;QAC5C,CAAC;IACH,CAAC;CACF,CAAA;AAPY,6BAA6B;IADzC,UAAU,CAAC,YAAY,CAAC;GACZ,6BAA6B,CAOzC"}

package/lib/mjs/config/configuration-http.d.ts

@@ -0,0 +1,34 @@
+declare const configurationHttp: {
+    system: {
+        dirs: {
+            controllers: string[];
+        };
+    };
+    rbac: {
+        grants: {
+            /**
+             * Dedicated admin sub-role granting full management over configuration
+             * entries. Mirrors the `admin.users` sub-role in @spinajs/rbac: only the
+             * `admin` role ( and `system`, which extends admin ) inherits it below, so
+             * the configuration HTTP api is an admin-only capability. The resource
+             * itself is named `configuration` ( see @Resource in the controller ).
+             */
+            'admin.configuration': {
+                configuration: {
+                    'read:any': string[];
+                    'update:any': string[];
+                };
+            };
+            /**
+             * Admin inherits configuration management. The config merge concatenates
+             * `$extend` arrays, so this is additive - it does not overwrite the base
+             * admin grants ( eg. `admin.users` ).
+             */
+            admin: {
+                $extend: string[];
+            };
+        };
+    };
+};
+export default configurationHttp;
+//# sourceMappingURL=configuration-http.d.ts.map

package/lib/mjs/config/configuration-http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration-http.d.ts","sourceRoot":"","sources":["../../../src/config/configuration-http.ts"],"names":[],"mappings":"AAOA,QAAA,MAAM,iBAAiB;;;;;;;;YAQjB;;;;;;eAMG;;;;;;;YAQH;;;;eAIG;;;;;;CAMR,CAAC;AAEF,eAAe,iBAAiB,CAAC"}

package/lib/mjs/config/configuration-http.js

@@ -0,0 +1,39 @@
+import { join, normalize, resolve } from 'path';
+function dir(path) {
+    const inCommonJs = typeof module !== 'undefined';
+    return resolve(normalize(join(process.env.WORKSPACE_ROOT_PATH ?? process.cwd(), 'node_modules', '@spinajs', 'configuration-http', 'lib', inCommonJs ? 'cjs' : 'mjs', path)));
+}
+const configurationHttp = {
+    system: {
+        dirs: {
+            controllers: [dir('controllers')],
+        },
+    },
+    rbac: {
+        grants: {
+            /**
+             * Dedicated admin sub-role granting full management over configuration
+             * entries. Mirrors the `admin.users` sub-role in @spinajs/rbac: only the
+             * `admin` role ( and `system`, which extends admin ) inherits it below, so
+             * the configuration HTTP api is an admin-only capability. The resource
+             * itself is named `configuration` ( see @Resource in the controller ).
+             */
+            'admin.configuration': {
+                configuration: {
+                    'read:any': ['*'],
+                    'update:any': ['*'],
+                },
+            },
+            /**
+             * Admin inherits configuration management. The config merge concatenates
+             * `$extend` arrays, so this is additive - it does not overwrite the base
+             * admin grants ( eg. `admin.users` ).
+             */
+            admin: {
+                $extend: ['admin.configuration'],
+            },
+        },
+    },
+};
+export default configurationHttp;
+//# sourceMappingURL=configuration-http.js.map

package/lib/mjs/config/configuration-http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration-http.js","sourceRoot":"","sources":["../../../src/config/configuration-http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEhD,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC;IACjD,OAAO,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,oBAAoB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAC/K,CAAC;AAED,MAAM,iBAAiB,GAAG;IACxB,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,WAAW,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;SAClC;KACF;IACD,IAAI,EAAE;QACJ,MAAM,EAAE;YACN;;;;;;eAMG;YACH,qBAAqB,EAAE;gBACrB,aAAa,EAAE;oBACb,UAAU,EAAE,CAAC,GAAG,CAAC;oBACjB,YAAY,EAAE,CAAC,GAAG,CAAC;iBACpB;aACF;YAED;;;;eAIG;YACH,KAAK,EAAE;gBACL,OAAO,EAAE,CAAC,qBAAqB,CAAC;aACjC;SACF;KACF;CACF,CAAC;AAEF,eAAe,iBAAiB,CAAC"}

package/lib/mjs/controllers/Configuration.d.ts

@@ -0,0 +1,66 @@
+import { BadRequestResponse, BaseController, Ok } from '@spinajs/http';
+import { DataValidator } from '@spinajs/validation';
+import { DbConfig } from '@spinajs/configuration-db-source';
+import { UpdateConfigDto } from '../dto/update-config-dto.js';
+/**
+ * HTTP api for database stored configuration values.
+ *
+ * Exposes read and update operations over the `configuration` table managed by
+ * `@spinajs/configuration-db-source`. Entries themselves are created by code
+ * that exposes config options ( `expose: true` ), so this api intentionally does
+ * NOT allow creating or deleting arbitrary entries - only tuning their values.
+ *
+ * Writes are persisted to the database only. The running application picks up
+ * the change through the db-source watch poll, and only for entries with
+ * `Watch = true`.
+ *
+ * @tags Configuration
+ */
+export declare class ConfigurationController extends BaseController {
+    protected Validator: DataValidator;
+    /**
+     * List configuration entries
+     * Returns all database stored configuration entries, optionally filtered by group.
+     * @security cookieAuth
+     * @param group Optional group name to filter entries by
+     * @response 200 List of configuration entries
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Forbidden — readAny permission required on configuration resource
+     */
+    list(group?: string): Promise<Ok<Record<string, unknown>[]>>;
+    /**
+     * Get configuration entry
+     * Returns a single configuration entry identified by its slug.
+     * @security cookieAuth
+     * @param slug Unique configuration entry slug
+     * @response 200 Configuration entry
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Forbidden — readAny permission required on configuration resource
+     * @response 404 Configuration entry not found
+     */
+    get(entry: DbConfig): Promise<Ok<Record<string, unknown>>>;
+    /**
+     * Update configuration entry value
+     * Updates the value ( and optionally default/watch flag ) of an existing entry.
+     * The incoming value is validated against the entry `Type` and `Meta` constraints.
+     * Structural fields ( slug, group, type ) cannot be changed through this api.
+     * @security cookieAuth
+     * @param slug Unique configuration entry slug
+     * @response 200 Updated configuration entry
+     * @response 400 Invalid value for the entry type or constraints
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Forbidden — updateAny permission required on configuration resource
+     * @response 404 Configuration entry not found
+     */
+    update(entry: DbConfig, data: UpdateConfigDto): Promise<Ok<Record<string, unknown>> | BadRequestResponse<any>>;
+    /**
+     * Validates a single value against the entry value schema, returning a 400
+     * response on failure or `null` when it passes.
+     *
+     * The value is wrapped in an object ( `{ [field]: value }` ) so it is always a
+     * non-null object for the validator - a bare `null` / scalar would otherwise
+     * confuse `tryValidate`'s schema-vs-data overload resolution.
+     */
+    private validateValue;
+}
+//# sourceMappingURL=Configuration.d.ts.map

package/lib/mjs/controllers/Configuration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Configuration.d.ts","sourceRoot":"","sources":["../../../src/controllers/Configuration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAuB,EAAE,EAAwB,MAAM,eAAe,CAAC;AAGlH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAgB9D;;;;;;;;;;;;;GAaG;AACH,qBAGa,uBAAwB,SAAQ,cAAc;IAEzD,SAAS,CAAC,SAAS,EAAG,aAAa,CAAC;IAEpC;;;;;;;;OAQG;IAGU,IAAI,CAAU,KAAK,CAAC,EAAE,MAAM;IAKzC;;;;;;;;;OASG;IAGU,GAAG,CAAwD,KAAK,EAAE,QAAQ;IAIvF;;;;;;;;;;;;OAYG;IAGU,MAAM,CAAwD,KAAK,EAAE,QAAQ,EAAU,IAAI,EAAE,eAAe;IAmCzH;;;;;;;OAOG;IACH,OAAO,CAAC,aAAa;CActB"}

package/lib/mjs/controllers/Configuration.js

@@ -0,0 +1,167 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { BadRequestResponse, BaseController, BasePath, Body, Get, Ok, Patch, Policy, Query } from '@spinajs/http';
+import { AuthorizedPolicy, Permission, Resource } from '@spinajs/rbac-http';
+import { Autoinject } from '@spinajs/di';
+import { DataValidator } from '@spinajs/validation';
+import { FromModel } from '@spinajs/orm-http';
+import { DbConfig } from '@spinajs/configuration-db-source';
+import { UpdateConfigDto } from '../dto/update-config-dto.js';
+import { valueSchema } from '../validation.js';
+/**
+ * Serializes an entry for the api. `DbConfig.dehydrate()` emits only the declared
+ * columns with Value / Default in their canonical stored form ( numbers as "10",
+ * booleans as "true"/"false", dates / times as ISO 8601 etc. ) produced by the
+ * DbConfigValueConverter, and Meta already parsed into an object by its @Json
+ * converter - the same representation they round-trip through on update.
+ */
+function present(entry) {
+    const out = entry.dehydrate();
+    out.Meta = entry.Meta ?? null;
+    return out;
+}
+/**
+ * HTTP api for database stored configuration values.
+ *
+ * Exposes read and update operations over the `configuration` table managed by
+ * `@spinajs/configuration-db-source`. Entries themselves are created by code
+ * that exposes config options ( `expose: true` ), so this api intentionally does
+ * NOT allow creating or deleting arbitrary entries - only tuning their values.
+ *
+ * Writes are persisted to the database only. The running application picks up
+ * the change through the db-source watch poll, and only for entries with
+ * `Watch = true`.
+ *
+ * @tags Configuration
+ */
+let ConfigurationController = class ConfigurationController extends BaseController {
+    /**
+     * List configuration entries
+     * Returns all database stored configuration entries, optionally filtered by group.
+     * @security cookieAuth
+     * @param group Optional group name to filter entries by
+     * @response 200 List of configuration entries
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Forbidden — readAny permission required on configuration resource
+     */
+    async list(group) {
+        const entries = await (group ? DbConfig.where('Group', group) : DbConfig.all());
+        return new Ok(entries.map((e) => present(e)));
+    }
+    /**
+     * Get configuration entry
+     * Returns a single configuration entry identified by its slug.
+     * @security cookieAuth
+     * @param slug Unique configuration entry slug
+     * @response 200 Configuration entry
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Forbidden — readAny permission required on configuration resource
+     * @response 404 Configuration entry not found
+     */
+    async get(entry) {
+        return new Ok(present(entry));
+    }
+    /**
+     * Update configuration entry value
+     * Updates the value ( and optionally default/watch flag ) of an existing entry.
+     * The incoming value is validated against the entry `Type` and `Meta` constraints.
+     * Structural fields ( slug, group, type ) cannot be changed through this api.
+     * @security cookieAuth
+     * @param slug Unique configuration entry slug
+     * @response 200 Updated configuration entry
+     * @response 400 Invalid value for the entry type or constraints
+     * @response 401 Unauthorized — valid session required
+     * @response 403 Forbidden — updateAny permission required on configuration resource
+     * @response 404 Configuration entry not found
+     */
+    async update(entry, data) {
+        // Build the value schema from the entry Type + Meta ( entry.Meta is already an
+        // object here, parsed by its @Json converter on load ) and validate the
+        // incoming value(s) against it. Validation can only happen here - not on the
+        // request DTO - because the entry Type isn't known until after this lookup.
+        const schema = valueSchema(entry.Type, entry.Meta);
+        const valueError = this.validateValue(schema, 'Value', data.Value);
+        if (valueError) {
+            return valueError;
+        }
+        if (data.Default !== undefined) {
+            const defaultError = this.validateValue(schema, 'Default', data.Default);
+            if (defaultError) {
+                return defaultError;
+            }
+        }
+        // Assign the raw, validated value(s). The DbConfigValueConverter does all the
+        // type-based coercion into the canonical stored form on update().
+        entry.Value = data.Value;
+        if (data.Default !== undefined) {
+            entry.Default = data.Default;
+        }
+        if (data.Watch !== undefined) {
+            entry.Watch = data.Watch;
+        }
+        await entry.update();
+        return new Ok(present(entry));
+    }
+    /**
+     * Validates a single value against the entry value schema, returning a 400
+     * response on failure or `null` when it passes.
+     *
+     * The value is wrapped in an object ( `{ [field]: value }` ) so it is always a
+     * non-null object for the validator - a bare `null` / scalar would otherwise
+     * confuse `tryValidate`'s schema-vs-data overload resolution.
+     */
+    validateValue(valueSchema, field, value) {
+        const [isValid, errors] = this.Validator.tryValidate({ type: 'object', properties: { [field]: valueSchema }, required: [field] }, { [field]: value });
+        if (isValid) {
+            return null;
+        }
+        const message = (errors ?? []).map((e) => `${field}${e.instancePath ? e.instancePath.replace(`/${field}`, '') : ''} ${e.message ?? 'is invalid'}`.trim()).join('; ') || `invalid value for ${field}`;
+        return new BadRequestResponse({ error: { message } });
+    }
+};
+__decorate([
+    Autoinject(),
+    __metadata("design:type", DataValidator)
+], ConfigurationController.prototype, "Validator", void 0);
+__decorate([
+    Get('/'),
+    Permission(['readAny']),
+    __param(0, Query()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], ConfigurationController.prototype, "list", null);
+__decorate([
+    Get(':slug'),
+    Permission(['readAny']),
+    __param(0, FromModel({ paramField: 'slug', queryField: 'Slug' })),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [DbConfig]),
+    __metadata("design:returntype", Promise)
+], ConfigurationController.prototype, "get", null);
+__decorate([
+    Patch(':slug'),
+    Permission(['updateAny']),
+    __param(0, FromModel({ paramField: 'slug', queryField: 'Slug' })),
+    __param(1, Body()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [DbConfig, UpdateConfigDto]),
+    __metadata("design:returntype", Promise)
+], ConfigurationController.prototype, "update", null);
+ConfigurationController = __decorate([
+    BasePath('configuration'),
+    Policy(AuthorizedPolicy),
+    Resource('configuration')
+], ConfigurationController);
+export { ConfigurationController };
+//# sourceMappingURL=Configuration.js.map

package/lib/mjs/controllers/Configuration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Configuration.js","sourceRoot":"","sources":["../../../src/controllers/Configuration.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAClH,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C;;;;;;GAMG;AACH,SAAS,OAAO,CAAC,KAAe;IAC9B,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,EAA6B,CAAC;IACzD,GAAG,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;IAC9B,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;GAaG;AAII,IAAM,uBAAuB,GAA7B,MAAM,uBAAwB,SAAQ,cAAc;IAIzD;;;;;;;;OAQG;IAGU,AAAN,KAAK,CAAC,IAAI,CAAU,KAAc;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QAChF,OAAO,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;;;;OASG;IAGU,AAAN,KAAK,CAAC,GAAG,CAAwD,KAAe;QACrF,OAAO,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;;;;;;OAYG;IAGU,AAAN,KAAK,CAAC,MAAM,CAAwD,KAAe,EAAU,IAAqB;QACvH,+EAA+E;QAC/E,wEAAwE;QACxE,6EAA6E;QAC7E,4EAA4E;QAC5E,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAEnD,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACzE,IAAI,YAAY,EAAE,CAAC;gBACjB,OAAO,YAAY,CAAC;YACtB,CAAC;QACH,CAAC;QAED,8EAA8E;QAC9E,kEAAkE;QAClE,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAA2B,CAAC;QAC/C,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,OAA+B,CAAC;QACvD,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAC3B,CAAC;QAED,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;QAErB,OAAO,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;;OAOG;IACK,aAAa,CAAC,WAAoC,EAAE,KAAa,EAAE,KAAc;QACvF,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAClD,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,EAC3E,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CACnB,CAAC;QAEF,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,IAAI,YAAY,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,qBAAqB,KAAK,EAAE,CAAC;QAErM,OAAO,IAAI,kBAAkB,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACxD,CAAC;CACF,CAAA;AA1GW;IADT,UAAU,EAAE;8BACS,aAAa;0DAAC;AAavB;IAFZ,GAAG,CAAC,GAAG,CAAC;IACR,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IACL,WAAA,KAAK,EAAE,CAAA;;;;mDAGzB;AAcY;IAFZ,GAAG,CAAC,OAAO,CAAC;IACZ,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC;IACN,WAAA,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;;qCAAQ,QAAQ;;kDAEtF;AAiBY;IAFZ,KAAK,CAAC,OAAO,CAAC;IACd,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC;IACL,WAAA,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;IAAmB,WAAA,IAAI,EAAE,CAAA;;qCAAjB,QAAQ,EAAgB,eAAe;;qDAiCxH;AApFU,uBAAuB;IAHnC,QAAQ,CAAC,eAAe,CAAC;IACzB,MAAM,CAAC,gBAAgB,CAAC;IACxB,QAAQ,CAAC,eAAe,CAAC;GACb,uBAAuB,CA4GnC"}

package/lib/mjs/dto/update-config-dto.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Body payload for updating a configuration entry value.
+ *
+ * Only the operationally meaningful fields are editable. Structural fields
+ * ( `Slug`, `Group`, `Type` ) are owned by code that exposes the option and
+ * cannot be changed through this api.
+ */
+export declare class UpdateConfigDto {
+    Value: any;
+    Default?: any;
+    Watch?: boolean;
+    constructor(data: Partial<UpdateConfigDto>);
+}
+//# sourceMappingURL=update-config-dto.d.ts.map

package/lib/mjs/dto/update-config-dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-config-dto.d.ts","sourceRoot":"","sources":["../../../src/dto/update-config-dto.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,qBAYa,eAAe;IAEnB,KAAK,EAAE,GAAG,CAAC;IAGX,OAAO,CAAC,EAAE,GAAG,CAAC;IAEd,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEX,IAAI,EAAE,OAAO,CAAC,eAAe,CAAC;CAG3C"}

package/lib/mjs/dto/update-config-dto.js

@@ -0,0 +1,39 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Schema } from '@spinajs/validation';
+/**
+ * Body payload for updating a configuration entry value.
+ *
+ * Only the operationally meaningful fields are editable. Structural fields
+ * ( `Slug`, `Group`, `Type` ) are owned by code that exposes the option and
+ * cannot be changed through this api.
+ */
+let UpdateConfigDto = class UpdateConfigDto {
+    constructor(data) {
+        Object.assign(this, data);
+    }
+};
+UpdateConfigDto = __decorate([
+    Schema({
+        type: 'object',
+        $id: 'configuration.http.updateConfigDTO',
+        properties: {
+            // value type varies with the entry `Type`, real validation happens against
+            // Type/Meta in the controller, so the schema only requires its presence
+            Value: {},
+            Default: {},
+            Watch: { type: 'boolean' },
+        },
+        required: ['Value'],
+    }),
+    __metadata("design:paramtypes", [Object])
+], UpdateConfigDto);
+export { UpdateConfigDto };
+//# sourceMappingURL=update-config-dto.js.map

package/lib/mjs/dto/update-config-dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-config-dto.js","sourceRoot":"","sources":["../../../src/dto/update-config-dto.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C;;;;;;GAMG;AAaI,IAAM,eAAe,GAArB,MAAM,eAAe;IAS1B,YAAY,IAA8B;QACxC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;CACF,CAAA;AAZY,eAAe;IAZ3B,MAAM,CAAC;QACN,IAAI,EAAE,QAAQ;QACd,GAAG,EAAE,oCAAoC;QACzC,UAAU,EAAE;YACV,2EAA2E;YAC3E,wEAAwE;YACxE,KAAK,EAAE,EAAE;YACT,OAAO,EAAE,EAAE;YACX,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;SAC3B;QACD,QAAQ,EAAE,CAAC,OAAO,CAAC;KACpB,CAAC;;GACW,eAAe,CAY3B"}

package/lib/mjs/index.d.ts

@@ -0,0 +1,5 @@
+export * from './controllers/Configuration.js';
+export * from './dto/update-config-dto.js';
+export * from './validation.js';
+export * from './bootstrap.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gCAAgC,CAAC;AAC/C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC"}

package/lib/mjs/index.js

@@ -0,0 +1,5 @@
+export * from './controllers/Configuration.js';
+export * from './dto/update-config-dto.js';
+export * from './validation.js';
+export * from './bootstrap.js';
+//# sourceMappingURL=index.js.map

package/lib/mjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gCAAgC,CAAC;AAC/C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC"}

package/lib/mjs/package.json

@@ -0,0 +1 @@
+{"type":"module"}

package/lib/mjs/validation.d.ts

@@ -0,0 +1,29 @@
+import { ConfigurationEntryType, IConfigurationEntryMeta } from '@spinajs/configuration-db-source';
+/** A plain JSON Schema fragment. */
+type JsonSchema = Record<string, unknown>;
+/**
+ * Base JSON Schema per configuration `Type`. These shapes are constant - the
+ * per-entry `Meta` ( bounds / allowed values ) is folded on top at request time
+ * by {@link valueSchema}.
+ *
+ * Validation only - it asserts the incoming value is acceptable. Coercion into
+ * the typed / canonical stored form is the converter's job ( see
+ * DbConfigValueConverter ), so eg. a `date` is just a `format: date` string
+ * here, not a luxon DateTime.
+ */
+export declare const VALUE_SCHEMAS: Record<ConfigurationEntryType, JsonSchema>;
+/**
+ * Resolves the value schema for an entry: the constant base schema for its
+ * `Type` with the entry `Meta` constraints applied.
+ *
+ * The constraints target the schema "leaf" - the `items` schema for array types
+ * ( manyOf / *-range ), otherwise the schema itself - so allowed values and
+ * bounds land on the element being validated regardless of arity.
+ *
+ * Fed to `DataValidator` ( ajv ) in the controller, after the entry - and so its
+ * Type / Meta - has been loaded from the db. It can't live on the request DTO
+ * schema, which is validated before that lookup when the type is still unknown.
+ */
+export declare function valueSchema(type: ConfigurationEntryType, meta?: IConfigurationEntryMeta): JsonSchema;
+export {};
+//# sourceMappingURL=validation.d.ts.map

package/lib/mjs/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAEnG,oCAAoC;AACpC,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE1C;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,sBAAsB,EAAE,UAAU,CAiBpE,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,sBAAsB,EAAE,IAAI,CAAC,EAAE,uBAAuB,GAAG,UAAU,CA8BpG"}