@vritti/api-sdk 0.0.1 → 0.0.3

package/dist/index.js

@@ -1,11 +1,1228 @@
 var __defProp = Object.defineProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 
-// src/index.ts
-var getHello = /* @__PURE__ */ __name(() => {
-  return "Hello, World!";
-}, "getHello");
+// src/auth/auth-config.module.ts
+import { Global as Global2, Module as Module2 } from "@nestjs/common";
+import { ConfigModule, ConfigService as ConfigService2 } from "@nestjs/config";
+import { APP_GUARD } from "@nestjs/core";
+import { JwtModule } from "@nestjs/jwt";
+
+// src/request/request.module.ts
+import { Global, Module } from "@nestjs/common";
+
+// src/request/services/request.service.ts
+import { Inject, Injectable, Scope } from "@nestjs/common";
+import { REQUEST } from "@nestjs/core";
+function _ts_decorate(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate, "_ts_decorate");
+function _ts_metadata(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata, "_ts_metadata");
+function _ts_param(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param, "_ts_param");
+var RequestService = class {
+  static {
+    __name(this, "RequestService");
+  }
+  request;
+  constructor(request) {
+    this.request = request;
+  }
+  /**
+  * Extract tenant identifier from request headers
+  * Priority: x-tenant-id > x-subdomain
+  * @returns Tenant identifier or null if not found
+  */
+  getTenantIdentifier() {
+    const getHeader = /* @__PURE__ */ __name((key) => {
+      const value = this.request.headers?.[key];
+      return Array.isArray(value) ? value[0] : value;
+    }, "getHeader");
+    return getHeader("x-tenant-id") || getHeader("x-subdomain") || null;
+  }
+  /**
+  * Extract access token from Authorization header
+  * Format: "Bearer <token>"
+  * @returns Access token or null if not found
+  */
+  getAccessToken() {
+    const authHeader = this.request.headers?.authorization;
+    if (!authHeader) {
+      return null;
+    }
+    const [type, token] = authHeader.split(" ") ?? [];
+    return type === "Bearer" && token ? token : null;
+  }
+  /**
+  * Extract refresh token from session-id cookie
+  * Cookie name: session-id
+  * @returns Refresh token or null if not found
+  */
+  getRefreshToken() {
+    try {
+      const cookies = this.request.cookies;
+      if (cookies && typeof cookies === "object") {
+        const sessionId = cookies["session-id"];
+        if (sessionId) {
+          return sessionId;
+        }
+      }
+      return null;
+    } catch (error) {
+      return null;
+    }
+  }
+  /**
+  * Get a specific header value
+  * @param key Header key
+  * @returns Header value (string, array, or undefined)
+  */
+  getHeader(key) {
+    return this.request.headers?.[key];
+  }
+  /**
+  * Get all headers
+  * @returns Record of all headers
+  */
+  getAllHeaders() {
+    return this.request.headers || {};
+  }
+};
+RequestService = _ts_decorate([
+  Injectable({
+    scope: Scope.REQUEST
+  }),
+  _ts_param(0, Inject(REQUEST)),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof FastifyRequest === "undefined" ? Object : FastifyRequest
+  ])
+], RequestService);
+
+// src/request/request.module.ts
+function _ts_decorate2(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate2, "_ts_decorate");
+var RequestModule = class {
+  static {
+    __name(this, "RequestModule");
+  }
+};
+RequestModule = _ts_decorate2([
+  Global(),
+  Module({
+    providers: [
+      RequestService
+    ],
+    exports: [
+      RequestService
+    ]
+  })
+], RequestModule);
+
+// src/auth/guards/vritti-auth.guard.ts
+import { Injectable as Injectable3, Logger as Logger2, Scope as Scope2, UnauthorizedException } from "@nestjs/common";
+import { ConfigService } from "@nestjs/config";
+import { Reflector } from "@nestjs/core";
+import { JwtService } from "@nestjs/jwt";
+import * as jwt from "jsonwebtoken";
+
+// src/database/services/primary-database.service.ts
+import { Inject as Inject2, Injectable as Injectable2, InternalServerErrorException, Logger } from "@nestjs/common";
+
+// src/database/constants.ts
+var DATABASE_MODULE_OPTIONS = Symbol("DATABASE_MODULE_OPTIONS");
+
+// src/database/services/primary-database.service.ts
+function _ts_decorate3(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate3, "_ts_decorate");
+function _ts_metadata2(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata2, "_ts_metadata");
+function _ts_param2(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param2, "_ts_param");
+var PrimaryDatabaseService = class _PrimaryDatabaseService {
+  static {
+    __name(this, "PrimaryDatabaseService");
+  }
+  options;
+  logger = new Logger(_PrimaryDatabaseService.name);
+  /** Primary database client for querying tenant registry */
+  primaryDbClient;
+  /** In-memory cache: Map<tenantIdentifier, TenantConfig> */
+  tenantConfigCache = /* @__PURE__ */ new Map();
+  /** Cache TTL in milliseconds */
+  cacheTTL;
+  constructor(options) {
+    this.options = options;
+    this.cacheTTL = options.connectionCacheTTL || 3e5;
+  }
+  async onModuleInit() {
+    if (this.options.primaryDb) {
+      await this.initializePrimaryDbClient();
+    }
+  }
+  /**
+  * Initialize connection to primary database
+  */
+  async initializePrimaryDbClient() {
+    try {
+      const PrimaryDbClient = this.options.prismaClientConstructor;
+      const databaseUrl = this.buildPrimaryDbUrl();
+      this.primaryDbClient = new PrimaryDbClient({
+        datasources: {
+          db: {
+            url: databaseUrl
+          }
+        },
+        log: [
+          "error",
+          "warn"
+        ]
+      });
+      await this.primaryDbClient.$connect();
+      this.logger.log("Connected to primary database (tenant registry)");
+    } catch (error) {
+      this.logger.error("Failed to connect to primary database", error);
+      throw new InternalServerErrorException("Failed to initialize tenant registry");
+    }
+  }
+  /**
+  * Build connection URL from primary database properties
+  */
+  buildPrimaryDbUrl() {
+    if (!this.options.primaryDb) {
+      throw new Error("Primary database configuration not provided");
+    }
+    const { host, port = 5432, username, password, database, schema = "public", sslMode = "require" } = this.options.primaryDb;
+    let url = `postgresql://${username}:${password}@${host}:${port}/${database}`;
+    const params = new URLSearchParams();
+    if (schema) {
+      params.set("schema", schema);
+    }
+    params.set("sslmode", sslMode);
+    const queryString = params.toString();
+    if (queryString) {
+      url += `?${queryString}`;
+    }
+    this.logger.debug(`Primary DB connection URL: ${this.maskPassword(url)}`);
+    return url;
+  }
+  /**
+  * Mask password in connection URL for logging
+  */
+  maskPassword(url) {
+    return url.replace(/:([^@]+)@/, ":****@");
+  }
+  /**
+  * Get tenant configuration by identifier (ID or slug)
+  *
+  * @param tenantIdentifier Tenant ID or slug
+  * @returns Tenant configuration or null if not found
+  */
+  async getTenantInfo(tenantIdentifier) {
+    const cached = this.tenantConfigCache.get(tenantIdentifier);
+    if (cached) {
+      this.logger.debug(`Cache hit for tenant: ${tenantIdentifier}`);
+      return cached;
+    }
+    try {
+      if (!this.primaryDbClient) {
+        throw new Error("Primary database client not initialized");
+      }
+      this.logger.debug(`Querying primary database for tenant: ${tenantIdentifier}`);
+      const tenant = await this.primaryDbClient.tenant.findFirst({
+        where: {
+          OR: [
+            {
+              id: tenantIdentifier
+            },
+            {
+              subdomain: tenantIdentifier
+            }
+          ],
+          status: "ACTIVE"
+        },
+        include: {
+          databaseConfig: true
+        }
+      });
+      if (!tenant) {
+        this.logger.warn(`Tenant not found: ${tenantIdentifier}`);
+        return null;
+      }
+      const info = {
+        id: tenant.id,
+        subdomain: tenant.subdomain,
+        type: tenant.dbType,
+        status: tenant.status,
+        // For SHARED tenants: schema name
+        schemaName: tenant.databaseConfig?.dbSchema || void 0,
+        // For DEDICATED tenants: database configuration from TenantDatabaseConfig table
+        databaseName: tenant.databaseConfig?.dbName || void 0,
+        databaseHost: tenant.databaseConfig?.dbHost || void 0,
+        databasePort: tenant.databaseConfig?.dbPort || void 0,
+        databaseUsername: tenant.databaseConfig?.dbUsername ? this.decrypt(tenant.databaseConfig.dbUsername) : void 0,
+        databasePassword: tenant.databaseConfig?.dbPassword ? this.decrypt(tenant.databaseConfig.dbPassword) : void 0,
+        databaseSslMode: tenant.databaseConfig?.dbSslMode || void 0,
+        connectionPoolSize: tenant.databaseConfig?.connectionPoolSize || void 0
+      };
+      this.cacheInfo(info);
+      return info;
+    } catch (error) {
+      this.logger.error(`Failed to fetch tenant info: ${tenantIdentifier}`, error);
+      throw new InternalServerErrorException("Failed to resolve tenant");
+    }
+  }
+  /**
+  * Cache tenant information with TTL
+  */
+  cacheInfo(info) {
+    this.tenantConfigCache.set(info.id, info);
+    this.tenantConfigCache.set(info.subdomain, info);
+    setTimeout(() => {
+      this.tenantConfigCache.delete(info.id);
+      this.tenantConfigCache.delete(info.subdomain);
+      this.logger.debug(`Cache expired for tenant: ${info.subdomain}`);
+    }, this.cacheTTL);
+  }
+  /**
+  * Clear cached tenant information
+  *
+  * Useful when tenant settings are updated and cache needs to be invalidated
+  *
+  * @param tenantIdentifier Tenant ID or slug
+  */
+  clearTenantCache(tenantIdentifier) {
+    const config = this.tenantConfigCache.get(tenantIdentifier);
+    if (config) {
+      this.tenantConfigCache.delete(config.id);
+      this.tenantConfigCache.delete(config.subdomain);
+      this.logger.log(`Cleared cache for tenant: ${tenantIdentifier}`);
+    }
+  }
+  /**
+  * Clear all cached tenant configurations
+  */
+  clearAllCaches() {
+    const size = this.tenantConfigCache.size;
+    this.tenantConfigCache.clear();
+    this.logger.log(`Cleared ${size} cached tenant configs`);
+  }
+  /**
+  * Get primary database client for direct database access
+  *
+  * This is useful for platform admin operations (creating tenants, billing, etc.)
+  *
+  * @returns Primary database client instance
+  * @throws Error if primary database client is not initialized
+  */
+  getPrimaryDbClient() {
+    if (!this.primaryDbClient) {
+      throw new Error("Primary database client not initialized. Are you in gateway mode?");
+    }
+    return this.primaryDbClient;
+  }
+  /**
+  * Decrypt database credentials
+  *
+  * Override this method to implement your encryption strategy
+  *
+  * @param encrypted Encrypted value
+  * @returns Decrypted value
+  */
+  decrypt(encrypted) {
+    return encrypted;
+  }
+  async onModuleDestroy() {
+    if (this.primaryDbClient) {
+      await this.primaryDbClient.$disconnect();
+      this.logger.log("Disconnected from primary database");
+    }
+  }
+};
+PrimaryDatabaseService = _ts_decorate3([
+  Injectable2(),
+  _ts_param2(0, Inject2(DATABASE_MODULE_OPTIONS)),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
+    typeof DatabaseModuleOptions === "undefined" ? Object : DatabaseModuleOptions
+  ])
+], PrimaryDatabaseService);
+
+// src/auth/guards/vritti-auth.guard.ts
+function _ts_decorate4(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate4, "_ts_decorate");
+function _ts_metadata3(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata3, "_ts_metadata");
+var VrittiAuthGuard = class _VrittiAuthGuard {
+  static {
+    __name(this, "VrittiAuthGuard");
+  }
+  reflector;
+  configService;
+  jwtService;
+  primaryDatabase;
+  requestService;
+  logger = new Logger2(_VrittiAuthGuard.name);
+  constructor(reflector, configService, jwtService, primaryDatabase, requestService) {
+    this.reflector = reflector;
+    this.configService = configService;
+    this.jwtService = jwtService;
+    this.primaryDatabase = primaryDatabase;
+    this.requestService = requestService;
+  }
+  async canActivate(context) {
+    const request = context.switchToHttp().getRequest();
+    const isPublic = this.reflector.getAllAndOverride("isPublic", [
+      context.getHandler(),
+      context.getClass()
+    ]);
+    if (isPublic) {
+      this.logger.debug("Public endpoint detected, skipping authentication");
+      return true;
+    }
+    const isOnboarding = this.reflector.getAllAndOverride("isOnboarding", [
+      context.getHandler(),
+      context.getClass()
+    ]);
+    try {
+      const accessToken = this.requestService.getAccessToken();
+      if (!accessToken) {
+        this.logger.warn("Access token not found in Authorization header");
+        throw new UnauthorizedException("Access token not found");
+      }
+      const decodedToken = this.jwtService.decode(accessToken);
+      if (!decodedToken) {
+        this.logger.warn("Failed to decode access token");
+        throw new UnauthorizedException("Invalid token format");
+      }
+      if (isOnboarding) {
+        if (decodedToken.type !== "onboarding") {
+          this.logger.warn("Onboarding endpoint requires onboarding token");
+          throw new UnauthorizedException("This endpoint requires an onboarding token");
+        }
+        const validatedToken2 = this.validateAccessToken(accessToken);
+        this.logger.debug("Onboarding token validated successfully");
+        const userId2 = validatedToken2.userId;
+        request.user = {
+          id: userId2
+        };
+        return true;
+      }
+      if (decodedToken.type === "onboarding") {
+        this.logger.warn("Regular endpoint accessed with onboarding token");
+        throw new UnauthorizedException("Onboarding tokens cannot access this endpoint");
+      }
+      const validatedToken = this.validateAccessToken(accessToken);
+      this.logger.debug("Access token validated successfully");
+      const refreshToken = this.requestService.getRefreshToken();
+      if (!refreshToken) {
+        this.logger.warn("Refresh token (session-id) not found in cookies");
+        throw new UnauthorizedException("Refresh token not found");
+      }
+      this.validateRefreshToken(refreshToken);
+      this.logger.debug("Refresh token validated successfully");
+      const userId = validatedToken.userId;
+      request.user = {
+        id: userId
+      };
+      const tenantIdentifier = this.requestService.getTenantIdentifier();
+      if (!tenantIdentifier) {
+        this.logger.warn("Tenant identifier not found in request");
+        throw new UnauthorizedException("Tenant identifier not found");
+      }
+      this.logger.debug(`Tenant identifier extracted: ${tenantIdentifier}`);
+      if (tenantIdentifier === "cloud") {
+        this.logger.debug("Platform admin access detected, skipping tenant database validation");
+        return true;
+      }
+      const tenantInfo = await this.primaryDatabase.getTenantInfo(tenantIdentifier);
+      if (!tenantInfo) {
+        this.logger.warn(`Invalid tenant: ${tenantIdentifier}`);
+        throw new UnauthorizedException("Invalid tenant");
+      }
+      if (tenantInfo.status !== "ACTIVE") {
+        this.logger.warn(`Tenant ${tenantIdentifier} has status: ${tenantInfo.status}`);
+        throw new UnauthorizedException(`Tenant is ${tenantInfo.status}`);
+      }
+      this.logger.debug(`Tenant validated: ${tenantInfo.subdomain} (${tenantInfo.type})`);
+      return true;
+    } catch (error) {
+      if (error instanceof UnauthorizedException) {
+        throw error;
+      }
+      this.logger.error("Unexpected error in auth guard", error);
+      throw new UnauthorizedException("Authentication failed");
+    }
+  }
+  /**
+  * Validate access token with proper expiry checks
+  * Throws UnauthorizedException if token is invalid or expired
+  */
+  validateAccessToken(token) {
+    try {
+      const decoded = this.jwtService.verify(token);
+      this.logger.debug(`Access token decoded for user: ${decoded.userId}`);
+      if (decoded.exp) {
+        const expiryTime = decoded.exp * 1e3;
+        const currentTime = Date.now();
+        const timeRemaining = expiryTime - currentTime;
+        this.logger.debug(`Access token valid for ${Math.floor(timeRemaining / 1e3)} more seconds`);
+      }
+      return decoded;
+    } catch (error) {
+      if (error instanceof UnauthorizedException) {
+        throw error;
+      }
+      const jwtError = error;
+      if (jwtError?.name === "TokenExpiredError") {
+        this.logger.warn(`Access token expired at: ${jwtError?.expiredAt}`);
+        throw new UnauthorizedException("Access token has expired");
+      }
+      if (jwtError?.name === "JsonWebTokenError") {
+        this.logger.warn(`Access token verification failed: ${jwtError?.message}`);
+        throw new UnauthorizedException("Invalid access token");
+      }
+      if (jwtError?.name === "NotBeforeError") {
+        this.logger.warn("Access token used before valid (nbf claim)");
+        throw new UnauthorizedException("Access token not yet valid");
+      }
+      this.logger.error("Unexpected error validating access token", error);
+      throw new UnauthorizedException("Access token validation failed");
+    }
+  }
+  /**
+  * Validate refresh token with proper expiry checks
+  * Throws UnauthorizedException if token is invalid or expired
+  */
+  validateRefreshToken(token) {
+    const jwtSecret = this.configService.get("JWT_REFRESH_SECRET") || this.configService.get("JWT_SECRET");
+    this.validateRefreshTokenWithSecret(token, jwtSecret);
+  }
+  /**
+  * Helper to validate refresh token with specific secret
+  */
+  validateRefreshTokenWithSecret(token, secret) {
+    if (!secret) {
+      this.logger.error("JWT secret not configured for refresh token validation");
+      throw new UnauthorizedException("Server configuration error");
+    }
+    try {
+      const decoded = jwt.verify(token, secret, {
+        algorithms: [
+          "HS256",
+          "HS512",
+          "RS256"
+        ]
+      });
+      this.logger.debug(`Refresh token decoded for user: ${decoded.userId}`);
+      if (decoded.exp) {
+        const expiryTime = decoded.exp * 1e3;
+        const currentTime = Date.now();
+        if (currentTime > expiryTime) {
+          this.logger.warn("Refresh token has expired");
+          throw new UnauthorizedException("Refresh token has expired. Please login again");
+        }
+        const timeRemaining = expiryTime - currentTime;
+        this.logger.debug(`Refresh token valid for ${Math.floor(timeRemaining / 1e3)} more seconds`);
+      }
+    } catch (error) {
+      if (error instanceof UnauthorizedException) {
+        throw error;
+      }
+      const jwtError = error;
+      if (jwtError?.name === "TokenExpiredError") {
+        this.logger.warn(`Refresh token expired at: ${jwtError?.expiredAt}`);
+        throw new UnauthorizedException("Refresh token has expired. Please login again");
+      }
+      if (jwtError?.name === "JsonWebTokenError") {
+        this.logger.warn(`Refresh token verification failed: ${jwtError?.message}`);
+        throw new UnauthorizedException("Invalid refresh token");
+      }
+      if (jwtError?.name === "NotBeforeError") {
+        this.logger.warn("Refresh token used before valid (nbf claim)");
+        throw new UnauthorizedException("Refresh token not yet valid");
+      }
+      this.logger.error("Unexpected error validating refresh token", error);
+      throw new UnauthorizedException("Refresh token validation failed");
+    }
+  }
+};
+VrittiAuthGuard = _ts_decorate4([
+  Injectable3({
+    scope: Scope2.REQUEST
+  }),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof Reflector === "undefined" ? Object : Reflector,
+    typeof ConfigService === "undefined" ? Object : ConfigService,
+    typeof JwtService === "undefined" ? Object : JwtService,
+    typeof PrimaryDatabaseService === "undefined" ? Object : PrimaryDatabaseService,
+    typeof RequestService === "undefined" ? Object : RequestService
+  ])
+], VrittiAuthGuard);
+
+// src/auth/auth-config.module.ts
+function _ts_decorate5(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate5, "_ts_decorate");
+var AuthConfigModule = class _AuthConfigModule {
+  static {
+    __name(this, "AuthConfigModule");
+  }
+  /**
+  * Register the auth module with async configuration
+  *
+  * This method:
+  * 1. Configures JwtModule with JWT_SECRET from ConfigService
+  * 2. Provides VrittiAuthGuard globally (applies to all routes)
+  * 3. Exports JwtModule for use in other modules (e.g., for signing tokens)
+  *
+  * @returns Dynamic module configuration
+  */
+  static forRootAsync() {
+    return {
+      module: _AuthConfigModule,
+      imports: [
+        ConfigModule,
+        RequestModule,
+        JwtModule.registerAsync({
+          imports: [
+            ConfigModule
+          ],
+          inject: [
+            ConfigService2
+          ],
+          useFactory: /* @__PURE__ */ __name((config) => ({
+            secret: config.get("JWT_SECRET"),
+            signOptions: {
+              algorithm: "HS256"
+            }
+          }), "useFactory")
+        })
+      ],
+      providers: [
+        {
+          provide: APP_GUARD,
+          useClass: VrittiAuthGuard
+        }
+      ],
+      exports: [
+        JwtModule
+      ]
+    };
+  }
+};
+AuthConfigModule = _ts_decorate5([
+  Global2(),
+  Module2({})
+], AuthConfigModule);
+
+// src/database/database.module.ts
+import { Global as Global3, Module as Module3 } from "@nestjs/common";
+import { APP_INTERCEPTOR } from "@nestjs/core";
+
+// src/database/interceptors/message-tenant-context.interceptor.ts
+import { Injectable as Injectable5, Logger as Logger3, Scope as Scope4 } from "@nestjs/common";
+import { tap } from "rxjs/operators";
+
+// src/database/services/tenant-context.service.ts
+import { Injectable as Injectable4, Scope as Scope3, UnauthorizedException as UnauthorizedException2 } from "@nestjs/common";
+function _ts_decorate6(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate6, "_ts_decorate");
+var TenantContextService = class {
+  static {
+    __name(this, "TenantContextService");
+  }
+  tenantInfo = null;
+  /**
+  * Set tenant information for this request/message
+  *
+  * This is typically called by:
+  * - TenantContextInterceptor (for HTTP requests in gateway)
+  * - MessageTenantContextInterceptor (for RabbitMQ messages in microservices)
+  * - Manual context setup in message handlers
+  *
+  * @param tenantInfo Complete tenant information
+  * @throws Error if tenant context is already set (prevents accidental overwrites)
+  */
+  setTenant(tenantInfo) {
+    if (this.tenantInfo) {
+      throw new Error("Tenant context already set for this request");
+    }
+    this.tenantInfo = tenantInfo;
+  }
+  /**
+  * Get tenant information for this request/message
+  *
+  * @returns Tenant information
+  * @throws UnauthorizedException if tenant context hasn't been set
+  */
+  getTenant() {
+    if (!this.tenantInfo) {
+      throw new UnauthorizedException2("Tenant context not set");
+    }
+    return this.tenantInfo;
+  }
+  /**
+  * Check if tenant context has been set
+  *
+  * @returns true if tenant context is available
+  */
+  hasTenant() {
+    return this.tenantInfo !== null;
+  }
+  /**
+  * Clear tenant context
+  *
+  * This is useful for cleanup in RabbitMQ message handlers
+  * after the message has been processed.
+  *
+  * HTTP requests don't need manual cleanup as the service
+  * instance is destroyed when the request ends.
+  */
+  clearTenant() {
+    this.tenantInfo = null;
+  }
+  /**
+  * Get tenant ID safely (returns null if not set)
+  *
+  * @returns Tenant ID or null
+  */
+  getTenantIdSafe() {
+    return this.tenantInfo?.id ?? null;
+  }
+  /**
+  * Get tenant subdomain safely (returns null if not set)
+  *
+  * @returns Tenant subdomain or null
+  */
+  getTenantSubdomainSafe() {
+    return this.tenantInfo?.subdomain ?? null;
+  }
+};
+TenantContextService = _ts_decorate6([
+  Injectable4({
+    scope: Scope3.REQUEST
+  })
+], TenantContextService);
+
+// src/database/interceptors/message-tenant-context.interceptor.ts
+function _ts_decorate7(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate7, "_ts_decorate");
+function _ts_metadata4(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata4, "_ts_metadata");
+var MessageTenantContextInterceptor = class _MessageTenantContextInterceptor {
+  static {
+    __name(this, "MessageTenantContextInterceptor");
+  }
+  tenantContext;
+  logger = new Logger3(_MessageTenantContextInterceptor.name);
+  constructor(tenantContext) {
+    this.tenantContext = tenantContext;
+  }
+  intercept(context, next) {
+    const contextType = context.getType();
+    if (contextType === "rpc") {
+      const rpcContext = context.switchToRpc();
+      const payload = rpcContext.getData();
+      if (payload && payload.tenant) {
+        const tenant = payload.tenant;
+        this.logger.debug(`Setting tenant context from message: ${tenant.subdomain}`);
+        try {
+          this.tenantContext.setTenant(tenant);
+          this.logger.log(`Tenant context set: ${tenant.subdomain} (${tenant.type})`);
+        } catch (error) {
+          this.logger.error("Failed to set tenant context from message", error);
+        }
+      } else {
+        this.logger.warn("Message payload missing tenant information");
+      }
+    }
+    return next.handle().pipe(tap({
+      next: /* @__PURE__ */ __name(() => {
+        this.cleanupContext();
+      }, "next"),
+      error: /* @__PURE__ */ __name(() => {
+        this.cleanupContext();
+      }, "error"),
+      complete: /* @__PURE__ */ __name(() => {
+        this.cleanupContext();
+      }, "complete")
+    }));
+  }
+  /**
+  * Clean up tenant context after message is processed
+  */
+  cleanupContext() {
+    if (this.tenantContext.hasTenant()) {
+      const tenant = this.tenantContext.getTenantIdSafe();
+      this.tenantContext.clearTenant();
+      this.logger.debug(`Cleaned up tenant context: ${tenant}`);
+    }
+  }
+};
+MessageTenantContextInterceptor = _ts_decorate7([
+  Injectable5({
+    scope: Scope4.REQUEST
+  }),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    typeof TenantContextService === "undefined" ? Object : TenantContextService
+  ])
+], MessageTenantContextInterceptor);
+
+// src/database/interceptors/tenant-context.interceptor.ts
+import { Injectable as Injectable6, Logger as Logger4, Scope as Scope5, UnauthorizedException as UnauthorizedException3 } from "@nestjs/common";
+function _ts_decorate8(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate8, "_ts_decorate");
+function _ts_metadata5(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata5, "_ts_metadata");
+var TenantContextInterceptor = class _TenantContextInterceptor {
+  static {
+    __name(this, "TenantContextInterceptor");
+  }
+  tenantContext;
+  primaryDatabase;
+  requestService;
+  logger = new Logger4(_TenantContextInterceptor.name);
+  constructor(tenantContext, primaryDatabase, requestService) {
+    this.tenantContext = tenantContext;
+    this.primaryDatabase = primaryDatabase;
+    this.requestService = requestService;
+  }
+  async intercept(context, next) {
+    const request = context.switchToHttp().getRequest();
+    this.logger.debug(`Processing request: ${request.method} ${request.url}`);
+    try {
+      const tenantIdentifier = this.requestService.getTenantIdentifier();
+      if (!tenantIdentifier) {
+        throw new UnauthorizedException3("Tenant identifier not found in request");
+      }
+      this.logger.debug(`Tenant identifier extracted: ${tenantIdentifier}`);
+      if (tenantIdentifier === "cloud") {
+        this.logger.log("Cloud platform access detected, skipping tenant context setup");
+        return next.handle();
+      }
+      const tenantInfo = await this.primaryDatabase.getTenantInfo(tenantIdentifier);
+      if (!tenantInfo) {
+        this.logger.warn(`Invalid tenant: ${tenantIdentifier}`);
+        throw new UnauthorizedException3("Invalid tenant");
+      }
+      if (tenantInfo.status !== "ACTIVE") {
+        this.logger.warn(`Tenant ${tenantIdentifier} has status: ${tenantInfo.status}`);
+        throw new UnauthorizedException3(`Tenant is ${tenantInfo.status}`);
+      }
+      this.logger.debug(`Tenant config loaded: ${tenantInfo.subdomain} (${tenantInfo.type})`);
+      this.tenantContext.setTenant(tenantInfo);
+      request.tenant = tenantInfo;
+      this.logger.log(`Tenant context set: ${tenantInfo.subdomain}`);
+    } catch (error) {
+      this.logger.error("Failed to set tenant context", error);
+      throw error;
+    }
+    return next.handle();
+  }
+};
+TenantContextInterceptor = _ts_decorate8([
+  Injectable6({
+    scope: Scope5.REQUEST
+  }),
+  _ts_metadata5("design:type", Function),
+  _ts_metadata5("design:paramtypes", [
+    typeof TenantContextService === "undefined" ? Object : TenantContextService,
+    typeof PrimaryDatabaseService === "undefined" ? Object : PrimaryDatabaseService,
+    typeof RequestService === "undefined" ? Object : RequestService
+  ])
+], TenantContextInterceptor);
+
+// src/database/services/tenant-database.service.ts
+import { Inject as Inject3, Injectable as Injectable7, InternalServerErrorException as InternalServerErrorException2, Logger as Logger5 } from "@nestjs/common";
+function _ts_decorate9(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate9, "_ts_decorate");
+function _ts_metadata6(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata6, "_ts_metadata");
+function _ts_param3(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param3, "_ts_param");
+var TenantDatabaseService = class _TenantDatabaseService {
+  static {
+    __name(this, "TenantDatabaseService");
+  }
+  options;
+  tenantContext;
+  logger = new Logger5(_TenantDatabaseService.name);
+  /** Connection pool: Map<cacheKey, DbClient> */
+  clients = /* @__PURE__ */ new Map();
+  /** Track last usage time for idle connection cleanup */
+  clientLastUsed = /* @__PURE__ */ new Map();
+  /** Cleanup interval timer */
+  cleanupInterval;
+  constructor(options, tenantContext) {
+    this.options = options;
+    this.tenantContext = tenantContext;
+    this.startConnectionCleaner();
+  }
+  /**
+  * Get tenant-scoped database client for the current request/message
+  *
+  * This method:
+  * 1. Gets tenant info from TenantContextService
+  * 2. Builds a connection URL based on tenant type
+  * 3. Returns cached client if exists, otherwise creates new one
+  *
+  * @returns Promise<Database client instance>
+  * @throws UnauthorizedException if tenant context not set
+  * @throws InternalServerErrorException if connection fails
+  *
+  * @example
+  * const dbClient = await tenantDatabase.getDbClient<PrismaClient>();
+  * const users = await dbClient.user.findMany();
+  */
+  async getDbClient() {
+    const tenant = this.tenantContext.getTenant();
+    const cacheKey = this.buildCacheKey(tenant);
+    if (this.clients.has(cacheKey)) {
+      this.clientLastUsed.set(cacheKey, Date.now());
+      this.logger.debug(`Reusing cached connection: ${cacheKey}`);
+      return this.clients.get(cacheKey);
+    }
+    this.logger.log(`Creating new database connection: ${cacheKey}`);
+    const client = await this.createDbClient(tenant);
+    this.clients.set(cacheKey, client);
+    this.clientLastUsed.set(cacheKey, Date.now());
+    return client;
+  }
+  /**
+  * Create a new database client for the given tenant
+  */
+  async createDbClient(tenant) {
+    try {
+      const databaseUrl = this.buildTenantDbUrl(tenant);
+      const PrismaClient = await this.options.prismaClientConstructor;
+      const client = new PrismaClient({
+        datasources: {
+          db: {
+            url: databaseUrl
+          }
+        },
+        log: [
+          "error",
+          "warn"
+        ]
+      });
+      await client.$connect();
+      this.logger.log(`Connected to database for tenant: ${tenant.subdomain}`);
+      return client;
+    } catch (error) {
+      this.logger.error(`Failed to create database connection for tenant: ${tenant.subdomain}`, error);
+      throw new InternalServerErrorException2("Failed to connect to tenant database");
+    }
+  }
+  /**
+  * Build connection URL for enterprise tenant (dedicated database)
+  */
+  buildTenantDbUrl(tenant) {
+    const { databaseHost, databasePort, databaseName, databaseUsername, databasePassword, databaseSslMode } = tenant;
+    if (!databaseHost || !databaseName || !databaseUsername) {
+      throw new Error(`Enterprise tenant ${tenant.subdomain} missing database configuration`);
+    }
+    const port = databasePort || 5432;
+    const sslMode = databaseSslMode || "require";
+    const connectionUrl = `postgresql://${databaseUsername}:${databasePassword}@${databaseHost}:${port}/${databaseName}?sslmode=${sslMode}`;
+    this.logger.debug(`Enterprise connection URL: ${this.maskPassword(connectionUrl)}`);
+    return connectionUrl;
+  }
+  /**
+  * Build cache key for connection pooling
+  */
+  buildCacheKey(tenant) {
+    return `${tenant.type}:${tenant.databaseName}@${tenant.databaseHost}`;
+  }
+  /**
+  * Start periodic cleanup of idle connections
+  */
+  startConnectionCleaner() {
+    const interval = this.options.connectionCacheTTL || 3e5;
+    this.cleanupInterval = setInterval(() => {
+      this.cleanupIdleConnections();
+    }, interval);
+    this.logger.log(`Connection cleanup scheduled every ${interval / 1e3} seconds`);
+  }
+  /**
+  * Clean up idle connections that haven't been used recently
+  */
+  cleanupIdleConnections() {
+    const now = Date.now();
+    const maxIdle = this.options.connectionCacheTTL || 3e5;
+    let cleaned = 0;
+    for (const [key, lastUsed] of this.clientLastUsed.entries()) {
+      if (now - lastUsed > maxIdle) {
+        const client = this.clients.get(key);
+        if (client) {
+          client.$disconnect().then(() => {
+            this.logger.debug(`Cleaned up idle connection: ${key}`);
+          }).catch((error) => {
+            this.logger.error(`Error disconnecting idle client: ${key}`, error);
+          });
+          this.clients.delete(key);
+          this.clientLastUsed.delete(key);
+          cleaned++;
+        }
+      }
+    }
+    if (cleaned > 0) {
+      this.logger.log(`Cleaned up ${cleaned} idle connections`);
+    }
+  }
+  /**
+  * Get current connection pool statistics
+  */
+  getPoolStats() {
+    return {
+      activeConnections: this.clients.size,
+      tenants: Array.from(this.clients.keys())
+    };
+  }
+  /**
+  * Mask password in connection URL for logging
+  */
+  maskPassword(url) {
+    return url.replace(/:([^@]+)@/, ":****@");
+  }
+  async onModuleDestroy() {
+    if (this.cleanupInterval) {
+      clearInterval(this.cleanupInterval);
+    }
+    this.logger.log(`Disconnecting ${this.clients.size} database connections`);
+    const disconnectPromises = Array.from(this.clients.entries()).map(async ([key, client]) => {
+      try {
+        await client.$disconnect();
+        this.logger.debug(`Disconnected: ${key}`);
+      } catch (error) {
+        this.logger.error(`Error disconnecting client: ${key}`, error);
+      }
+    });
+    await Promise.all(disconnectPromises);
+    this.logger.log("All database connections closed");
+  }
+};
+TenantDatabaseService = _ts_decorate9([
+  Injectable7(),
+  _ts_param3(0, Inject3(DATABASE_MODULE_OPTIONS)),
+  _ts_metadata6("design:type", Function),
+  _ts_metadata6("design:paramtypes", [
+    typeof DatabaseModuleOptions === "undefined" ? Object : DatabaseModuleOptions,
+    typeof TenantContextService === "undefined" ? Object : TenantContextService
+  ])
+], TenantDatabaseService);
+
+// src/database/database.module.ts
+function _ts_decorate10(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate10, "_ts_decorate");
+var DatabaseModule = class _DatabaseModule {
+  static {
+    __name(this, "DatabaseModule");
+  }
+  /**
+  * Configure DatabaseModule for Gateway/HTTP mode (multi-tenant web servers)
+  *
+  * This mode is for API Gateways that handle HTTP requests:
+  * - Automatically registers TenantContextInterceptor
+  * - Extracts tenant from subdomain or x-tenant-id header
+  * - Queries primary database for tenant configuration
+  * - Provides PrimaryDatabaseService for tenant lookup
+  *
+  * @param options Async configuration options
+  * @returns Dynamic module configuration with HTTP interceptor
+  *
+  * @example
+  * DatabaseModule.forServer({
+  *   inject: [ConfigService],
+  *   useFactory: (config: ConfigService) => ({
+  *     primaryDb: {
+  *       host: config.get('PRIMARY_DB_HOST'),
+  *       port: config.get('PRIMARY_DB_PORT'),
+  *       username: config.get('PRIMARY_DB_USERNAME'),
+  *       password: config.get('PRIMARY_DB_PASSWORD'),
+  *       database: config.get('PRIMARY_DB_DATABASE'),
+  *     },
+  *     prismaClientConstructor: PrismaClient,
+  *   }),
+  * })
+  */
+  static forServer(options) {
+    return this.createDynamicModule(options, "gateway");
+  }
+  /**
+  * Configure DatabaseModule for Microservice/Messaging mode (RabbitMQ workers)
+  *
+  * This mode is for microservices that process messages from queues:
+  * - Automatically registers MessageTenantContextInterceptor
+  * - Extracts tenant from RabbitMQ message patterns
+  * - No primary database needed (tenant comes from message context)
+  *
+  * @param options Async configuration options
+  * @returns Dynamic module configuration with message interceptor
+  *
+  * @example
+  * DatabaseModule.forMicroservice({
+  *   inject: [ConfigService],
+  *   useFactory: (config: ConfigService) => ({
+  *     prismaClientConstructor: PrismaClient,
+  *   }),
+  * })
+  */
+  static forMicroservice(options) {
+    return this.createDynamicModule(options, "microservice");
+  }
+  /**
+  * Internal helper to create dynamic module with conditional interceptor registration
+  *
+  * @param options Configuration options
+  * @param mode Mode of operation (gateway or microservice)
+  * @returns Dynamic module configuration
+  */
+  static createDynamicModule(options, mode) {
+    const asyncProvider = {
+      provide: DATABASE_MODULE_OPTIONS,
+      useFactory: options.useFactory,
+      inject: options.inject || []
+    };
+    const providers = [
+      asyncProvider,
+      TenantContextService,
+      PrimaryDatabaseService,
+      TenantDatabaseService
+    ];
+    if (mode === "gateway") {
+      providers.push({
+        provide: APP_INTERCEPTOR,
+        useClass: TenantContextInterceptor
+      });
+    } else {
+      providers.push({
+        provide: APP_INTERCEPTOR,
+        useClass: MessageTenantContextInterceptor
+      });
+    }
+    return {
+      module: _DatabaseModule,
+      imports: [
+        RequestModule
+      ],
+      providers,
+      exports: [
+        TenantDatabaseService,
+        TenantContextService,
+        PrimaryDatabaseService,
+        asyncProvider
+      ]
+    };
+  }
+};
+DatabaseModule = _ts_decorate10([
+  Global3(),
+  Module3({})
+], DatabaseModule);
+
+// src/database/decorators/tenant.decorator.ts
+import { createParamDecorator } from "@nestjs/common";
+var Tenant = createParamDecorator((data, ctx) => {
+  const request = ctx.switchToHttp().getRequest();
+  const tenantContext = request.app?.get?.(TenantContextService);
+  if (!tenantContext) {
+    throw new Error("TenantContextService not found.");
+  }
+  return tenantContext.getTenant();
+});
+
+// src/auth/decorators/onboarding.decorator.ts
+import { SetMetadata } from "@nestjs/common";
+var Onboarding = /* @__PURE__ */ __name(() => SetMetadata("isOnboarding", true), "Onboarding");
+
+// src/auth/decorators/public.decorator.ts
+import { SetMetadata as SetMetadata2 } from "@nestjs/common";
+var Public = /* @__PURE__ */ __name(() => SetMetadata2("isPublic", true), "Public");
 export {
-  getHello
+  AuthConfigModule,
+  DatabaseModule,
+  Onboarding,
+  PrimaryDatabaseService,
+  Public,
+  Tenant,
+  TenantContextService,
+  TenantDatabaseService,
+  VrittiAuthGuard
 };
 //# sourceMappingURL=index.js.map