ad2app-lib 1.44.0 → 1.44.1

package/dist/types/agency.d.ts

@@ -203,25 +203,40 @@ export interface I_SponsoredBy {
     /** Present once the sponsorship is ending: the date their plan runs to. */
     until?: string;
 }
+/**
+ * Every DTO below carries class-validator decorators and a constructor that
+ * survives being called with nothing.
+ *
+ * Both are load-bearing and were missing until 2026-09-22. The backend mounts
+ * a global `ValidationPipe`, which validates the decorated metadata of the
+ * class a handler's `@Body()` is typed with — an undecorated class, or a body
+ * typed as a plain interface, is simply passed through unchecked. And the pipe
+ * instantiates the class with NO arguments, so a constructor that reads
+ * `data.name` would throw a TypeError on every request rather than validate
+ * anything. The rest of this library's DTOs take `data?: Partial<T>` for that
+ * reason; these now do too.
+ */
 export declare class CreateAgencyOrganizationDto {
     name: string;
+    /** Rendered as a link on the admin screen, so the protocol is checked here. */
     website?: string;
     registryId: string;
+    /** ISO-3166 alpha-2: which register a reviewer should look in. */
     registryCountry: string;
     contactEmail: string;
-    constructor(data: CreateAgencyOrganizationDto);
+    constructor(data?: Partial<CreateAgencyOrganizationDto>);
 }
 export declare class InviteAgencyMemberDto {
     email: string;
-    constructor(data: InviteAgencyMemberDto);
+    constructor(data?: Partial<InviteAgencyMemberDto>);
 }
 export declare class RedeemAgencyInviteDto {
     token: string;
-    constructor(data: RedeemAgencyInviteDto);
+    constructor(data?: Partial<RedeemAgencyInviteDto>);
 }
 export declare class AcceptAgencyMemberInviteDto {
     token: string;
-    constructor(data: AcceptAgencyMemberInviteDto);
+    constructor(data?: Partial<AcceptAgencyMemberInviteDto>);
 }
 /**
  * Accepting consent. Either arm identifies the grant being answered; `scopes`
@@ -230,31 +245,34 @@ export declare class AcceptAgencyMemberInviteDto {
 export declare class AcceptGrantDto {
     token?: string;
     grantId?: string;
+    /** A subset of the three reads. Never empty: sharing nothing is declining. */
     scopes?: I_AgencyGrantScope[];
-    constructor(data: AcceptGrantDto);
+    constructor(data?: Partial<AcceptGrantDto>);
 }
 /** The creator narrowing or widening a live grant — the only other write path. */
 export declare class UpdateGrantScopesDto {
     scopes: I_AgencyGrantScope[];
-    constructor(data: UpdateGrantScopesDto);
+    constructor(data?: Partial<UpdateGrantScopesDto>);
 }
 export declare class SponsorCreatorDto {
     tier: SponsoredTier;
-    constructor(data: SponsorCreatorDto);
+    constructor(data?: Partial<SponsorCreatorDto>);
 }
 export declare class AgencyDiscoverQueryDto {
     /** An EXACT platform username or e-mail. Never recorded in analytics (FR-015). */
     q: string;
-    constructor(data: AgencyDiscoverQueryDto);
+    constructor(data?: Partial<AgencyDiscoverQueryDto>);
 }
 export declare class AgencyAccessRequestDto {
     userId: string;
     scopes: I_AgencyGrantScope[];
-    constructor(data: AgencyAccessRequestDto);
+    constructor(data?: Partial<AgencyAccessRequestDto>);
 }
 export declare class AdminSetOrganizationStatusDto {
     status: Extract<AgencyOrganizationStatus, 'approved' | 'rejected'>;
-    /** Required on reject — a rejected applicant is shown this (FR-002). */
+    /** Required on reject — a rejected applicant is shown this (FR-002). The
+     *  "required when rejecting" half is a rule about the PAIR, so it stays in
+     *  the service where both fields are in hand. */
     reason?: string;
-    constructor(data: AdminSetOrganizationStatusDto);
+    constructor(data?: Partial<AdminSetOrganizationStatusDto>);
 }

package/dist/types/agency.js

@@ -1,20 +1,16 @@
 "use strict";
-/**
- * Agency domain — organizations, memberships and creator access grants (spec 175).
- *
- * The shape behind "an agency sees its creators' numbers, because the creators
- * said yes". Two doors, one product: a creator account is unchanged by any of
- * this, and gains at most one grant.
- *
- * The one idea worth carrying into every consumer: a GRANT IS READ-ONLY AND
- * CREATOR-OWNED. The agency asks for scopes; only a creator's own act ever
- * writes `grantedScopes` (FR-008, SC-002). Nothing here can express a write on
- * a creator's account, and that is deliberate — the absence is the feature.
- *
- * See specs/175-agency-roster/contracts/lib-types.md.
- */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AdminSetOrganizationStatusDto = exports.AgencyAccessRequestDto = exports.AgencyDiscoverQueryDto = exports.SponsorCreatorDto = exports.UpdateGrantScopesDto = exports.AcceptGrantDto = exports.AcceptAgencyMemberInviteDto = exports.RedeemAgencyInviteDto = exports.InviteAgencyMemberDto = exports.CreateAgencyOrganizationDto = exports.AGENCY_ROSTER_NEEDS_ATTENTION_STATES = exports.AGENCY_ROSTER_ROW_STATES = exports.CREATOR_ACCESS_GRANT_STATES = exports.AGENCY_ORGANIZATION_STATUSES = exports.isAgencyGrantScope = exports.AGENCY_GRANT_SCOPES = exports.AGENCY_ROUTE_PATHS = void 0;
+const class_validator_1 = require("class-validator");
 // ── Cross-repo route constants ───────────────────────────────────────────────
 /**
  * Paths that BOTH repos have to agree on, with one home here.
@@ -125,76 +121,179 @@ exports.AGENCY_ROSTER_NEEDS_ATTENTION_STATES = [
     'stale',
 ];
 // ── DTOs ─────────────────────────────────────────────────────────────────────
+/**
+ * Every DTO below carries class-validator decorators and a constructor that
+ * survives being called with nothing.
+ *
+ * Both are load-bearing and were missing until 2026-09-22. The backend mounts
+ * a global `ValidationPipe`, which validates the decorated metadata of the
+ * class a handler's `@Body()` is typed with — an undecorated class, or a body
+ * typed as a plain interface, is simply passed through unchecked. And the pipe
+ * instantiates the class with NO arguments, so a constructor that reads
+ * `data.name` would throw a TypeError on every request rather than validate
+ * anything. The rest of this library's DTOs take `data?: Partial<T>` for that
+ * reason; these now do too.
+ */
 class CreateAgencyOrganizationDto {
     constructor(data) {
-        this.name = data.name;
-        this.website = data.website;
-        this.registryId = data.registryId;
-        this.registryCountry = data.registryCountry;
-        this.contactEmail = data.contactEmail;
+        this.name = data?.name ?? '';
+        this.website = data?.website;
+        this.registryId = data?.registryId ?? '';
+        this.registryCountry = data?.registryCountry ?? '';
+        this.contactEmail = data?.contactEmail ?? '';
     }
 }
 exports.CreateAgencyOrganizationDto = CreateAgencyOrganizationDto;
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], CreateAgencyOrganizationDto.prototype, "name", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsUrl)({ protocols: ['http', 'https'], require_protocol: true }),
+    __metadata("design:type", String)
+], CreateAgencyOrganizationDto.prototype, "website", void 0);
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], CreateAgencyOrganizationDto.prototype, "registryId", void 0);
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.Length)(2, 2),
+    __metadata("design:type", String)
+], CreateAgencyOrganizationDto.prototype, "registryCountry", void 0);
+__decorate([
+    (0, class_validator_1.IsEmail)(),
+    __metadata("design:type", String)
+], CreateAgencyOrganizationDto.prototype, "contactEmail", void 0);
 class InviteAgencyMemberDto {
     constructor(data) {
-        this.email = data.email;
+        this.email = data?.email ?? '';
     }
 }
 exports.InviteAgencyMemberDto = InviteAgencyMemberDto;
+__decorate([
+    (0, class_validator_1.IsEmail)(),
+    __metadata("design:type", String)
+], InviteAgencyMemberDto.prototype, "email", void 0);
 class RedeemAgencyInviteDto {
     constructor(data) {
-        this.token = data.token;
+        this.token = data?.token ?? '';
     }
 }
 exports.RedeemAgencyInviteDto = RedeemAgencyInviteDto;
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], RedeemAgencyInviteDto.prototype, "token", void 0);
 class AcceptAgencyMemberInviteDto {
     constructor(data) {
-        this.token = data.token;
+        this.token = data?.token ?? '';
     }
 }
 exports.AcceptAgencyMemberInviteDto = AcceptAgencyMemberInviteDto;
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], AcceptAgencyMemberInviteDto.prototype, "token", void 0);
 /**
  * Accepting consent. Either arm identifies the grant being answered; `scopes`
  * is the creator's answer and defaults to the requested set when absent.
  */
 class AcceptGrantDto {
     constructor(data) {
-        this.token = data.token;
-        this.grantId = data.grantId;
-        this.scopes = data.scopes;
+        this.token = data?.token;
+        this.grantId = data?.grantId;
+        this.scopes = data?.scopes;
     }
 }
 exports.AcceptGrantDto = AcceptGrantDto;
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], AcceptGrantDto.prototype, "token", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsUUID)(),
+    __metadata("design:type", String)
+], AcceptGrantDto.prototype, "grantId", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsArray)(),
+    (0, class_validator_1.ArrayNotEmpty)(),
+    (0, class_validator_1.IsIn)(exports.AGENCY_GRANT_SCOPES, { each: true }),
+    __metadata("design:type", Array)
+], AcceptGrantDto.prototype, "scopes", void 0);
 /** The creator narrowing or widening a live grant — the only other write path. */
 class UpdateGrantScopesDto {
     constructor(data) {
-        this.scopes = data.scopes;
+        this.scopes = data?.scopes ?? [];
     }
 }
 exports.UpdateGrantScopesDto = UpdateGrantScopesDto;
+__decorate([
+    (0, class_validator_1.IsArray)(),
+    (0, class_validator_1.ArrayNotEmpty)(),
+    (0, class_validator_1.IsIn)(exports.AGENCY_GRANT_SCOPES, { each: true }),
+    __metadata("design:type", Array)
+], UpdateGrantScopesDto.prototype, "scopes", void 0);
 class SponsorCreatorDto {
     constructor(data) {
-        this.tier = data.tier;
+        this.tier = data?.tier ?? 'starter';
     }
 }
 exports.SponsorCreatorDto = SponsorCreatorDto;
+__decorate([
+    (0, class_validator_1.IsIn)(['starter', 'pro']),
+    __metadata("design:type", String)
+], SponsorCreatorDto.prototype, "tier", void 0);
 class AgencyDiscoverQueryDto {
     constructor(data) {
-        this.q = data.q;
+        this.q = data?.q ?? '';
     }
 }
 exports.AgencyDiscoverQueryDto = AgencyDiscoverQueryDto;
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], AgencyDiscoverQueryDto.prototype, "q", void 0);
 class AgencyAccessRequestDto {
     constructor(data) {
-        this.userId = data.userId;
-        this.scopes = data.scopes;
+        this.userId = data?.userId ?? '';
+        this.scopes = data?.scopes ?? [];
     }
 }
 exports.AgencyAccessRequestDto = AgencyAccessRequestDto;
+__decorate([
+    (0, class_validator_1.IsUUID)(),
+    __metadata("design:type", String)
+], AgencyAccessRequestDto.prototype, "userId", void 0);
+__decorate([
+    (0, class_validator_1.IsArray)(),
+    (0, class_validator_1.ArrayNotEmpty)(),
+    (0, class_validator_1.IsIn)(exports.AGENCY_GRANT_SCOPES, { each: true }),
+    __metadata("design:type", Array)
+], AgencyAccessRequestDto.prototype, "scopes", void 0);
 class AdminSetOrganizationStatusDto {
     constructor(data) {
-        this.status = data.status;
-        this.reason = data.reason;
+        this.status = data?.status ?? 'approved';
+        this.reason = data?.reason;
     }
 }
 exports.AdminSetOrganizationStatusDto = AdminSetOrganizationStatusDto;
+__decorate([
+    (0, class_validator_1.IsIn)(['approved', 'rejected']),
+    __metadata("design:type", Object)
+], AdminSetOrganizationStatusDto.prototype, "status", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], AdminSetOrganizationStatusDto.prototype, "reason", void 0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ad2app-lib",
-  "version": "1.44.0",
+  "version": "1.44.1",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "type": "commonjs",
@@ -51,7 +51,7 @@
     "prepare": "npm run build"
   },
   "keywords": [],
-  "author": "Maciej Górski@ad2.app",
+  "author": "Maciej G\u00f3rski@ad2.app",
   "license": "ISC",
   "description": "Package to share types and utils across the ad2app projects",
   "dependencies": {

package/src/types/agency.test.ts

@@ -10,6 +10,14 @@ import {
   isAgencyGrantScope,
   CreateAgencyOrganizationDto,
   AgencyAccessRequestDto,
+  InviteAgencyMemberDto,
+  RedeemAgencyInviteDto,
+  AcceptAgencyMemberInviteDto,
+  AcceptGrantDto,
+  UpdateGrantScopesDto,
+  SponsorCreatorDto,
+  AgencyDiscoverQueryDto,
+  AdminSetOrganizationStatusDto,
 } from "./agency";
 
 test("the grant scope set is exactly the three reads the spec allows", () => {
@@ -78,3 +86,53 @@ test("DTOs construct from a plain object (the house `new I_DTO()` shape)", () =>
   const request = new AgencyAccessRequestDto({ userId: "u-1", scopes: ["analytics"] });
   assert.deepEqual(request.scopes, ["analytics"]);
 });
+
+test("every agency DTO survives being constructed with NOTHING", () => {
+  // What a validation pipe actually does. `plainToInstance` calls the
+  // constructor with no arguments before copying the body onto it, so a
+  // constructor that read `data.name` threw a TypeError on every request
+  // instead of validating anything (found 2026-09-22).
+  const DTOS = [
+    CreateAgencyOrganizationDto,
+    InviteAgencyMemberDto,
+    RedeemAgencyInviteDto,
+    AcceptAgencyMemberInviteDto,
+    AcceptGrantDto,
+    UpdateGrantScopesDto,
+    SponsorCreatorDto,
+    AgencyDiscoverQueryDto,
+    AgencyAccessRequestDto,
+    AdminSetOrganizationStatusDto,
+  ];
+
+  for (const Dto of DTOS) {
+    assert.doesNotThrow(() => new (Dto as new () => unknown)(), `${Dto.name} threw on an empty construct`);
+  }
+});
+
+test("every agency DTO carries validation metadata, not just a shape", () => {
+  // An undecorated class typed onto a handler's @Body() is passed through
+  // unchecked: the pipe validates DECORATORS, and there were none until
+  // 2026-09-22. Read from class-validator's own registry rather than by
+  // booting a pipe.
+  const { getMetadataStorage } = require("class-validator");
+  const storage = getMetadataStorage();
+
+  const DECORATED = [
+    CreateAgencyOrganizationDto,
+    InviteAgencyMemberDto,
+    RedeemAgencyInviteDto,
+    AcceptAgencyMemberInviteDto,
+    AcceptGrantDto,
+    UpdateGrantScopesDto,
+    SponsorCreatorDto,
+    AgencyDiscoverQueryDto,
+    AgencyAccessRequestDto,
+    AdminSetOrganizationStatusDto,
+  ];
+
+  for (const Dto of DECORATED) {
+    const rules = storage.getTargetValidationMetadatas(Dto, Dto.name, false, false);
+    assert.ok(rules.length > 0, `${Dto.name} has no validation rules`);
+  }
+});

package/src/types/agency.ts

@@ -1,3 +1,16 @@
+import {
+  ArrayNotEmpty,
+  IsArray,
+  IsEmail,
+  IsIn,
+  IsNotEmpty,
+  IsOptional,
+  IsString,
+  IsUrl,
+  IsUUID,
+  Length,
+} from 'class-validator';
+
 /**
  * Agency domain — organizations, memberships and creator access grants (spec 175).
  *
@@ -278,43 +291,77 @@ export interface I_SponsoredBy {
 
 // ── DTOs ─────────────────────────────────────────────────────────────────────
 
+/**
+ * Every DTO below carries class-validator decorators and a constructor that
+ * survives being called with nothing.
+ *
+ * Both are load-bearing and were missing until 2026-09-22. The backend mounts
+ * a global `ValidationPipe`, which validates the decorated metadata of the
+ * class a handler's `@Body()` is typed with — an undecorated class, or a body
+ * typed as a plain interface, is simply passed through unchecked. And the pipe
+ * instantiates the class with NO arguments, so a constructor that reads
+ * `data.name` would throw a TypeError on every request rather than validate
+ * anything. The rest of this library's DTOs take `data?: Partial<T>` for that
+ * reason; these now do too.
+ */
+
 export class CreateAgencyOrganizationDto {
+  @IsString()
+  @IsNotEmpty()
   name: string;
+
+  /** Rendered as a link on the admin screen, so the protocol is checked here. */
+  @IsOptional()
+  @IsUrl({ protocols: ['http', 'https'], require_protocol: true })
   website?: string;
+
+  @IsString()
+  @IsNotEmpty()
   registryId: string;
+
+  /** ISO-3166 alpha-2: which register a reviewer should look in. */
+  @IsString()
+  @Length(2, 2)
   registryCountry: string;
+
+  @IsEmail()
   contactEmail: string;
 
-  constructor(data: CreateAgencyOrganizationDto) {
-    this.name = data.name;
-    this.website = data.website;
-    this.registryId = data.registryId;
-    this.registryCountry = data.registryCountry;
-    this.contactEmail = data.contactEmail;
+  constructor(data?: Partial<CreateAgencyOrganizationDto>) {
+    this.name = data?.name ?? '';
+    this.website = data?.website;
+    this.registryId = data?.registryId ?? '';
+    this.registryCountry = data?.registryCountry ?? '';
+    this.contactEmail = data?.contactEmail ?? '';
   }
 }
 
 export class InviteAgencyMemberDto {
+  @IsEmail()
   email: string;
 
-  constructor(data: InviteAgencyMemberDto) {
-    this.email = data.email;
+  constructor(data?: Partial<InviteAgencyMemberDto>) {
+    this.email = data?.email ?? '';
   }
 }
 
 export class RedeemAgencyInviteDto {
+  @IsString()
+  @IsNotEmpty()
   token: string;
 
-  constructor(data: RedeemAgencyInviteDto) {
-    this.token = data.token;
+  constructor(data?: Partial<RedeemAgencyInviteDto>) {
+    this.token = data?.token ?? '';
   }
 }
 
 export class AcceptAgencyMemberInviteDto {
+  @IsString()
+  @IsNotEmpty()
   token: string;
 
-  constructor(data: AcceptAgencyMemberInviteDto) {
-    this.token = data.token;
+  constructor(data?: Partial<AcceptAgencyMemberInviteDto>) {
+    this.token = data?.token ?? '';
   }
 }
 
@@ -323,60 +370,89 @@ export class AcceptAgencyMemberInviteDto {
  * is the creator's answer and defaults to the requested set when absent.
  */
 export class AcceptGrantDto {
+  @IsOptional()
+  @IsString()
+  @IsNotEmpty()
   token?: string;
+
+  @IsOptional()
+  @IsUUID()
   grantId?: string;
+
+  /** A subset of the three reads. Never empty: sharing nothing is declining. */
+  @IsOptional()
+  @IsArray()
+  @ArrayNotEmpty()
+  @IsIn(AGENCY_GRANT_SCOPES as unknown as string[], { each: true })
   scopes?: I_AgencyGrantScope[];
 
-  constructor(data: AcceptGrantDto) {
-    this.token = data.token;
-    this.grantId = data.grantId;
-    this.scopes = data.scopes;
+  constructor(data?: Partial<AcceptGrantDto>) {
+    this.token = data?.token;
+    this.grantId = data?.grantId;
+    this.scopes = data?.scopes;
   }
 }
 
 /** The creator narrowing or widening a live grant — the only other write path. */
 export class UpdateGrantScopesDto {
+  @IsArray()
+  @ArrayNotEmpty()
+  @IsIn(AGENCY_GRANT_SCOPES as unknown as string[], { each: true })
   scopes: I_AgencyGrantScope[];
 
-  constructor(data: UpdateGrantScopesDto) {
-    this.scopes = data.scopes;
+  constructor(data?: Partial<UpdateGrantScopesDto>) {
+    this.scopes = data?.scopes ?? [];
   }
 }
 
 export class SponsorCreatorDto {
+  @IsIn(['starter', 'pro'])
   tier: SponsoredTier;
 
-  constructor(data: SponsorCreatorDto) {
-    this.tier = data.tier;
+  constructor(data?: Partial<SponsorCreatorDto>) {
+    this.tier = data?.tier ?? 'starter';
   }
 }
 
 export class AgencyDiscoverQueryDto {
   /** An EXACT platform username or e-mail. Never recorded in analytics (FR-015). */
+  @IsString()
+  @IsNotEmpty()
   q: string;
 
-  constructor(data: AgencyDiscoverQueryDto) {
-    this.q = data.q;
+  constructor(data?: Partial<AgencyDiscoverQueryDto>) {
+    this.q = data?.q ?? '';
   }
 }
 
 export class AgencyAccessRequestDto {
+  @IsUUID()
   userId: string;
+
+  @IsArray()
+  @ArrayNotEmpty()
+  @IsIn(AGENCY_GRANT_SCOPES as unknown as string[], { each: true })
   scopes: I_AgencyGrantScope[];
 
-  constructor(data: AgencyAccessRequestDto) {
-    this.userId = data.userId;
-    this.scopes = data.scopes;
+  constructor(data?: Partial<AgencyAccessRequestDto>) {
+    this.userId = data?.userId ?? '';
+    this.scopes = data?.scopes ?? [];
   }
 }
 
 export class AdminSetOrganizationStatusDto {
+  @IsIn(['approved', 'rejected'])
   status: Extract<AgencyOrganizationStatus, 'approved' | 'rejected'>;
-  /** Required on reject — a rejected applicant is shown this (FR-002). */
+
+  /** Required on reject — a rejected applicant is shown this (FR-002). The
+   *  "required when rejecting" half is a rule about the PAIR, so it stays in
+   *  the service where both fields are in hand. */
+  @IsOptional()
+  @IsString()
   reason?: string;
 
-  constructor(data: AdminSetOrganizationStatusDto) {
-    this.status = data.status;
-    this.reason = data.reason;
+  constructor(data?: Partial<AdminSetOrganizationStatusDto>) {
+    this.status = data?.status ?? 'approved';
+    this.reason = data?.reason;
   }
 }