prow-authority 3.6.3

package/.claude/settings.local.json

@@ -0,0 +1,11 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(xargs ls -la)",
+      "Read(//home/beseif/Documentos/Back/prow-feu/**)",
+      "Read(//home/beseif/Documentos/Back/prow-feu/src/**)",
+      "Bash(find /home/beseif/Documentos -name \"prow-notifications.yaml\" 2>/dev/null)",
+      "Read(//home/beseif/Documentos/**)"
+    ]
+  }
+}

package/.dockerignore

@@ -0,0 +1,11 @@
+node_modules
+dist
+config
+.git
+.github
+*.log
+logs
+.vscode
+Dockerfile
+Dockerfile.dev
+.dockerignore

package/.github/workflows/_deploy.yml

@@ -0,0 +1,191 @@
+name: _deploy (reusable)
+
+# Workflow reutilizable: build de imagen Docker + push a Amazon ECR.
+#
+# config/config.yaml sigue gestionandose exactamente igual que hoy: vive en
+# el checkout de prow-configuration-files en la propia EC2 (mismo mecanismo
+# de actualizacion que ya usa ese repo). Antes se conectaba con el proceso
+# PM2 via symlink; con Docker, al tener el contenedor su propio filesystem
+# aislado, un symlink que apunte fuera del mount no se resolveria dentro del
+# contenedor. Por eso aqui se monta directamente el fichero real del
+# checkout como bind-mount de solo lectura en el `docker run` (ver
+# CONFIG_HOST_PATH). Ningun secreto de config pasa por GitHub Actions ni
+# por AWS: no hace falta tocar IAM para eso.
+#
+# Variables de REPOSITORIO (mismo valor para dev y prod, no van en el
+# Environment — misma cuenta/region de AWS para ambos entornos):
+#   ECR_REGISTRY     — ej: 123456789.dkr.ecr.eu-west-1.amazonaws.com
+#   ECR_REPOSITORY   — ej: prow/prow-authority
+#   AWS_REGION       — ej: eu-west-1
+#   CONFIG_HOST_PATH — ruta al config.yaml real dentro del checkout de
+#                      prow-configuration-files: /node/configuration-files/prow-authority.yaml
+#                      Es la misma ruta en ambas EC2 — lo que cambia es la
+#                      rama (develop/prod) checkouteada en cada maquina en
+#                      esa misma ruta. (fichero, no carpeta — se monta 1:1
+#                      sobre /app/config/config.yaml)
+#   Si algun dia dev/prod necesitan un valor distinto para alguna de estas
+#   (ej. prod en otra cuenta de AWS), basta con redefinirla tambien en el
+#   Environment correspondiente — una variable de Environment con el mismo
+#   nombre tiene prioridad sobre la de repositorio.
+#
+# Variables requeridas por GitHub Environment (dev/prod):
+#   INSTANCE_ID — id de la EC2 destino (i-xxxxxxxx)
+#   HOST_PORT   — puerto del host mapeado al 5001 del contenedor
+#
+# Secrets requeridos (repositorio, ver _deploy.yml de prow-feu — misma cuenta AWS):
+#   AWS_ROLE_ARN — rol OIDC de CI con permisos ECR push + SSM SendCommand
+#   NPM_TOKEN    — npm automation token para @beseif-solutions/*
+#
+# El llamador debe pasar `secrets: inherit`.
+
+on:
+  workflow_call:
+    inputs:
+      environment:
+        description: GitHub Environment del que se leen secrets y variables (dev/prod)
+        required: true
+        type: string
+      image_tag:
+        description: >
+          Tag principal de la imagen. Dev usa "dev"; prod usa el tag de release (ej: "v1.2.3").
+        required: true
+        type: string
+      tag_latest:
+        description: Si true, publica tambien la etiqueta :latest (solo para prod).
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+  id-token: write  # requerido para OIDC (sts:AssumeRoleWithWebIdentity)
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    environment: ${{ inputs.environment }}
+
+    env:
+      ECR_REGISTRY: ${{ vars.ECR_REGISTRY }}
+      ECR_REPOSITORY: ${{ vars.ECR_REPOSITORY }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Configure AWS credentials (OIDC)
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          aws-region: ${{ vars.AWS_REGION }}
+
+      - name: Login to Amazon ECR
+        uses: aws-actions/amazon-ecr-login@v2
+
+      # Construye la lista de tags segun el entorno:
+      #   dev  → :dev
+      #   prod → :v1.2.3 + :latest
+      - name: Compute image tags
+        id: tags
+        run: |
+          BASE="${ECR_REGISTRY}/${ECR_REPOSITORY}"
+          TAGS="${BASE}:${{ inputs.image_tag }}"
+          if [ "${{ inputs.tag_latest }}" = "true" ]; then
+            TAGS="${TAGS}"$'\n'"${BASE}:latest"
+          fi
+          echo "tags<<EOF" >> "$GITHUB_OUTPUT"
+          echo "${TAGS}" >> "$GITHUB_OUTPUT"
+          echo "EOF" >> "$GITHUB_OUTPUT"
+
+      - name: Write build secrets to files
+        run: printf '%s' "${NPM_TOKEN}" > /tmp/npm_token
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.tags.outputs.tags }}
+          secret-files: |
+            npm_token=/tmp/npm_token
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      # Ordena a la EC2 (por instance ID) que haga login en ECR, descargue la
+      # imagen nueva y reinicie el contenedor montando el config.yaml real
+      # del checkout de prow-configuration-files (CONFIG_HOST_PATH) como
+      # solo lectura. El instance profile de la EC2 ya tiene permisos ECR
+      # pull, no hace falta nada nuevo en IAM.
+      - name: Deploy to EC2 (SSM)
+        run: |
+          set -euo pipefail
+
+          BASE="${ECR_REGISTRY}/${ECR_REPOSITORY}"
+          IMAGE="${BASE}:${{ inputs.image_tag }}"
+          CONTAINER=$(basename "${ECR_REPOSITORY}")
+
+          REMOTE="
+            aws ecr get-login-password --region ${{ vars.AWS_REGION }} \
+              | docker login --username AWS --password-stdin ${ECR_REGISTRY} \
+            && docker pull ${IMAGE} \
+            && docker stop ${CONTAINER} || true \
+            && docker rm ${CONTAINER} || true \
+            && docker run -d \
+                 --name ${CONTAINER} \
+                 --restart unless-stopped \
+                 -p ${{ vars.HOST_PORT }}:5001 \
+                 -v ${{ vars.CONFIG_HOST_PATH }}:/app/config/config.yaml:ro \
+                 ${IMAGE}
+          "
+          B64=$(printf '%s' "${REMOTE}" | base64 -w0)
+
+          CMD_ID=$(aws ssm send-command \
+            --region ${{ vars.AWS_REGION }} \
+            --document-name AWS-RunShellScript \
+            --comment "deploy ${GITHUB_SHA::7} -> ${CONTAINER}:${{ inputs.image_tag }}" \
+            --targets "Key=instanceids,Values=${{ vars.INSTANCE_ID }}" \
+            --parameters "commands=[\"echo ${B64} | base64 -d | bash\"]" \
+            --query Command.CommandId --output text)
+          echo "SSM CommandId: ${CMD_ID}"
+
+          for _ in $(seq 1 60); do
+            STATUS=$(aws ssm list-command-invocations \
+              --region ${{ vars.AWS_REGION }} \
+              --command-id "${CMD_ID}" \
+              --query "CommandInvocations[0].Status" --output text 2>/dev/null || echo "Pending")
+            echo "Estado: ${STATUS}"
+            if echo "${STATUS}" | grep -qE 'Pending|InProgress|Delayed'; then
+              sleep 5; continue
+            fi
+            break
+          done
+
+          if [ "${STATUS}" != "Success" ]; then
+            echo "::error::Deploy fallido con estado: ${STATUS}"
+            aws ssm get-command-invocation \
+              --region ${{ vars.AWS_REGION }} \
+              --command-id "${CMD_ID}" \
+              --instance-id "${{ vars.INSTANCE_ID }}" \
+              --query "StandardErrorContent" --output text || true
+            exit 1
+          fi
+          echo "Deploy OK — ${CONTAINER}:${{ inputs.image_tag }}" >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Summary
+        run: |
+          BASE="${ECR_REGISTRY}/${ECR_REPOSITORY}"
+
+          echo "### Imagen publicada y desplegada" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "**Tags publicados:**" >> "$GITHUB_STEP_SUMMARY"
+          echo '```' >> "$GITHUB_STEP_SUMMARY"
+          echo "${BASE}:${{ inputs.image_tag }}" >> "$GITHUB_STEP_SUMMARY"
+          if [ "${{ inputs.tag_latest }}" = "true" ]; then
+            echo "${BASE}:latest" >> "$GITHUB_STEP_SUMMARY"
+          fi
+          echo '```' >> "$GITHUB_STEP_SUMMARY"

package/.github/workflows/deploy-dev.yml

@@ -0,0 +1,30 @@
+name: Deploy Dev
+
+# Publica la imagen Docker del entorno Dev en ECR con tag :dev y despliega
+# en la EC2 de dev via SSM.
+#
+# Tags que genera:
+#   :dev          — siempre apunta al ultimo build de develop
+
+on:
+  push:
+    branches: [develop]
+  workflow_dispatch: {}
+
+# Cancela despliegues solapados de Dev (un push nuevo invalida el anterior).
+concurrency:
+  group: deploy-dev
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  deploy:
+    uses: ./.github/workflows/_deploy.yml
+    with:
+      environment: dev
+      image_tag: dev
+      tag_latest: false
+    secrets: inherit

package/.github/workflows/deploy-prod.yml

@@ -0,0 +1,34 @@
+name: Deploy Prod
+
+# Publica la imagen Docker del entorno Prod en ECR con el tag de release y
+# despliega en la EC2 de prod via SSM.
+# Se dispara al publicar un GitHub Release (tag v*) o manualmente.
+# La aprobacion previa la impone la proteccion del environment `prod`
+# (required reviewers).
+#
+# Tags que genera:
+#   :v1.2.3        — version exacta del release
+#   :latest        — apunta siempre al ultimo release de produccion
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch: {}
+
+# En Prod NO cancelamos un despliegue en curso.
+concurrency:
+  group: deploy-prod
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  deploy:
+    uses: ./.github/workflows/_deploy.yml
+    with:
+      environment: prod
+      image_tag: ${{ github.ref_name }}
+      tag_latest: true
+    secrets: inherit

package/CLAUDE.md

@@ -0,0 +1,114 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## What this service is
+
+`prow-authority` is the central auth/licensing/billing service for the Prow platform ("letsprow"). It is the
+source of truth for users, organizations, memberships/roles, services, licenses/quotas, policies, notifications,
+and billing (Stripe + Holded invoicing). Other Prow services integrate with it via the
+`@beseif-solutions/prow-authority-for-services` client library (see `src/helpers/authority.ts`), which this
+service also uses internally to check quotas/licensing and emit notification events.
+
+## Commands
+
+```bash
+npm run build          # tsc compile src/ -> dist/
+npm run build_watch    # tsc --watch
+npm run clean          # rimraf dist
+npm run run            # nodemon dist/index.js, watching dist/**/*.js (runs the already-built output)
+npm run develop        # clean + build + build_watch + run, in parallel (main dev loop)
+npm run start          # node dist/index.js (no watch, e.g. for prod)
+npm run lint           # eslint --ext .ts src --fix
+```
+
+There is no test runner configured in `package.json` — there are no automated tests in this repo currently.
+
+A `pre-push` git hook (via husky) runs `npm run build`, so a broken TypeScript build blocks pushes.
+
+The server reads its port and all external service credentials from `config/config.yaml` (loaded via
+`@beseif-solutions/utility-functions`'s `YamlParser` in `src/helpers/config.ts`, exposed as `nconf`). There is a
+single `config.yaml` (not environment-specific files), so changes to it affect whichever environment the running
+instance points at — check `SERVICES:RDS:URL` / `SERVICES:AUTHORITY:HOST` before assuming which environment you're
+touching.
+
+## Architecture
+
+Layered, per-resource structure under `src/v1/`, mirrored across five parallel folders — a new resource typically
+touches one file in each:
+
+```
+routes/<scope>/<resource>-router.ts       Express Router: parses req, calls controller, maps result/errors to HTTP
+controllers/<scope>/<resource>-controller.ts   Business logic: validation, orchestration, calls DAOs/other controllers
+daos/<resource>-dao.ts                    Raw MySQL access (mysql2-style, via @beseif-solutions/utility-functions MySQL)
+schemas/<scope>/<resource>-schemas.ts     Joi-like validation schemas (Schema.* from utility-functions) for add/update
+types/<scope>/<resource>-types.ts         Domain type (public shape) + DBRecord type (raw DB row shape)
+```
+
+Controllers, routers and DAOs are implemented as singleton classes exported as a default instance
+(`class UserCtrl { ... }` → `export default new UserCtrl()`), not as plain functions/modules — follow this pattern
+for new resources.
+
+Every router action follows the same try/catch shape: call the controller, `res.json(response)` on success; on
+error, `if (e instanceof APIError) res.status(e.code).json(e.data)` else 500 with `e.message`. `APIError`
+(`src/helpers/api-error.ts`) is the only structured error type — throw it from controllers/DAOs with a
+`StatusCodes` + `detail` message when a caller-facing failure occurs.
+
+Controllers commonly call other controllers directly (not DAOs) when crossing resource boundaries (e.g.
+`user-controller` calls `user-organization-controller` and `identity-token-controller`) — this keeps validation and
+side effects (e.g. cache invalidation, notifications) consistent.
+
+### Request scopes / route mounting (`src/v1/routes/v1-router.ts`)
+
+- `/admin/*` — internal/back-office CRUD across nearly every resource (users, organizations, licenses, policies,
+  billing, schedules...). Gated by the `admin` middleware (`src/v1/middlewares/static/static-middleware.ts`),
+  which checks a static `x-admin-token` header against `SERVICES:AUTH:ADMIN`.
+- `/auth/identity` + `/user` — end-user login/session flows, protected by identity bearer tokens
+  (`identity-token-middleware.ts`).
+- `/auth/organization` + `/organization` — organization-scoped session flows (`organization-token-middleware.ts`),
+  which resolve and cache an `Environment` (user + organization) in Redis for 60s.
+- `/service`, `/services` (public) — consumed by other Prow services. Authenticated via
+  `x-service-uuid`/`x-service-token` headers (`service-token-middleware.ts`), which also resolves and caches a
+  `ServiceEnvironment` (service + organization + licenses) in Redis for 60s, and can push license-change
+  notifications back to the calling service's configured webhook.
+- `/billing` — Stripe/Holded-backed billing endpoints.
+- `authority-middleware.ts` — used when *this* service's own actions need to check quota (`isPossible`) or license
+  status (`organization`) against itself via the `authority` client from `src/helpers/authority.ts`.
+
+Auth middlewares consistently split into two steps chained in the router: an `exists` check (pull token out of
+headers, 401 if missing) then a `validate` check (resolve token to a user/environment, attach to `req`). Downstream
+middleware/controllers assume the previous step ran and throw a 500 "Middleware dependency broken" `APIError` if
+the expected `req` property is missing — preserve this ordering when adding routes.
+
+### Data layer
+
+- MySQL is the primary store (`src/helpers/mysql.ts`, connection pool of 5). `src/v1/daos/schema.sql` is the
+  canonical schema reference (tables for users, organizations, memberships, services, licenses/limits, policies,
+  billing cycles, invoices, payment methods, accounting seats). DAOs use `mySql.queryConstructor` for simple
+  get/list/delete (built from a `Where<T>` object plus optional `Modifiers` — order/limit/timeout, see
+  `src/v1/common-types.ts`) and raw parameterized SQL strings for insert/update.
+- JSON-typed DB columns (`properties`, `preferences`, `metadata`, `internal`, `utm`, `billing`) are
+  `JSON.stringify`'d going into DAOs and parsed back out in the controller's `parse()` step, which is also where
+  DB rows (`DBRecord`) get reshaped into the public-facing domain type (masking `password`, defaulting
+  `preferences.language`, etc).
+- Redis (`src/v1/daos/redis-dao.ts`, generic `RedisDao<T>`) is used purely as a short-lived (60s) cache for
+  resolved auth environments, refreshed via `setImmediate` after the response is sent (stale-while-revalidate
+  style) rather than blocking the request.
+
+### Scheduling & external integrations
+
+- `src/v1/controllers/admin/schedule-controller.ts` registers cron-style jobs on construction (via
+  `Scheduler.schedule` from utility-functions) for license-limit checks, license-change fallback sync, billing
+  cycle rollover, and invoice generation — these run inside the service process, not as separate jobs.
+- `src/helpers/stripe.ts` / `src/helpers/holded.ts` wrap the Stripe SDK and Holded invoicing API respectively.
+- `src/helpers/notifications.ts` sends transactional email (Gmail templates) and Slack notifications through a
+  separate Prow notifications service; `NotificationEventNames` and their payload types are centralized in
+  `src/helpers/authority.ts`.
+- `src/helpers/s3.ts` handles avatar/cover image upload for users/organizations/services.
+
+### Deprecated code
+
+Files/paths prefixed `@deprecated` (e.g. `controllers/auth/@deprecated oauth-controller.ts`,
+`daos/@deprecated auth-dao.ts`) are kept for reference/rollback but are not part of the active auth flow — the
+active identity/organization token flows are `identity-token-*` and `organization-token-*`. Don't extend the
+deprecated files; treat new auth work as belonging in the token-based controllers/middlewares.

package/Dockerfile

@@ -0,0 +1,61 @@
+# Imagen de runtime para prow-authority (Node/Express).
+#
+# A diferencia de un front (que hornea sus vars en el bundle en build-time),
+# esta API lee config/config.yaml en RUNTIME (ver src/helpers/config.ts,
+# resuelve la ruta a <workdir>/config/config.yaml). Ese fichero contiene
+# credenciales reales, esta en .gitignore y NUNCA debe copiarse dentro de
+# la imagen. En su lugar se monta como volumen al arrancar el contenedor,
+# apuntando al fichero real gestionado por prow-configuration-files:
+#
+#   docker run -v /node/configuration-files/prow-authority.yaml:/app/config/config.yaml:ro ...
+#
+# El unico secret de build es NPM_TOKEN, necesario para instalar los
+# paquetes privados @beseif-solutions/*.
+#
+# Build local:
+#   DOCKER_BUILDKIT=1 docker build \
+#     --secret id=npm_token,env=NPM_TOKEN \
+#     -t prow-authority:local .
+#
+# Run local (con un config.yaml de dev, ej. de prow-configuration-files):
+#   docker run -p 5001:5001 -v "$(pwd)/config.yaml:/app/config/config.yaml:ro" prow-authority:local
+
+# ---- Stage 1: install deps + build ----------------------------------
+FROM node:20.9.0-bookworm-slim AS builder
+WORKDIR /app
+
+COPY package.json package-lock.json ./
+RUN --mount=type=secret,id=npm_token \
+    printf '//registry.npmjs.org/:_authToken=%s\n' "$(cat /run/secrets/npm_token)" > .npmrc \
+ && npm ci \
+ && rm -f .npmrc
+
+COPY tsconfig.json ./
+COPY src ./src
+RUN npm run build
+
+# ---- Stage 2: production deps only -----------------------------------
+FROM node:20.9.0-bookworm-slim AS deps
+WORKDIR /app
+
+COPY package.json package-lock.json ./
+RUN --mount=type=secret,id=npm_token \
+    printf '//registry.npmjs.org/:_authToken=%s\n' "$(cat /run/secrets/npm_token)" > .npmrc \
+ && npm ci --omit=dev \
+ && rm -f .npmrc
+
+# ---- Stage 3: runtime --------------------------------------------------
+FROM node:20.9.0-bookworm-slim AS runtime
+WORKDIR /app
+ENV NODE_ENV=production
+
+COPY --from=deps /app/node_modules ./node_modules
+COPY --from=builder /app/dist ./dist
+COPY package.json ./
+
+# config/config.yaml se monta como volumen (ver cabecera de este fichero).
+# El directorio existe vacio en la imagen para que el mount tenga destino.
+RUN mkdir -p /app/config
+
+EXPOSE 5001
+CMD ["node", "dist/index.js"]

package/Dockerfile.dev

@@ -0,0 +1,24 @@
+# Imagen de desarrollo local (hot-reload). El codigo y config.yaml los
+# proporciona docker-compose en tiempo de ejecucion (bind-mount + volumen con
+# nombre para node_modules) — ver prow-configuration-files/docker-compose.yml,
+# servicio `authority`. Esta imagen solo instala dependencias.
+#
+# El token de npm para @beseif-solutions/* entra como build secret y nunca
+# queda grabado en la imagen.
+
+FROM node:20.9.0-bookworm-slim
+WORKDIR /app
+
+COPY package.json package-lock.json ./
+RUN --mount=type=secret,id=npm_token \
+    printf '//registry.npmjs.org/:_authToken=%s\n' "$(cat /run/secrets/npm_token)" > .npmrc \
+ && npm ci \
+ && rm -f .npmrc
+
+# .npmrc de runtime: resuelve el token desde la variable NPM_TOKEN (inyectada
+# por compose) para poder hacer `npm install <pkg>` dentro del contenedor ya
+# arrancado. Vive en /root para que el bind-mount de /app no lo tape.
+RUN printf '//registry.npmjs.org/:_authToken=${NPM_TOKEN}\n' > /root/.npmrc
+
+EXPOSE 5001
+CMD ["npm", "run", "develop"]

package/README.md

@@ -0,0 +1 @@
+Demo provider for Zapdos-CLI documentation

package/package.json

@@ -0,0 +1,61 @@
+{
+  "name": "prow-authority",
+  "version": "3.6.3",
+  "description": "Prow environment user management",
+  "scripts": {
+    "clean": "rimraf dist",
+    "build": "tsc",
+    "build_watch": "tsc --watch",
+    "run": "nodemon './dist/index.js' --watch './dist/**/*.js'",
+    "develop": "npm-run-all clean build --parallel build_watch run",
+    "start": "node dist/index.js",
+    "lint": "npx eslint -c .eslintrc.js --ext .ts src --fix"
+  },
+  "keywords": [],
+  "author": "Beseif",
+  "license": "ISC",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/beseif-solutions/prow-authority.git"
+  },
+  "bugs": {
+    "url": "https://github.com/beseif-solutions/prow-authority/issues"
+  },
+  "homepage": "https://github.com/beseif-solutions/prow-authority#readme",
+  "dependencies": {
+    "@beseif-solutions/prow-authority-for-services": "1.1.0",
+    "@beseif-solutions/utility-functions": "1.0.3",
+    "@types/node": "^14.18.34",
+    "cors": "^2.8.5",
+    "country-list": "^2.4.1",
+    "country-list-spanish": "^0.3.2",
+    "express": "^4.17.1",
+    "form-data": "^4.0.2",
+    "http-status-codes": "^2.3.0",
+    "lodash": "^4.17.21",
+    "path": "^0.12.7",
+    "stripe": "^18.0.0",
+    "ts-node": "^8.10.2",
+    "typescript": "4.6.3"
+  },
+  "devDependencies": {
+    "@cpmech/httpcodes": "^3.18.0",
+    "@types/cors": "^2.8.17",
+    "@types/express": "^4.17.6",
+    "@types/lodash": "4.17.5",
+    "@typescript-eslint/eslint-plugin": "^5.38.0",
+    "@typescript-eslint/parser": "^5.38.0",
+    "eslint": "^8.24.0",
+    "eslint-plugin-jsdoc": "^39.3.6",
+    "eslint-plugin-prefer-arrow": "^1.2.3",
+    "husky": "^4.2.5",
+    "nodemon": "^2.0.4",
+    "npm-run-all": "^4.1.5",
+    "rimraf": "^3.0.2"
+  },
+  "husky": {
+    "hooks": {
+      "pre-push": "npm run build"
+    }
+  }
+}

package/src/App.ts

@@ -0,0 +1,40 @@
+import cors from 'cors';
+import express, { Request, Response } from 'express';
+import httpcodes from 'http-status-codes';
+import v1Router from './v1/routes/v1-router';
+
+class App {
+  public express: express.Application;
+
+  constructor() {
+    this.express = express();
+    this.middleware();
+    this.routes();
+  }
+
+  private middleware(): void {
+    this.express.use(express.json({ limit: `200mb` }));
+    this.express.use(express.urlencoded({ extended: false }));
+    this.express.use(cors());
+
+    this.express.use((req, res, next) => {
+      console.log(`-> [${req.method}] ${req.originalUrl}`);
+      res.once(`finish`, () => {
+        console.log(`<- [${req.method}] ${req.originalUrl}`, res.statusCode);
+      });
+      next();
+    });
+  }
+
+  private readonly notFound = (req: Request, res: Response) => {
+    res.status(httpcodes.NOT_FOUND).json({ message: `Not found` });
+  };
+
+  private routes(): void {
+    this.express.use(`/v1`, v1Router);
+    this.express.use(this.notFound);
+  }
+}
+
+
+export default new App().express;

package/src/helpers/api-error.ts

@@ -0,0 +1,21 @@
+
+import { StatusCodes, getReasonPhrase } from 'http-status-codes';
+
+export default class APIError extends Error {
+
+  public readonly code: StatusCodes;
+  public readonly data: { code: StatusCodes, message: string, detail: string };
+
+  constructor(data: { code: StatusCodes, detail: string }) {
+    super(`API Error (${data.code}): ${data.detail}`);
+    this.code = data.code;
+    this.data = {
+      code: data.code,
+      message: getReasonPhrase(data.code),
+      detail: data.detail,
+    };
+  }
+}
+
+export { StatusCodes } from 'http-status-codes';
+