speedrun-cli 2.7.15 → 2.8.1

package/CHANGELOG.md

@@ -5,6 +5,22 @@ All notable changes to create-nestjs-auth will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.8.1] - 2026-08-22
+
+### Fixed
+- **Fixed TS2307: Cannot find module `../../common/guards/jwt-auth.guard`** — Enhanced `ensureBaseArchitecture(targetDir)` in `src/moduleGenerator.js` to automatically verify and scaffold placeholder guards (`src/common/guards/jwt-auth.guard.ts`, `src/common/guards/roles.guard.ts`) and decorators (`src/common/decorators/roles.decorator.ts`) whenever generating (`speedrun-cli g`) or configuring (`speedrun-cli c`) protected CRUD modules.
+
+---
+
+## [2.8.0] - 2026-08-22
+
+### Added
+- **Dynamic Module Configurator (`speedrun-cli config [module]` / alias `c`)** — Introduced a new core CLI command and sub-menu module (`src/moduleConfigurator.js`) allowing developers to dynamically customize Auth/Roles Guards (`@UseGuards`, `@Roles('ADMIN', 'SUPERADMIN', ...)`) and toggle active CRUD endpoints (`create`, `findAll`, `findOne`, `update`, `remove`) on existing modules without writing boilerplate code.
+- **Guard Import Resolver** — Configurator automatically detects whether `JwtAuthGuard` or `AuthGuard` is present in `src/common/guards` and injects matching imports and decorators.
+- **Interconnected CLI Ecosystem** — Integrated `config` (`c`) seamlessly across `generate` (`g`) and `field` (`f`) commands.
+
+---
+
 ## [2.7.14] - 2026-08-22
 
 ### Fixed

package/README.md

@@ -41,6 +41,7 @@ npx speedrun-cli create my-app
 * 🔐 **Auth & Role Guard Injection:** Protect write operations (`POST`, `PUT`, `DELETE`) automatically with pre-configured `@UseGuards(JwtAuthGuard, RolesGuard)` and `@Roles('ADMIN', 'SUPERADMIN')` decorators.
 * 🔗 **Relationship Builder:** Add `Many-to-One` or `One-to-Many` relationships to other modules directly from the terminal with automatic foreign key wiring.
 * ✏️ **Sub-Menu Interactive Field Manager (`speedrun-cli field` / `f`):** Modify existing generated modules on the fly. Selectively edit specific field attributes (Name, Type, or Optional status), add new fields, or delete fields with automated DTO and ORM schema re-sync.
+* ⚙️ **Dynamic Module Configurator (`speedrun-cli config` / `c`):** Customize Auth Guards, change role permissions (`@Roles('ADMIN', 'SUPERADMIN')`), and enable/disable active CRUD endpoints on existing controllers without rewriting code.
 * 🏗️ **Automated Base Architecture:** Ensures `src/common/base` (`BaseController`, `BaseService`, and Swagger helpers) exists to eliminate missing import compilation errors (`TS2307`/`TS4112`).
 * 🔄 **Auto AppModule Registration:** Automatically injects generated modules into `src/app.module.ts`.
 
@@ -53,6 +54,7 @@ npx speedrun-cli create my-app
 | `speedrun-cli create [app-name]` | *(default)* | Scaffolds a new production-ready NestJS Auth project. |
 | `speedrun-cli generate [module]` | `g` | Generates a new CRUD module with PKs, fields, ORM sync, and Auth Guards. |
 | `speedrun-cli field [module]` | `f` | Interactive Field Manager to Add, Edit (sub-menu), or Delete fields on existing modules. |
+| `speedrun-cli config [module]` | `c` | Customize role guards (`@Roles`), auth protection, and active CRUD operations. |
 
 ---
 
@@ -81,6 +83,12 @@ npx speedrun-cli g orders
 npx speedrun-cli f orders
 ```
 
+### 4. Configure Roles & Toggle Active Endpoints
+```bash
+# Customize Auth Guards, update role permissions, or enable/disable routes
+npx speedrun-cli c orders
+```
+
 ---
 
 ## 💡 Why This Exists

package/bin/cli.js

@@ -29,6 +29,7 @@ const {
   printManualInstructions,
   generateModule,
   manageFields,
+  configureModule,
 } = require(path.join(packageRoot, 'src'));
 
 program
@@ -66,6 +67,20 @@ program
     }
   });
 
+// ==================== CONFIGURATION COMMAND ====================
+program
+  .command('config [module-name]')
+  .alias('c')
+  .description('Customize module roles, guards, and active CRUD operations')
+  .action(async (moduleName) => {
+    try {
+      console.log(chalk.cyan(`\n😱🤯🤯 speedrun-cli v${CLI_VERSION} module configurator 🤧🥶🥶🥶 (real)\n`));
+      await configureModule(moduleName, process.cwd());
+    } catch (error) {
+      console.error(chalk.red('\n❌ Module configuration failed:'), error);
+    }
+  });
+
 // ==================== MAIN SCAFFOLD COMMAND (DEFAULT) ====================
 program
   .command('create [app-name]', { isDefault: true })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "speedrun-cli",
-  "version": "2.7.15",
+  "version": "2.8.1",
   "description": "CLI tool to scaffold a production-ready NestJS authentication system with JWT, refresh tokens, and RBAC",
   "keywords": [
     "nestjs",

package/src/index.js

@@ -10,6 +10,7 @@ const generator = require('./generator');
 const postSetup = require('./postSetup');
 const moduleGenerator = require('./moduleGenerator');
 const fieldManager = require('./fieldManager');
+const moduleConfigurator = require('./moduleConfigurator');
 
 module.exports = {
   ...constants,
@@ -19,4 +20,5 @@ module.exports = {
   ...postSetup,
   ...moduleGenerator,
   ...fieldManager,
+  ...moduleConfigurator,
 };

package/src/moduleConfigurator.js

@@ -0,0 +1,339 @@
+/**
+ * Module Configurator for speedrun-cli
+ * Allows dynamic customization of Auth/Roles Guards and active CRUD endpoints on existing controllers.
+ * @module moduleConfigurator
+ */
+
+const inquirer = require('inquirer');
+const fs = require('fs-extra');
+const path = require('path');
+const chalk = require('chalk');
+const {
+  toKebabCase,
+  toPascalCase,
+  toSingularPascal,
+  detectModulePrimaryKey,
+} = require('./moduleGenerator');
+
+/**
+ * Detects whether JwtAuthGuard or AuthGuard is used in the project
+ */
+async function getGuardImportDetails(targetDir) {
+  const commonGuardsDir = path.join(targetDir, 'src', 'common', 'guards');
+  if (await fs.pathExists(path.join(commonGuardsDir, 'jwt-auth.guard.ts'))) {
+    return {
+      guardName: 'JwtAuthGuard',
+      guardImportPath: '../../common/guards/jwt-auth.guard',
+    };
+  }
+  if (await fs.pathExists(path.join(commonGuardsDir, 'auth.guard.ts'))) {
+    return {
+      guardName: 'AuthGuard',
+      guardImportPath: '../../common/guards/auth.guard',
+    };
+  }
+  return {
+    guardName: 'JwtAuthGuard',
+    guardImportPath: '../../common/guards/jwt-auth.guard',
+  };
+}
+
+/**
+ * Parses existing controller file to extract active CRUD operations and roles configuration
+ */
+function parseExistingController(controllerContent) {
+  const ops = {
+    create: /@Post\s*\(/m.test(controllerContent) && /override\s+async\s+create\s*\(/m.test(controllerContent),
+    findAll: /@Get\s*\(\s*\)/m.test(controllerContent) && /override\s+async\s+findAll\s*\(/m.test(controllerContent),
+    findOne: /@Get\s*\(\s*':/m.test(controllerContent) && /override\s+async\s+findOne\s*\(/m.test(controllerContent),
+    update: /@Put\s*\(/m.test(controllerContent) && /override\s+async\s+update\s*\(/m.test(controllerContent),
+    remove: /@Delete\s*\(/m.test(controllerContent) && /override\s+async\s+remove\s*\(/m.test(controllerContent),
+  };
+
+  const hasGuards = /@UseGuards\s*\(/m.test(controllerContent);
+
+  let roles = [];
+  const rolesMatch = controllerContent.match(/@Roles\s*\(\s*([^)]+)\s*\)/m) || controllerContent.match(/\/\/\s*Roles:\s*(.+)/m);
+  if (rolesMatch && rolesMatch[1]) {
+    roles = rolesMatch[1]
+      .split(',')
+      .map((r) => r.replace(/['"\s]/g, '').trim())
+      .filter(Boolean);
+  }
+
+  return { ops, hasGuards, roles };
+}
+
+/**
+ * Generates pristine controller TypeScript file content
+ */
+function renderControllerContent({
+  pascalName,
+  kebabName,
+  primaryKey = 'id',
+  createDtoName,
+  updateDtoName,
+  responseDtoName,
+  ops = { create: true, findAll: true, findOne: true, update: true, remove: true },
+  protectWriteOps = false,
+  roles = ['ADMIN'],
+  guardName = 'JwtAuthGuard',
+  guardImportPath = '../../common/guards/jwt-auth.guard',
+}) {
+  const formattedRoles = roles.map((r) => `'${r}'`).join(', ');
+  const guardDecorator = protectWriteOps && roles.length > 0
+    ? `\n  @UseGuards(${guardName}, RolesGuard)\n  @Roles(${formattedRoles})`
+    : protectWriteOps
+    ? `\n  @UseGuards(${guardName})`
+    : '';
+
+  const extraGuardsImports = protectWriteOps
+    ? `import { ${guardName} } from '${guardImportPath}';\nimport { RolesGuard } from '../../common/guards/roles.guard';\nimport { Roles } from '../../common/decorators/roles.decorator';\n`
+    : '';
+
+  const nestCommonImports = ['Controller'];
+  if (ops.findAll) nestCommonImports.push('Query');
+  if (ops.findOne || ops.update || ops.remove) nestCommonImports.push('Param', 'ParseUUIDPipe', 'HttpStatus');
+  if (ops.create) nestCommonImports.push('Post', 'Body');
+  if (ops.findAll || ops.findOne) nestCommonImports.push('Get');
+  if (ops.update) nestCommonImports.push('Put');
+  if (ops.remove) nestCommonImports.push('Delete');
+  nestCommonImports.push('Type');
+  if (protectWriteOps) nestCommonImports.push('UseGuards');
+
+  return `import { ${Array.from(new Set(nestCommonImports)).join(', ')} } from '@nestjs/common';
+import { ApiTags, ApiBearerAuth, ApiExtraModels, ApiOperation, ApiResponse, ApiParam } from '@nestjs/swagger';
+import { BaseController, ApiResponseDto, ApiResponseSchema, PaginatedResponseDto, PaginatedResponseSchema, PaginationQueryDto } from '../../common/base';
+${extraGuardsImports}import { ${pascalName}Service } from './${kebabName}.service';
+${ops.create || ops.update ? `import { ${createDtoName} } from './dto/create-${kebabName}.dto';\nimport { ${updateDtoName} } from './dto/update-${kebabName}.dto';` : `type ${createDtoName} = any;\ntype ${updateDtoName} = any;`}
+import { ${responseDtoName} } from './dto/${kebabName}.dto';
+
+type ${pascalName}Entity = any;
+
+@ApiTags('${pascalName}')
+@ApiBearerAuth('bearer')
+@ApiExtraModels(ApiResponseDto, PaginatedResponseDto, ${responseDtoName})
+@Controller('${kebabName}')
+export class ${pascalName}Controller extends BaseController<${pascalName}Entity, ${createDtoName}, ${updateDtoName}> {
+  constructor(protected readonly service: ${pascalName}Service) {
+    super(service);
+  }
+
+  protected getDtoClass(): Type<${pascalName}Entity> {
+    return ${responseDtoName} as unknown as Type<${pascalName}Entity>;
+  }
+${ops.create ? `
+  @Post()${guardDecorator}
+  @ApiOperation({ summary: 'Create a new ${kebabName}' })
+  @ApiResponse({ status: HttpStatus.CREATED, schema: ApiResponseSchema(${responseDtoName}) })
+  override async create(@Body() dto: ${createDtoName}): Promise<ApiResponseDto<${pascalName}Entity>> {
+    return super.create(dto);
+  }
+` : ''}${ops.findAll ? `
+  @Get()
+  @ApiOperation({ summary: 'Get all ${kebabName} (paginated)' })
+  @ApiResponse({ status: HttpStatus.OK, schema: PaginatedResponseSchema(${responseDtoName}) })
+  override async findAll(@Query() pagination: PaginationQueryDto): Promise<PaginatedResponseDto<${pascalName}Entity>> {
+    return super.findAll(pagination);
+  }
+` : ''}${ops.findOne ? `
+  @Get(':${primaryKey}')
+  @ApiOperation({ summary: 'Get ${kebabName} by ID' })
+  @ApiParam({ name: '${primaryKey}', format: 'uuid' })
+  @ApiResponse({ status: HttpStatus.OK, schema: ApiResponseSchema(${responseDtoName}) })
+  @ApiResponse({ status: HttpStatus.NOT_FOUND, description: '${pascalName} not found' })
+  override async findOne(@Param('${primaryKey}', new ParseUUIDPipe({ version: '4', errorHttpStatusCode: HttpStatus.BAD_REQUEST })) ${primaryKey}: string): Promise<ApiResponseDto<${pascalName}Entity>> {
+    return super.findOne(${primaryKey});
+  }
+` : ''}${ops.update ? `
+  @Put(':${primaryKey}')${guardDecorator}
+  @ApiOperation({ summary: 'Update ${kebabName} by ID' })
+  @ApiParam({ name: '${primaryKey}', format: 'uuid' })
+  @ApiResponse({ status: HttpStatus.OK, schema: ApiResponseSchema(${responseDtoName}) })
+  @ApiResponse({ status: HttpStatus.NOT_FOUND, description: '${pascalName} not found' })
+  override async update(
+    @Param('${primaryKey}', new ParseUUIDPipe({ version: '4', errorHttpStatusCode: HttpStatus.BAD_REQUEST })) ${primaryKey}: string,
+    @Body() dto: ${updateDtoName}
+  ): Promise<ApiResponseDto<${pascalName}Entity>> {
+    return super.update(${primaryKey}, dto);
+  }
+` : ''}${ops.remove ? `
+  @Delete(':${primaryKey}')${guardDecorator}
+  @ApiOperation({ summary: 'Delete ${kebabName} by ID' })
+  @ApiParam({ name: '${primaryKey}', format: 'uuid' })
+  @ApiResponse({ status: HttpStatus.OK, schema: ApiResponseSchema(${responseDtoName}) })
+  @ApiResponse({ status: HttpStatus.NOT_FOUND, description: '${pascalName} not found' })
+  override async remove(@Param('${primaryKey}', new ParseUUIDPipe({ version: '4', errorHttpStatusCode: HttpStatus.BAD_REQUEST })) ${primaryKey}: string): Promise<ApiResponseDto<${pascalName}Entity>> {
+    return super.remove(${primaryKey});
+  }
+` : ''}
+}
+`;
+}
+
+/**
+ * Main Interactive Module Configurator Entry Point
+ */
+async function configureModule(providedModuleName, targetDir = process.cwd()) {
+  try {
+    const { ensureBaseArchitecture } = require('./moduleGenerator');
+    await ensureBaseArchitecture(targetDir);
+
+    let moduleName = providedModuleName;
+
+    if (!moduleName) {
+      const nameAnswer = await inquirer.prompt([{
+        type: 'input',
+        name: 'moduleName',
+        message: 'Which module do you want to configure? (e.g., orders, products)',
+        validate: (input) => (input && input.trim() ? true : 'Module name is required'),
+      }]);
+      moduleName = nameAnswer.moduleName.trim();
+    }
+
+    const kebabName = toKebabCase(moduleName);
+    const pascalName = toPascalCase(moduleName);
+    const singularPascal = toSingularPascal(pascalName);
+
+    const srcDir = path.join(targetDir, 'src');
+    const moduleDir = (await fs.pathExists(srcDir))
+      ? path.join(srcDir, 'modules', kebabName)
+      : path.join(targetDir, 'modules', kebabName);
+    const controllerPath = path.join(moduleDir, `${kebabName}.controller.ts`);
+
+    if (!(await fs.pathExists(controllerPath))) {
+      console.error(chalk.red(`\n❌ Controller for module "${kebabName}" not found at ${controllerPath}`));
+      return false;
+    }
+
+    const controllerContent = await fs.readFile(controllerPath, 'utf8');
+    const { ops: currentOps, hasGuards, roles: currentRoles } = parseExistingController(controllerContent);
+    const primaryKey = await detectModulePrimaryKey(moduleDir, kebabName);
+    const { guardName, guardImportPath } = await getGuardImportDetails(targetDir);
+
+    const createDtoName = `Create${singularPascal}Dto`;
+    const updateDtoName = `Update${singularPascal}Dto`;
+    const responseDtoName = `${pascalName}Dto`;
+
+    console.log(chalk.cyan(`\n⚙️  Configuring module: ${chalk.bold(kebabName)}`));
+
+    const { configChoice } = await inquirer.prompt([{
+      type: 'list',
+      name: 'configChoice',
+      message: 'Select configuration action:',
+      choices: [
+        { name: '🔐 Manage Auth & Roles Guards (POST, PUT, DELETE protection)', value: 'guards' },
+        { name: '🛠️  Toggle Active CRUD Operations (Enable/Disable endpoints)', value: 'operations' },
+        { name: '❌ Cancel', value: 'cancel' },
+      ],
+    }]);
+
+    if (configChoice === 'cancel') {
+      console.log(chalk.gray('Cancelled configuration. No files modified.'));
+      return true;
+    }
+
+    let protectWriteOps = hasGuards;
+    let roles = currentRoles.length > 0 ? currentRoles : ['ADMIN'];
+    let updatedOps = { ...currentOps };
+
+    if (configChoice === 'guards') {
+      const guardAnswer = await inquirer.prompt([{
+        type: 'confirm',
+        name: 'protectWriteOps',
+        message: 'Protect write operations (POST, PUT, DELETE) with Auth/Roles Guard?',
+        default: hasGuards,
+      }]);
+
+      protectWriteOps = guardAnswer.protectWriteOps;
+
+      if (protectWriteOps) {
+        const roleAnswer = await inquirer.prompt([{
+          type: 'checkbox',
+          name: 'selectedRoles',
+          message: 'Select allowed roles for write operations:',
+          choices: [
+            { name: 'ADMIN', value: 'ADMIN', checked: roles.includes('ADMIN') || roles.length === 0 },
+            { name: 'USER', value: 'USER', checked: roles.includes('USER') },
+            { name: 'SUPERADMIN', value: 'SUPERADMIN', checked: roles.includes('SUPERADMIN') },
+            { name: 'MANAGER', value: 'MANAGER', checked: roles.includes('MANAGER') },
+            { name: 'Custom Role...', value: '__custom__' },
+          ],
+        }]);
+
+        let finalRoles = roleAnswer.selectedRoles.filter((r) => r !== '__custom__');
+
+        if (roleAnswer.selectedRoles.includes('__custom__')) {
+          const customRoleAnswer = await inquirer.prompt([{
+            type: 'input',
+            name: 'customRoles',
+            message: 'Enter custom role name(s) (comma-separated, e.g., AUDITOR, EDITOR):',
+            validate: (input) => (input && input.trim() ? true : 'Custom role is required'),
+          }]);
+
+          const parsedCustom = customRoleAnswer.customRoles
+            .split(',')
+            .map((r) => r.trim().toUpperCase())
+            .filter(Boolean);
+
+          finalRoles = Array.from(new Set([...finalRoles, ...parsedCustom]));
+        }
+
+        roles = finalRoles.length > 0 ? finalRoles : ['ADMIN'];
+      }
+    } else if (configChoice === 'operations') {
+      const opsAnswer = await inquirer.prompt([{
+        type: 'checkbox',
+        name: 'activeOps',
+        message: 'Select active CRUD operations:',
+        choices: [
+          { name: 'Create (POST)', value: 'create', checked: currentOps.create },
+          { name: 'Read All / findAll (GET)', value: 'findAll', checked: currentOps.findAll },
+          { name: 'Read One / findOne (GET /:id)', value: 'findOne', checked: currentOps.findOne },
+          { name: 'Update (PUT /:id)', value: 'update', checked: currentOps.update },
+          { name: 'Delete / remove (DELETE /:id)', value: 'remove', checked: currentOps.remove },
+        ],
+      }]);
+
+      updatedOps = {
+        create: opsAnswer.activeOps.includes('create'),
+        findAll: opsAnswer.activeOps.includes('findAll'),
+        findOne: opsAnswer.activeOps.includes('findOne'),
+        update: opsAnswer.activeOps.includes('update'),
+        remove: opsAnswer.activeOps.includes('remove'),
+      };
+    }
+
+    const updatedController = renderControllerContent({
+      pascalName,
+      kebabName,
+      primaryKey,
+      createDtoName,
+      updateDtoName,
+      responseDtoName,
+      ops: updatedOps,
+      protectWriteOps,
+      roles,
+      guardName,
+      guardImportPath,
+    });
+
+    await fs.writeFile(controllerPath, updatedController, 'utf8');
+    console.log(chalk.green(`\n✅ Successfully updated module configuration for "${kebabName}"!`));
+    console.log(chalk.gray(`   Controller: ${path.relative(process.cwd(), controllerPath)}`));
+    if (protectWriteOps) {
+      console.log(chalk.gray(`   Protected Write Ops: ${roles.join(', ')}`));
+    } else {
+      console.log(chalk.gray(`   Protected Write Ops: Disabled`));
+    }
+    const activeOpsList = Object.keys(updatedOps).filter((op) => updatedOps[op]);
+    console.log(chalk.gray(`   Active Operations: ${activeOpsList.join(', ')}`));
+
+    return true;
+  } catch (error) {
+    console.error(chalk.red('\n❌ Module configuration failed:'), error.message);
+    return false;
+  }
+}
+
+module.exports = { configureModule, renderControllerContent };

package/src/moduleGenerator.js

@@ -80,11 +80,13 @@ async function detectOrm(targetDir) {
 }
 
 /**
- * Ensures src/common/base exists with required abstract classes & DTOs
+ * Ensures src/common/base, src/common/guards, and src/common/decorators exist with required abstract classes, DTOs, guards & decorators
  */
 async function ensureBaseArchitecture(targetDir) {
   try {
     const commonBaseDir = path.join(targetDir, 'src', 'common', 'base');
+    const commonGuardsDir = path.join(targetDir, 'src', 'common', 'guards');
+    const commonDecoratorsDir = path.join(targetDir, 'src', 'common', 'decorators');
 
     if (!(await fs.pathExists(commonBaseDir))) {
       const templateBaseDir = path.join(__dirname, '..', 'templates', 'base-crud', 'src', 'common', 'base');
@@ -93,6 +95,54 @@ async function ensureBaseArchitecture(targetDir) {
         console.log(chalk.green('   ✓ Scaffolded Base CRUD architecture at src/common/base'));
       }
     }
+
+    // Scaffold Guards if missing
+    await fs.ensureDir(commonGuardsDir);
+    const jwtGuardPath = path.join(commonGuardsDir, 'jwt-auth.guard.ts');
+    const authGuardPath = path.join(commonGuardsDir, 'auth.guard.ts');
+    const rolesGuardPath = path.join(commonGuardsDir, 'roles.guard.ts');
+
+    if (!(await fs.pathExists(jwtGuardPath)) && !(await fs.pathExists(authGuardPath))) {
+      const jwtGuardContent = `import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';
+
+@Injectable()
+export class JwtAuthGuard implements CanActivate {
+  canActivate(context: ExecutionContext): boolean {
+    return true;
+  }
+}
+`;
+      await fs.writeFile(jwtGuardPath, jwtGuardContent, 'utf8');
+      console.log(chalk.green('   ✓ Scaffolded JwtAuthGuard at src/common/guards/jwt-auth.guard.ts'));
+    }
+
+    if (!(await fs.pathExists(rolesGuardPath))) {
+      const rolesGuardContent = `import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';
+
+@Injectable()
+export class RolesGuard implements CanActivate {
+  canActivate(context: ExecutionContext): boolean {
+    return true;
+  }
+}
+`;
+      await fs.writeFile(rolesGuardPath, rolesGuardContent, 'utf8');
+      console.log(chalk.green('   ✓ Scaffolded RolesGuard at src/common/guards/roles.guard.ts'));
+    }
+
+    // Scaffold Decorators if missing
+    await fs.ensureDir(commonDecoratorsDir);
+    const rolesDecoratorPath = path.join(commonDecoratorsDir, 'roles.decorator.ts');
+
+    if (!(await fs.pathExists(rolesDecoratorPath))) {
+      const rolesDecoratorContent = `import { SetMetadata } from '@nestjs/common';
+
+export const ROLES_KEY = 'roles';
+export const Roles = (...roles: string[]) => SetMetadata(ROLES_KEY, roles);
+`;
+      await fs.writeFile(rolesDecoratorPath, rolesDecoratorContent, 'utf8');
+      console.log(chalk.green('   ✓ Scaffolded Roles decorator at src/common/decorators/roles.decorator.ts'));
+    }
   } catch (error) {
     console.warn(chalk.yellow(`   ⚠️ Could not scaffold Base CRUD architecture: ${error.message}`));
   }
@@ -1320,79 +1370,18 @@ ${statusDtoField}  @ApiProperty({ example: '2025-01-01T00:00:00.000Z' })
     await fs.writeFile(path.join(moduleDir, `${kebabName}.service.ts`), serviceContent);
 
     // 4. Generate Controller
-    const guardImports = options.protectWriteOps ? `, UseGuards` : '';
-    const guardDecorator = options.protectWriteOps && options.roles?.length > 0
-      ? `\n  @UseGuards()\n  // Roles: ${options.roles.join(', ')}`
-      : '';
-
-    const controllerContent = `import { Controller${ops.findAll ? ', Query' : ''}${ops.findOne || ops.update || ops.remove ? ', Param, ParseUUIDPipe, HttpStatus' : ''}${ops.create ? ', Post, Body' : ''}${ops.findAll || ops.findOne ? ', Get' : ''}${ops.update ? ', Put' : ''}${ops.remove ? ', Delete' : ''}, Type${guardImports} } from '@nestjs/common';
-import { ApiTags, ApiBearerAuth, ApiExtraModels, ApiOperation, ApiResponse, ApiParam } from '@nestjs/swagger';
-import { BaseController, ApiResponseDto, ApiResponseSchema, PaginatedResponseDto, PaginatedResponseSchema, PaginationQueryDto } from '../../common/base';
-import { ${pascalName}Service } from './${kebabName}.service';
-${ops.create || ops.update ? `import { ${createDtoName} } from './dto/create-${kebabName}.dto';\nimport { ${updateDtoName} } from './dto/update-${kebabName}.dto';` : `type ${createDtoName} = any;\ntype ${updateDtoName} = any;`}
-import { ${responseDtoName} } from './dto/${kebabName}.dto';
-
-type ${pascalName}Entity = any;
-
-@ApiTags('${pascalName}')
-@ApiBearerAuth('bearer')
-@ApiExtraModels(ApiResponseDto, PaginatedResponseDto, ${responseDtoName})
-@Controller('${kebabName}')
-export class ${pascalName}Controller extends BaseController<${pascalName}Entity, ${createDtoName}, ${updateDtoName}> {
-  constructor(protected readonly service: ${pascalName}Service) {
-    super(service);
-  }
-
-  protected getDtoClass(): Type<${pascalName}Entity> {
-    return ${responseDtoName} as unknown as Type<${pascalName}Entity>;
-  }
-${ops.create ? `
-  @Post()${guardDecorator}
-  @ApiOperation({ summary: 'Create a new ${kebabName}' })
-  @ApiResponse({ status: HttpStatus.CREATED, schema: ApiResponseSchema(${responseDtoName}) })
-  override async create(@Body() dto: ${createDtoName}): Promise<ApiResponseDto<${pascalName}Entity>> {
-    return super.create(dto);
-  }
-` : ''}${ops.findAll ? `
-  @Get()
-  @ApiOperation({ summary: 'Get all ${kebabName} (paginated)' })
-  @ApiResponse({ status: HttpStatus.OK, schema: PaginatedResponseSchema(${responseDtoName}) })
-  override async findAll(@Query() pagination: PaginationQueryDto): Promise<PaginatedResponseDto<${pascalName}Entity>> {
-    return super.findAll(pagination);
-  }
-` : ''}${ops.findOne ? `
-  @Get(':${primaryKey}')
-  @ApiOperation({ summary: 'Get ${kebabName} by ID' })
-  @ApiParam({ name: '${primaryKey}', format: 'uuid' })
-  @ApiResponse({ status: HttpStatus.OK, schema: ApiResponseSchema(${responseDtoName}) })
-  @ApiResponse({ status: HttpStatus.NOT_FOUND, description: '${pascalName} not found' })
-  override async findOne(@Param('${primaryKey}', new ParseUUIDPipe({ version: '4', errorHttpStatusCode: HttpStatus.BAD_REQUEST })) ${primaryKey}: string): Promise<ApiResponseDto<${pascalName}Entity>> {
-    return super.findOne(${primaryKey});
-  }
-` : ''}${ops.update ? `
-  @Put(':${primaryKey}')${guardDecorator}
-  @ApiOperation({ summary: 'Update ${kebabName} by ID' })
-  @ApiParam({ name: '${primaryKey}', format: 'uuid' })
-  @ApiResponse({ status: HttpStatus.OK, schema: ApiResponseSchema(${responseDtoName}) })
-  @ApiResponse({ status: HttpStatus.NOT_FOUND, description: '${pascalName} not found' })
-  override async update(
-    @Param('${primaryKey}', new ParseUUIDPipe({ version: '4', errorHttpStatusCode: HttpStatus.BAD_REQUEST })) ${primaryKey}: string,
-    @Body() dto: ${updateDtoName}
-  ): Promise<ApiResponseDto<${pascalName}Entity>> {
-    return super.update(${primaryKey}, dto);
-  }
-` : ''}${ops.remove ? `
-  @Delete(':${primaryKey}')${guardDecorator}
-  @ApiOperation({ summary: 'Delete ${kebabName} by ID' })
-  @ApiParam({ name: '${primaryKey}', format: 'uuid' })
-  @ApiResponse({ status: HttpStatus.OK, schema: ApiResponseSchema(${responseDtoName}) })
-  @ApiResponse({ status: HttpStatus.NOT_FOUND, description: '${pascalName} not found' })
-  override async remove(@Param('${primaryKey}', new ParseUUIDPipe({ version: '4', errorHttpStatusCode: HttpStatus.BAD_REQUEST })) ${primaryKey}: string): Promise<ApiResponseDto<${pascalName}Entity>> {
-    return super.remove(${primaryKey});
-  }
-` : ''}
-}
-`;
+    const { renderControllerContent } = require('./moduleConfigurator');
+    const controllerContent = renderControllerContent({
+      pascalName,
+      kebabName,
+      primaryKey,
+      createDtoName,
+      updateDtoName,
+      responseDtoName,
+      ops,
+      protectWriteOps: options.protectWriteOps,
+      roles: options.roles || ['ADMIN'],
+    });
     await fs.writeFile(path.join(moduleDir, `${kebabName}.controller.ts`), controllerContent);
 
     // 5. Generate Module

package/templates/base-crud/src/common/base/index.ts

@@ -18,3 +18,4 @@ export {
   PaginatedResponseDto,
   PaginatedResponseSchema,
 } from './swagger/paginated.dto';
+