zibri 2.2.1 → 2.4.0

package/README.md

@@ -9,7 +9,7 @@
 
 Zibri is an opiniated typescript backend framework based on express. It's heavily inspired by frameworks like [LoopBack](https://loopback.io/doc/en/lb4/index.html) and [Nest](https://docs.nestjs.com/).
 
-What differentiates it from such frameworks can be found in our [goals section](#goals).
+What differentiates it from such frameworks can be found in our [goals section](#-goals).
 
 # 📑 Documentation
 The official documentation of Zibri can be found under [https://service-soft.github.io/zibri](https://service-soft.github.io/zibri)
@@ -54,7 +54,7 @@ With Zibri you can rely on a strong foundation of battle tested libraries that h
 - express as the server
 - typeorm for handling everything database related
 - nodemailer for sending emails
-- handlebars for templating
+- handlebars and preact for templating
 - busboy for file uploads (the foundation of multer)
 - socket.io for websockets
 - node-cron for cron jobs

package/dist/cjs/application-options.model.d.ts

@@ -3,10 +3,43 @@ import { AuthStrategies } from './auth/strategies/auth-strategies.model';
 import { CronJob } from './cron/cron-job.model';
 import { DataSourceInterface } from './data-source/data-sources/data-source.interface';
 import { DiProvider } from './di/models/di-provider.model';
+import { KnownHeader } from './http/known-header.enum';
 import { BodyParserInterface } from './parsing/body-parser.interface';
 import { ZibriPlugin } from './plugin/plugin.model';
+import { DeepPartial } from './types/deep-partial.type';
 import { Newable } from './types/newable.type';
 import { Version } from './types/version.type';
+/**
+ * Configuration options for strict transport security / hsts.
+ */
+export type HstsOptions = {
+    /**
+     * The maximum age for which strict transport should be enabled. Defaults to 2 years.
+     */
+    maxAgeSeconds: number;
+    /**
+     * Whether or not subdomains should be included. Defaults to true.
+     */
+    includeSubDomains: boolean;
+    /**
+     * Whether or not this url should be put on a preload list. Defaults to false.
+     */
+    preload: boolean;
+};
+/**
+ * The global security options for a Zibri application.
+ */
+export type ZibriApplicationSecurityOptions = {
+    /**
+     * Some headers to set.
+     */
+    headers: {
+        /**
+         * Configuration for the strict transport security / hsts header.
+         */
+        [KnownHeader.STRICT_TRANSPORT_SECURITY]: boolean | HstsOptions;
+    };
+};
 /**
  * All options for a Zibri application.
  */
@@ -34,6 +67,10 @@ export type ZibriApplicationOptions = {
      * The websocket controllers to register in the app.
      */
     websocketControllers: Newable<unknown>[];
+    /**
+     * Globals security settings, like eg. Hsts.
+     */
+    security?: DeepPartial<ZibriApplicationSecurityOptions>;
     /**
      * The data sources to register in the app.
      */

package/dist/cjs/application-options.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"application-options.model.d.ts","sourceRoot":"","sources":["../../src/application-options.model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kDAAkD,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAE/C;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG;IAClC;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;OAEG;IACH,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IAChC;;OAEG;IACH,oBAAoB,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IACzC;;OAEG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;IAC7C;;OAEG;IACH,SAAS,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;IAClC;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;IAC7C;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC;;OAEG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9B;;OAEG;IACH,OAAO,CAAC,EAAE,WAAW,EAAE,CAAA;CAC1B,CAAC"}
+{"version":3,"file":"application-options.model.d.ts","sourceRoot":"","sources":["../../src/application-options.model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,MAAM,kDAAkD,CAAC;AACvF,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAE/C;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG;IACtB;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB;;OAEG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;OAEG;IACH,OAAO,EAAE,OAAO,CAAA;CACnB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,+BAA+B,GAAG;IAC1C;;OAEG;IACH,OAAO,EAAE;QACL;;WAEG;QACH,CAAC,WAAW,CAAC,yBAAyB,CAAC,EAAE,OAAO,GAAG,WAAW,CAAA;KACjE,CAAA;CACJ,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG;IAClC;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;OAEG;IACH,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IAChC;;OAEG;IACH,oBAAoB,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IACzC;;OAEG;IACH,QAAQ,CAAC,EAAE,WAAW,CAAC,+BAA+B,CAAC,CAAC;IACxD;;OAEG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;IAC7C;;OAEG;IACH,SAAS,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;IAClC;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;IAC7C;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC;;OAEG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9B;;OAEG;IACH,OAAO,CAAC,EAAE,WAAW,EAAE,CAAA;CAC1B,CAAC"}

package/dist/cjs/application-options.model.js

@@ -1,3 +1,4 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+const known_header_enum_1 = require("./http/known-header.enum");
 //# sourceMappingURL=application-options.model.js.map

package/dist/cjs/application-options.model.js.map

@@ -1 +1 @@
-{"version":3,"file":"application-options.model.js","sourceRoot":"","sources":["../../src/application-options.model.ts"],"names":[],"mappings":""}
+{"version":3,"file":"application-options.model.js","sourceRoot":"","sources":["../../src/application-options.model.ts"],"names":[],"mappings":";;AAKA,gEAAuD"}

package/dist/cjs/application.d.ts

@@ -1,11 +1,17 @@
 import { Server } from 'node:http';
 import { RequestHandler } from 'express';
-import { ZibriApplicationOptions } from './application-options.model';
+import { ZibriApplicationOptions, ZibriApplicationSecurityOptions } from './application-options.model';
 import { GlobalErrorHandler } from './error-handling/error-handler.model';
 import { Route } from './routing/controller-route-configuration.model';
-import { RouterInterface } from './routing/router.interface';
 import { OmitStrict } from './types/omit-strict.type';
-type FullZibriApplicationOptions = Required<OmitStrict<ZibriApplicationOptions, 'plugins'>>;
+type FullZibriApplicationOptions = Required<OmitStrict<ZibriApplicationOptions, 'plugins' | 'security'>> & {
+    security: ZibriApplicationSecurityOptions;
+};
+declare const SHUTDOWN_SIGNALS: readonly ["SIGTERM", "SIGINT", "SIGHUP"];
+/**
+ * A os signal that triggers the shutdown of a Zibri application.
+ */
+export type ShutdownSignal = typeof SHUTDOWN_SIGNALS[number];
 /**
  * A Zibri application.
  */
@@ -15,29 +21,12 @@ export declare class ZibriApplication {
      * The internal express app.
      */
     private readonly express;
+    private readonly signalHandlers;
     /**
      * The underlying http server.
      */
     readonly server: Server;
-    private _router;
-    /**
-     * The router used by the application.
-     */
-    get router(): RouterInterface;
-    private logger;
-    private metricsService;
-    private assetService;
-    private openApiService;
-    private parser;
-    private dataSourceService;
-    private authService;
-    private twoFactorService;
-    private cronService;
-    private multithreadingService;
-    private websocketService;
-    private emailService;
-    private backupService;
-    private mailingListService?;
+    private get logger();
     /**
      * The options of which the application was build.
      */
@@ -51,15 +40,30 @@ export declare class ZibriApplication {
     /**
      * Initializes the app.
      * @param H - The global handlebars instance, needed to provide some helpers used in templating.
+     * @param handlebarComponentsDir - Directory where handlebars components reside. Defaults to assetService.assetsPath/templates/components.
      */
-    init(H: typeof Handlebars): Promise<void>;
+    init(H: typeof Handlebars, handlebarComponentsDir?: string): Promise<void>;
     /**
      * Starts on the given port.
      * @param port - The port to start on.
      * @throws When the app has already been started.
      */
     start(port: number): Promise<void>;
+    /**
+     * Gracefully shuts down the application.
+     * @param signal - The signal that shuts down the application. Can be left empty if manually called.
+     */
+    shutdown(signal?: ShutdownSignal): Promise<void>;
+    private beforeAppInit;
+    private onAppInit;
+    private afterAppInit;
+    private afterAppShutdown;
+    private onAppShutdown;
+    private beforeAppShutdown;
+    private shutdownHttpServer;
+    private validateInjectables;
     private createFullOptions;
+    private logDefaults;
 }
 export {};
 //# sourceMappingURL=application.d.ts.map

package/dist/cjs/application.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"application.d.ts","sourceRoot":"","sources":["../../src/application.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,MAAM,EAAE,MAAM,WAAW,CAAC;AAGjD,OAAgB,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAElD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AActE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAW1E,OAAO,EAAE,KAAK,EAAE,MAAM,gDAAgD,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAKtD,KAAK,2BAA2B,GAAG,QAAQ,CAAC,UAAU,CAAC,uBAAuB,EAAE,SAAS,CAAC,CAAC,CAAC;AAE5F;;GAEG;AACH,qBAAa,gBAAgB;IAwCb,OAAO,CAAC,QAAQ,CAAC,eAAe;IAvC5C;;OAEG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO,CAEP;IAEjB;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAA8B;IAErD,OAAO,CAAC,OAAO,CAAmB;IAElC;;OAEG;IACH,IAAI,MAAM,IAAI,eAAe,CAE5B;IACD,OAAO,CAAC,MAAM,CAAmB;IACjC,OAAO,CAAC,cAAc,CAA2B;IACjD,OAAO,CAAC,YAAY,CAAyB;IAC7C,OAAO,CAAC,cAAc,CAA2B;IACjD,OAAO,CAAC,MAAM,CAAmB;IACjC,OAAO,CAAC,iBAAiB,CAA8B;IACvD,OAAO,CAAC,WAAW,CAAwB;IAC3C,OAAO,CAAC,gBAAgB,CAA6B;IACrD,OAAO,CAAC,WAAW,CAAwB;IAC3C,OAAO,CAAC,qBAAqB,CAAkC;IAC/D,OAAO,CAAC,gBAAgB,CAAsD;IAC9E,OAAO,CAAC,YAAY,CAAyB;IAC7C,OAAO,CAAC,aAAa,CAA0B;IAC/C,OAAO,CAAC,kBAAkB,CAAC,CAA8B;IACzD;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,2BAA2B,CAAC;gBAEjB,eAAe,EAAE,uBAAuB;IAMrE,GAAG,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI;IAElC,GAAG,CAAC,YAAY,EAAE,kBAAkB,GAAG,IAAI;IAE3C,GAAG,CAAC,GAAG,QAAQ,EAAE,cAAc,EAAE,GAAG,IAAI;IAExC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,EAAE,cAAc,EAAE,GAAG,IAAI;IAErD,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,IAAI;IAOlD;;;OAGG;IACG,IAAI,CAAC,CAAC,EAAE,OAAO,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAuF/C;;;;OAIG;IACG,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAexC,OAAO,CAAC,iBAAiB;CA+B5B"}
+{"version":3,"file":"application.d.ts","sourceRoot":"","sources":["../../src/application.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,MAAM,EAAE,MAAM,WAAW,CAAC;AAKjD,OAAgB,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAElD,OAAO,EAAe,uBAAuB,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAYpH,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAiB1E,OAAO,EAAE,KAAK,EAAE,MAAM,gDAAgD,CAAC;AAEvE,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAOtD,KAAK,2BAA2B,GAAG,QAAQ,CAAC,UAAU,CAAC,uBAAuB,EAAE,SAAS,GAAG,UAAU,CAAC,CAAC,GAAG;IAEvG,QAAQ,EAAE,+BAA+B,CAAA;CAC5C,CAAC;AAGF,QAAA,MAAM,gBAAgB,0CAA2C,CAAC;AAWlE;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;AAE7D;;GAEG;AACH,qBAAa,gBAAgB;IAwBb,OAAO,CAAC,QAAQ,CAAC,eAAe;IAvB5C;;OAEG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO,CAEP;IAEjB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA0E;IAEzG;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAA8B;IAErD,OAAO,KAAK,MAAM,GAEjB;IAED;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,2BAA2B,CAAC;gBAEjB,eAAe,EAAE,uBAAuB;IAoCrE,GAAG,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI;IAElC,GAAG,CAAC,YAAY,EAAE,kBAAkB,GAAG,IAAI;IAE3C,GAAG,CAAC,GAAG,QAAQ,EAAE,cAAc,EAAE,GAAG,IAAI;IAExC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,EAAE,cAAc,EAAE,GAAG,IAAI;IAErD,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,IAAI;IAOlD;;;;OAIG;IACG,IAAI,CACN,CAAC,EAAE,OAAO,UAAU,EACpB,sBAAsB,GAAE,MAAyG,GAClI,OAAO,CAAC,IAAI,CAAC;IAwChB;;;;OAIG;IACG,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BxC;;;OAGG;IACG,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;YAmCxC,aAAa;YAmBb,SAAS;YAMT,YAAY;YAMZ,gBAAgB;YAkBhB,aAAa;YAkBb,iBAAiB;YAkBjB,kBAAkB;IAiBhC,OAAO,CAAC,mBAAmB;IAmC3B,OAAO,CAAC,iBAAiB;YA6CX,WAAW;CAoB5B"}

package/dist/cjs/application.js

@@ -5,18 +5,47 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ZibriApplication = void 0;
 const node_http_1 = require("node:http");
+const cookie_parser_1 = __importDefault(require("cookie-parser"));
 const cors_1 = __importDefault(require("cors"));
 const express_1 = __importDefault(require("express"));
 const otp_two_factor_method_1 = require("./auth/2fa/methods/otp/otp.two-factor-method");
+const two_factor_method_interface_1 = require("./auth/2fa/methods/two-factor-method.interface");
+const auth_strategy_interface_1 = require("./auth/strategies/auth-strategy.interface");
 const jwt_auth_strategy_1 = require("./auth/strategies/jwt/jwt.auth-strategy");
+const cron_job_model_1 = require("./cron/cron-job.model");
+const data_source_interface_1 = require("./data-source/data-sources/data-source.interface");
 const zibri_di_tokens_default_1 = require("./di/default/zibri-di-tokens.default");
+const get_all_registered_tokens_function_1 = require("./di/get-all-registered-tokens.function");
 const inject_function_1 = require("./di/inject.function");
 const register_function_1 = require("./di/register.function");
 const unmatched_route_error_1 = require("./error-handling/errors/unmatched-route.error");
+const after_app_init_interface_1 = require("./global/after-app-init.interface");
+const after_app_shutdown_interface_1 = require("./global/after-app-shutdown.interface");
+const app_state_enum_1 = require("./global/app-state.enum");
+const before_app_init_interface_1 = require("./global/before-app-init.interface");
+const before_app_shutdown_interface_1 = require("./global/before-app-shutdown.interface");
 const global_registry_1 = require("./global/global-registry");
+const on_app_init_interface_1 = require("./global/on-app-init.interface");
+const on_app_shutdown_interface_1 = require("./global/on-app-shutdown.interface");
+const on_app_start_interface_1 = require("./global/on-app-start.interface");
 const handlebar_utilities_1 = require("./handlebars/handlebar.utilities");
+const known_header_enum_1 = require("./http/known-header.enum");
 const form_data_body_parser_1 = require("./parsing/form-data/form-data.body-parser");
 const json_body_parser_1 = require("./parsing/json/json.body-parser");
+const plugin_model_1 = require("./plugin/plugin.model");
+const fs_utilities_1 = require("./utilities/fs.utilities");
+const ms_1 = require("./utilities/ms");
+const number_utilities_1 = require("./utilities/number.utilities");
+const promise_utilities_1 = require("./utilities/promise.utilities");
+// eslint-disable-next-line typescript/typedef
+const SHUTDOWN_SIGNALS = ['SIGTERM', 'SIGINT', 'SIGHUP'];
+const DEFAULT_SHUTDOWN_TIMEOUT_IN_MS = ms_1.Ms.SECOND * 30;
+const defaultHstsOptions = {
+    maxAgeSeconds: number_utilities_1.NumberUtilities.multiply(ms_1.Ms.YEAR, 2).dividedBy(1000)
+        .toNumber(),
+    includeSubDomains: true,
+    preload: false
+};
 /**
  * A Zibri application.
  */
@@ -28,32 +57,14 @@ class ZibriApplication {
     express = (0, express_1.default)()
         .disable('x-powered-by')
         .use((0, cors_1.default)());
+    signalHandlers = new Map();
     /**
      * The underlying http server.
      */
     server = (0, node_http_1.createServer)(this.express);
-    _router;
-    // eslint-disable-next-line jsdoc/require-returns
-    /**
-     * The router used by the application.
-     */
-    get router() {
-        return this._router;
-    }
-    logger;
-    metricsService;
-    assetService;
-    openApiService;
-    parser;
-    dataSourceService;
-    authService;
-    twoFactorService;
-    cronService;
-    multithreadingService;
-    websocketService;
-    emailService;
-    backupService;
-    mailingListService;
+    get logger() {
+        return (0, inject_function_1.inject)(zibri_di_tokens_default_1.ZIBRI_DI_TOKENS.LOGGER);
+    }
     /**
      * The options of which the application was build.
      */
@@ -61,6 +72,28 @@ class ZibriApplication {
     constructor(providedOptions) {
         this.providedOptions = providedOptions;
         this.options = this.createFullOptions();
+        this.use((req, res, next) => {
+            res.setHeader(known_header_enum_1.KnownHeader.X_CONTENT_TYPE_OPTIONS, 'nosniff');
+            res.setHeader(known_header_enum_1.KnownHeader.REFERRER_POLICY, 'strict-origin-when-cross-origin');
+            const hsts = this.options.security.headers[known_header_enum_1.KnownHeader.STRICT_TRANSPORT_SECURITY];
+            const isSecure = req.secure || req.headers[known_header_enum_1.KnownHeader.X_FORWARDED_PROTO] === 'https';
+            if (isSecure && hsts !== false) {
+                const options = hsts === true
+                    ? defaultHstsOptions
+                    : hsts;
+                res.setHeader(known_header_enum_1.KnownHeader.STRICT_TRANSPORT_SECURITY, [
+                    `max-age=${options.maxAgeSeconds}`,
+                    ...options.includeSubDomains ? ['includeSubDomains'] : [],
+                    ...options.preload ? ['preload'] : []
+                ].join('; '));
+            }
+            next();
+        });
+        for (const signal of SHUTDOWN_SIGNALS) {
+            const handler = () => void this.shutdown(signal);
+            this.signalHandlers.set(signal, handler);
+            process.on(signal, handler);
+        }
         global_registry_1.GlobalRegistry.markAppAsCreated();
     }
     // eslint-disable-next-line jsdoc/require-jsdoc, typescript/no-explicit-any
@@ -71,67 +104,31 @@ class ZibriApplication {
     /**
      * Initializes the app.
      * @param H - The global handlebars instance, needed to provide some helpers used in templating.
+     * @param handlebarComponentsDir - Directory where handlebars components reside. Defaults to assetService.assetsPath/templates/components.
      */
-    async init(H) {
-        await handlebar_utilities_1.HandlebarUtilities.init(H);
+    async init(H, handlebarComponentsDir = fs_utilities_1.FsUtilities.getPath((0, inject_function_1.inject)(zibri_di_tokens_default_1.ZIBRI_DI_TOKENS.ASSET_SERVICE).assetsPath, 'templates', 'components')) {
+        await handlebar_utilities_1.HandlebarUtilities.init(H, handlebarComponentsDir);
         global_registry_1.GlobalRegistry.setAppData(this.options);
         for (const provider of this.options.providers) {
             (0, register_function_1.register)(provider);
         }
-        this.logger = (0, inject_function_1.inject)(zibri_di_tokens_default_1.ZIBRI_DI_TOKENS.LOGGER);
-        await this.logger.attachTo(this);
-        this.metricsService = (0, inject_function_1.inject)(zibri_di_tokens_default_1.ZIBRI_DI_TOKENS.METRICS_SERVICE);
-        await this.metricsService.attachTo(this);
-        if (!this.providedOptions.authStrategies) {
-            await this.logger.info('No auth strategies provided, defaults to:');
-            for (const strategy of this.options.authStrategies) {
-                await this.logger.info(`  - ${strategy.name}`);
-            }
-        }
-        if (!this.providedOptions.twoFactorMethods) {
-            await this.logger.info('No two factor methods provided, defaults to:');
-            for (const strategy of this.options.twoFactorMethods) {
-                await this.logger.info(`  - ${strategy.name}`);
-            }
-        }
-        if (!this.providedOptions.bodyParsers) {
-            await this.logger.info('No body parsers provided, defaults to:');
-            for (const bodyParser of this.options.bodyParsers) {
-                await this.logger.info(`  - ${bodyParser.name}`);
-            }
+        await this.logDefaults();
+        const tokens = (0, get_all_registered_tokens_function_1.getAllRegisteredTokens)();
+        await this.beforeAppInit(tokens);
+        const injectables = tokens.map(t => (0, inject_function_1.inject)(t));
+        this.validateInjectables(injectables);
+        await this.onAppInit(injectables);
+        const secret = (0, inject_function_1.inject)(zibri_di_tokens_default_1.ZIBRI_DI_TOKENS.COOKIE_SIGN_SECRET);
+        if (secret) {
+            this.use((0, cookie_parser_1.default)(secret));
         }
-        this.dataSourceService = (0, inject_function_1.inject)(zibri_di_tokens_default_1.ZIBRI_DI_TOKENS.DATA_SOURCE_SERVICE);
-        await this.dataSourceService.init();
-        this.twoFactorService = (0, inject_function_1.inject)(zibri_di_tokens_default_1.ZIBRI_DI_TOKENS.TWO_FACTOR_SERVICE);
-        await this.twoFactorService.init(this.options.twoFactorMethods);
-        this.authService = (0, inject_function_1.inject)(zibri_di_tokens_default_1.ZIBRI_DI_TOKENS.AUTH_SERVICE);
-        await this.authService.init(this.options.authStrategies);
-        this.parser = (0, inject_function_1.inject)(zibri_di_tokens_default_1.ZIBRI_DI_TOKENS.PARSER);
-        await this.parser.attachTo(this);
-        this._router = (0, inject_function_1.inject)(zibri_di_tokens_default_1.ZIBRI_DI_TOKENS.ROUTER);
-        await this._router.init(this);
-        this.assetService = (0, inject_function_1.inject)(zibri_di_tokens_default_1.ZIBRI_DI_TOKENS.ASSET_SERVICE);
-        await this.assetService.attachTo(this);
-        this.emailService = (0, inject_function_1.inject)(zibri_di_tokens_default_1.ZIBRI_DI_TOKENS.EMAIL_SERVICE);
-        this.emailService.attachTo(this);
-        this.mailingListService = (0, inject_function_1.inject)(zibri_di_tokens_default_1.ZIBRI_DI_TOKENS.MAILING_LIST_SERVICE);
-        this.mailingListService?.attachTo(this);
-        this.openApiService = (0, inject_function_1.inject)(zibri_di_tokens_default_1.ZIBRI_DI_TOKENS.OPEN_API_SERVICE);
-        await this.openApiService.attachTo(this);
+        await this.afterAppInit(injectables);
         for (const controller of this.options.controllers) {
             (0, inject_function_1.inject)(controller);
         }
         for (const websocketController of this.options.websocketControllers) {
             (0, inject_function_1.inject)(websocketController);
         }
-        this.cronService = (0, inject_function_1.inject)(zibri_di_tokens_default_1.ZIBRI_DI_TOKENS.CRON_SERVICE);
-        await this.cronService.init(this.options.cronJobs);
-        this.multithreadingService = (0, inject_function_1.inject)(zibri_di_tokens_default_1.ZIBRI_DI_TOKENS.MULTITHREADING_SERVICE);
-        await this.multithreadingService.init();
-        this.websocketService = (0, inject_function_1.inject)(zibri_di_tokens_default_1.ZIBRI_DI_TOKENS.WEBSOCKET_SERVICE);
-        await this.websocketService.attachTo(this);
-        this.backupService = (0, inject_function_1.inject)(zibri_di_tokens_default_1.ZIBRI_DI_TOKENS.BACKUP_SERVICE);
-        await this.backupService.init();
         for (const plugin of this.providedOptions.plugins ?? []) {
             await plugin.validate(this);
         }
@@ -143,20 +140,189 @@ class ZibriApplication {
      * @throws When the app has already been started.
      */
     async start(port) {
-        if (global_registry_1.GlobalRegistry.isAppRunning()) {
+        if (global_registry_1.GlobalRegistry.isAppStarted()) {
             // We need this check in addition to the one in the registry.
-            // Because we would otherwise have a wrong state when we call markAppAsRunning
+            // Because we would otherwise have a wrong state when we call markAppAsStarted
             // and then this.app.listen fails.
             throw new Error('The application has already been started');
         }
-        await this.router.attachTo(this);
+        const injectables = (0, get_all_registered_tokens_function_1.getAllRegisteredTokens)().map(t => (0, inject_function_1.inject)(t));
+        for (const element of injectables.filter(i => (0, on_app_start_interface_1.implementsOnAppStart)(i))) {
+            await element.onAppStart(this);
+        }
         this.use((req, _, next) => next(new unmatched_route_error_1.UnmatchedRouteError(req.originalUrl)));
         this.use((0, inject_function_1.inject)(zibri_di_tokens_default_1.ZIBRI_DI_TOKENS.GLOBAL_ERROR_HANDLER));
         this.server.listen(port);
-        global_registry_1.GlobalRegistry.markAppAsRunning();
+        if (port === 0) {
+            const address = this.server.address();
+            if (address != undefined && typeof address !== 'string') {
+                port = address.port;
+            }
+        }
+        global_registry_1.GlobalRegistry.markAppAsStarted();
         await this.logger.info(`${this.options.name} is running on port ${port}`);
     }
+    /**
+     * Gracefully shuts down the application.
+     * @param signal - The signal that shuts down the application. Can be left empty if manually called.
+     */
+    async shutdown(signal) {
+        switch (global_registry_1.GlobalRegistry.getAppData('state')) {
+            case app_state_enum_1.AppState.OFFLINE:
+            case app_state_enum_1.AppState.SHUTTING_DOWN: {
+                // is already offline or shutting down, nothing to do here
+                return;
+            }
+            case app_state_enum_1.AppState.CREATED: {
+                // nothing has been initialized yet, can simply quit without handling shutdown hooks
+                await this.logger.info('shutting down...');
+                global_registry_1.GlobalRegistry.markAppAsShuttingDown();
+                for (const [signal, handler] of this.signalHandlers) {
+                    process.off(signal, handler);
+                }
+                process.exit(0);
+            }
+            case app_state_enum_1.AppState.INITIALIZED:
+            case app_state_enum_1.AppState.STARTED: {
+                await this.logger.info('shutting down...');
+                global_registry_1.GlobalRegistry.markAppAsShuttingDown();
+                for (const [signal, handler] of this.signalHandlers) {
+                    process.off(signal, handler);
+                }
+                await this.shutdownHttpServer();
+                const injectables = (0, get_all_registered_tokens_function_1.getAllRegisteredTokens)().map(t => (0, inject_function_1.inject)(t));
+                await this.beforeAppShutdown(injectables, signal);
+                await this.onAppShutdown(injectables, signal);
+                await this.afterAppShutdown(injectables, signal);
+                process.exit(0);
+            }
+        }
+    }
+    async beforeAppInit(tokens) {
+        const sortedTokens = tokens.sort((a, b) => {
+            if ('key' in a && a.key === zibri_di_tokens_default_1.ZIBRI_DI_TOKENS.DATA_SOURCE_SERVICE.key) {
+                return -1;
+            }
+            if ('key' in b && b.key === zibri_di_tokens_default_1.ZIBRI_DI_TOKENS.DATA_SOURCE_SERVICE.key) {
+                return 1;
+            }
+            return 0;
+        });
+        for (const token of sortedTokens) {
+            const injectable = (0, inject_function_1.inject)(token);
+            if ((0, before_app_init_interface_1.implementsBeforeAppInit)(injectable)) {
+                await injectable.beforeAppInit(this);
+            }
+        }
+    }
+    async onAppInit(injectables) {
+        for (const element of injectables.filter(i => (0, on_app_init_interface_1.implementsOnAppInit)(i))) {
+            await element.onAppInit(this);
+        }
+    }
+    async afterAppInit(injectables) {
+        for (const element of injectables.filter(i => (0, after_app_init_interface_1.implementsAfterAppInit)(i))) {
+            await element.afterAppInit(this);
+        }
+    }
+    async afterAppShutdown(injectables, signal) {
+        const elements = injectables.filter(i => (0, after_app_shutdown_interface_1.implementsAfterAppShutdown)(i));
+        await Promise.all(elements.map(async (e) => {
+            try {
+                const timeoutInMs = e.shutdownTimeoutInMs ?? DEFAULT_SHUTDOWN_TIMEOUT_IN_MS;
+                // no abort signal here because stopping the api does that.
+                await promise_utilities_1.PromiseUtilities.withTimeout(() => e.afterAppShutdown(this, signal), timeoutInMs);
+            }
+            catch (error) {
+                await this.logger.error(error instanceof Error
+                    ? error
+                    : new Error(`Error running afterAppShutdown for "${e.constructor.name}":`, { cause: error }));
+            }
+        }));
+    }
+    async onAppShutdown(injectables, signal) {
+        const elements = injectables.filter(i => (0, on_app_shutdown_interface_1.implementsOnAppShutdown)(i));
+        await Promise.all(elements.map(async (e) => {
+            try {
+                const timeoutInMs = e.shutdownTimeoutInMs ?? DEFAULT_SHUTDOWN_TIMEOUT_IN_MS;
+                // no abort signal here because stopping the api does that.
+                await promise_utilities_1.PromiseUtilities.withTimeout(() => e.onAppShutdown(this, signal), timeoutInMs);
+            }
+            catch (error) {
+                await this.logger.error(error instanceof Error
+                    ? error
+                    : new Error(`Error running onAppShutdown for "${e.constructor.name}":`, { cause: error }));
+            }
+        }));
+    }
+    async beforeAppShutdown(injectables, signal) {
+        const elements = injectables.filter(i => (0, before_app_shutdown_interface_1.implementsBeforeAppShutdown)(i));
+        await Promise.all(elements.map(async (e) => {
+            try {
+                const timeoutInMs = e.shutdownTimeoutInMs ?? DEFAULT_SHUTDOWN_TIMEOUT_IN_MS;
+                // no abort signal here because stopping the api does that.
+                await promise_utilities_1.PromiseUtilities.withTimeout(() => e.beforeAppShutdown(this, signal), timeoutInMs);
+            }
+            catch (error) {
+                await this.logger.error(error instanceof Error
+                    ? error
+                    : new Error(`Error running beforeAppShutdown for "${e.constructor.name}":`, { cause: error }));
+            }
+        }));
+    }
+    async shutdownHttpServer() {
+        if (!this.server.listening) {
+            return;
+        }
+        return new Promise((resolve, reject) => {
+            // eslint-disable-next-line promise/prefer-await-to-callbacks
+            this.server.close(err => {
+                if (err) {
+                    reject(err);
+                }
+                else {
+                    resolve();
+                }
+            });
+        });
+    }
+    validateInjectables(injectables) {
+        for (const element of injectables) {
+            if (element instanceof plugin_model_1.ZibriPlugin) {
+                throw new Error([
+                    `Invalid class marked with @Injectable: ${element.constructor.name}`,
+                    'Plugins interfere with the injection system, making them injectable is forbidden.'
+                ].join('\n'));
+            }
+            if (element instanceof cron_job_model_1.CronJob) {
+                throw new Error([
+                    `Invalid class marked with @Injectable: ${element.constructor.name}`,
+                    'Cron jobs should be registered by the cron service.'
+                ].join('\n'));
+            }
+            if ((0, two_factor_method_interface_1.isTwoFactorMethod)(element)) {
+                throw new Error([
+                    `Invalid class marked with @Injectable: ${element.constructor.name}`,
+                    'Two factor methods should be registered by the two factor service.'
+                ].join('\n'));
+            }
+            if ((0, auth_strategy_interface_1.isAuthStrategy)(element)) {
+                throw new Error([
+                    `Invalid class marked with @Injectable: ${element.constructor.name}`,
+                    'Auth strategies should be registered by the auth service.'
+                ].join('\n'));
+            }
+            if ((0, data_source_interface_1.isDataSource)(element) && !this.options.dataSources.find(ds => ds.name === element.constructor.name)) {
+                throw new Error([
+                    `Invalid class marked with @DataSource: ${element.constructor.name}`,
+                    'The data source has not been included in the application options.'
+                ].join('\n'));
+            }
+        }
+    }
     createFullOptions() {
+        // eslint-disable-next-line stylistic/max-len
+        const hsts = this.providedOptions.security?.headers?.[known_header_enum_1.KnownHeader.STRICT_TRANSPORT_SECURITY];
         const res = {
             dataSources: [],
             authStrategies: [],
@@ -164,7 +330,17 @@ class ZibriApplication {
             bodyParsers: [],
             providers: [],
             cronJobs: [],
-            ...this.providedOptions
+            ...this.providedOptions,
+            security: {
+                headers: {
+                    [known_header_enum_1.KnownHeader.STRICT_TRANSPORT_SECURITY]: typeof hsts === 'boolean'
+                        ? hsts
+                        : {
+                            ...defaultHstsOptions,
+                            ...hsts
+                        }
+                }
+            }
         };
         for (const plugin of this.providedOptions.plugins ?? []) {
             // TODO: handle order of plugin initialization so that everything is available for DI inside the plugin constructor.
@@ -185,6 +361,26 @@ class ZibriApplication {
         }
         return res;
     }
+    async logDefaults() {
+        if (!this.providedOptions.authStrategies) {
+            await this.logger.info('No auth strategies provided, defaults to:');
+            for (const strategy of this.options.authStrategies) {
+                await this.logger.info(`  - ${strategy.name}`);
+            }
+        }
+        if (!this.providedOptions.twoFactorMethods) {
+            await this.logger.info('No two factor methods provided, defaults to:');
+            for (const strategy of this.options.twoFactorMethods) {
+                await this.logger.info(`  - ${strategy.name}`);
+            }
+        }
+        if (!this.providedOptions.bodyParsers) {
+            await this.logger.info('No body parsers provided, defaults to:');
+            for (const bodyParser of this.options.bodyParsers) {
+                await this.logger.info(`  - ${bodyParser.name}`);
+            }
+        }
+    }
 }
 exports.ZibriApplication = ZibriApplication;
 //# sourceMappingURL=application.js.map