zibri 2.2.1 → 2.4.0

package/src/application.ts

@@ -1,41 +1,69 @@
 import { createServer, Server } from 'node:http';
+import { AddressInfo } from 'node:net';
 
+import cookieParser from 'cookie-parser';
 import cors from 'cors';
 import express, { RequestHandler } from 'express';
 
-import { ZibriApplicationOptions } from './application-options.model';
-import { AssetServiceInterface } from './assets/asset-service.interface';
+import { HstsOptions, ZibriApplicationOptions, ZibriApplicationSecurityOptions } from './application-options.model';
 import { OtpTwoFactorMethod } from './auth/2fa/methods/otp/otp.two-factor-method';
-import { TwoFactorServiceInterface } from './auth/2fa/two-factor-service.interface';
-import { AuthServiceInterface } from './auth/auth-service.interface';
+import { isTwoFactorMethod } from './auth/2fa/methods/two-factor-method.interface';
+import { isAuthStrategy } from './auth/strategies/auth-strategy.interface';
 import { JwtAuthStrategy } from './auth/strategies/jwt/jwt.auth-strategy';
-import { BackupServiceInterface } from './backup/backup-service.interface';
-import { CronServiceInterface } from './cron/cron-service.interface';
-import { DataSourceServiceInterface } from './data-source/data-source-service.interface';
+import { CronJob } from './cron/cron-job.model';
+import { isDataSource } from './data-source/data-sources/data-source.interface';
 import { ZIBRI_DI_TOKENS } from './di/default/zibri-di-tokens.default';
+import { getAllRegisteredTokens } from './di/get-all-registered-tokens.function';
 import { inject } from './di/inject.function';
+import { DiToken } from './di/models/di-token.model';
 import { register } from './di/register.function';
-import { EmailServiceInterface } from './email/email-service.interface';
-import { MailingListServiceInterface } from './email/mailing-list/mailing-list-service.interface';
 import { GlobalErrorHandler } from './error-handling/error-handler.model';
 import { UnmatchedRouteError } from './error-handling/errors/unmatched-route.error';
+import { implementsAfterAppInit } from './global/after-app-init.interface';
+import { AfterAppShutdown, implementsAfterAppShutdown } from './global/after-app-shutdown.interface';
+import { AppState } from './global/app-state.enum';
+import { implementsBeforeAppInit } from './global/before-app-init.interface';
+import { BeforeAppShutdown, implementsBeforeAppShutdown } from './global/before-app-shutdown.interface';
 import { GlobalRegistry } from './global/global-registry';
+import { implementsOnAppInit } from './global/on-app-init.interface';
+import { implementsOnAppShutdown, OnAppShutdown } from './global/on-app-shutdown.interface';
+import { implementsOnAppStart } from './global/on-app-start.interface';
 import { HandlebarUtilities } from './handlebars/handlebar.utilities';
+import { KnownHeader } from './http/known-header.enum';
 import { LoggerInterface } from './logging/logger.interface';
-import { MetricsServiceInterface } from './metrics/metrics-service.interface';
-import { MultithreadingServiceInterface } from './multithreading/services/multithreading-service.interface';
-import { OpenApiServiceInterface } from './open-api/open-api-service.interface';
 import { FormDataBodyParser } from './parsing/form-data/form-data.body-parser';
 import { JsonBodyParser } from './parsing/json/json.body-parser';
-import { ParserInterface } from './parsing/parser.interface';
+import { ZibriPlugin } from './plugin/plugin.model';
 import { Route } from './routing/controller-route-configuration.model';
-import { RouterInterface } from './routing/router.interface';
+import { DeepPartial } from './types/deep-partial.type';
 import { OmitStrict } from './types/omit-strict.type';
-import { BaseWebsocketConnection } from './websocket/models/connection/base-websocket-connection.model';
-import { WebsocketServiceInterface } from './websocket/services/websocket-service.interface';
+import { FsUtilities } from './utilities/fs.utilities';
+import { Ms } from './utilities/ms';
+import { NumberUtilities } from './utilities/number.utilities';
+import { PromiseUtilities } from './utilities/promise.utilities';
 
 // eslint-disable-next-line jsdoc/require-jsdoc
-type FullZibriApplicationOptions = Required<OmitStrict<ZibriApplicationOptions, 'plugins'>>;
+type FullZibriApplicationOptions = Required<OmitStrict<ZibriApplicationOptions, 'plugins' | 'security'>> & {
+    // eslint-disable-next-line jsdoc/require-jsdoc
+    security: ZibriApplicationSecurityOptions
+};
+
+// eslint-disable-next-line typescript/typedef
+const SHUTDOWN_SIGNALS = ['SIGTERM', 'SIGINT', 'SIGHUP'] as const;
+
+const DEFAULT_SHUTDOWN_TIMEOUT_IN_MS: number = Ms.SECOND * 30;
+
+const defaultHstsOptions: HstsOptions = {
+    maxAgeSeconds: NumberUtilities.multiply(Ms.YEAR, 2).dividedBy(1000)
+        .toNumber(),
+    includeSubDomains: true,
+    preload: false
+};
+
+/**
+ * A os signal that triggers the shutdown of a Zibri application.
+ */
+export type ShutdownSignal = typeof SHUTDOWN_SIGNALS[number];
 
 /**
  * A Zibri application.
@@ -48,33 +76,17 @@ export class ZibriApplication {
         .disable('x-powered-by')
         .use(cors());
 
+    private readonly signalHandlers: Map<ShutdownSignal, () => void> = new Map<ShutdownSignal, () => void>();
+
     /**
      * The underlying http server.
      */
     readonly server: Server = createServer(this.express);
 
-    private _router!: RouterInterface;
-    // eslint-disable-next-line jsdoc/require-returns
-    /**
-     * The router used by the application.
-     */
-    get router(): RouterInterface {
-        return this._router;
-    }
-    private logger!: LoggerInterface;
-    private metricsService!: MetricsServiceInterface;
-    private assetService!: AssetServiceInterface;
-    private openApiService!: OpenApiServiceInterface;
-    private parser!: ParserInterface;
-    private dataSourceService!: DataSourceServiceInterface;
-    private authService!: AuthServiceInterface;
-    private twoFactorService!: TwoFactorServiceInterface;
-    private cronService!: CronServiceInterface;
-    private multithreadingService!: MultithreadingServiceInterface;
-    private websocketService!: WebsocketServiceInterface<BaseWebsocketConnection>;
-    private emailService!: EmailServiceInterface;
-    private backupService!: BackupServiceInterface;
-    private mailingListService?: MailingListServiceInterface;
+    private get logger(): LoggerInterface {
+        return inject(ZIBRI_DI_TOKENS.LOGGER);
+    }
+
     /**
      * The options of which the application was build.
      */
@@ -82,6 +94,36 @@ export class ZibriApplication {
 
     constructor(private readonly providedOptions: ZibriApplicationOptions) {
         this.options = this.createFullOptions();
+
+        this.use((req, res, next) => {
+            res.setHeader(KnownHeader.X_CONTENT_TYPE_OPTIONS, 'nosniff');
+            res.setHeader(KnownHeader.REFERRER_POLICY, 'strict-origin-when-cross-origin');
+
+            const hsts: boolean | HstsOptions = this.options.security.headers[KnownHeader.STRICT_TRANSPORT_SECURITY];
+            const isSecure: boolean = req.secure || req.headers[KnownHeader.X_FORWARDED_PROTO] === 'https';
+            if (isSecure && hsts !== false) {
+                const options: HstsOptions = hsts === true
+                    ? defaultHstsOptions
+                    : hsts;
+                res.setHeader(
+                    KnownHeader.STRICT_TRANSPORT_SECURITY,
+                    [
+                        `max-age=${options.maxAgeSeconds}`,
+                        ...options.includeSubDomains ? ['includeSubDomains'] : [],
+                        ...options.preload ? ['preload'] : []
+                    ].join('; ')
+                );
+            }
+
+            next();
+        });
+
+        for (const signal of SHUTDOWN_SIGNALS) {
+            const handler: () => void = () => void this.shutdown(signal);
+            this.signalHandlers.set(signal, handler);
+            process.on(signal, handler);
+        }
+
         GlobalRegistry.markAppAsCreated();
     }
 
@@ -104,66 +146,35 @@ export class ZibriApplication {
     /**
      * Initializes the app.
      * @param H - The global handlebars instance, needed to provide some helpers used in templating.
+     * @param handlebarComponentsDir - Directory where handlebars components reside. Defaults to assetService.assetsPath/templates/components.
      */
-    async init(H: typeof Handlebars): Promise<void> {
-        await HandlebarUtilities.init(H);
+    async init(
+        H: typeof Handlebars,
+        handlebarComponentsDir: string = FsUtilities.getPath(inject(ZIBRI_DI_TOKENS.ASSET_SERVICE).assetsPath, 'templates', 'components')
+    ): Promise<void> {
+        await HandlebarUtilities.init(H, handlebarComponentsDir);
         GlobalRegistry.setAppData(this.options);
 
         for (const provider of this.options.providers) {
             register(provider);
         }
 
-        this.logger = inject(ZIBRI_DI_TOKENS.LOGGER);
-        await this.logger.attachTo(this);
+        await this.logDefaults();
 
-        this.metricsService = inject(ZIBRI_DI_TOKENS.METRICS_SERVICE);
-        await this.metricsService.attachTo(this);
+        const tokens: DiToken<unknown>[] = getAllRegisteredTokens();
+        await this.beforeAppInit(tokens);
 
-        if (!this.providedOptions.authStrategies) {
-            await this.logger.info('No auth strategies provided, defaults to:');
-            for (const strategy of this.options.authStrategies) {
-                await this.logger.info(`  - ${strategy.name}`);
-            }
-        }
-        if (!this.providedOptions.twoFactorMethods) {
-            await this.logger.info('No two factor methods provided, defaults to:');
-            for (const strategy of this.options.twoFactorMethods) {
-                await this.logger.info(`  - ${strategy.name}`);
-            }
-        }
-        if (!this.providedOptions.bodyParsers) {
-            await this.logger.info('No body parsers provided, defaults to:');
-            for (const bodyParser of this.options.bodyParsers) {
-                await this.logger.info(`  - ${bodyParser.name}`);
-            }
-        }
-
-        this.dataSourceService = inject(ZIBRI_DI_TOKENS.DATA_SOURCE_SERVICE);
-        await this.dataSourceService.init();
-
-        this.twoFactorService = inject(ZIBRI_DI_TOKENS.TWO_FACTOR_SERVICE);
-        await this.twoFactorService.init(this.options.twoFactorMethods);
+        const injectables: unknown[] = tokens.map(t => inject(t));
+        this.validateInjectables(injectables);
 
-        this.authService = inject(ZIBRI_DI_TOKENS.AUTH_SERVICE);
-        await this.authService.init(this.options.authStrategies);
+        await this.onAppInit(injectables);
 
-        this.parser = inject(ZIBRI_DI_TOKENS.PARSER);
-        await this.parser.attachTo(this);
-
-        this._router = inject(ZIBRI_DI_TOKENS.ROUTER);
-        await this._router.init(this);
-
-        this.assetService = inject(ZIBRI_DI_TOKENS.ASSET_SERVICE);
-        await this.assetService.attachTo(this);
-
-        this.emailService = inject(ZIBRI_DI_TOKENS.EMAIL_SERVICE);
-        this.emailService.attachTo(this);
-
-        this.mailingListService = inject(ZIBRI_DI_TOKENS.MAILING_LIST_SERVICE);
-        this.mailingListService?.attachTo(this);
+        const secret: string | undefined = inject(ZIBRI_DI_TOKENS.COOKIE_SIGN_SECRET);
+        if (secret) {
+            this.use(cookieParser(secret));
+        }
 
-        this.openApiService = inject(ZIBRI_DI_TOKENS.OPEN_API_SERVICE);
-        await this.openApiService.attachTo(this);
+        await this.afterAppInit(injectables);
 
         for (const controller of this.options.controllers) {
             inject(controller);
@@ -173,18 +184,6 @@ export class ZibriApplication {
             inject(websocketController);
         }
 
-        this.cronService = inject(ZIBRI_DI_TOKENS.CRON_SERVICE);
-        await this.cronService.init(this.options.cronJobs);
-
-        this.multithreadingService = inject(ZIBRI_DI_TOKENS.MULTITHREADING_SERVICE);
-        await this.multithreadingService.init();
-
-        this.websocketService = inject<WebsocketServiceInterface<BaseWebsocketConnection>>(ZIBRI_DI_TOKENS.WEBSOCKET_SERVICE);
-        await this.websocketService.attachTo(this);
-
-        this.backupService = inject(ZIBRI_DI_TOKENS.BACKUP_SERVICE);
-        await this.backupService.init();
-
         for (const plugin of this.providedOptions.plugins ?? []) {
             await plugin.validate(this);
         }
@@ -198,21 +197,211 @@ export class ZibriApplication {
      * @throws When the app has already been started.
      */
     async start(port: number): Promise<void> {
-        if (GlobalRegistry.isAppRunning()) {
+        if (GlobalRegistry.isAppStarted()) {
             // We need this check in addition to the one in the registry.
-            // Because we would otherwise have a wrong state when we call markAppAsRunning
+            // Because we would otherwise have a wrong state when we call markAppAsStarted
             // and then this.app.listen fails.
             throw new Error('The application has already been started');
         }
-        await this.router.attachTo(this);
+
+        const injectables: unknown[] = getAllRegisteredTokens().map(t => inject(t));
+        for (const element of injectables.filter(i => implementsOnAppStart(i))) {
+            await element.onAppStart(this);
+        }
+
         this.use((req, _, next) => next(new UnmatchedRouteError(req.originalUrl)));
         this.use(inject(ZIBRI_DI_TOKENS.GLOBAL_ERROR_HANDLER));
         this.server.listen(port);
-        GlobalRegistry.markAppAsRunning();
+        if (port === 0) {
+            const address: string | AddressInfo | null = this.server.address();
+            if (address != undefined && typeof address !== 'string') {
+                port = address.port;
+            }
+        }
+        GlobalRegistry.markAppAsStarted();
         await this.logger.info(`${this.options.name} is running on port ${port}`);
     }
 
+    /**
+     * Gracefully shuts down the application.
+     * @param signal - The signal that shuts down the application. Can be left empty if manually called.
+     */
+    async shutdown(signal?: ShutdownSignal): Promise<void> {
+        switch (GlobalRegistry.getAppData('state')) {
+            case AppState.OFFLINE:
+            case AppState.SHUTTING_DOWN: {
+                // is already offline or shutting down, nothing to do here
+                return;
+            }
+            case AppState.CREATED: {
+                // nothing has been initialized yet, can simply quit without handling shutdown hooks
+                await this.logger.info('shutting down...');
+                GlobalRegistry.markAppAsShuttingDown();
+                for (const [signal, handler] of this.signalHandlers) {
+                    process.off(signal, handler);
+                }
+                process.exit(0);
+            }
+            case AppState.INITIALIZED:
+            case AppState.STARTED: {
+                await this.logger.info('shutting down...');
+                GlobalRegistry.markAppAsShuttingDown();
+                for (const [signal, handler] of this.signalHandlers) {
+                    process.off(signal, handler);
+                }
+
+                await this.shutdownHttpServer();
+                const injectables: unknown[] = getAllRegisteredTokens().map(t => inject(t));
+                await this.beforeAppShutdown(injectables, signal);
+                await this.onAppShutdown(injectables, signal);
+                await this.afterAppShutdown(injectables, signal);
+
+                process.exit(0);
+            }
+        }
+    }
+
+    private async beforeAppInit(tokens: DiToken<unknown>[]): Promise<void> {
+        const sortedTokens: DiToken<unknown>[] = tokens.sort((a, b) => {
+            if ('key' in a && a.key === ZIBRI_DI_TOKENS.DATA_SOURCE_SERVICE.key) {
+                return -1;
+            }
+            if ('key' in b && b.key === ZIBRI_DI_TOKENS.DATA_SOURCE_SERVICE.key) {
+                return 1;
+            }
+            return 0;
+        });
+
+        for (const token of sortedTokens) {
+            const injectable: unknown = inject(token);
+            if (implementsBeforeAppInit(injectable)) {
+                await injectable.beforeAppInit(this);
+            }
+        }
+    }
+
+    private async onAppInit(injectables: unknown[]): Promise<void> {
+        for (const element of injectables.filter(i => implementsOnAppInit(i))) {
+            await element.onAppInit(this);
+        }
+    }
+
+    private async afterAppInit(injectables: unknown[]): Promise<void> {
+        for (const element of injectables.filter(i => implementsAfterAppInit(i))) {
+            await element.afterAppInit(this);
+        }
+    }
+
+    private async afterAppShutdown(injectables: unknown[], signal: ShutdownSignal | undefined): Promise<void> {
+        const elements: AfterAppShutdown[] = injectables.filter(i => implementsAfterAppShutdown(i));
+        await Promise.all(elements.map(async e => {
+            try {
+                const timeoutInMs: number = e.shutdownTimeoutInMs ?? DEFAULT_SHUTDOWN_TIMEOUT_IN_MS;
+                // no abort signal here because stopping the api does that.
+                await PromiseUtilities.withTimeout(() => e.afterAppShutdown(this, signal), timeoutInMs);
+            }
+            catch (error) {
+                await this.logger.error(
+                    error instanceof Error
+                        ? error
+                        : new Error(`Error running afterAppShutdown for "${e.constructor.name}":`, { cause: error })
+                );
+            }
+        }));
+    }
+
+    private async onAppShutdown(injectables: unknown[], signal: ShutdownSignal | undefined): Promise<void> {
+        const elements: OnAppShutdown[] = injectables.filter(i => implementsOnAppShutdown(i));
+        await Promise.all(elements.map(async e => {
+            try {
+                const timeoutInMs: number = e.shutdownTimeoutInMs ?? DEFAULT_SHUTDOWN_TIMEOUT_IN_MS;
+                // no abort signal here because stopping the api does that.
+                await PromiseUtilities.withTimeout(() => e.onAppShutdown(this, signal), timeoutInMs);
+            }
+            catch (error) {
+                await this.logger.error(
+                    error instanceof Error
+                        ? error
+                        : new Error(`Error running onAppShutdown for "${e.constructor.name}":`, { cause: error })
+                );
+            }
+        }));
+    }
+
+    private async beforeAppShutdown(injectables: unknown[], signal: ShutdownSignal | undefined): Promise<void> {
+        const elements: BeforeAppShutdown[] = injectables.filter(i => implementsBeforeAppShutdown(i));
+        await Promise.all(elements.map(async e => {
+            try {
+                const timeoutInMs: number = e.shutdownTimeoutInMs ?? DEFAULT_SHUTDOWN_TIMEOUT_IN_MS;
+                // no abort signal here because stopping the api does that.
+                await PromiseUtilities.withTimeout(() => e.beforeAppShutdown(this, signal), timeoutInMs);
+            }
+            catch (error) {
+                await this.logger.error(
+                    error instanceof Error
+                        ? error
+                        : new Error(`Error running beforeAppShutdown for "${e.constructor.name}":`, { cause: error })
+                );
+            }
+        }));
+    }
+
+    private async shutdownHttpServer(): Promise<void> {
+        if (!this.server.listening) {
+            return;
+        }
+        return new Promise((resolve, reject) => {
+            // eslint-disable-next-line promise/prefer-await-to-callbacks
+            this.server.close(err => {
+                if (err) {
+                    reject(err);
+                }
+                else {
+                    resolve();
+                }
+            });
+        });
+    }
+
+    private validateInjectables(injectables: unknown[]): void {
+        for (const element of injectables) {
+            if (element instanceof ZibriPlugin) {
+                throw new Error([
+                    `Invalid class marked with @Injectable: ${element.constructor.name}`,
+                    'Plugins interfere with the injection system, making them injectable is forbidden.'
+                ].join('\n'));
+            }
+            if (element instanceof CronJob) {
+                throw new Error([
+                    `Invalid class marked with @Injectable: ${element.constructor.name}`,
+                    'Cron jobs should be registered by the cron service.'
+                ].join('\n'));
+            }
+            if (isTwoFactorMethod(element)) {
+                throw new Error([
+                    `Invalid class marked with @Injectable: ${element.constructor.name}`,
+                    'Two factor methods should be registered by the two factor service.'
+                ].join('\n'));
+            }
+            if (isAuthStrategy(element)) {
+                throw new Error([
+                    `Invalid class marked with @Injectable: ${element.constructor.name}`,
+                    'Auth strategies should be registered by the auth service.'
+                ].join('\n'));
+            }
+            if (isDataSource(element) && !this.options.dataSources.find(ds => ds.name === element.constructor.name)) {
+                throw new Error([
+                    `Invalid class marked with @DataSource: ${element.constructor.name}`,
+                    'The data source has not been included in the application options.'
+                ].join('\n'));
+            }
+        }
+    }
+
     private createFullOptions(): FullZibriApplicationOptions {
+        // eslint-disable-next-line stylistic/max-len
+        const hsts: DeepPartial<HstsOptions> | boolean | undefined = this.providedOptions.security?.headers?.[KnownHeader.STRICT_TRANSPORT_SECURITY];
+
         const res: FullZibriApplicationOptions = {
             dataSources: [],
             authStrategies: [],
@@ -220,7 +409,17 @@ export class ZibriApplication {
             bodyParsers: [],
             providers: [],
             cronJobs: [],
-            ...this.providedOptions
+            ...this.providedOptions,
+            security: {
+                headers: {
+                    [KnownHeader.STRICT_TRANSPORT_SECURITY]: typeof hsts === 'boolean'
+                        ? hsts
+                        : {
+                            ...defaultHstsOptions,
+                            ...hsts
+                        }
+                }
+            }
         };
         for (const plugin of this.providedOptions.plugins ?? []) {
             // TODO: handle order of plugin initialization so that everything is available for DI inside the plugin constructor.
@@ -243,4 +442,25 @@ export class ZibriApplication {
 
         return res;
     }
+
+    private async logDefaults(): Promise<void> {
+        if (!this.providedOptions.authStrategies) {
+            await this.logger.info('No auth strategies provided, defaults to:');
+            for (const strategy of this.options.authStrategies) {
+                await this.logger.info(`  - ${strategy.name}`);
+            }
+        }
+        if (!this.providedOptions.twoFactorMethods) {
+            await this.logger.info('No two factor methods provided, defaults to:');
+            for (const strategy of this.options.twoFactorMethods) {
+                await this.logger.info(`  - ${strategy.name}`);
+            }
+        }
+        if (!this.providedOptions.bodyParsers) {
+            await this.logger.info('No body parsers provided, defaults to:');
+            for (const bodyParser of this.options.bodyParsers) {
+                await this.logger.info(`  - ${bodyParser.name}`);
+            }
+        }
+    }
 }

package/src/assets/asset-service.interface.ts

@@ -1,7 +1,6 @@
-import { ZibriApplication } from '../application';
 import { TreeNode } from './asset.service';
 import { Route } from '../routing/controller-route-configuration.model';
-import { Path } from '../utilities/fs.utilities';
+import { FsPath } from '../utilities/fs.utilities';
 
 /**
  * Interface for an asset service.
@@ -10,32 +9,19 @@ export interface AssetServiceInterface {
     /**
      * The path of the assets.
      */
-    readonly assetsPath: Path,
+    readonly assetsPath: FsPath,
     /**
      * The path of the assets which are also publicly registered on the online file explorer.
      */
-    readonly publicAssetsPath: Path,
-    /**
-     * The path of the email templates.
-     */
-    readonly emailTemplatePath: Path,
-    /**
-     * The path of the page templates.
-     */
-    readonly pageTemplatePath: Path,
+    readonly publicAssetsPath: FsPath,
     /**
      * The path of the component templates.
      */
-    readonly componentTemplatePath: Path,
+    readonly componentTemplatePath: FsPath,
     /**
      * The route under which the file explorer with the public assets is registered.
      */
     readonly assetsRoute: Route,
-    /**
-     * Attaches the service to the application.
-     */
-    // eslint-disable-next-line typescript/no-explicit-any
-    attachTo: (app: ZibriApplication, ...params: any[]) => void | Promise<void>,
     /**
      * Builds a file tree.
      */

package/src/assets/asset-service.test.ts

@@ -5,7 +5,7 @@ import { AssetServiceInterface } from './asset-service.interface';
 import { TreeNode } from './asset.service';
 import { ZIBRI_DI_TOKENS } from '../di/default/zibri-di-tokens.default';
 import { inject } from '../di/inject.function';
-import { FsUtilities, Path } from '../utilities/fs.utilities';
+import { FsUtilities, FsPath } from '../utilities/fs.utilities';
 
 describe('AssetService', () => {
     let assetService: AssetServiceInterface;
@@ -16,8 +16,8 @@ describe('AssetService', () => {
 
     describe('buildFileTree', () => {
         it('should build a file tree for a given directory', async () => {
-            const mockDirPath: Path = FsUtilities.getPath(__dirname, '..', '__testing__', 'mocks', 'tree');
-            (assetService.publicAssetsPath as unknown as Path) = mockDirPath;
+            const mockDirPath: FsPath = FsUtilities.getPath(__dirname, '..', '__testing__', 'mocks', 'tree');
+            (assetService.publicAssetsPath as unknown as FsPath) = mockDirPath;
             const expectedTree: TreeNode[] = [
                 // Mocked file tree structure
                 { name: 'file1.txt', type: 'file', route: '/assets/file1.txt' },

package/src/assets/asset.service.ts

@@ -5,12 +5,15 @@ import express from 'express';
 import { AssetServiceInterface } from './asset-service.interface';
 import { ZibriApplication } from '../application';
 import { Inject } from '../di/decorators/inject.decorator';
+import { Injectable } from '../di/decorators/injectable.decorator';
 import { ZIBRI_DI_TOKENS } from '../di/default/zibri-di-tokens.default';
+import { inject } from '../di/inject.function';
+import { OnAppInit } from '../global/on-app-init.interface';
 import { HttpMethod } from '../http/http-method.enum';
 import { type LoggerInterface } from '../logging/logger.interface';
 import { FileResponse } from '../parsing/form-data/file-response.model';
 import { Route } from '../routing/controller-route-configuration.model';
-import { FsUtilities, Path } from '../utilities/fs.utilities';
+import { FsUtilities, FsPath } from '../utilities/fs.utilities';
 import { ObjectUtilities } from '../utilities/object.utilities';
 
 // eslint-disable-next-line jsdoc/require-jsdoc
@@ -31,17 +34,14 @@ type WalkedPath = { relPath: string, isFile: boolean };
 /**
  * Default asset service implementation of Zibri.
  */
-export class AssetService implements AssetServiceInterface {
+@Injectable({ register: 'onUse' })
+export class AssetService implements AssetServiceInterface, OnAppInit {
     // eslint-disable-next-line jsdoc/require-jsdoc
-    readonly assetsPath: Path = FsUtilities.getPath(__dirname, 'assets');
+    readonly assetsPath: FsPath = FsUtilities.getPath(__dirname, 'assets');
     // eslint-disable-next-line jsdoc/require-jsdoc
-    readonly publicAssetsPath: Path = FsUtilities.getPath(this.assetsPath, 'public');
+    readonly publicAssetsPath: FsPath = FsUtilities.getPath(this.assetsPath, 'public');
     // eslint-disable-next-line jsdoc/require-jsdoc
-    readonly pageTemplatePath: Path = FsUtilities.getPath(this.assetsPath, 'templates', 'pages');
-    // eslint-disable-next-line jsdoc/require-jsdoc
-    readonly emailTemplatePath: Path = FsUtilities.getPath(this.assetsPath, 'templates', 'emails');
-    // eslint-disable-next-line jsdoc/require-jsdoc
-    readonly componentTemplatePath: Path = FsUtilities.getPath(this.assetsPath, 'templates', 'components');
+    readonly componentTemplatePath: FsPath = FsUtilities.getPath(this.assetsPath, 'templates', 'components');
     // eslint-disable-next-line jsdoc/require-jsdoc
     readonly assetsRoute: Route = '/assets';
 
@@ -51,10 +51,11 @@ export class AssetService implements AssetServiceInterface {
     ) {}
 
     // eslint-disable-next-line jsdoc/require-jsdoc
-    async attachTo(app: ZibriApplication): Promise<void> {
+    async onAppInit(app: ZibriApplication): Promise<void> {
         await this.logger.info(`registers public static assets from folder "${this.publicAssetsPath}" at ${this.assetsRoute}`);
         app.use(this.assetsRoute, express.static(this.publicAssetsPath));
-        await app.router.register({
+
+        await inject(ZIBRI_DI_TOKENS.ROUTER).registerRoute({
             httpMethod: HttpMethod.GET,
             route: '/favicon.ico',
             handler: () => FileResponse.fromPath(FsUtilities.getPath(this.publicAssetsPath, 'favicon.png'))
@@ -117,14 +118,14 @@ export class AssetService implements AssetServiceInterface {
     }
 
     private async walk(
-        dir: Path,
-        base: Path = dir
+        dir: FsPath,
+        base: FsPath = dir
     ): Promise<WalkedPath[]> {
         const entries: Dirent[] = await FsUtilities.readdir(dir);
         const results: WalkedPath[] = [];
         for (const entry of entries) {
-            const abs: Path = FsUtilities.getPath(dir, entry.name);
-            const rel: Path = FsUtilities.relative(base, abs);
+            const abs: FsPath = FsUtilities.getPath(dir, entry.name);
+            const rel: FsPath = FsUtilities.relative(base, abs);
             if (entry.isDirectory()) {
                 results.push({ relPath: rel, isFile: false });
                 results.push(...await this.walk(abs, base));

package/src/auth/2fa/methods/otp/otp-credentials.model.ts

@@ -6,7 +6,7 @@ import { OmitClass } from '../../../../entity/omit-class.model';
 /**
  * Credentials for a one time password.
  */
-@Entity()
+@Entity({ allowOrphan: true })
 export class OtpCredentials extends BaseEntity {
     /**
      * The user id that these credentials belong to.