zibri 2.3.0 → 2.4.1

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "zibri",
-    "version": "2.3.0",
+    "version": "2.4.1",
     "main": "./dist/cjs/index.js",
     "types": "./dist/cjs/index.d.ts",
     "module": "./dist/esm/index.mjs",
@@ -49,58 +49,60 @@
     "license": "MIT",
     "description": "TS Backend Framework",
     "peerDependencies": {
-        "axios": "^1.13.2",
-        "bcryptjs": "^3.0.2",
-        "bignumber.js": "^9.3.1",
-        "handlebars": "^4.7.8",
+        "axios": "^1.16.0",
+        "bcryptjs": "^3.0.3",
+        "bignumber.js": "^11.1.1",
+        "handlebars": "^4.7.9",
         "hi-base32": "^0.5.1",
-        "jsonwebtoken": "^9.0.2",
-        "otpauth": "^9.4.1",
+        "jsonwebtoken": "^9.0.3",
+        "otpauth": "^9.5.1",
         "pdfmake": "^0.2.2",
-        "preact": "^10.28.3",
-        "preact-render-to-string": "^6.6.5",
+        "preact": "^10.29.1",
+        "preact-render-to-string": "^6.6.7",
         "rxjs": "^7.8.2",
-        "socket.io": "^4.8.1",
+        "socket.io": "^4.8.3",
         "ts-node": "^10.9.2",
-        "uuid": "^11.1.0",
-        "xmlbuilder2": "^4.0.3"
+        "uuid": "^11.1.1",
+        "xmlbuilder2": "^4.0.3",
+        "cookie-parser": "^1.4.7"
     },
     "dependencies": {
         "@fastify/busboy": "^3.2.0",
-        "cors": "^2.8.5",
-        "express": "^5.1.0",
+        "cors": "^2.8.6",
+        "express": "^5.2.1",
         "glob": "^13.0.6",
         "node-cron": "^4.2.1",
-        "nodemailer": "^8.0.4",
-        "pg": "^8.16.3",
+        "nodemailer": "^8.0.7",
+        "pg": "^8.20.0",
         "prom-client": "^15.1.3",
         "reflect-metadata": "^0.2.2",
         "swagger-ui-express": "^5.0.1",
         "swagger2openapi": "^7.0.8",
-        "systeminformation": "^5.27.10",
-        "typeorm": "^0.3.27"
+        "systeminformation": "^5.31.6",
+        "typeorm": "^0.3.29"
     },
     "devDependencies": {
         "@faker-js/faker": "^9.9.0",
-        "@jest/globals": "^30.2.0",
-        "@swc/core": "^1.13.5",
-        "@testcontainers/postgresql": "^11.6.0",
+        "@jest/globals": "^30.3.0",
+        "@swc/core": "^1.15.33",
+        "@testcontainers/postgresql": "^11.14.0",
+        "@types/cookie-parser": "^1.4.10",
         "@types/cors": "^2.8.19",
-        "@types/express": "^5.0.3",
+        "@types/express": "^5.0.6",
         "@types/jsonwebtoken": "^9.0.10",
-        "@types/node": "^24.10.13",
-        "@types/nodemailer": "^7.0.1",
+        "@types/node": "^25.6.0",
+        "@types/nodemailer": "^8.0.0",
         "@types/pdfmake": "^0.2.11",
         "@types/swagger-ui-express": "^4.1.8",
         "@types/swagger2openapi": "^7.0.4",
         "eslint": "^9.36.0",
         "eslint-config-service-soft": "^2.1.6",
-        "jest": "^30.2.0",
+        "jest": "^30.3.0",
         "npm-run-all": "^4.1.5",
         "openapi3-ts": "^4.5.0",
-        "testcontainers": "^11.6.0",
-        "ts-jest": "^29.4.6",
-        "typedoc": "^0.28.17",
-        "typescript": "^5.9.3"
+        "testcontainers": "^11.14.0",
+        "ts-jest": "^29.4.9",
+        "typedoc": "^0.28.19",
+        "typescript": "^5.9.2"
     }
 }

package/src/__testing__/constants.ts

@@ -2,8 +2,14 @@ import { FsUtilities, FsPath } from '../utilities/fs.utilities';
 
 export const testFileFolder: FsPath = FsUtilities.getPath(__dirname, 'file-output');
 
+export const testAssetsFolder: FsPath = FsUtilities.getPath(__dirname, 'mocks', 'assets');
+
 export const POSTGRES_TEST_IMAGE: string = 'postgres:17.6';
 
 export const noOp: () => void = () => {};
 
-export const noOpAsync: () => Promise<void> = async () => {};
+export const noOpAsync: () => Promise<void> = async () => {};
+
+export async function flushMicrotasks(): Promise<void> {
+    await Promise.resolve();
+}

package/src/__testing__/mocks/entities/child.entity.ts

@@ -10,6 +10,9 @@ export class Child {
     @Property.string()
     name!: string;
 
-    @Property.manyToOne({ target: () => Parent, inverseSide: 'children' })
+    @Property.manyToOne({ target: () => Parent, joinColumn: 'parentId', inverseSide: 'children' })
     parent!: Parent;
+
+    @Property.string({ format: 'uuid' })
+    parentId!: string;
 }

package/src/__testing__/mocks/entities/company.entity.ts

@@ -3,8 +3,11 @@ import { BaseEntity } from '../../../entity/base-entity.model';
 import { Entity } from '../../../entity/decorators/entity.decorator';
 import { Property } from '../../../entity/decorators/property.decorator';
 
-@Entity()
+@Entity({ allowOrphan: true })
 export class Company extends BaseEntity {
-    @Property.belongsToOne({ target: () => User, inverseSide: 'company' })
+    @Property.belongsToOne({ target: () => User, joinColumn: 'ownerId', inverseSide: 'company' })
     owner!: User;
+
+    @Property.string({ format: 'uuid' })
+    ownerId!: string;
 }

package/src/__testing__/mocks/entities/profile.entity.ts

@@ -2,7 +2,7 @@ import { User } from './user.entity';
 import { Entity } from '../../../entity/decorators/entity.decorator';
 import { Property } from '../../../entity/decorators/property.decorator';
 
-@Entity()
+@Entity({ allowOrphan: true })
 export class Profile {
     @Property.string({ primary: true })
     id!: string;
@@ -10,6 +10,9 @@ export class Profile {
     @Property.string()
     bio!: string;
 
-    @Property.belongsToOne({ target: () => User, inverseSide: 'profile' })
+    @Property.belongsToOne({ target: () => User, joinColumn: 'userId', inverseSide: 'profile' })
     user!: User;
+
+    @Property.string({ format: 'uuid' })
+    userId!: string;
 }

package/src/__testing__/mocks/entities/role.entity.ts

@@ -2,7 +2,7 @@ import { User } from './user.entity';
 import { Entity } from '../../../entity/decorators/entity.decorator';
 import { Property } from '../../../entity/decorators/property.decorator';
 
-@Entity()
+@Entity({ allowOrphan: true })
 export class Role {
     @Property.string({ primary: true })
     id!: string;

package/src/__testing__/mocks/entities/user.entity.ts

@@ -8,7 +8,7 @@ import { Entity } from '../../../entity/decorators/entity.decorator';
 import { Property } from '../../../entity/decorators/property.decorator';
 import { OmitStrict } from '../../../types/omit-strict.type';
 
-@Entity()
+@Entity({ allowOrphan: true })
 export class User {
     @Property.string({ primary: true })
     id!: string;

package/src/__testing__/test-server/create-test-data-source.function.ts

@@ -1,18 +1,24 @@
 import { OtpCredentials } from '../../auth/2fa/methods/otp/otp-credentials.model';
+import { EncryptionKey } from '../../auth/encryption/encryption-key.model';
+import { EncryptionStrategyEntity } from '../../auth/encryption/strategies/encryption-strategy-entity.model';
+import { HashStrategyEntity } from '../../auth/hash/strategies/hash-strategy-entity.model';
 import { PasswordResetToken } from '../../auth/models/password-reset-token.model';
 import { JwtCredentials } from '../../auth/strategies/jwt/jwt-credentials.model';
 import { JwtRefreshToken } from '../../auth/strategies/jwt/jwt-refresh-token.model';
 import { ChangeSet } from '../../change-sets/models/change-set.model';
 import { Change } from '../../change-sets/models/change.model';
 import { CronJobEntity } from '../../cron/cron-job-entity.model';
-import { PostgresDataSource, PostgresOptions } from '../../data-source/data-sources/postgres-data-source.model';
+import { PostgresDataSource, PostgresOptions } from '../../data-source/data-sources/postgres-typeorm-data-source.model';
 import { DataSource } from '../../data-source/decorators/data-source.decorator';
 import { MigrationEntity } from '../../data-source/migration/migration-entity.model';
 import { Email } from '../../email/models/email.model';
 import { BaseEntity } from '../../entity/base-entity.model';
+import { EventSubscriberRun } from '../../event/event-subscriber-run.model';
+import { Event } from '../../event/event.model';
 import { Log } from '../../logging/log.model';
 import { ThreadJobEntity } from '../../multithreading/models/thread-job-entity.model';
 import { Newable } from '../../types/newable.type';
+import { OmitStrict } from '../../types/omit-strict.type';
 import { WebsocketChannel } from '../../websocket/models/websocket-channel.model';
 import { WebsocketMessage } from '../../websocket/models/websocket-message.model';
 import { JwtUser } from '../mocks/entities/jwt-user.entity';
@@ -40,7 +46,12 @@ export const defaultTestServerEntities: Newable<BaseEntity>[] = [
     JwtRefreshToken,
     JwtCredentials,
     OtpCredentials,
-    ThreadJobEntity
+    ThreadJobEntity,
+    Event,
+    EventSubscriberRun,
+    HashStrategyEntity,
+    EncryptionKey,
+    EncryptionStrategyEntity
 ];
 
 export function createTestDataSource({
@@ -49,16 +60,15 @@ export function createTestDataSource({
     username = 'postgres',
     password = 'password',
     database = 'db'
-}: CreateTestDataSourceOptions = {}): Newable<PostgresDataSource> {
+}: CreateTestDataSourceOptions = {}): Newable<PostgresDataSource & { entities: Newable<BaseEntity>[] }> {
 
     @DataSource()
     class DbDataSource extends PostgresDataSource {
-        options: PostgresOptions = {
+        options: OmitStrict<PostgresOptions, 'type' | 'entities'> = {
             host,
             username,
             password,
-            database,
-            synchronize: true
+            database
         };
         entities: Newable<BaseEntity>[] = entities;
     }

package/src/__testing__/test-server/providers.ts

@@ -1,3 +1,6 @@
+import { randomBytes } from 'node:crypto';
+
+import { AesGcmEncryptionStrategy } from '../../auth/encryption/strategies/aes-gcm.encryption-strategy';
 import { PasswordResetEmailTemplate } from '../../auth/strategies/jwt/jwt-auth.controller';
 import { CronServiceInterface } from '../../cron/cron-service.interface';
 import { ZIBRI_DI_TOKENS } from '../../di/default/zibri-di-tokens.default';
@@ -15,11 +18,11 @@ export const defaultTestServerProviders: DiProvider<unknown>[] = [
         useFactory: () => 'test'
     }),
     defineProvider({
-        token: ZIBRI_DI_TOKENS.JWT_CONFIRM_PASSWORD_RESET_URL,
+        token: ZIBRI_DI_TOKENS.CONFIRM_PASSWORD_RESET_URL,
         useFactory: () => 'http://localhost:4200/confirm-password-reset'
     }),
     defineProvider({
-        token: ZIBRI_DI_TOKENS.JWT_PASSWORD_RESET_EMAIL_TEMPLATE,
+        token: ZIBRI_DI_TOKENS.PASSWORD_RESET_EMAIL_TEMPLATE,
         // eslint-disable-next-line typescript/no-explicit-any
         useValue: (() => 'string') as unknown as PasswordResetEmailTemplate<any, any>
     }),
@@ -38,6 +41,13 @@ export const defaultTestServerProviders: DiProvider<unknown>[] = [
             };
         }
     }),
+    defineProvider({
+        token: ZIBRI_DI_TOKENS.ENCRYPTION_MASTER_OPTIONS,
+        useValue: {
+            currentMasterStrategy: new AesGcmEncryptionStrategy(),
+            currentMasterKey: { id: 'mk1', value: randomBytes(32) }
+        }
+    }),
     defineProvider({
         token: ZIBRI_DI_TOKENS.CRON_SERVICE,
         useFactory: () => {

package/src/__testing__/test-server/start-test-server.function.ts

@@ -1,3 +1,5 @@
+import { AddressInfo } from 'node:net';
+
 import { jest } from '@jest/globals';
 import { PostgreSqlContainer, StartedPostgreSqlContainer } from '@testcontainers/postgresql';
 import H from 'handlebars/runtime';
@@ -9,16 +11,18 @@ import { defaultTestServerProviders } from './providers';
 import './user-repository'; // this import is needed so that the DI system can pick up the user repository.
 import { ZibriApplication } from '../../application';
 import { ZibriApplicationOptions } from '../../application-options.model';
-import { PostgresDataSource, PostgresOptions } from '../../data-source/data-sources/postgres-data-source.model';
+import { PostgresDataSource, PostgresOptions } from '../../data-source/data-sources/postgres-typeorm-data-source.model';
 import { ZIBRI_DI_TOKENS } from '../../di/default/zibri-di-tokens.default';
 import { DiContainer } from '../../di/di-container';
 import { inject } from '../../di/inject.function';
 import { LoggerInterface } from '../../logging/logger.interface';
 import { Newable } from '../../types/newable.type';
-import { noOp, POSTGRES_TEST_IMAGE } from '../constants';
+import { noOp, POSTGRES_TEST_IMAGE, testAssetsFolder } from '../constants';
 import { createTestDataSource } from './create-test-data-source.function';
+import { AssetServiceInterface } from '../../assets/asset-service.interface';
+import { OmitStrict } from '../../types/omit-strict.type';
 
-type StartTestServerOptions = Partial<Pick<ZibriApplicationOptions, 'providers' | 'plugins'>> & {
+type StartTestServerOptions = Partial<Pick<ZibriApplicationOptions, 'providers' | 'plugins' | 'controllers' | 'cronJobs'>> & {
     dataSources?: Newable<PostgresDataSource>[]
 };
 
@@ -29,6 +33,18 @@ export class StartedTestServer {
         private readonly exitSpy = jest.spyOn(process, 'exit').mockImplementation(() => undefined as never)
     ) {}
 
+    async start(): Promise<string> {
+        await this.app.start(0);
+        const address: string | AddressInfo | null = this.app.server.address();
+        if (address == undefined || typeof address === 'string') {
+            throw new Error('Failed to resolve test server port.');
+        }
+        const host: string = address.address === '::' || address.address === '0.0.0.0'
+            ? '127.0.0.1'
+            : address.address;
+        return `http://${host}:${address.port}`;
+    }
+
     async shutdown(): Promise<void> {
         await this.app.shutdown();
         this.exitSpy.mockRestore();
@@ -40,7 +56,9 @@ export async function startTestServer(
     {
         dataSources = [createTestDataSource()],
         providers = defaultTestServerProviders,
-        plugins = defaultTestServerPlugins
+        plugins = defaultTestServerPlugins,
+        controllers = [],
+        cronJobs = []
     }: StartTestServerOptions = {}
 ): Promise<StartedTestServer> {
     // Reset singleton — every test file gets a clean container with no stale instances.
@@ -53,8 +71,7 @@ export async function startTestServer(
             .withUsername(dataSource.options.username ?? 'postgres')
             .withPassword(dataSource.options.password?.toString() ?? 'password')
             .start();
-        // eslint-disable-next-line typescript/no-unnecessary-type-assertion
-        (dataSource.options as PostgresOptions) = {
+        (dataSource.options as OmitStrict<PostgresOptions, 'type' | 'entities'>) = {
             ...dataSource.options,
             port: container.getMappedPort(5432)
         };
@@ -66,15 +83,19 @@ export async function startTestServer(
     const info: typeof logger.info = logger.info;
     logger.info = noOp;
 
+    const assetService: AssetServiceInterface = inject(ZIBRI_DI_TOKENS.ASSET_SERVICE);
+    (assetService.assetsPath as string) = testAssetsFolder;
+
     const app: ZibriApplication = new ZibriApplication({
         name: 'test',
         version: '0.0.1',
         baseUrl: 'http://localhost:3000',
-        controllers: [],
+        controllers,
         websocketControllers: [],
         dataSources,
         providers,
-        plugins
+        plugins,
+        cronJobs
     });
 
     await app.init(H);

package/src/__testing__/test-server/user-repository.ts

@@ -1,6 +1,7 @@
 import { UserRepo } from '../../auth/decorators/user-repo.decorator';
 import { JwtCredentials } from '../../auth/strategies/jwt/jwt-credentials.model';
 import { UserRepositoryInterface } from '../../auth/user/user-repository.interface';
+import { getDefaultBeforeReturnHook, getDefaultBeforeSaveHook } from '../../data-source/hooks/hooks.default';
 import { Repository } from '../../data-source/repository';
 import { InjectRepository } from '../../di/decorators/inject-repository.decorator';
 import { Inject } from '../../di/decorators/inject.decorator';
@@ -18,10 +19,10 @@ export class DefaultTestServerUserRepository extends Repository<JwtUser>
         repo: Repository<JwtUser>,
         @Inject(ZIBRI_DI_TOKENS.LOGGER)
         logger: LoggerInterface,
-        @InjectRepository(JwtUser)
+        @InjectRepository(JwtCredentials)
         private readonly credentialsRepository: Repository<JwtCredentials>
     ) {
-        super(JwtUser, repo, logger);
+        super(JwtUser, repo, logger, repo.dataSource, getDefaultBeforeSaveHook(), getDefaultBeforeReturnHook());
     }
 
     async findByEmail(email: string): Promise<JwtUser> {
@@ -29,6 +30,6 @@ export class DefaultTestServerUserRepository extends Repository<JwtUser>
     }
 
     async resolveCredentialsFor(user: JwtUser): Promise<JwtCredentials> {
-        return this.credentialsRepository.findOne({ where: { userId: user.id } });
+        return await this.credentialsRepository.findOne({ where: { userId: user.id } });
     }
 }

package/src/application-options.model.ts

@@ -3,11 +3,46 @@ import { AuthStrategies } from './auth/strategies/auth-strategies.model';
 import { CronJob } from './cron/cron-job.model';
 import { DataSourceInterface } from './data-source/data-sources/data-source.interface';
 import { DiProvider } from './di/models/di-provider.model';
+import { KnownHeader } from './http/known-header.enum';
 import { BodyParserInterface } from './parsing/body-parser.interface';
 import { ZibriPlugin } from './plugin/plugin.model';
+import { DeepPartial } from './types/deep-partial.type';
 import { Newable } from './types/newable.type';
 import { Version } from './types/version.type';
 
+/**
+ * Configuration options for strict transport security / hsts.
+ */
+export type HstsOptions = {
+    /**
+     * The maximum age for which strict transport should be enabled. Defaults to 2 years.
+     */
+    maxAgeSeconds: number,
+    /**
+     * Whether or not subdomains should be included. Defaults to true.
+     */
+    includeSubDomains: boolean,
+    /**
+     * Whether or not this url should be put on a preload list. Defaults to false.
+     */
+    preload: boolean
+};
+
+/**
+ * The global security options for a Zibri application.
+ */
+export type ZibriApplicationSecurityOptions = {
+    /**
+     * Some headers to set.
+     */
+    headers: {
+        /**
+         * Configuration for the strict transport security / hsts header.
+         */
+        [KnownHeader.STRICT_TRANSPORT_SECURITY]: boolean | HstsOptions
+    }
+};
+
 /**
  * All options for a Zibri application.
  */
@@ -35,6 +70,10 @@ export type ZibriApplicationOptions = {
      * The websocket controllers to register in the app.
      */
     websocketControllers: Newable<unknown>[],
+    /**
+     * Globals security settings, like eg. Hsts.
+     */
+    security?: DeepPartial<ZibriApplicationSecurityOptions>,
     /**
      * The data sources to register in the app.
      */

package/src/application.ts

@@ -1,9 +1,11 @@
 import { createServer, Server } from 'node:http';
+import { AddressInfo } from 'node:net';
 
+import cookieParser from 'cookie-parser';
 import cors from 'cors';
 import express, { RequestHandler } from 'express';
 
-import { ZibriApplicationOptions } from './application-options.model';
+import { HstsOptions, ZibriApplicationOptions, ZibriApplicationSecurityOptions } from './application-options.model';
 import { OtpTwoFactorMethod } from './auth/2fa/methods/otp/otp.two-factor-method';
 import { isTwoFactorMethod } from './auth/2fa/methods/two-factor-method.interface';
 import { isAuthStrategy } from './auth/strategies/auth-strategy.interface';
@@ -27,24 +29,37 @@ import { implementsOnAppInit } from './global/on-app-init.interface';
 import { implementsOnAppShutdown, OnAppShutdown } from './global/on-app-shutdown.interface';
 import { implementsOnAppStart } from './global/on-app-start.interface';
 import { HandlebarUtilities } from './handlebars/handlebar.utilities';
+import { KnownHeader } from './http/known-header.enum';
 import { LoggerInterface } from './logging/logger.interface';
 import { FormDataBodyParser } from './parsing/form-data/form-data.body-parser';
 import { JsonBodyParser } from './parsing/json/json.body-parser';
 import { ZibriPlugin } from './plugin/plugin.model';
 import { Route } from './routing/controller-route-configuration.model';
+import { DeepPartial } from './types/deep-partial.type';
 import { OmitStrict } from './types/omit-strict.type';
 import { FsUtilities } from './utilities/fs.utilities';
 import { Ms } from './utilities/ms';
+import { NumberUtilities } from './utilities/number.utilities';
 import { PromiseUtilities } from './utilities/promise.utilities';
 
 // eslint-disable-next-line jsdoc/require-jsdoc
-type FullZibriApplicationOptions = Required<OmitStrict<ZibriApplicationOptions, 'plugins'>>;
+type FullZibriApplicationOptions = Required<OmitStrict<ZibriApplicationOptions, 'plugins' | 'security'>> & {
+    // eslint-disable-next-line jsdoc/require-jsdoc
+    security: ZibriApplicationSecurityOptions
+};
 
 // eslint-disable-next-line typescript/typedef
 const SHUTDOWN_SIGNALS = ['SIGTERM', 'SIGINT', 'SIGHUP'] as const;
 
 const DEFAULT_SHUTDOWN_TIMEOUT_IN_MS: number = Ms.SECOND * 30;
 
+const defaultHstsOptions: HstsOptions = {
+    maxAgeSeconds: NumberUtilities.multiply(Ms.YEAR, 2).dividedBy(1000)
+        .toNumber(),
+    includeSubDomains: true,
+    preload: false
+};
+
 /**
  * A os signal that triggers the shutdown of a Zibri application.
  */
@@ -80,6 +95,29 @@ export class ZibriApplication {
     constructor(private readonly providedOptions: ZibriApplicationOptions) {
         this.options = this.createFullOptions();
 
+        this.use((req, res, next) => {
+            res.setHeader(KnownHeader.X_CONTENT_TYPE_OPTIONS, 'nosniff');
+            res.setHeader(KnownHeader.REFERRER_POLICY, 'strict-origin-when-cross-origin');
+
+            const hsts: boolean | HstsOptions = this.options.security.headers[KnownHeader.STRICT_TRANSPORT_SECURITY];
+            const isSecure: boolean = req.secure || req.headers[KnownHeader.X_FORWARDED_PROTO] === 'https';
+            if (isSecure && hsts !== false) {
+                const options: HstsOptions = hsts === true
+                    ? defaultHstsOptions
+                    : hsts;
+                res.setHeader(
+                    KnownHeader.STRICT_TRANSPORT_SECURITY,
+                    [
+                        `max-age=${options.maxAgeSeconds}`,
+                        ...options.includeSubDomains ? ['includeSubDomains'] : [],
+                        ...options.preload ? ['preload'] : []
+                    ].join('; ')
+                );
+            }
+
+            next();
+        });
+
         for (const signal of SHUTDOWN_SIGNALS) {
             const handler: () => void = () => void this.shutdown(signal);
             this.signalHandlers.set(signal, handler);
@@ -130,6 +168,12 @@ export class ZibriApplication {
         this.validateInjectables(injectables);
 
         await this.onAppInit(injectables);
+
+        const secret: string | undefined = inject(ZIBRI_DI_TOKENS.COOKIE_SIGN_SECRET);
+        if (secret) {
+            this.use(cookieParser(secret));
+        }
+
         await this.afterAppInit(injectables);
 
         for (const controller of this.options.controllers) {
@@ -168,6 +212,12 @@ export class ZibriApplication {
         this.use((req, _, next) => next(new UnmatchedRouteError(req.originalUrl)));
         this.use(inject(ZIBRI_DI_TOKENS.GLOBAL_ERROR_HANDLER));
         this.server.listen(port);
+        if (port === 0) {
+            const address: string | AddressInfo | null = this.server.address();
+            if (address != undefined && typeof address !== 'string') {
+                port = address.port;
+            }
+        }
         GlobalRegistry.markAppAsStarted();
         await this.logger.info(`${this.options.name} is running on port ${port}`);
     }
@@ -190,7 +240,10 @@ export class ZibriApplication {
                 for (const [signal, handler] of this.signalHandlers) {
                     process.off(signal, handler);
                 }
-                process.exit(0);
+                if (signal != undefined) {
+                    process.exit(0);
+                }
+                return;
             }
             case AppState.INITIALIZED:
             case AppState.STARTED: {
@@ -206,7 +259,10 @@ export class ZibriApplication {
                 await this.onAppShutdown(injectables, signal);
                 await this.afterAppShutdown(injectables, signal);
 
-                process.exit(0);
+                if (signal != undefined) {
+                    process.exit(0);
+                }
+                return;
             }
         }
     }
@@ -247,7 +303,8 @@ export class ZibriApplication {
         await Promise.all(elements.map(async e => {
             try {
                 const timeoutInMs: number = e.shutdownTimeoutInMs ?? DEFAULT_SHUTDOWN_TIMEOUT_IN_MS;
-                await PromiseUtilities.withTimeout(e.afterAppShutdown(this, signal), timeoutInMs);
+                // no abort signal here because stopping the api does that.
+                await PromiseUtilities.withTimeout(() => e.afterAppShutdown(this, signal), timeoutInMs);
             }
             catch (error) {
                 await this.logger.error(
@@ -264,7 +321,8 @@ export class ZibriApplication {
         await Promise.all(elements.map(async e => {
             try {
                 const timeoutInMs: number = e.shutdownTimeoutInMs ?? DEFAULT_SHUTDOWN_TIMEOUT_IN_MS;
-                await PromiseUtilities.withTimeout(e.onAppShutdown(this, signal), timeoutInMs);
+                // no abort signal here because stopping the api does that.
+                await PromiseUtilities.withTimeout(() => e.onAppShutdown(this, signal), timeoutInMs);
             }
             catch (error) {
                 await this.logger.error(
@@ -281,7 +339,8 @@ export class ZibriApplication {
         await Promise.all(elements.map(async e => {
             try {
                 const timeoutInMs: number = e.shutdownTimeoutInMs ?? DEFAULT_SHUTDOWN_TIMEOUT_IN_MS;
-                await PromiseUtilities.withTimeout(e.beforeAppShutdown(this, signal), timeoutInMs);
+                // no abort signal here because stopping the api does that.
+                await PromiseUtilities.withTimeout(() => e.beforeAppShutdown(this, signal), timeoutInMs);
             }
             catch (error) {
                 await this.logger.error(
@@ -346,6 +405,9 @@ export class ZibriApplication {
     }
 
     private createFullOptions(): FullZibriApplicationOptions {
+        // eslint-disable-next-line stylistic/max-len
+        const hsts: DeepPartial<HstsOptions> | boolean | undefined = this.providedOptions.security?.headers?.[KnownHeader.STRICT_TRANSPORT_SECURITY];
+
         const res: FullZibriApplicationOptions = {
             dataSources: [],
             authStrategies: [],
@@ -353,7 +415,17 @@ export class ZibriApplication {
             bodyParsers: [],
             providers: [],
             cronJobs: [],
-            ...this.providedOptions
+            ...this.providedOptions,
+            security: {
+                headers: {
+                    [KnownHeader.STRICT_TRANSPORT_SECURITY]: typeof hsts === 'boolean'
+                        ? hsts
+                        : {
+                            ...defaultHstsOptions,
+                            ...hsts
+                        }
+                }
+            }
         };
         for (const plugin of this.providedOptions.plugins ?? []) {
             // TODO: handle order of plugin initialization so that everything is available for DI inside the plugin constructor.

package/src/assets/asset.service.ts

@@ -61,12 +61,6 @@ export class AssetService implements AssetServiceInterface, OnAppInit {
             handler: () => FileResponse.fromPath(FsUtilities.getPath(this.publicAssetsPath, 'favicon.png'))
         });
 
-        // await app.router.registerRoute({
-        //     httpMethod: HttpMethod.GET,
-        //     route: '/favicon.ico',
-        //     handler: () => FileResponse.fromPath(FsUtilities.getPath(this.publicAssetsPath, 'favicon.png'))
-        // });
-
     }
 
     // eslint-disable-next-line jsdoc/require-jsdoc