Fix Build Error

dist/adapters/notification/core-api-client.js

@@ -0,0 +1,131 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CoreApiClient = exports.CoreApiClientError = void 0;
+class CoreApiClientError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.name = 'CoreApiClientError';
+        this.status = status;
+    }
+}
+exports.CoreApiClientError = CoreApiClientError;
+class CoreApiClient {
+    apiUrl;
+    clientId;
+    clientSecret;
+    timeoutMs;
+    cachedToken = null;
+    tokenExpiry = 0; // epoch ms
+    tokenMarginSec = 60; // safety margin in seconds
+    constructor(options) {
+        this.apiUrl = options?.apiUrl ?? process.env.RAYLAB_CORE_API_URL ?? 'http://localhost:3000';
+        this.clientId = options?.clientId ?? process.env.RAYLAB_BOT_CLIENT_ID ?? '';
+        this.clientSecret = options?.clientSecret ?? process.env.RAYLAB_BOT_CLIENT_SECRET ?? '';
+        this.timeoutMs = options?.timeoutMs ?? 5000;
+        if (!this.clientId || !this.clientSecret) {
+            // keep construction allowed but operations will fail with clear errors
+        }
+    }
+    async fetchWithTimeout(url, init) {
+        const controller = new AbortController();
+        const id = setTimeout(() => controller.abort(), this.timeoutMs);
+        try {
+            const res = await fetch(url, { ...init, signal: controller.signal });
+            return res;
+        }
+        finally {
+            clearTimeout(id);
+        }
+    }
+    isTokenValid() {
+        return !!this.cachedToken && Date.now() < this.tokenExpiry;
+    }
+    async requestAccessToken() {
+        if (!this.clientId || !this.clientSecret) {
+            throw new CoreApiClientError('Missing client credentials');
+        }
+        const url = `${this.apiUrl.replace(/\/$/, '')}/api/v1/auth/token`;
+        const body = JSON.stringify({ client_id: this.clientId, client_secret: this.clientSecret, grant_type: 'client_credentials' });
+        let res;
+        try {
+            res = await this.fetchWithTimeout(url, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body,
+            });
+        }
+        catch (err) {
+            if (err.name === 'AbortError') {
+                throw new CoreApiClientError('Request timeout');
+            }
+            throw new CoreApiClientError('Network error');
+        }
+        if (res.status === 401) {
+            throw new CoreApiClientError('Invalid client credentials', 401);
+        }
+        if (res.status >= 400) {
+            throw new CoreApiClientError(`Token request failed with status ${res.status}`, res.status);
+        }
+        const payload = await res.json();
+        // Expecting { success: true, data: { access_token, token_type, expires_in }, ... }
+        const data = payload?.data;
+        if (!data || !data.access_token) {
+            throw new CoreApiClientError('Invalid token response');
+        }
+        // Cache token
+        this.cachedToken = data.access_token;
+        const expiresIn = typeof data.expires_in === 'number' ? data.expires_in : parseInt(data.expires_in, 10) || 3600;
+        const effective = Math.max(0, expiresIn - this.tokenMarginSec);
+        this.tokenExpiry = Date.now() + effective * 1000;
+        return { access_token: data.access_token, token_type: data.token_type ?? 'Bearer', expires_in: expiresIn };
+    }
+    async getToken() {
+        if (this.isTokenValid()) {
+            return this.cachedToken;
+        }
+        const tokenResp = await this.requestAccessToken();
+        return tokenResp.access_token;
+    }
+    async authenticatedRequest(input, init, retry = true) {
+        const token = await this.getToken();
+        const headers = new Headers(init?.headers);
+        headers.set('Authorization', `Bearer ${token}`);
+        headers.set('Accept', 'application/json');
+        let res;
+        try {
+            res = await this.fetchWithTimeout(typeof input === 'string' ? input : input.url, {
+                ...init,
+                headers,
+            });
+        }
+        catch (err) {
+            if (err.name === 'AbortError') {
+                throw new CoreApiClientError('Request timeout');
+            }
+            throw new CoreApiClientError('Network error');
+        }
+        if (res.status === 401 && retry) {
+            // invalidate token and retry once
+            this.cachedToken = null;
+            this.tokenExpiry = 0;
+            try {
+                const newToken = await this.getToken();
+                const headers2 = new Headers(init?.headers);
+                headers2.set('Authorization', `Bearer ${newToken}`);
+                headers2.set('Accept', 'application/json');
+                const res2 = await this.fetchWithTimeout(typeof input === 'string' ? input : input.url, {
+                    ...init,
+                    headers: headers2,
+                });
+                return res2;
+            }
+            catch (e) {
+                throw e;
+            }
+        }
+        return res;
+    }
+}
+exports.CoreApiClient = CoreApiClient;
+//# sourceMappingURL=core-api-client.js.map

dist/adapters/notification/core-api-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-api-client.js","sourceRoot":"","sources":["../../../src/adapters/notification/core-api-client.ts"],"names":[],"mappings":";;;AAMA,MAAa,kBAAmB,SAAQ,KAAK;IACpC,MAAM,CAAU;IACvB,YAAY,OAAe,EAAE,MAAe;QAC1C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAPD,gDAOC;AAED,MAAa,aAAa;IAChB,MAAM,CAAS;IACf,QAAQ,CAAS;IACjB,YAAY,CAAS;IACrB,SAAS,CAAS;IAElB,WAAW,GAAkB,IAAI,CAAC;IAClC,WAAW,GAAW,CAAC,CAAC,CAAC,WAAW;IACpC,cAAc,GAAG,EAAE,CAAC,CAAC,2BAA2B;IAExD,YAAY,OAA2F;QACrG,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,uBAAuB,CAAC;QAC5F,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC;QAC5E,IAAI,CAAC,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,EAAE,CAAC;QACxF,IAAI,CAAC,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,IAAI,CAAC;QAE5C,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,uEAAuE;QACzE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,GAAW,EAAE,IAAiB;QAC3D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAChE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;YACrE,OAAO,GAAG,CAAC;QACb,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,YAAY;QAClB,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC;IAC7D,CAAC;IAEM,KAAK,CAAC,kBAAkB;QAC7B,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,MAAM,IAAI,kBAAkB,CAAC,4BAA4B,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC;QAElE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAE9H,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE;gBACrC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC9B,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,IAAI,kBAAkB,CAAC,eAAe,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,kBAAkB,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACtB,MAAM,IAAI,kBAAkB,CAAC,oCAAoC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7F,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACjC,mFAAmF;QACnF,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,CAAC;QAC3B,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAChC,MAAM,IAAI,kBAAkB,CAAC,wBAAwB,CAAC,CAAC;QACzD,CAAC;QAED,cAAc;QACd,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC;QACrC,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;QAChH,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/D,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;QAEjD,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IAC7G,CAAC;IAEM,KAAK,CAAC,QAAQ;QACnB,IAAI,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,WAAqB,CAAC;QACpC,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAClD,OAAO,SAAS,CAAC,YAAY,CAAC;IAChC,CAAC;IAEM,KAAK,CAAC,oBAAoB,CAAC,KAAkB,EAAE,IAAkB,EAAE,KAAK,GAAG,IAAI;QACpF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QAEpC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAsB,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QAE1C,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,KAAiB,CAAC,GAAG,EAAE;gBAC5F,GAAG,IAAI;gBACP,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC9B,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,IAAI,kBAAkB,CAAC,eAAe,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,EAAE,CAAC;YAChC,kCAAkC;YAClC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;YACxB,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACvC,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAsB,CAAC,CAAC;gBAC3D,QAAQ,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,QAAQ,EAAE,CAAC,CAAC;gBACpD,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;gBAC3C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,KAAiB,CAAC,GAAG,EAAE;oBACnG,GAAG,IAAI;oBACP,OAAO,EAAE,QAAQ;iBAClB,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,CAAC,CAAC;YACV,CAAC;QACH,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AArID,sCAqIC"}

dist/app.module.js

@@ -0,0 +1,62 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppModule = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const identity_module_1 = require("./modules/identity/identity.module");
+const auth_module_1 = require("./modules/auth/auth.module");
+const health_module_1 = require("./modules/health/health.module");
+const authorization_module_1 = require("./modules/authorization/authorization.module");
+const audit_module_1 = require("./modules/audit/audit.module");
+const application_module_1 = require("./modules/application/application.module");
+const debt_module_1 = require("./modules/bot-debt/debt.module");
+let AppModule = class AppModule {
+};
+exports.AppModule = AppModule;
+exports.AppModule = AppModule = __decorate([
+    (0, common_1.Module)({
+        imports: [
+            config_1.ConfigModule.forRoot({
+                isGlobal: true,
+                // Load .env files depending on NODE_ENV. Default to development .env
+                envFilePath: process.env.NODE_ENV === 'production' ? '.env.production' : '.env',
+                // Basic validation: ensure expected frontend URLs and OIDC settings are present
+                validate: (env) => {
+                    const errors = [];
+                    const nodeEnv = env.NODE_ENV || process.env.NODE_ENV || 'development';
+                    if (!env.FRONTEND_URL)
+                        errors.push('FRONTEND_URL is not set');
+                    if (nodeEnv === 'production' && !env.PRODUCTION_FRONTEND_URL)
+                        errors.push('PRODUCTION_FRONTEND_URL is not set');
+                    // OIDC required settings
+                    if (!env.AUTHENTIK_ISSUER)
+                        errors.push('AUTHENTIK_ISSUER is not set');
+                    if (!env.AUTHENTIK_CLIENT_ID)
+                        errors.push('AUTHENTIK_CLIENT_ID is not set');
+                    if (!env.AUTHENTIK_CLIENT_SECRET)
+                        errors.push('AUTHENTIK_CLIENT_SECRET is not set');
+                    if (!env.AUTHENTIK_REDIRECT_URI)
+                        errors.push('AUTHENTIK_REDIRECT_URI is not set');
+                    if (errors.length > 0)
+                        throw new Error('Environment validation error: ' + errors.join('; '));
+                    return env;
+                },
+            }),
+            identity_module_1.IdentityModule,
+            auth_module_1.AuthModule,
+            health_module_1.HealthModule,
+            // Authorization module provides permission checks and cache
+            authorization_module_1.AuthorizationModule,
+            audit_module_1.AuditModule,
+            application_module_1.ApplicationModule,
+            debt_module_1.DebtModule,
+        ],
+    })
+], AppModule);
+//# sourceMappingURL=app.module.js.map

dist/app.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.module.js","sourceRoot":"","sources":["../src/app.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,2CAA8C;AAE9C,wEAAoE;AACpE,4DAAwD;AACxD,kEAA8D;AAC9D,uFAAmF;AACnF,+DAA2D;AAC3D,iFAA6E;AAC7E,gEAA4D;AAwCrD,IAAM,SAAS,GAAf,MAAM,SAAS;CAAG,CAAA;AAAZ,8BAAS;oBAAT,SAAS;IArCrB,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,qBAAY,CAAC,OAAO,CAAC;gBAEf,QAAQ,EAAE,IAAI;gBACd,qEAAqE;gBACrE,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM;gBAC/E,gFAAgF;gBAChF,QAAQ,EAAE,CAAC,GAAwB,EAAE,EAAE;oBACrC,MAAM,MAAM,GAAa,EAAE,CAAC;oBAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,aAAa,CAAC;oBAEtE,IAAI,CAAC,GAAG,CAAC,YAAY;wBAAE,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;oBAC9D,IAAI,OAAO,KAAK,YAAY,IAAI,CAAC,GAAG,CAAC,uBAAuB;wBAAE,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;oBAEhH,yBAAyB;oBACzB,IAAI,CAAC,GAAG,CAAC,gBAAgB;wBAAE,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;oBACtE,IAAI,CAAC,GAAG,CAAC,mBAAmB;wBAAE,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;oBAC5E,IAAI,CAAC,GAAG,CAAC,uBAAuB;wBAAE,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;oBACpF,IAAI,CAAC,GAAG,CAAC,sBAAsB;wBAAE,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;oBAElF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;oBAC7F,OAAO,GAAG,CAAC;gBACb,CAAC;aACF,CAAC;YAEF,gCAAc;YACd,wBAAU;YACV,4BAAY;YACZ,4DAA4D;YACpD,0CAAmB;YACnB,0BAAW;YACX,sCAAiB;YACjB,wBAAU;SAEvB;KACF,CAAC;GACW,SAAS,CAAG"}

dist/core/auth/guards/jwt-auth.guard.js

@@ -0,0 +1,127 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwtAuthGuard = void 0;
+const common_1 = require("@nestjs/common");
+const jose_1 = require("jose");
+const identity_data_1 = require("../interfaces/identity-data");
+const jwt = __importStar(require("jsonwebtoken"));
+/**
+ * JwtAuthGuard verifies JWTs issued by the external Identity Provider (Authentik)
+ * using JWKS (RS256). It also accepts internal RayLab JWTs signed with a local secret.
+ */
+let JwtAuthGuard = class JwtAuthGuard {
+    jwks = null;
+    logger = new common_1.Logger('JwtAuthGuard');
+    constructor() { }
+    async canActivate(context) {
+        const request = context.switchToHttp().getRequest();
+        let token;
+        const authHeader = request.headers.authorization;
+        if (authHeader) {
+            const [type, t] = authHeader.split(' ');
+            if (type === 'Bearer' && t)
+                token = t;
+        }
+        // fallback to cookie if no Authorization header
+        if (!token) {
+            token = request.cookies?.raylab_jwt;
+            this.logger.debug(`No Authorization header. Trying cookie. cookiePresent=${!!request.cookies} tokenFromCookie=${!!token}`);
+        }
+        else {
+            this.logger.debug('Authorization header found. Using Bearer token.');
+        }
+        if (!token) {
+            this.logger.debug('No token found in Authorization header or cookie.');
+            throw new common_1.UnauthorizedException('Authorization token is missing.');
+        }
+        const jwksUri = process.env.AUTHENTIK_JWKS_URI;
+        // First try verifying with external JWKS (Authentik)
+        if (jwksUri) {
+            try {
+                if (!this.jwks)
+                    this.jwks = (0, jose_1.createRemoteJWKSet)(new URL(jwksUri));
+                const { payload } = await (0, jose_1.jwtVerify)(token, this.jwks, {
+                    issuer: process.env.AUTHENTIK_ISSUER,
+                    audience: process.env.AUTHENTIK_AUDIENCE,
+                });
+                const identity = new identity_data_1.IdentityData(payload.sub, payload.preferred_username, payload.email, payload);
+                request.identity = identity;
+                // mark as external (verified by Authentik JWKS)
+                request.identitySource = 'external';
+                this.logger.debug(`Verified token using external JWKS. sub=${payload.sub}`);
+                return true;
+            }
+            catch (err) {
+                this.logger.debug(`External JWKS verification failed: ${err.message}`);
+                // ignore and try internal verification
+            }
+        }
+        // Fallback: verify with internal symmetric secret
+        const secret = process.env.RAYLAB_JWT_SECRET;
+        if (!secret) {
+            this.logger.error('RAYLAB_JWT_SECRET is not configured.');
+            throw new common_1.UnauthorizedException('Invalid or expired token.');
+        }
+        try {
+            const payload = jwt.verify(token, secret);
+            const identity = new identity_data_1.IdentityData(payload.sub, payload.preferred_username, payload.email, payload);
+            request.identity = identity;
+            // mark as internal (verified by RayLab internal secret)
+            request.identitySource = 'internal';
+            this.logger.debug(`Verified token using internal secret. sub=${payload.sub}`);
+            return true;
+        }
+        catch (err) {
+            this.logger.debug(`Internal token verification failed: ${err.message}`);
+            throw new common_1.UnauthorizedException('Invalid or expired token.');
+        }
+    }
+};
+exports.JwtAuthGuard = JwtAuthGuard;
+exports.JwtAuthGuard = JwtAuthGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [])
+], JwtAuthGuard);
+//# sourceMappingURL=jwt-auth.guard.js.map

dist/core/auth/guards/jwt-auth.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-auth.guard.js","sourceRoot":"","sources":["../../../../src/core/auth/guards/jwt-auth.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAMwB;AAExB,+BAAqD;AACrD,+DAA2D;AAC3D,kDAAoC;AAEpC;;;GAGG;AAEI,IAAM,YAAY,GAAlB,MAAM,YAAY;IACf,IAAI,GAAiD,IAAI,CAAC;IACjD,MAAM,GAAG,IAAI,eAAM,CAAC,cAAc,CAAC,CAAC;IAErD,gBAAe,CAAC;IAEhB,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAyC,CAAC;QAEvF,IAAI,KAAyB,CAAC;QAElC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACjD,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC;gBAAE,KAAK,GAAG,CAAC,CAAC;QACxC,CAAC;QAED,gDAAgD;QAChD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAI,OAAe,CAAC,OAAO,EAAE,UAAU,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAE,OAAe,CAAC,OAAO,oBAAoB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACtI,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACvE,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAE3C,qDAAqD;QACzD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,IAAI;oBAAE,IAAI,CAAC,IAAI,GAAG,IAAA,yBAAkB,EAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;gBAEjE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE;oBACpD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;oBACpC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;iBACzC,CAAC,CAAC;gBAEK,MAAM,QAAQ,GAAG,IAAI,4BAAY,CACvC,OAAO,CAAC,GAAa,EACpB,OAAe,CAAC,kBAAwC,EACxD,OAAe,CAAC,KAA2B,EAC5C,OAA8B,CAC/B,CAAC;gBAEF,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;gBAC5B,gDAAgD;gBAC/C,OAAe,CAAC,cAAc,GAAG,UAAU,CAAC;gBAC7C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC5E,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAuC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;gBAClF,uCAAuC;YACzC,CAAC;QACH,CAAC;QAED,kDAAkD;QAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QACjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC1D,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,CAAC;YACG,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAQ,CAAC;YAEvD,MAAM,QAAQ,GAAG,IAAI,4BAAY,CAC/B,OAAO,CAAC,GAAa,EACrB,OAAO,CAAC,kBAAwC,EAChD,OAAO,CAAC,KAA2B,EACnC,OAA8B,CAC/B,CAAC;YAEF,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;YAC5B,wDAAwD;YACvD,OAAe,CAAC,cAAc,GAAG,UAAU,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YAC9E,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAwC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACnF,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;CACF,CAAA;AAvFY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;;GACA,YAAY,CAuFxB"}

dist/core/auth/interfaces/authenticated-request.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=authenticated-request.interface.js.map

dist/core/auth/interfaces/authenticated-request.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticated-request.interface.js","sourceRoot":"","sources":["../../../../src/core/auth/interfaces/authenticated-request.interface.ts"],"names":[],"mappings":""}

dist/core/config/database.config.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = () => ({
+    database: {
+        url: `postgresql://` +
+            `${process.env.DB_USER}:` +
+            `${process.env.DB_PASSWORD}@` +
+            `${process.env.SERVER_HOST}:` +
+            `${process.env.DB_PORT}/` +
+            `${process.env.DB_NAME}?schema=public`
+    }
+});
+//# sourceMappingURL=database.config.js.map

dist/core/config/database.config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.config.js","sourceRoot":"","sources":["../../../src/core/config/database.config.ts"],"names":[],"mappings":";;AAAA,kBAAe,GAAG,EAAE,CAAC,CAAC;IAClB,QAAQ,EAAE;QACN,GAAG,EACC,eAAe;YACf,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG;YACzB,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG;YAC7B,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG;YAC7B,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG;YACzB,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,gBAAgB;KAC7C;CACJ,CAAC,CAAC"}

dist/core/events/event-dispatcher.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EventDispatcher = void 0;
+class EventDispatcher {
+    publisher = new (require('./event-publisher').InMemoryEventPublisher)();
+    register(handler) {
+        this.publisher.register(handler);
+    }
+    async dispatch(event) {
+        await this.publisher.publish(event);
+    }
+}
+exports.EventDispatcher = EventDispatcher;
+//# sourceMappingURL=event-dispatcher.js.map

dist/core/events/event-dispatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-dispatcher.js","sourceRoot":"","sources":["../../../src/core/events/event-dispatcher.ts"],"names":[],"mappings":";;;AAEA,MAAa,eAAe;IAClB,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,sBAAsB,CAAC,EAAE,CAAC;IAEhF,QAAQ,CAAC,OAA0C;QACjD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAkB;QAC/B,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;CACF;AAVD,0CAUC"}

dist/core/events/event-handler.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=event-handler.js.map

dist/core/events/event-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-handler.js","sourceRoot":"","sources":["../../../src/core/events/event-handler.ts"],"names":[],"mappings":""}

dist/core/events/event-publisher.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InMemoryEventPublisher = void 0;
+class InMemoryEventPublisher {
+    handlers = [];
+    register(handler) {
+        this.handlers.push(handler);
+    }
+    async publish(event) {
+        await Promise.all(this.handlers.map((h) => h(event)));
+    }
+}
+exports.InMemoryEventPublisher = InMemoryEventPublisher;
+//# sourceMappingURL=event-publisher.js.map

dist/core/events/event-publisher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-publisher.js","sourceRoot":"","sources":["../../../src/core/events/event-publisher.ts"],"names":[],"mappings":";;;AAMA,MAAa,sBAAsB;IACzB,QAAQ,GAA6C,EAAE,CAAC;IAEhE,QAAQ,CAAC,OAA0C;QACjD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAkB;QAC9B,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;CACF;AAVD,wDAUC"}

dist/core/events/event.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=event.interface.js.map

dist/core/events/event.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"event.interface.js","sourceRoot":"","sources":["../../../src/core/events/event.interface.ts"],"names":[],"mappings":""}

dist/core/exceptions/http-exception.filter.js

@@ -0,0 +1,29 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HttpExceptionFilter = void 0;
+const common_1 = require("@nestjs/common");
+let HttpExceptionFilter = class HttpExceptionFilter {
+    catch(exception, host) {
+        const ctx = host.switchToHttp();
+        const response = ctx.getResponse();
+        const status = exception.getStatus ? exception.getStatus() : 500;
+        response.status(status).json({
+            success: false,
+            error: {
+                code: exception.code || 'INTERNAL_ERROR',
+                message: exception.message || 'Internal server error',
+            },
+        });
+    }
+};
+exports.HttpExceptionFilter = HttpExceptionFilter;
+exports.HttpExceptionFilter = HttpExceptionFilter = __decorate([
+    (0, common_1.Catch)()
+], HttpExceptionFilter);
+//# sourceMappingURL=http-exception.filter.js.map

dist/core/exceptions/http-exception.filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-exception.filter.js","sourceRoot":"","sources":["../../../src/core/exceptions/http-exception.filter.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAuE;AAGhE,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC9B,KAAK,CAAC,SAAc,EAAE,IAAmB;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAEjE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;YAC3B,OAAO,EAAE,KAAK;YACd,KAAK,EAAE;gBACL,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,gBAAgB;gBACxC,OAAO,EAAE,SAAS,CAAC,OAAO,IAAI,uBAAuB;aACtD;SACF,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAdY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,cAAK,GAAE;GACK,mBAAmB,CAc/B"}

dist/core/logger/logger.service.js

@@ -0,0 +1,11 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.logger = void 0;
+const pino_1 = __importDefault(require("pino"));
+exports.logger = (0, pino_1.default)({
+    level: process.env.LOG_LEVEL || 'info',
+});
+//# sourceMappingURL=logger.service.js.map

dist/core/logger/logger.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.service.js","sourceRoot":"","sources":["../../../src/core/logger/logger.service.ts"],"names":[],"mappings":";;;;;;AAAA,gDAAwB;AAEX,QAAA,MAAM,GAAG,IAAA,cAAI,EAAC;IACzB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,MAAM;CACvC,CAAC,CAAC"}

dist/core/middleware/request-id.middleware.js

@@ -0,0 +1,23 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RequestIdMiddleware = void 0;
+const common_1 = require("@nestjs/common");
+const uuid_1 = require("uuid");
+let RequestIdMiddleware = class RequestIdMiddleware {
+    use(req, res, next) {
+        req.requestId = req.headers['x-request-id'] || (0, uuid_1.v4)();
+        res.setHeader('X-Request-ID', req.requestId);
+        next();
+    }
+};
+exports.RequestIdMiddleware = RequestIdMiddleware;
+exports.RequestIdMiddleware = RequestIdMiddleware = __decorate([
+    (0, common_1.Injectable)()
+], RequestIdMiddleware);
+//# sourceMappingURL=request-id.middleware.js.map

dist/core/middleware/request-id.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-id.middleware.js","sourceRoot":"","sources":["../../../src/core/middleware/request-id.middleware.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAA4D;AAC5D,+BAAoC;AAG7B,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC9B,GAAG,CAAC,GAAQ,EAAE,GAAQ,EAAE,IAAgB;QACtC,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,IAAA,SAAM,GAAE,CAAC;QACxD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,EAAE,CAAC;IACT,CAAC;CACF,CAAA;AANY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,mBAAU,GAAE;GACA,mBAAmB,CAM/B"}

dist/main.js

@@ -0,0 +1,62 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const common_1 = require("@nestjs/common");
+const cookie_parser_1 = __importDefault(require("cookie-parser"));
+const core_1 = require("@nestjs/core");
+const config_1 = require("@nestjs/config");
+const swagger_1 = require("@nestjs/swagger");
+const app_module_1 = require("./app.module");
+async function bootstrap() {
+    const app = await core_1.NestFactory.create(app_module_1.AppModule);
+    const config = app.get(config_1.ConfigService);
+    const logger = new common_1.Logger('Bootstrap');
+    // enable cookie parser so req.cookies is populated
+    app.use((0, cookie_parser_1.default)());
+    app.setGlobalPrefix('');
+    app.useGlobalPipes(new common_1.ValidationPipe({
+        whitelist: true,
+        transform: true,
+        forbidNonWhitelisted: true,
+    }));
+    // CORS configuration: only allow configured frontend origins and enable credentials
+    const allowedOrigins = [];
+    const frontend = config.get('FRONTEND_URL');
+    const prodFrontend = config.get('PRODUCTION_FRONTEND_URL');
+    if (frontend)
+        allowedOrigins.push(frontend);
+    if (prodFrontend)
+        allowedOrigins.push(prodFrontend);
+    app.enableCors({
+        origin: allowedOrigins,
+        credentials: true,
+        methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],
+        allowedHeaders: [
+            'Content-Type',
+            'Authorization',
+            'Accept',
+            'Origin',
+            'X-Requested-With',
+        ],
+    });
+    const swaggerEnabled = config.get('SWAGGER_ENABLED') === 'true';
+    if (swaggerEnabled) {
+        const swaggerConfig = new swagger_1.DocumentBuilder()
+            .setTitle('RayLab Core API')
+            .setDescription('RayLab Core REST API')
+            .setVersion('1.0.0')
+            .addBearerAuth()
+            .build();
+        const document = swagger_1.SwaggerModule.createDocument(app, swaggerConfig);
+        swagger_1.SwaggerModule.setup('ApiList', app, document);
+    }
+    const port = config.get('PORT') || 3000;
+    logger.log(`Allowed CORS origins: ${JSON.stringify(allowedOrigins)}`);
+    logger.log(`Server listening on port ${port}`);
+    await app.listen(port);
+    logger.log(`Server running on http://localhost:${port}`);
+}
+bootstrap();
+//# sourceMappingURL=main.js.map

dist/main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";;;;;AAAA,2CAAwD;AACxD,kEAAyC;AACzC,uCAA2C;AAC3C,2CAA+C;AAC/C,6CAAiE;AAEjE,6CAAyC;AAEzC,KAAK,UAAU,SAAS;IACtB,MAAM,GAAG,GAAG,MAAM,kBAAW,CAAC,MAAM,CAAC,sBAAS,CAAC,CAAC;IAEhD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,sBAAa,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,WAAW,CAAC,CAAC;IAEvC,mDAAmD;IACnD,GAAG,CAAC,GAAG,CAAC,IAAA,uBAAY,GAAE,CAAC,CAAC;IAExB,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IAExB,GAAG,CAAC,cAAc,CAChB,IAAI,uBAAc,CAAC;QACjB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,IAAI;QACf,oBAAoB,EAAE,IAAI;KAC3B,CAAC,CACH,CAAC;IAEF,oFAAoF;IACpF,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAS,cAAc,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAS,yBAAyB,CAAC,CAAC;IACnE,IAAI,QAAQ;QAAE,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,YAAY;QAAE,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAEpD,GAAG,CAAC,UAAU,CAAC;QACb,MAAM,EAAE,cAAc;QACtB,WAAW,EAAE,IAAI;QACjB,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC;QAC7D,cAAc,EAAE;YACd,cAAc;YACd,eAAe;YACf,QAAQ;YACR,QAAQ;YACR,kBAAkB;SACnB;KACF,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAS,iBAAiB,CAAC,KAAK,MAAM,CAAC;IAExE,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,aAAa,GAAG,IAAI,yBAAe,EAAE;aACxC,QAAQ,CAAC,iBAAiB,CAAC;aAC3B,cAAc,CAAC,sBAAsB,CAAC;aACtC,UAAU,CAAC,OAAO,CAAC;aACnB,aAAa,EAAE;aACf,KAAK,EAAE,CAAC;QAEX,MAAM,QAAQ,GAAG,uBAAa,CAAC,cAAc,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAElE,uBAAa,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;IAEC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAS,MAAM,CAAC,IAAI,IAAI,CAAC;IAElD,MAAM,CAAC,GAAG,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IACtE,MAAM,CAAC,GAAG,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC;IAE/C,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAEvB,MAAM,CAAC,GAAG,CAAC,sCAAsC,IAAI,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,EAAE,CAAC"}

dist/modules/authorization/application/authorization.service.js

@@ -0,0 +1,2 @@
+"use strict";
+//# sourceMappingURL=authorization.service.js.map

dist/modules/authorization/application/authorization.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.service.js","sourceRoot":"","sources":["../../../../src/modules/authorization/application/authorization.service.ts"],"names":[],"mappings":""}

dist/modules/authorization/presentation/decorators/permission.decorator.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Permissions = void 0;
+const common_1 = require("@nestjs/common");
+const Permissions = (...permissions) => (0, common_1.SetMetadata)('permissions', permissions);
+exports.Permissions = Permissions;
+//# sourceMappingURL=permission.decorator.js.map

dist/modules/authorization/presentation/decorators/permission.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.decorator.js","sourceRoot":"","sources":["../../../../../src/modules/authorization/presentation/decorators/permission.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAA6C;AAEtC,MAAM,WAAW,GAAG,CAAC,GAAG,WAAqB,EAAE,EAAE,CACtD,IAAA,oBAAW,EAAC,aAAa,EAAE,WAAW,CAAC,CAAC;AAD7B,QAAA,WAAW,eACkB"}

dist/modules/authorization/presentation/guards/permission.guard.js

@@ -0,0 +1,46 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PermissionGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+let PermissionGuard = class PermissionGuard {
+    reflector;
+    constructor(reflector) {
+        this.reflector = reflector;
+    }
+    canActivate(context) {
+        const permissions = this.reflector.getAllAndOverride('permissions', [
+            context.getHandler(),
+            context.getClass(),
+        ]);
+        if (!permissions) {
+            return true;
+        }
+        const request = context.switchToHttp().getRequest();
+        const user = request.currentUser;
+        if (!user) {
+            throw new common_1.UnauthorizedException('Current user is missing.');
+        }
+        const hasAll = permissions.every((permission) => {
+            return user.hasPermission(permission);
+        });
+        if (!hasAll)
+            throw new common_1.ForbiddenException('Insufficient permissions.');
+        return true;
+    }
+};
+exports.PermissionGuard = PermissionGuard;
+exports.PermissionGuard = PermissionGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [core_1.Reflector])
+], PermissionGuard);
+//# sourceMappingURL=permission.guard.js.map

dist/modules/authorization/presentation/guards/permission.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.guard.js","sourceRoot":"","sources":["../../../../../src/modules/authorization/presentation/guards/permission.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAMwB;AACxB,uCAAyC;AAGlC,IAAM,eAAe,GAArB,MAAM,eAAe;IAEP;IADnB,YACmB,SAAoB;QAApB,cAAS,GAAT,SAAS,CAAW;IACpC,CAAC;IAEJ,WAAW,CAAC,OAAyB;QACnC,MAAM,WAAW,GACf,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC9B,aAAa,EACb;YACE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CACF,CAAC;QAEJ,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAS,CAAC;QAE3D,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC;QAEjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,0BAA0B,CAAC,CAAC;QAC9D,CAAC;QAEG,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE;YAClD,OAAO,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,2BAAkB,CAAC,2BAA2B,CAAC,CAAC;QAEvE,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAnCY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;qCAGmB,gBAAS;GAF5B,eAAe,CAmC3B"}

dist/modules/identity/application/handlers/create-user.handler.js

@@ -0,0 +1,26 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreateUserHandler = void 0;
+const common_1 = require("@nestjs/common");
+let CreateUserHandler = class CreateUserHandler {
+    constructor() { }
+    async execute(dto) {
+        // Legacy handler - creation via this path is deprecated. Use the new handlers under application/handlers/user.
+        throw new common_1.BadRequestException('Deprecated handler. User creation via this endpoint is not supported.');
+    }
+};
+exports.CreateUserHandler = CreateUserHandler;
+exports.CreateUserHandler = CreateUserHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [])
+], CreateUserHandler);
+//# sourceMappingURL=create-user.handler.js.map

dist/modules/identity/application/handlers/create-user.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-user.handler.js","sourceRoot":"","sources":["../../../../../src/modules/identity/application/handlers/create-user.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAiE;AAI1D,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC5B,gBAAe,CAAC;IAEhB,KAAK,CAAC,OAAO,CAAC,GAAkB;QAC9B,+GAA+G;QAC/G,MAAM,IAAI,4BAAmB,CAAC,uEAAuE,CAAC,CAAC;IACzG,CAAC;CACF,CAAA;AAPY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;;GACA,iBAAiB,CAO7B"}

dist/modules/identity/application/handlers/delete-user.handler.js

@@ -0,0 +1,36 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeleteUserHandler = void 0;
+const common_1 = require("@nestjs/common");
+const user_repository_interface_1 = require("../../domain/repositories/user.repository.interface");
+let DeleteUserHandler = class DeleteUserHandler {
+    userRepository;
+    constructor(userRepository) {
+        this.userRepository = userRepository;
+    }
+    async execute(id) {
+        const user = await this.userRepository.findById(id);
+        if (!user) {
+            throw new common_1.NotFoundException('User not found.');
+        }
+        user.delete();
+        await this.userRepository.update(user);
+        // TODO:
+        // Publish UserDeletedEvent
+    }
+};
+exports.DeleteUserHandler = DeleteUserHandler;
+exports.DeleteUserHandler = DeleteUserHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [user_repository_interface_1.UserRepository])
+], DeleteUserHandler);
+//# sourceMappingURL=delete-user.handler.js.map

dist/modules/identity/application/handlers/delete-user.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete-user.handler.js","sourceRoot":"","sources":["../../../../../src/modules/identity/application/handlers/delete-user.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAGwB;AAExB,mGAAqF;AAG9E,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAET;IADnB,YACmB,cAA8B;QAA9B,mBAAc,GAAd,cAAc,CAAgB;IAC9C,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAEpD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,0BAAiB,CAAC,iBAAiB,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;QAEd,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAEvC,QAAQ;QACR,2BAA2B;IAC7B,CAAC;CACF,CAAA;AAnBY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAGwB,0CAAc;GAFtC,iBAAiB,CAmB7B"}

dist/modules/identity/application/handlers/find-user.handler.js

@@ -0,0 +1,33 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FindUserHandler = void 0;
+const common_1 = require("@nestjs/common");
+const user_repository_interface_1 = require("../../domain/repositories/user.repository.interface");
+let FindUserHandler = class FindUserHandler {
+    userRepository;
+    constructor(userRepository) {
+        this.userRepository = userRepository;
+    }
+    async execute(id) {
+        const user = await this.userRepository.findById(id);
+        if (!user) {
+            throw new common_1.NotFoundException('User not found.');
+        }
+        return user;
+    }
+};
+exports.FindUserHandler = FindUserHandler;
+exports.FindUserHandler = FindUserHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [user_repository_interface_1.UserRepository])
+], FindUserHandler);
+//# sourceMappingURL=find-user.handler.js.map

dist/modules/identity/application/handlers/find-user.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-user.handler.js","sourceRoot":"","sources":["../../../../../src/modules/identity/application/handlers/find-user.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAGwB;AAExB,mGAAqF;AAI9E,IAAM,eAAe,GAArB,MAAM,eAAe;IAEP;IADnB,YACmB,cAA8B;QAA9B,mBAAc,GAAd,cAAc,CAAgB;IAC9C,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAEpD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,0BAAiB,CAAC,iBAAiB,CAAC,CAAC;QACjD,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAdY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;qCAGwB,0CAAc;GAFtC,eAAe,CAc3B"}

dist/modules/identity/application/handlers/find-users.handler.js

@@ -0,0 +1,29 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FindUsersHandler = void 0;
+const common_1 = require("@nestjs/common");
+const user_repository_interface_1 = require("../../domain/repositories/user.repository.interface");
+let FindUsersHandler = class FindUsersHandler {
+    userRepository;
+    constructor(userRepository) {
+        this.userRepository = userRepository;
+    }
+    async execute() {
+        return await this.userRepository.findAll();
+    }
+};
+exports.FindUsersHandler = FindUsersHandler;
+exports.FindUsersHandler = FindUsersHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [user_repository_interface_1.UserRepository])
+], FindUsersHandler);
+//# sourceMappingURL=find-users.handler.js.map

dist/modules/identity/application/handlers/find-users.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"find-users.handler.js","sourceRoot":"","sources":["../../../../../src/modules/identity/application/handlers/find-users.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAE5C,mGAAqF;AAI9E,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAER;IADnB,YACmB,cAA8B;QAA9B,mBAAc,GAAd,cAAc,CAAgB;IAC9C,CAAC;IAEJ,KAAK,CAAC,OAAO;QACX,OAAO,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;IAC7C,CAAC;CACF,CAAA;AARY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;qCAGwB,0CAAc;GAFtC,gBAAgB,CAQ5B"}

dist/modules/identity/application/handlers/login.handler.js

@@ -0,0 +1,96 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LoginHandler = void 0;
+const common_1 = require("@nestjs/common");
+const bcrypt = __importStar(require("bcrypt"));
+const jwt_1 = require("@nestjs/jwt");
+const user_repository_interface_1 = require("../../domain/repositories/user.repository.interface");
+let LoginHandler = class LoginHandler {
+    userRepository;
+    jwtService;
+    constructor(userRepository, jwtService) {
+        this.userRepository = userRepository;
+        this.jwtService = jwtService;
+    }
+    async execute(dto) {
+        const user = await this.userRepository.findByEmail(dto.email);
+        // Generic error message for security
+        const unauthorizedMsg = 'Invalid credentials.';
+        if (!user) {
+            throw new common_1.UnauthorizedException(unauthorizedMsg);
+        }
+        const isMatch = await bcrypt.compare(dto.password, user.password);
+        if (!isMatch) {
+            throw new common_1.UnauthorizedException(unauthorizedMsg);
+        }
+        // Build payload according to existing JwtPayload interface
+        const metadata = user.metadata ?? {};
+        const role = typeof metadata.role === 'string' ? metadata.role : 'USER';
+        const permissions = Array.isArray(metadata.permissions) ? metadata.permissions : [];
+        const payload = {
+            sub: user.id,
+            email: user.email,
+            role,
+            permissions,
+        };
+        const accessToken = await this.jwtService.signAsync(payload);
+        return {
+            access_token: accessToken,
+            expires_in: '1d',
+            user: {
+                id: user.id,
+                name: user.name,
+                email: user.email,
+            },
+        };
+    }
+};
+exports.LoginHandler = LoginHandler;
+exports.LoginHandler = LoginHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [user_repository_interface_1.UserRepository,
+        jwt_1.JwtService])
+], LoginHandler);
+//# sourceMappingURL=login.handler.js.map

dist/modules/identity/application/handlers/login.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.handler.js","sourceRoot":"","sources":["../../../../../src/modules/identity/application/handlers/login.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAmE;AACnE,+CAAiC;AACjC,qCAAyC;AAGzC,mGAAqF;AAG9E,IAAM,YAAY,GAAlB,MAAM,YAAY;IAEJ;IACA;IAFnB,YACmB,cAA8B,EAC9B,UAAsB;QADtB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,eAAU,GAAV,UAAU,CAAY;IACtC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,GAAa;QACzB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAE9D,qCAAqC;QACrC,MAAM,eAAe,GAAG,sBAAsB,CAAC;QAE/C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,eAAe,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAElE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,8BAAqB,CAAC,eAAe,CAAC,CAAC;QACnD,CAAC;QAED,2DAA2D;QAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QAErC,MAAM,IAAI,GAAG,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QAExE,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QAEpF,MAAM,OAAO,GAAG;YACd,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI;YACJ,WAAW;SACZ,CAAC;QAEF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAE7D,OAAO;YACL,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE;gBACJ,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AAhDY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;qCAGwB,0CAAc;QAClB,gBAAU;GAH9B,YAAY,CAgDxB"}

dist/modules/identity/application/handlers/token.handler.js

@@ -0,0 +1,103 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenHandler = void 0;
+const common_1 = require("@nestjs/common");
+const bcrypt = __importStar(require("bcrypt"));
+const jwt_1 = require("@nestjs/jwt");
+const service_account_repository_interface_1 = require("../../domain/repositories/service-account.repository.interface");
+let TokenHandler = class TokenHandler {
+    serviceAccountRepository;
+    jwtService;
+    constructor(serviceAccountRepository, jwtService) {
+        this.serviceAccountRepository = serviceAccountRepository;
+        this.jwtService = jwtService;
+    }
+    async execute(body) {
+        const { client_id, client_secret, grant_type } = body;
+        if (grant_type !== 'client_credentials') {
+            throw new common_1.BadRequestException('Invalid grant_type.');
+        }
+        const unauthorizedMsg = 'Invalid client credentials.';
+        if (!client_id || !client_secret) {
+            throw new common_1.UnauthorizedException(unauthorizedMsg);
+        }
+        const serviceAccount = await this.serviceAccountRepository.findByClientId(client_id);
+        if (!serviceAccount) {
+            // generic error
+            throw new common_1.UnauthorizedException(unauthorizedMsg);
+        }
+        // check status
+        if (serviceAccount.status !== 'ACTIVE') {
+            throw new common_1.UnauthorizedException(unauthorizedMsg);
+        }
+        const match = await bcrypt.compare(client_secret, serviceAccount.clientSecretHash);
+        if (!match) {
+            throw new common_1.UnauthorizedException(unauthorizedMsg);
+        }
+        const payload = {
+            sub: serviceAccount.id,
+            client_id: serviceAccount.clientId,
+            // existing JwtPayload expects email; provide empty string to remain compatible
+            email: '',
+            role: serviceAccount.role,
+            permissions: serviceAccount.permissions ?? [],
+        };
+        const accessToken = await this.jwtService.signAsync(payload, {
+            expiresIn: '1h',
+        });
+        return {
+            access_token: accessToken,
+            token_type: 'Bearer',
+            expires_in: 3600,
+        };
+    }
+};
+exports.TokenHandler = TokenHandler;
+exports.TokenHandler = TokenHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [service_account_repository_interface_1.ServiceAccountRepository,
+        jwt_1.JwtService])
+], TokenHandler);
+//# sourceMappingURL=token.handler.js.map

dist/modules/identity/application/handlers/token.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.handler.js","sourceRoot":"","sources":["../../../../../src/modules/identity/application/handlers/token.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAwF;AACxF,+CAAiC;AACjC,qCAAyC;AACzC,yHAA0G;AAGnG,IAAM,YAAY,GAAlB,MAAM,YAAY;IAEJ;IACA;IAFnB,YACmB,wBAAkD,EAClD,UAAsB;QADtB,6BAAwB,GAAxB,wBAAwB,CAA0B;QAClD,eAAU,GAAV,UAAU,CAAY;IACtC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,IAAyE;QACrF,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;QAEtD,IAAI,UAAU,KAAK,oBAAoB,EAAE,CAAC;YACxC,MAAM,IAAI,4BAAmB,CAAC,qBAAqB,CAAC,CAAC;QACvD,CAAC;QAED,MAAM,eAAe,GAAG,6BAA6B,CAAC;QAEtD,IAAI,CAAC,SAAS,IAAI,CAAC,aAAa,EAAE,CAAC;YACjC,MAAM,IAAI,8BAAqB,CAAC,eAAe,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAErF,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,gBAAgB;YAChB,MAAM,IAAI,8BAAqB,CAAC,eAAe,CAAC,CAAC;QACnD,CAAC;QAED,eAAe;QACf,IAAI,cAAc,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,IAAI,8BAAqB,CAAC,eAAe,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,cAAc,CAAC,gBAAgB,CAAC,CAAC;QAEnF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,8BAAqB,CAAC,eAAe,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,OAAO,GAAQ;YACnB,GAAG,EAAE,cAAc,CAAC,EAAE;YACtB,SAAS,EAAE,cAAc,CAAC,QAAQ;YAClC,+EAA+E;YAC/E,KAAK,EAAE,EAAE;YACT,IAAI,EAAE,cAAc,CAAC,IAAI;YACzB,WAAW,EAAE,cAAc,CAAC,WAAW,IAAI,EAAE;SAC9C,CAAC;QAEF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE;YAC3D,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QAEH,OAAO;YACL,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,IAAI;SACjB,CAAC;IACJ,CAAC;CACF,CAAA;AAxDY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;qCAGkC,+DAAwB;QACtC,gBAAU;GAH9B,YAAY,CAwDxB"}

dist/modules/identity/application/handlers/update-user.handler.js

@@ -0,0 +1,26 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UpdateUserHandler = void 0;
+const common_1 = require("@nestjs/common");
+let UpdateUserHandler = class UpdateUserHandler {
+    constructor() { }
+    async execute(id, dto) {
+        // Legacy handler - deprecated. Use new handlers under application/handlers/user.
+        throw new common_1.BadRequestException('Deprecated handler.');
+    }
+};
+exports.UpdateUserHandler = UpdateUserHandler;
+exports.UpdateUserHandler = UpdateUserHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [])
+], UpdateUserHandler);
+//# sourceMappingURL=update-user.handler.js.map

dist/modules/identity/application/handlers/update-user.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-user.handler.js","sourceRoot":"","sources":["../../../../../src/modules/identity/application/handlers/update-user.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAiE;AAI1D,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC5B,gBAAe,CAAC;IAEhB,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,GAAkB;QAC1C,iFAAiF;QACjF,MAAM,IAAI,4BAAmB,CAAC,qBAAqB,CAAC,CAAC;IACvD,CAAC;CACF,CAAA;AAPY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;;GACA,iBAAiB,CAO7B"}

dist/modules/identity/domain/entities/service-account.entity.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServiceAccount = void 0;
+class ServiceAccount {
+    id;
+    clientId;
+    clientSecretHash;
+    name;
+    role;
+    permissions;
+    status;
+    metadata;
+    constructor(id, clientId, clientSecretHash, name, role, permissions, status, metadata) {
+        this.id = id;
+        this.clientId = clientId;
+        this.clientSecretHash = clientSecretHash;
+        this.name = name;
+        this.role = role;
+        this.permissions = permissions;
+        this.status = status;
+        this.metadata = metadata;
+    }
+    static create(data) {
+        return new ServiceAccount(crypto.randomUUID(), data.clientId, data.clientSecretHash, data.name, data.role, data.permissions, 'ACTIVE', data.metadata);
+    }
+    static restore(data) {
+        return new ServiceAccount(data.id, data.clientId, data.clientSecretHash, data.name, data.role, data.permissions, data.status, data.metadata);
+    }
+    disable() {
+        this.status = 'DISABLED';
+    }
+    enable() {
+        this.status = 'ACTIVE';
+    }
+}
+exports.ServiceAccount = ServiceAccount;
+//# sourceMappingURL=service-account.entity.js.map

dist/modules/identity/domain/entities/service-account.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-account.entity.js","sourceRoot":"","sources":["../../../../../src/modules/identity/domain/entities/service-account.entity.ts"],"names":[],"mappings":";;;AAAA,MAAa,cAAc;IAEP;IACT;IACA;IACA;IACA;IACA;IACA;IACA;IART,YACkB,EAAU,EACnB,QAAgB,EAChB,gBAAwB,EACxB,IAAY,EACZ,IAAY,EACZ,WAAqB,EACrB,MAAc,EACd,QAA8B;QAPrB,OAAE,GAAF,EAAE,CAAQ;QACnB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,qBAAgB,GAAhB,gBAAgB,CAAQ;QACxB,SAAI,GAAJ,IAAI,CAAQ;QACZ,SAAI,GAAJ,IAAI,CAAQ;QACZ,gBAAW,GAAX,WAAW,CAAU;QACrB,WAAM,GAAN,MAAM,CAAQ;QACd,aAAQ,GAAR,QAAQ,CAAsB;IACpC,CAAC;IAEJ,MAAM,CAAC,MAAM,CAAC,IAOb;QACC,OAAO,IAAI,cAAc,CACvB,MAAM,CAAC,UAAU,EAAE,EACnB,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,WAAW,EAChB,QAAQ,EACR,IAAI,CAAC,QAAQ,CACd,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,IASd;QACC,OAAO,IAAI,cAAc,CACvB,IAAI,CAAC,EAAE,EACP,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,QAAQ,CACd,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC;IAC3B,CAAC;IAED,MAAM;QACJ,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC;IACzB,CAAC;CACF;AA7DD,wCA6DC"}

dist/modules/identity/domain/entities/user.entity.js

@@ -0,0 +1,113 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserData = exports.User = void 0;
+class User {
+    id;
+    name;
+    email;
+    password;
+    metadata;
+    constructor(id, name, email, password, metadata) {
+        this.id = id;
+        this.name = name;
+        this.email = email;
+        this.password = password;
+        this.metadata = metadata;
+    }
+    static create(data) {
+        return new User(crypto.randomUUID(), data.name, data.email, data.password, data.metadata);
+    }
+    delete() {
+        // Business Rule
+    }
+    changeEmail(email) {
+        this.email = email;
+    }
+    changeName(name) {
+        this.name = name;
+    }
+    changePassword(newPassword) {
+        this.password = newPassword;
+    }
+    static restore(data) {
+        return new User(data.id, data.name, data.email, data.password, data.metadata);
+    }
+}
+exports.User = User;
+class UserData {
+    id;
+    authentikId;
+    username;
+    email;
+    name;
+    roles;
+    permissions;
+    isActive;
+    deletedAt;
+    lastSeenAt;
+    lastSyncedAt;
+    syncStatus;
+    storageQuota;
+    storageUsed;
+    constructor(id, authentikId, username, email, name, roles, permissions, isActive, deletedAt, lastSeenAt, lastSyncedAt, syncStatus, storageQuota, storageUsed) {
+        this.id = id;
+        this.authentikId = authentikId;
+        this.username = username;
+        this.email = email;
+        this.name = name;
+        this.roles = roles;
+        this.permissions = permissions;
+        this.isActive = isActive;
+        this.deletedAt = deletedAt;
+        this.lastSeenAt = lastSeenAt;
+        this.lastSyncedAt = lastSyncedAt;
+        this.syncStatus = syncStatus;
+        this.storageQuota = storageQuota;
+        this.storageUsed = storageUsed;
+    }
+    static create(data) {
+        return new UserData(crypto.randomUUID(), data.authentikId ?? null, data.username, data.email ?? '', data.name ?? data.username, [], [], true, null, null, null, null, data.storageQuota ?? null, data.storageUsed ?? null);
+    }
+    static restore(props) {
+        return new UserData(props.id, props.authentikId ?? null, props.username, props.email, props.name ?? props.username, props.roles || [], props.permissions || [], props.isActive ?? true, props.deletedAt ?? null, props.lastSeenAt ?? null, props.lastSyncedAt ?? null, props.syncStatus ?? null, props.storageQuota ?? null, props.storageUsed ?? null);
+    }
+    assignRole(role) {
+        if (this.roles.some(r => r.id && r.id === role.id))
+            return;
+        this.roles.push(role);
+    }
+    removeRole(roleId) {
+        const idx = this.roles.findIndex(r => r.id === roleId);
+        if (idx === -1)
+            return;
+        this.roles.splice(idx, 1);
+    }
+    assignPermission(permission) {
+        if (this.permissions.some(p => p.id && p.id === permission.id))
+            return;
+        this.permissions.push(permission);
+    }
+    removePermission(permissionId) {
+        const idx = this.permissions.findIndex(p => p.id === permissionId);
+        if (idx === -1)
+            return;
+        this.permissions.splice(idx, 1);
+    }
+    changeEmail(email) {
+        this.email = email;
+    }
+    changeUsername(username) {
+        this.username = username;
+    }
+    touchLastSeen() {
+        this.lastSeenAt = new Date();
+    }
+    setStorageQuota(q) {
+        this.storageQuota = q;
+    }
+    setStorageUsed(u) {
+        this.storageUsed = u;
+    }
+}
+exports.UserData = UserData;
+//# sourceMappingURL=user.entity.js.map

dist/modules/identity/domain/entities/user.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.entity.js","sourceRoot":"","sources":["../../../../../src/modules/identity/domain/entities/user.entity.ts"],"names":[],"mappings":";;;AAAA,MAAa,IAAI;IAEG;IACT;IACA;IACA;IACA;IALT,YACkB,EAAU,EACnB,IAAY,EACZ,KAAa,EACb,QAAgB,EAChB,QAA8B;QAJrB,OAAE,GAAF,EAAE,CAAQ;QACnB,SAAI,GAAJ,IAAI,CAAQ;QACZ,UAAK,GAAL,KAAK,CAAQ;QACb,aAAQ,GAAR,QAAQ,CAAQ;QAChB,aAAQ,GAAR,QAAQ,CAAsB;IACpC,CAAC;IAEJ,MAAM,CAAC,MAAM,CAAC,IAKb;QACC,OAAO,IAAI,IAAI,CACb,MAAM,CAAC,UAAU,EAAE,EACnB,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,QAAQ,CACd,CAAC;IACJ,CAAC;IAED,MAAM;QACJ,gBAAgB;IAClB,CAAC;IAED,WAAW,CAAC,KAAa;QACvB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,UAAU,CAAC,IAAY;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,cAAc,CAAC,WAAmB;QAChC,IAAI,CAAC,QAAQ,GAAG,WAAW,CAAC;IAC9B,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,IAMd;QACC,OAAO,IAAI,IAAI,CACb,IAAI,CAAC,EAAE,EACP,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,QAAQ,CACd,CAAC;IACJ,CAAC;CACF;AAvDD,oBAuDC;AAED,MAAa,QAAQ;IAED;IACT;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IAdT,YACkB,EAAU,EACnB,WAA0B,EAC1B,QAAgB,EAChB,KAAa,EACb,IAAmB,EACnB,KAAY,EACZ,WAAkB,EAClB,QAAiB,EACjB,SAAsB,EACtB,UAAwB,EACxB,YAA0B,EAC1B,UAA0B,EAC1B,YAA4B,EAC5B,WAA2B;QAblB,OAAE,GAAF,EAAE,CAAQ;QACnB,gBAAW,GAAX,WAAW,CAAe;QAC1B,aAAQ,GAAR,QAAQ,CAAQ;QAChB,UAAK,GAAL,KAAK,CAAQ;QACb,SAAI,GAAJ,IAAI,CAAe;QACnB,UAAK,GAAL,KAAK,CAAO;QACZ,gBAAW,GAAX,WAAW,CAAO;QAClB,aAAQ,GAAR,QAAQ,CAAS;QACjB,cAAS,GAAT,SAAS,CAAa;QACtB,eAAU,GAAV,UAAU,CAAc;QACxB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,eAAU,GAAV,UAAU,CAAgB;QAC1B,iBAAY,GAAZ,YAAY,CAAgB;QAC5B,gBAAW,GAAX,WAAW,CAAgB;IACjC,CAAC;IAEJ,MAAM,CAAC,MAAM,CAAC,IAOb;QACC,OAAO,IAAI,QAAQ,CACjB,MAAM,CAAC,UAAU,EAAE,EACnB,IAAI,CAAC,WAAW,IAAI,IAAI,EACxB,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,KAAK,IAAI,EAAE,EAChB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,EAC1B,EAAE,EACF,EAAE,EACF,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,IAAI,CAAC,YAAY,IAAI,IAAI,EACzB,IAAI,CAAC,WAAW,IAAI,IAAI,CACzB,CAAC;IACJ,CAAC;IAEC,MAAM,CAAC,OAAO,CAAC,KAehB;QACC,OAAO,IAAI,QAAQ,CACjB,KAAK,CAAC,EAAE,EACR,KAAK,CAAC,WAAW,IAAI,IAAI,EACzB,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,EAC5B,KAAK,CAAC,KAAK,IAAI,EAAE,EACjB,KAAK,CAAC,WAAW,IAAI,EAAE,EACvB,KAAK,CAAC,QAAQ,IAAI,IAAI,EACtB,KAAK,CAAC,SAAS,IAAI,IAAI,EACvB,KAAK,CAAC,UAAU,IAAI,IAAI,EACxB,KAAK,CAAC,YAAY,IAAI,IAAI,EAC1B,KAAK,CAAC,UAAU,IAAI,IAAI,EACxB,KAAK,CAAC,YAAY,IAAI,IAAI,EAC1B,KAAK,CAAC,WAAW,IAAI,IAAI,CAC1B,CAAC;IACJ,CAAC;IAED,UAAU,CAAC,IAAS;QAClB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO;QAC3D,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,UAAU,CAAC,MAAc;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;QACvD,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,OAAO;QACvB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,gBAAgB,CAAC,UAAe;QAC9B,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE,CAAC;YAAE,OAAO;QACvE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;IAED,gBAAgB,CAAC,YAAoB;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC;QACnE,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,OAAO;QACvB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAClC,CAAC;IAED,WAAW,CAAC,KAAa;QACvB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,cAAc,CAAC,QAAgB;QAC7B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,aAAa;QACX,IAAI,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;IAC/B,CAAC;IAED,eAAe,CAAC,CAAS;QACvB,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,cAAc,CAAC,CAAS;QACtB,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;IACvB,CAAC;CACF;AAvHD,4BAuHC"}

dist/modules/identity/domain/events/user-created.event.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserCreatedEvent = void 0;
+class UserCreatedEvent {
+    payload;
+    name = 'UserCreated';
+    occurredAt = new Date();
+    constructor(payload) {
+        this.payload = payload;
+    }
+}
+exports.UserCreatedEvent = UserCreatedEvent;
+//# sourceMappingURL=user-created.event.js.map

dist/modules/identity/domain/events/user-created.event.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-created.event.js","sourceRoot":"","sources":["../../../../../src/modules/identity/domain/events/user-created.event.ts"],"names":[],"mappings":";;;AAEA,MAAa,gBAAgB;IAGC;IAFnB,IAAI,GAAG,aAAa,CAAC;IACrB,UAAU,GAAS,IAAI,IAAI,EAAE,CAAC;IACvC,YAA4B,OAAiF;QAAjF,YAAO,GAAP,OAAO,CAA0E;IAAG,CAAC;CAClH;AAJD,4CAIC"}

dist/modules/identity/domain/events/user-deleted.event.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserDeletedEvent = void 0;
+class UserDeletedEvent {
+    payload;
+    occurredAt;
+    name = 'UserDeleted';
+    constructor(payload, occurredAt = new Date()) {
+        this.payload = payload;
+        this.occurredAt = occurredAt;
+    }
+}
+exports.UserDeletedEvent = UserDeletedEvent;
+//# sourceMappingURL=user-deleted.event.js.map

dist/modules/identity/domain/events/user-deleted.event.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-deleted.event.js","sourceRoot":"","sources":["../../../../../src/modules/identity/domain/events/user-deleted.event.ts"],"names":[],"mappings":";;;AAEA,MAAa,gBAAgB;IAEC;IAA8B;IADjD,IAAI,GAAG,aAAa,CAAC;IAC9B,YAA4B,OAAY,EAAkB,aAAmB,IAAI,IAAI,EAAE;QAA3D,YAAO,GAAP,OAAO,CAAK;QAAkB,eAAU,GAAV,UAAU,CAAmB;IAAG,CAAC;CAC5F;AAHD,4CAGC"}

dist/modules/identity/domain/repositories/service-account.repository.interface.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServiceAccountRepository = void 0;
+class ServiceAccountRepository {
+}
+exports.ServiceAccountRepository = ServiceAccountRepository;
+//# sourceMappingURL=service-account.repository.interface.js.map

dist/modules/identity/domain/repositories/service-account.repository.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-account.repository.interface.js","sourceRoot":"","sources":["../../../../../src/modules/identity/domain/repositories/service-account.repository.interface.ts"],"names":[],"mappings":";;;AAEA,MAAsB,wBAAwB;CAQ7C;AARD,4DAQC"}

dist/modules/identity/domain/repositories/user.repository.interface.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserRepository = void 0;
+class UserRepository {
+}
+exports.UserRepository = UserRepository;
+//# sourceMappingURL=user.repository.interface.js.map

dist/modules/identity/domain/repositories/user.repository.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.repository.interface.js","sourceRoot":"","sources":["../../../../../src/modules/identity/domain/repositories/user.repository.interface.ts"],"names":[],"mappings":";;;AAEA,MAAsB,cAAc;CAgBnC;AAhBD,wCAgBC"}

dist/modules/identity/identity.module.js

@@ -0,0 +1,75 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityModule = void 0;
+const common_1 = require("@nestjs/common");
+const users_controller_1 = require("./presentation/controllers/users.controller");
+const prisma_service_1 = require("../../shared/prisma.service");
+const prisma_user_repository_1 = require("./infrastructure/repositories/prisma-user.repository");
+const user_interface_1 = require("./domain/repositories/user.interface");
+const event_dispatcher_1 = require("../../core/events/event-dispatcher");
+const jwt_auth_guard_1 = require("../../core/auth/guards/jwt-auth.guard");
+const jwt_1 = require("@nestjs/jwt");
+const create_user_handler_1 = require("./application/handlers/user/create-user.handler");
+const get_user_handler_1 = require("./application/handlers/user/get-user.handler");
+const delete_user_handler_1 = require("./application/handlers/user/delete-user.handler");
+const get_users_handler_1 = require("./application/handlers/user/get-users.handler");
+const update_user_handler_1 = require("./application/handlers/user/update-user.handler");
+const permission_guard_1 = require("../authorization/presentation/guards/permission.guard");
+const core_1 = require("@nestjs/core");
+const login_handler_1 = require("./application/handlers/login.handler");
+const auth_controller_1 = require("./presentation/controllers/auth.controller");
+const token_handler_1 = require("./application/handlers/token.handler");
+const prisma_service_account_repository_1 = require("./infrastructure/repositories/prisma-service-account.repository");
+const service_account_repository_interface_1 = require("./domain/repositories/service-account.repository.interface");
+let IdentityModule = class IdentityModule {
+};
+exports.IdentityModule = IdentityModule;
+exports.IdentityModule = IdentityModule = __decorate([
+    (0, common_1.Module)({
+        imports: [
+            jwt_1.JwtModule.register({
+                secret: process.env.JWT_SECRET,
+                signOptions: {
+                    expiresIn: '1d',
+                },
+            }),
+        ],
+        controllers: [users_controller_1.UsersController, auth_controller_1.AuthController],
+        providers: [
+            //#region User 
+            create_user_handler_1.CreateUserHandler,
+            get_user_handler_1.GetUserHandler,
+            get_users_handler_1.GetUsersHandler,
+            update_user_handler_1.UpdateUserHandler,
+            delete_user_handler_1.DeleteUserHandler,
+            login_handler_1.LoginHandler,
+            token_handler_1.TokenHandler,
+            //#endregion
+            jwt_auth_guard_1.JwtAuthGuard,
+            permission_guard_1.PermissionGuard,
+            core_1.Reflector,
+            prisma_service_1.PrismaService,
+            prisma_user_repository_1.PrismaUserRepository,
+            prisma_service_account_repository_1.PrismaServiceAccountRepository,
+            {
+                provide: user_interface_1.IUser,
+                useClass: prisma_user_repository_1.PrismaUserRepository,
+            },
+            {
+                provide: service_account_repository_interface_1.ServiceAccountRepository,
+                useClass: prisma_service_account_repository_1.PrismaServiceAccountRepository,
+            },
+            {
+                provide: 'EVENT_DISPATCHER',
+                useValue: new event_dispatcher_1.EventDispatcher(),
+            },
+        ],
+    })
+], IdentityModule);
+//# sourceMappingURL=identity.module.js.map

dist/modules/identity/identity.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.module.js","sourceRoot":"","sources":["../../../src/modules/identity/identity.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,kFAA8E;AAC9E,gEAA4D;AAC5D,iGAA4F;AAC5F,yEAA6D;AAC7D,yEAAqE;AACrE,0EAAqE;AACrE,qCAAwC;AACxC,yFAAoF;AACpF,mFAAiG;AACjG,yFAAoF;AACpF,qFAAoG;AACpG,yFAAoF;AACpF,4FAAwF;AACxF,uCAAyC;AACzC,wEAAoE;AACpE,gFAA4E;AAC5E,wEAAoE;AACpE,uHAAiH;AACjH,qHAAsG;AA4C/F,IAAM,cAAc,GAApB,MAAM,cAAc;CAAG,CAAA;AAAjB,wCAAc;yBAAd,cAAc;IAzC1B,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,eAAS,CAAC,QAAQ,CAAC;gBACjB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;gBAC9B,WAAW,EAAE;oBACX,SAAS,EAAE,IAAI;iBAChB;aACF,CAAC;SACH;QACD,WAAW,EAAE,CAAC,kCAAe,EAAE,gCAAc,CAAC;QAC9C,SAAS,EAAE;YACT,eAAe;YACf,uCAAiB;YACjB,iCAAe;YACf,mCAAgB;YAChB,uCAAiB;YACjB,uCAAiB;YACjB,4BAAY;YACZ,4BAAY;YACZ,YAAY;YAEZ,6BAAY;YACZ,kCAAe;YACf,gBAAS;YACL,8BAAa;YACjB,6CAAoB;YACpB,kEAA8B;YAC9B;gBACE,OAAO,EAAE,sBAAK;gBACd,QAAQ,EAAE,6CAAoB;aAC/B;YACD;gBACE,OAAO,EAAE,+DAAwB;gBACjC,QAAQ,EAAE,kEAA8B;aACzC;YACD;gBACE,OAAO,EAAE,kBAAkB;gBAC3B,QAAQ,EAAE,IAAI,kCAAe,EAAE;aAChC;SACF;KACF,CAAC;GACW,cAAc,CAAG"}

dist/modules/identity/infrastructure/mappers/prisma-user.mapper.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PrismaUserMapper = void 0;
+const user_entity_1 = require("../../domain/entities/user.entity");
+const role_entity_1 = require("../../domain/entities/role.entity");
+const permission_entity_1 = require("../../domain/entities/permission.entity");
+class PrismaUserMapper {
+    static toDomain(model) {
+        const roles = (model.userRoles || model.roles || []).map((ur) => {
+            const r = ur.role || ur.role;
+            const permissions = (r?.permissions || []).map((rp) => permission_entity_1.PermissionData.restore({
+                id: rp.permission.id,
+                name: rp.permission.name,
+                description: rp.permission.description,
+                createdAt: rp.permission.createdAt,
+                updatedAt: rp.permission.updatedAt,
+            }));
+            return role_entity_1.RoleData.restore({
+                id: r.id,
+                code: r.code,
+                name: r.name,
+                description: r.description,
+                permissions,
+                createdAt: r.createdAt,
+                updatedAt: r.updatedAt,
+            });
+        });
+        const permissions = (model.userPermissions || model.permissions || []).map((up) => permission_entity_1.PermissionData.restore({
+            id: up.permission?.id || up.id,
+            name: up.permission?.name || up.name,
+            description: up.permission?.description || up.description,
+            createdAt: up.permission?.createdAt || up.createdAt,
+            updatedAt: up.permission?.updatedAt || up.updatedAt,
+        }));
+        return user_entity_1.UserData.restore({
+            id: model.id,
+            authentikId: model.authentikUserId || model.authentikId || null,
+            username: model.username || model.name || model.username,
+            email: model.email,
+            roles,
+            permissions,
+            isActive: model.isActive ?? true,
+            deletedAt: model.deletedAt || null,
+            lastSeenAt: model.lastSeenAt || null,
+            storageQuota: model.storageQuota !== undefined && model.storageQuota !== null ? Number(model.storageQuota) : undefined,
+            storageUsed: model.storageUsed !== undefined && model.storageUsed !== null ? Number(model.storageUsed) : undefined,
+        });
+    }
+    static toPersistence(userData) {
+        return {
+            id: userData.id,
+            authentikUserId: userData.authentikUserId || userData.authentikId,
+            authentikId: userData.authentikId,
+            username: userData.username,
+            email: userData.email,
+            isActive: userData.isActive,
+            deletedAt: userData.deletedAt,
+            lastSeenAt: userData.lastSeenAt,
+            lastSyncedAt: userData.lastSyncedAt,
+            syncStatus: userData.syncStatus,
+            storageQuota: userData.storageQuota,
+            storageUsed: userData.storageUsed,
+        };
+    }
+}
+exports.PrismaUserMapper = PrismaUserMapper;
+//# sourceMappingURL=prisma-user.mapper.js.map

dist/modules/identity/infrastructure/mappers/prisma-user.mapper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prisma-user.mapper.js","sourceRoot":"","sources":["../../../../../src/modules/identity/infrastructure/mappers/prisma-user.mapper.ts"],"names":[],"mappings":";;;AAAA,mEAA6D;AAC7D,mEAA6D;AAC7D,+EAAyE;AAEzE,MAAa,gBAAgB;IACzB,MAAM,CAAC,QAAQ,CAAC,KAAU;QAC1B,MAAM,KAAK,GAAe,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAO,EAAE,EAAE;YAC3E,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC;YAC7B,MAAM,WAAW,GAAqB,CAAC,CAAC,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAO,EAAE,EAAE,CAC3E,kCAAc,CAAC,OAAO,CAAC;gBACrB,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE;gBACpB,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI;gBACxB,WAAW,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW;gBACtC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS;gBAClC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS;aACnC,CAAC,CACH,CAAC;YAEF,OAAO,sBAAQ,CAAC,OAAO,CAAC;gBACtB,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,WAAW;gBACX,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,SAAS,EAAE,CAAC,CAAC,SAAS;aACvB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEP,MAAM,WAAW,GAAqB,CAAC,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAO,EAAE,EAAE,CACnG,kCAAc,CAAC,OAAO,CAAC;YACrB,EAAE,EAAE,EAAE,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;YAC9B,IAAI,EAAE,EAAE,CAAC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,IAAI;YACpC,WAAW,EAAE,EAAE,CAAC,UAAU,EAAE,WAAW,IAAI,EAAE,CAAC,WAAW;YACzD,SAAS,EAAE,EAAE,CAAC,UAAU,EAAE,SAAS,IAAI,EAAE,CAAC,SAAS;YACnD,SAAS,EAAE,EAAE,CAAC,UAAU,EAAE,SAAS,IAAI,EAAE,CAAC,SAAS;SACpD,CAAC,CACH,CAAC;QAEN,OAAO,sBAAQ,CAAC,OAAO,CAAC;YACtB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,WAAW,EAAE,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,WAAW,IAAI,IAAI;YAC/D,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ;YACxD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK;YACL,WAAW;YACX,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;YACpC,YAAY,EAAE,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;YACtH,WAAW,EAAE,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;SACnH,CAAC,CAAC;IACL,CAAC;IAEC,MAAM,CAAC,aAAa,CAAC,QAAkB;QACnC,OAAO;YACL,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,eAAe,EAAG,QAAgB,CAAC,eAAe,IAAI,QAAQ,CAAC,WAAW;YAC1E,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,YAAY,EAAG,QAAgB,CAAC,YAAY;YAC5C,UAAU,EAAG,QAAgB,CAAC,UAAU;YACxC,YAAY,EAAG,QAAgB,CAAC,YAAY;YAC5C,WAAW,EAAG,QAAgB,CAAC,WAAW;SAC3C,CAAC;IACR,CAAC;CACF;AAlED,4CAkEC"}

dist/modules/identity/infrastructure/repositories/prisma-service-account.repository.js

@@ -0,0 +1,109 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PrismaServiceAccountRepository = void 0;
+const common_1 = require("@nestjs/common");
+const prisma_service_1 = require("../../../../shared/prisma.service");
+const service_account_entity_1 = require("../../domain/entities/service-account.entity");
+let PrismaServiceAccountRepository = class PrismaServiceAccountRepository {
+    prisma;
+    constructor(prisma) {
+        this.prisma = prisma;
+    }
+    async create(serviceAccount) {
+        const created = await this.prisma.serviceAccount.create({
+            data: {
+                id: serviceAccount.id,
+                client_id: serviceAccount.clientId,
+                client_secret_hash: serviceAccount.clientSecretHash,
+                name: serviceAccount.name,
+                role: serviceAccount.role,
+                permissions: serviceAccount.permissions,
+                status: serviceAccount.status,
+                metadata: serviceAccount.metadata ?? {},
+            },
+        });
+        return service_account_entity_1.ServiceAccount.restore({
+            id: created.id,
+            clientId: created.client_id,
+            clientSecretHash: created.client_secret_hash,
+            name: created.name,
+            role: created.role,
+            permissions: created.permissions,
+            status: created.status,
+            metadata: (created.metadata ?? {}),
+        });
+    }
+    async update(serviceAccount) {
+        const updated = await this.prisma.serviceAccount.update({
+            where: { id: serviceAccount.id },
+            data: {
+                client_id: serviceAccount.clientId,
+                client_secret_hash: serviceAccount.clientSecretHash,
+                name: serviceAccount.name,
+                role: serviceAccount.role,
+                permissions: serviceAccount.permissions,
+                status: serviceAccount.status,
+                metadata: serviceAccount.metadata ?? {},
+            },
+        });
+        return service_account_entity_1.ServiceAccount.restore({
+            id: updated.id,
+            clientId: updated.client_id,
+            clientSecretHash: updated.client_secret_hash,
+            name: updated.name,
+            role: updated.role,
+            permissions: updated.permissions,
+            status: updated.status,
+            metadata: (updated.metadata ?? {}),
+        });
+    }
+    async findById(id) {
+        const model = await this.prisma.serviceAccount.findUnique({
+            where: { id },
+        });
+        if (!model)
+            return null;
+        return service_account_entity_1.ServiceAccount.restore({
+            id: model.id,
+            clientId: model.client_id,
+            clientSecretHash: model.client_secret_hash,
+            name: model.name,
+            role: model.role,
+            permissions: model.permissions,
+            status: model.status,
+            metadata: (model.metadata ?? {}),
+        });
+    }
+    async findByClientId(clientId) {
+        const model = await this.prisma.serviceAccount.findUnique({
+            where: { client_id: clientId },
+        });
+        if (!model)
+            return null;
+        return service_account_entity_1.ServiceAccount.restore({
+            id: model.id,
+            clientId: model.client_id,
+            clientSecretHash: model.client_secret_hash,
+            name: model.name,
+            role: model.role,
+            permissions: model.permissions,
+            status: model.status,
+            metadata: (model.metadata ?? {}),
+        });
+    }
+};
+exports.PrismaServiceAccountRepository = PrismaServiceAccountRepository;
+exports.PrismaServiceAccountRepository = PrismaServiceAccountRepository = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [prisma_service_1.PrismaService])
+], PrismaServiceAccountRepository);
+//# sourceMappingURL=prisma-service-account.repository.js.map

dist/modules/identity/infrastructure/repositories/prisma-service-account.repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prisma-service-account.repository.js","sourceRoot":"","sources":["../../../../../src/modules/identity/infrastructure/repositories/prisma-service-account.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,sEAAkE;AAElE,yFAA8E;AAGvE,IAAM,8BAA8B,GAApC,MAAM,8BAA8B;IACZ;IAA7B,YAA6B,MAAqB;QAArB,WAAM,GAAN,MAAM,CAAe;IAAG,CAAC;IAEtD,KAAK,CAAC,MAAM,CAAC,cAA8B;QACzC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC;YACtD,IAAI,EAAE;gBACJ,EAAE,EAAE,cAAc,CAAC,EAAE;gBACrB,SAAS,EAAE,cAAc,CAAC,QAAQ;gBAClC,kBAAkB,EAAE,cAAc,CAAC,gBAAgB;gBACnD,IAAI,EAAE,cAAc,CAAC,IAAI;gBACzB,IAAI,EAAE,cAAc,CAAC,IAAI;gBACzB,WAAW,EAAE,cAAc,CAAC,WAAW;gBACvC,MAAM,EAAE,cAAc,CAAC,MAAM;gBAC7B,QAAQ,EAAE,cAAc,CAAC,QAAQ,IAAI,EAAE;aACxC;SACF,CAAC,CAAC;QAEH,OAAO,uCAAc,CAAC,OAAO,CAAC;YAC5B,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,gBAAgB,EAAE,OAAO,CAAC,kBAAkB;YAC5C,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,WAAW,EAAE,OAAO,CAAC,WAAuB;YAC5C,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAQ;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,cAA8B;QACzC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC;YACtD,KAAK,EAAE,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE;YAChC,IAAI,EAAE;gBACJ,SAAS,EAAE,cAAc,CAAC,QAAQ;gBAClC,kBAAkB,EAAE,cAAc,CAAC,gBAAgB;gBACnD,IAAI,EAAE,cAAc,CAAC,IAAI;gBACzB,IAAI,EAAE,cAAc,CAAC,IAAI;gBACzB,WAAW,EAAE,cAAc,CAAC,WAAW;gBACvC,MAAM,EAAE,cAAc,CAAC,MAAM;gBAC7B,QAAQ,EAAE,cAAc,CAAC,QAAQ,IAAI,EAAE;aACxC;SACF,CAAC,CAAC;QAEH,OAAO,uCAAc,CAAC,OAAO,CAAC;YAC5B,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,QAAQ,EAAE,OAAO,CAAC,SAAS;YAC3B,gBAAgB,EAAE,OAAO,CAAC,kBAAkB;YAC5C,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,WAAW,EAAE,OAAO,CAAC,WAAuB;YAC5C,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAQ;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC;YACxD,KAAK,EAAE,EAAE,EAAE,EAAE;SACd,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,OAAO,uCAAc,CAAC,OAAO,CAAC;YAC5B,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,QAAQ,EAAE,KAAK,CAAC,SAAS;YACzB,gBAAgB,EAAE,KAAK,CAAC,kBAAkB;YAC1C,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,WAAuB;YAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAQ;SACxC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB;QACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC;YACxD,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE;SAC/B,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,OAAO,uCAAc,CAAC,OAAO,CAAC;YAC5B,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,QAAQ,EAAE,KAAK,CAAC,SAAS;YACzB,gBAAgB,EAAE,KAAK,CAAC,kBAAkB;YAC1C,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,WAAuB;YAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAQ;SACxC,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA5FY,wEAA8B;yCAA9B,8BAA8B;IAD1C,IAAA,mBAAU,GAAE;qCAE0B,8BAAa;GADvC,8BAA8B,CA4F1C"}

dist/modules/identity/infrastructure/repositories/prisma-user.repository.js

@@ -0,0 +1,105 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PrismaUserRepository = void 0;
+const common_1 = require("@nestjs/common");
+const prisma_service_1 = require("../../../../shared/prisma.service");
+const prisma_user_mapper_1 = require("../mappers/prisma-user.mapper");
+let PrismaUserRepository = class PrismaUserRepository {
+    prisma;
+    constructor(prisma) {
+        this.prisma = prisma;
+    }
+    async create(user) {
+        const created = await this.prisma.user.create({ data: prisma_user_mapper_1.PrismaUserMapper.toPersistence(user) });
+        return prisma_user_mapper_1.PrismaUserMapper.toDomain(created);
+    }
+    async existsById(userId) {
+        const cnt = await this.prisma.user.count({ where: { id: userId } });
+        return cnt > 0;
+    }
+    async existByEmail(userEmail) {
+        const u = await this.prisma.user.findFirst({ where: { email: userEmail } });
+        return !!u;
+    }
+    async getById(userId) {
+        const row = await this.prisma.user.findUnique({ where: { id: userId }, include: { userRoles: { include: { role: { include: { permissions: { include: { permission: true } } } } } }, userPermissions: { include: { permission: true } } } });
+        if (!row)
+            throw new common_1.NotFoundException('User not found.');
+        return prisma_user_mapper_1.PrismaUserMapper.toDomain(row);
+    }
+    async getByEmail(userEmail) {
+        const row = await this.prisma.user.findUnique({ where: { email: userEmail }, include: { userRoles: { include: { role: { include: { permissions: { include: { permission: true } } } } } }, userPermissions: { include: { permission: true } } } });
+        if (!row)
+            throw new common_1.NotFoundException('User not found.');
+        return prisma_user_mapper_1.PrismaUserMapper.toDomain(row);
+    }
+    async findByAuthentikId(authentikId) {
+        const row = await this.prisma.user.findFirst({ where: { OR: [{ authentikId }, { authentikUserId: authentikId }] }, include: { userRoles: { include: { role: { include: { permissions: { include: { permission: true } } } } } }, userPermissions: { include: { permission: true } } } });
+        if (!row)
+            return null;
+        return prisma_user_mapper_1.PrismaUserMapper.toDomain(row);
+    }
+    async update(user) {
+        const updated = await this.prisma.user.update({ where: { id: user.id }, data: prisma_user_mapper_1.PrismaUserMapper.toPersistence(user), include: { userRoles: { include: { role: { include: { permissions: { include: { permission: true } } } } } }, userPermissions: { include: { permission: true } } } });
+        return prisma_user_mapper_1.PrismaUserMapper.toDomain(updated);
+    }
+    async find(params) {
+        const page = params.page && params.page > 0 ? params.page : 1;
+        const limit = params.limit && params.limit > 0 ? params.limit : 25;
+        const where = {};
+        if (params.search) {
+            where.OR = [
+                { username: { contains: params.search, mode: 'insensitive' } },
+                { name: { contains: params.search, mode: 'insensitive' } },
+                { email: { contains: params.search, mode: 'insensitive' } },
+            ];
+        }
+        if (params.isActive !== undefined && params.isActive !== null) {
+            where.isActive = params.isActive;
+        }
+        if (params.deleted !== undefined && params.deleted !== null) {
+            if (params.deleted)
+                where.deletedAt = { not: null };
+            else
+                where.deletedAt = null;
+        }
+        if (params.roleId) {
+            where.userRoles = { some: { roleId: params.roleId } };
+        }
+        const [total, items] = await Promise.all([
+            this.prisma.user.count({ where }),
+            this.prisma.user.findMany({ where, skip: (page - 1) * limit, take: limit, orderBy: { createdAt: 'desc' }, include: { userRoles: { include: { role: { include: { permissions: { include: { permission: true } } } } } }, userPermissions: { include: { permission: true } } } }),
+        ]);
+        return { data: items.map(i => prisma_user_mapper_1.PrismaUserMapper.toDomain(i)), total };
+    }
+    async softDelete(userId) {
+        await this.prisma.user.update({ where: { id: userId }, data: { deletedAt: new Date() } });
+    }
+    async restore(userId) {
+        const updated = await this.prisma.user.update({ where: { id: userId }, data: { deletedAt: null }, include: { userRoles: { include: { role: { include: { permissions: { include: { permission: true } } } } } }, userPermissions: { include: { permission: true } } } });
+        return prisma_user_mapper_1.PrismaUserMapper.toDomain(updated);
+    }
+    async enable(userId) {
+        const updated = await this.prisma.user.update({ where: { id: userId }, data: { isActive: true }, include: { userRoles: { include: { role: { include: { permissions: { include: { permission: true } } } } } }, userPermissions: { include: { permission: true } } } });
+        return prisma_user_mapper_1.PrismaUserMapper.toDomain(updated);
+    }
+    async disable(userId) {
+        const updated = await this.prisma.user.update({ where: { id: userId }, data: { isActive: false }, include: { userRoles: { include: { role: { include: { permissions: { include: { permission: true } } } } } }, userPermissions: { include: { permission: true } } } });
+        return prisma_user_mapper_1.PrismaUserMapper.toDomain(updated);
+    }
+};
+exports.PrismaUserRepository = PrismaUserRepository;
+exports.PrismaUserRepository = PrismaUserRepository = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [prisma_service_1.PrismaService])
+], PrismaUserRepository);
+//# sourceMappingURL=prisma-user.repository.js.map

dist/modules/identity/presentation/controllers/auth.controller.js

@@ -0,0 +1,68 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const login_dto_1 = require("../dto/login.dto");
+const login_handler_1 = require("../../application/handlers/login.handler");
+const token_handler_1 = require("../../application/handlers/token.handler");
+let AuthController = class AuthController {
+    loginHandler;
+    tokenHandler;
+    constructor(loginHandler, tokenHandler) {
+        this.loginHandler = loginHandler;
+        this.tokenHandler = tokenHandler;
+    }
+    async login(dto) {
+        const data = await this.loginHandler.execute(dto);
+        return {
+            success: true,
+            data,
+            meta: {},
+        };
+    }
+    async token(body) {
+        const data = await this.tokenHandler.execute(body);
+        return {
+            success: true,
+            data,
+            meta: {},
+        };
+    }
+};
+exports.AuthController = AuthController;
+__decorate([
+    (0, common_1.Post)('login'),
+    (0, swagger_1.ApiOperation)({ summary: 'Login and obtain access token' }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [login_dto_1.LoginDto]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "login", null);
+__decorate([
+    (0, common_1.Post)('token'),
+    (0, swagger_1.ApiOperation)({ summary: 'Obtain access token using client credentials' }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "token", null);
+exports.AuthController = AuthController = __decorate([
+    (0, swagger_1.ApiTags)('Auth'),
+    (0, common_1.Controller)('api/v1/auth'),
+    __metadata("design:paramtypes", [login_handler_1.LoginHandler,
+        token_handler_1.TokenHandler])
+], AuthController);
+//# sourceMappingURL=auth.controller.js.map

dist/modules/identity/presentation/controllers/auth.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.controller.js","sourceRoot":"","sources":["../../../../../src/modules/identity/presentation/controllers/auth.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAwD;AACxD,6CAAwD;AAExD,gDAA4C;AAC5C,4EAAwE;AACxE,4EAAwE;AAIjE,IAAM,cAAc,GAApB,MAAM,cAAc;IAEN;IACA;IAFnB,YACmB,YAA0B,EAC1B,YAA0B;QAD1B,iBAAY,GAAZ,YAAY,CAAc;QAC1B,iBAAY,GAAZ,YAAY,CAAc;IAC1C,CAAC;IAIE,AAAN,KAAK,CAAC,KAAK,CAAS,GAAa;QAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAElD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,IAAI;YACJ,IAAI,EAAE,EAAE;SACT,CAAC;IACJ,CAAC;IAIK,AAAN,KAAK,CAAC,KAAK,CAAS,IAAS;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEnD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,IAAI;YACJ,IAAI,EAAE,EAAE;SACT,CAAC;IACJ,CAAC;CACF,CAAA;AA7BY,wCAAc;AAQnB;IAFL,IAAA,aAAI,EAAC,OAAO,CAAC;IACb,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;IAC9C,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,oBAAQ;;2CAQhC;AAIK;IAFL,IAAA,aAAI,EAAC,OAAO,CAAC;IACb,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC;IAC7D,WAAA,IAAA,aAAI,GAAE,CAAA;;;;2CAQlB;yBA5BU,cAAc;IAF1B,IAAA,iBAAO,EAAC,MAAM,CAAC;IACf,IAAA,mBAAU,EAAC,aAAa,CAAC;qCAGS,4BAAY;QACZ,4BAAY;GAHlC,cAAc,CA6B1B"}

dist/modules/identity/presentation/controllers/users.controller.js

@@ -0,0 +1,150 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UsersController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const jwt_auth_guard_1 = require("../../../../core/auth/guards/jwt-auth.guard");
+const permission_guard_1 = require("../../../authorization/presentation/guards/permission.guard");
+const permission_decorator_1 = require("../../../authorization/presentation/decorators/permission.decorator");
+const get_user_handler_1 = require("../../application/handlers/user/get-user.handler");
+const get_users_handler_1 = require("../../application/handlers/user/get-users.handler");
+const create_user_handler_1 = require("../../application/handlers/user/create-user.handler");
+const update_user_handler_1 = require("../../application/handlers/user/update-user.handler");
+const delete_user_handler_1 = require("../../application/handlers/user/delete-user.handler");
+const create_user_dto_1 = require("../dto/create-user.dto");
+const update_user_dto_1 = require("../dto/update-user.dto");
+let UsersController = class UsersController {
+    createUserHandler;
+    findUserHandler;
+    findUsersHandler;
+    updateUserHandler;
+    deleteUserHandler;
+    constructor(createUserHandler, findUserHandler, findUsersHandler, updateUserHandler, deleteUserHandler) {
+        this.createUserHandler = createUserHandler;
+        this.findUserHandler = findUserHandler;
+        this.findUsersHandler = findUsersHandler;
+        this.updateUserHandler = updateUserHandler;
+        this.deleteUserHandler = deleteUserHandler;
+    }
+    sanitizeUser(user) {
+        if (!user)
+            return user;
+        if (Array.isArray(user)) {
+            return user.map(u => {
+                const { password, ...rest } = u;
+                return rest;
+            });
+        }
+        const { password, ...rest } = user;
+        return rest;
+    }
+    async create(dto) {
+        const data = await this.createUserHandler.execute(dto);
+        return {
+            success: true,
+            data: this.sanitizeUser(data),
+            meta: {},
+        };
+    }
+    async getById(id) {
+        const data = await this.findUserHandler.execute(id);
+        return {
+            success: true,
+            data: this.sanitizeUser(data),
+            meta: {},
+        };
+    }
+    async getAll() {
+        const data = await this.findUsersHandler.execute({});
+        return {
+            success: true,
+            data: this.sanitizeUser(data),
+            meta: {},
+        };
+    }
+    async update(id, dto) {
+        const data = await this.updateUserHandler.execute(id, dto);
+        return {
+            success: true,
+            data: this.sanitizeUser(data),
+            meta: {},
+        };
+    }
+    async delete(id) {
+        await this.deleteUserHandler.execute(id);
+        return {
+            success: true,
+            data: null,
+            meta: {},
+        };
+    }
+};
+exports.UsersController = UsersController;
+__decorate([
+    (0, common_1.Post)(),
+    (0, permission_decorator_1.Permissions)('USER_CREATE'),
+    (0, swagger_1.ApiOperation)({ summary: 'Create user' }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [create_user_dto_1.CreateUserDto]),
+    __metadata("design:returntype", Promise)
+], UsersController.prototype, "create", null);
+__decorate([
+    (0, common_1.Get)(':id'),
+    (0, permission_decorator_1.Permissions)('USER_READ'),
+    (0, swagger_1.ApiOperation)({ summary: 'Get user by id' }),
+    __param(0, (0, common_1.Param)('id')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], UsersController.prototype, "getById", null);
+__decorate([
+    (0, common_1.Get)(),
+    (0, permission_decorator_1.Permissions)('USER_READ_ADMIN'),
+    (0, swagger_1.ApiOperation)({ summary: 'Get All User' }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], UsersController.prototype, "getAll", null);
+__decorate([
+    (0, common_1.Patch)(':id'),
+    (0, permission_decorator_1.Permissions)('USER_UPDATE'),
+    (0, swagger_1.ApiOperation)({ summary: 'Update User' }),
+    __param(0, (0, common_1.Param)('id')),
+    __param(1, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, update_user_dto_1.UpdateUserDto]),
+    __metadata("design:returntype", Promise)
+], UsersController.prototype, "update", null);
+__decorate([
+    (0, common_1.Delete)(':id'),
+    (0, permission_decorator_1.Permissions)('USER_DELETE'),
+    (0, swagger_1.ApiOperation)({ summary: 'Delete user by id' }),
+    __param(0, (0, common_1.Param)('id')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], UsersController.prototype, "delete", null);
+exports.UsersController = UsersController = __decorate([
+    (0, swagger_1.ApiTags)('Users'),
+    (0, common_1.Controller)('api/v1/users'),
+    (0, common_1.UseGuards)(jwt_auth_guard_1.JwtAuthGuard, permission_guard_1.PermissionGuard),
+    __metadata("design:paramtypes", [create_user_handler_1.CreateUserHandler,
+        get_user_handler_1.GetUserHandler,
+        get_users_handler_1.GetUsersHandler,
+        update_user_handler_1.UpdateUserHandler,
+        delete_user_handler_1.DeleteUserHandler])
+], UsersController);
+//# sourceMappingURL=users.controller.js.map

dist/modules/identity/presentation/controllers/users.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.controller.js","sourceRoot":"","sources":["../../../../../src/modules/identity/presentation/controllers/users.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CASwB;AACxB,6CAAwD;AAExD,gFAA2E;AAC3E,kGAA8F;AAC9F,8GAAkG;AAElG,uFAAqG;AACrG,yFAAwG;AACxG,6FAAwF;AACxF,6FAAwF;AACxF,6FAAwF;AACxF,4DAAuD;AACvD,4DAAuD;AAKhD,IAAM,eAAe,GAArB,MAAM,eAAe;IAEP;IACA;IACA;IACA;IACA;IALnB,YACmB,iBAAoC,EACpC,eAAgC,EAChC,gBAAkC,EAClC,iBAAoC,EACpC,iBAAoC;QAJpC,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,oBAAe,GAAf,eAAe,CAAiB;QAChC,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,sBAAiB,GAAjB,iBAAiB,CAAmB;IACpD,CAAC;IAEI,YAAY,CAAC,IAAS;QAC5B,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;gBAClB,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,CAAQ,CAAC;gBACvC,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,IAAW,CAAC;QAC1C,OAAO,IAAI,CAAC;IACd,CAAC;IAKK,AAAN,KAAK,CAAC,MAAM,CAAS,GAAkB;QACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEvD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YAC7B,IAAI,EAAE,EAAE;SACT,CAAA;IACH,CAAC;IAKK,AAAN,KAAK,CAAC,OAAO,CAAc,EAAU;QACnC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAEpD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YAC7B,IAAI,EAAE,EAAE;SACT,CAAC;IACJ,CAAC;IAKK,AAAN,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAErD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YAC7B,IAAI,EAAE,EAAE;SACT,CAAC;IACJ,CAAC;IAKK,AAAN,KAAK,CAAC,MAAM,CAAc,EAAS,EAAU,GAAiB;QAC5D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAE3D,OAAO;YACL,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YAC7B,IAAI,EAAE,EAAE;SACT,CAAA;IACH,CAAC;IAKK,AAAN,KAAK,CAAC,MAAM,CAAc,EAAU;QAClC,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAEzC,OAAO;YACL,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,EAAE;SACT,CAAC;IACJ,CAAC;CACF,CAAA;AArFY,0CAAe;AAwBpB;IAHL,IAAA,aAAI,GAAE;IACN,IAAA,kCAAW,EAAC,aAAa,CAAC;IAC1B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAC3B,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,+BAAa;;6CAQtC;AAKK;IAHL,IAAA,YAAG,EAAC,KAAK,CAAC;IACV,IAAA,kCAAW,EAAC,WAAW,CAAC;IACxB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC7B,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;;;;8CAQzB;AAKK;IAHL,IAAA,YAAG,GAAE;IACL,IAAA,kCAAW,EAAC,iBAAiB,CAAC;IAC9B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;;;;6CASzC;AAKK;IAHL,IAAA,cAAK,EAAC,KAAK,CAAC;IACZ,IAAA,kCAAW,EAAC,aAAa,CAAC;IAC1B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAC3B,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;IAAa,WAAA,IAAA,aAAI,GAAE,CAAA;;6CAAK,+BAAa;;6CAQ7D;AAKK;IAHL,IAAA,eAAM,EAAC,KAAK,CAAC;IACb,IAAA,kCAAW,EAAC,aAAa,CAAC;IAC1B,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;IACjC,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;;;;6CAQxB;0BApFU,eAAe;IAH3B,IAAA,iBAAO,EAAC,OAAO,CAAC;IAChB,IAAA,mBAAU,EAAC,cAAc,CAAC;IAC1B,IAAA,kBAAS,EAAC,6BAAY,EAAE,kCAAe,CAAC;qCAGD,uCAAiB;QACnB,iCAAe;QACd,mCAAgB;QACf,uCAAiB;QACjB,uCAAiB;GAN5C,eAAe,CAqF3B"}

dist/modules/identity/presentation/dto/create-user.dto.js

@@ -0,0 +1,47 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreateUserDto = void 0;
+const class_validator_1 = require("class-validator");
+const swagger_1 = require("@nestjs/swagger");
+class CreateUserDto {
+    username;
+    email;
+    storageQuota;
+    storageUsed;
+}
+exports.CreateUserDto = CreateUserDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: 'John Doe' }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], CreateUserDto.prototype, "username", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: 'user@example.com' }),
+    (0, class_validator_1.IsEmail)(),
+    __metadata("design:type", String)
+], CreateUserDto.prototype, "email", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ example: 10737418240 }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsInt)(),
+    (0, class_validator_1.Min)(0),
+    __metadata("design:type", Number)
+], CreateUserDto.prototype, "storageQuota", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ example: 0 }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsInt)(),
+    (0, class_validator_1.Min)(0),
+    __metadata("design:type", Number)
+], CreateUserDto.prototype, "storageUsed", void 0);
+//# sourceMappingURL=create-user.dto.js.map

dist/modules/identity/presentation/dto/create-user.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-user.dto.js","sourceRoot":"","sources":["../../../../../src/modules/identity/presentation/dto/create-user.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAAgG;AAChG,6CAAmE;AAEnE,MAAa,aAAa;IAIxB,QAAQ,CAAU;IAIlB,KAAK,CAAU;IAQf,YAAY,CAAU;IAMtB,WAAW,CAAU;CACtB;AAvBD,sCAuBC;AAnBC;IAHC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IACpC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;+CACK;AAIlB;IAFC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC5C,IAAA,yBAAO,GAAE;;4CACK;AAQf;IAJC,IAAA,6BAAmB,EAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC7C,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAK,GAAE;IACP,IAAA,qBAAG,EAAC,CAAC,CAAC;;mDACe;AAMtB;IAJC,IAAA,6BAAmB,EAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACnC,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAK,GAAE;IACP,IAAA,qBAAG,EAAC,CAAC,CAAC;;kDACc"}

dist/modules/identity/presentation/dto/login.dto.js

@@ -0,0 +1,31 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LoginDto = void 0;
+const class_validator_1 = require("class-validator");
+const swagger_1 = require("@nestjs/swagger");
+class LoginDto {
+    email;
+    password;
+}
+exports.LoginDto = LoginDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: 'user@example.com' }),
+    (0, class_validator_1.IsEmail)(),
+    __metadata("design:type", String)
+], LoginDto.prototype, "email", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: 'strongpassword' }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.Length)(8, 128),
+    __metadata("design:type", String)
+], LoginDto.prototype, "password", void 0);
+//# sourceMappingURL=login.dto.js.map

dist/modules/identity/presentation/dto/login.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.dto.js","sourceRoot":"","sources":["../../../../../src/modules/identity/presentation/dto/login.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAA4D;AAC5D,6CAA8C;AAE9C,MAAa,QAAQ;IAGnB,KAAK,CAAU;IAKf,QAAQ,CAAU;CACnB;AATD,4BASC;AANC;IAFC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC5C,IAAA,yBAAO,GAAE;;uCACK;AAKf;IAHC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC1C,IAAA,0BAAQ,GAAE;IACV,IAAA,wBAAM,EAAC,CAAC,EAAE,GAAG,CAAC;;0CACG"}

dist/modules/identity/presentation/dto/update-user.dto.js

@@ -0,0 +1,56 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UpdateUserDto = void 0;
+const mapped_types_1 = require("@nestjs/mapped-types");
+const create_user_dto_1 = require("./create-user.dto");
+const swagger_1 = require("@nestjs/swagger");
+const class_validator_1 = require("class-validator");
+class UpdateUserDto extends (0, mapped_types_1.PartialType)(create_user_dto_1.CreateUserDto) {
+    name;
+    email;
+    metadata;
+    storageQuota;
+    storageUsed;
+}
+exports.UpdateUserDto = UpdateUserDto;
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], UpdateUserDto.prototype, "name", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsEmail)(),
+    __metadata("design:type", String)
+], UpdateUserDto.prototype, "email", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)(),
+    (0, class_validator_1.IsOptional)(),
+    __metadata("design:type", Object)
+], UpdateUserDto.prototype, "metadata", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ example: 10737418240 }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsInt)(),
+    (0, class_validator_1.Min)(0),
+    __metadata("design:type", Number)
+], UpdateUserDto.prototype, "storageQuota", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ example: 0 }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsInt)(),
+    (0, class_validator_1.Min)(0),
+    __metadata("design:type", Number)
+], UpdateUserDto.prototype, "storageUsed", void 0);
+//# sourceMappingURL=update-user.dto.js.map

dist/modules/identity/presentation/dto/update-user.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-user.dto.js","sourceRoot":"","sources":["../../../../../src/modules/identity/presentation/dto/update-user.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,uDAAmD;AACnD,uDAAkD;AAClD,6CAAsD;AACtD,qDAAoF;AAEpF,MAAa,aAAc,SAAQ,IAAA,0BAAW,EAAC,+BAAa,CAAC;IAI3D,IAAI,CAAU;IAKd,KAAK,CAAU;IAMf,QAAQ,CAAuB;IAM/B,YAAY,CAAU;IAMtB,WAAW,CAAU;CACtB;AA5BD,sCA4BC;AAxBC;IAHC,IAAA,6BAAmB,GAAE;IACrB,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;2CACG;AAKd;IAHC,IAAA,6BAAmB,GAAE;IACrB,IAAA,4BAAU,GAAE;IACZ,IAAA,yBAAO,GAAE;;4CACK;AAMf;IAFC,IAAA,6BAAmB,GAAE;IACrB,IAAA,4BAAU,GAAE;;+CACkB;AAM/B;IAJC,IAAA,6BAAmB,EAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC7C,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAK,GAAE;IACP,IAAA,qBAAG,EAAC,CAAC,CAAC;;mDACe;AAMtB;IAJC,IAAA,6BAAmB,EAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACnC,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAK,GAAE;IACP,IAAA,qBAAG,EAAC,CAAC,CAAC;;kDACc"}

dist/shared/prisma.service.js

@@ -0,0 +1,24 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PrismaService = void 0;
+const common_1 = require("@nestjs/common");
+const client_1 = require("@prisma/client");
+let PrismaService = class PrismaService extends client_1.PrismaClient {
+    async onModuleInit() {
+        await this.$connect();
+    }
+    async onModuleDestroy() {
+        await this.$disconnect();
+    }
+};
+exports.PrismaService = PrismaService;
+exports.PrismaService = PrismaService = __decorate([
+    (0, common_1.Injectable)()
+], PrismaService);
+//# sourceMappingURL=prisma.service.js.map

dist/shared/prisma.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prisma.service.js","sourceRoot":"","sources":["../../src/shared/prisma.service.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAA2E;AAC3E,2CAA8C;AAGvC,IAAM,aAAa,GAAnB,MAAM,aAAc,SAAQ,qBAAY;IAC7C,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;IAC3B,CAAC;CACF,CAAA;AARY,sCAAa;wBAAb,aAAa;IADzB,IAAA,mBAAU,GAAE;GACA,aAAa,CAQzB"}

dist/shared/utils/index.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noop = noop;
+function noop() { }
+//# sourceMappingURL=index.js.map

dist/shared/utils/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/shared/utils/index.ts"],"names":[],"mappings":";;AAAA,oBAAyB;AAAzB,SAAgB,IAAI,KAAI,CAAC"}

jest.config.cjs

@@ -1,12 +1,13 @@
 module.exports = {
   preset: 'ts-jest',
   testEnvironment: 'node',
-  testMatch: ['**/tests/**/*.spec.ts', '**/?(*.)+(spec|test).ts'],
+  testMatch: ['**/tests/**/*.spec.ts', '**/?(*.)+(spec|test).[tj]s?(x)'],
   testPathIgnorePatterns: ['/tests/api/', '/tests/integration/'],
-  moduleFileExtensions: ['ts', 'js', 'json'],
+  moduleFileExtensions: ['ts', 'js', 'json', 'node'],
   globals: {
     'ts-jest': {
       tsconfig: 'tsconfig.json',
     },
   },
 };
+

package-lock.json

@@ -4644,7 +4644,6 @@
       "version": "2.3.3",
       "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
       "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
-      "dev": true,
       "hasInstallScript": true,
       "optional": true,
       "os": [

prisma/schema.prisma

@@ -1,6 +1,3 @@
-// Prisma schema for RayLab Core - Phase 1
-// PostgreSQL datasource. DATABASE_URL must be set in environment.
-
 generator client {
   provider = "prisma-client-js"
 }
@@ -10,14 +7,19 @@ datasource db {
   url      = env("DATABASE_URL")
 }
 
+enum UserRoleSource {
+  AUTHENTIK
+  SYSTEM
+}
+
 model User {
-  id               String           @id @default(uuid()) @db.Uuid
+  id                 String   @id @default(uuid())
   authentikId        String?  @unique
   authentikUserId    String?  @unique
   authentikSubject   String?  @unique
-  username         String?          @unique @db.VarChar(255)
-  email            String?          @unique @db.VarChar(320)
-  name             String?          @db.VarChar(255)
+  username           String?  @unique
+  email              String?  @unique
+  name               String?
   picture            String?
   isActive           Boolean  @default(true)
   deletedAt          DateTime?
@@ -27,245 +29,233 @@ model User {
   storageQuota       BigInt?  @default(10737418240)
   storageUsed        BigInt?  @default(0)
   metadata           Json?
-  roles            UserRole[]
-  permissions      UserPermission[]
-  auditLogs        AuditLog[]
-  mediaObjects     MediaObject[]
-  lastGroupHash    String?          @db.Text
-  // relations for debt module
-  debtGroupsOwned  DebtGroup[]
-  debtGroupMembers DebtGroupMember[]
-  createdDebtTransactions DebtTransaction[]
-
+  lastGroupHash      String?
   createdAt          DateTime @default(now())
-  updatedAt        DateTime         @updatedAt
+  updatedAt          DateTime @default(now())
 
-  @@index([authentikId])
-  @@index([username])
-  @@index([email])
+  userRoles          UserRole[]
+  userPermissions    UserPermission[]
+  mediaObjects       MediaObject[]
+  auditLogs          AuditLog[] @relation("AuditUser")
+  debtTransactionsCreated DebtTransaction[] @relation("createdBy")
+  debtGroupMemberships DebtGroupMember[]
 }
 
+model ServiceAccount {
+  id                 String   @id @default(uuid())
+  client_id          String   @unique
+  client_secret_hash String
+  name               String
+  role               String
+  permissions        Json
+  status             String   @default("ACTIVE")
+  metadata           Json?
+  created_at         DateTime @default(now())
+  updated_at         DateTime @default(now())
+  deleted_at         DateTime?
+}
+
+
 model Role {
-  id          String                 @id @default(uuid()) @db.Uuid
-  code        String                 @unique @db.VarChar(100)
-  name        String                 @db.VarChar(255)
-  displayName String?                @db.VarChar(255)
+  id         String   @id @default(uuid())
+  code       String   @unique
+  name       String
+  displayName String?
   description String?
   isDefault  Boolean  @default(false)
-  permissions RolePermission[]
-  userRoles   UserRole[]
-  mappings    AuthGroupRoleMapping[]
   createdAt  DateTime @default(now())
-  updatedAt   DateTime               @updatedAt
+  updatedAt  DateTime @default(now())
+
+    permissions RolePermission[]
+  users      UserRole[]
+  authGroupRoleMappings AuthGroupRoleMapping[]
 }
 
 model Permission {
-  id              String           @id @default(uuid()) @db.Uuid
-  code            String           @unique @db.VarChar(150)
-  name            String           @db.VarChar(255)
-  displayName     String?          @db.VarChar(255)
+  id          String   @id @default(uuid())
+  code        String   @unique
+  name        String
+  displayName String?
   description String?
-  rolePermissions RolePermission[]
   createdAt   DateTime @default(now())
-  updatedAt       DateTime         @updatedAt
-  UserPermission  UserPermission[]
+  updatedAt   DateTime @default(now())
+
+  roles       RolePermission[]
+  users       UserPermission[]
 }
 
 model RolePermission {
-  id           String     @id @default(uuid()) @db.Uuid
-  role         Role       @relation(fields: [roleId], references: [id], onDelete: Cascade)
-  roleId       String     @db.Uuid
-  permission   Permission @relation(fields: [permissionId], references: [id], onDelete: Cascade)
-  permissionId String     @db.Uuid
+  id           String   @id @default(uuid())
+  roleId       String
+  permissionId String
   createdAt    DateTime @default(now())
 
+  role         Role     @relation(fields: [roleId], references: [id])
+  permission   Permission @relation(fields: [permissionId], references: [id])
+
   @@unique([roleId, permissionId])
   @@index([roleId])
   @@index([permissionId])
 }
 
 model UserPermission {
-  id           String     @id @default(uuid()) @db.Uuid
-  user         User       @relation(fields: [userId], references: [id], onDelete: Cascade)
-  userId       String     @db.Uuid
-  permission   Permission @relation(fields: [permissionId], references: [id], onDelete: Cascade)
-  permissionId String     @db.Uuid
-  assignedBy   String?    @db.VarChar(100)
+  id           String   @id @default(uuid())
+  userId       String
+  permissionId String
+  assignedBy   String?
   createdAt    DateTime @default(now())
 
+  user         User     @relation(fields: [userId], references: [id])
+  permission   Permission @relation(fields: [permissionId], references: [id])
+
   @@unique([userId, permissionId])
   @@index([userId])
   @@index([permissionId])
 }
 
-enum UserRoleSource {
-  AUTHENTIK
-  SYSTEM
-}
-
 model UserRole {
-  id        String         @id @default(uuid()) @db.Uuid
-  user      User           @relation(fields: [userId], references: [id], onDelete: Cascade)
-  userId    String         @db.Uuid
-  role      Role           @relation(fields: [roleId], references: [id], onDelete: Cascade)
-  roleId    String         @db.Uuid
+  id        String         @id @default(uuid())
+  userId    String
+  roleId    String
   source    UserRoleSource @default(AUTHENTIK)
   syncedAt  DateTime       @default(now())
   createdAt DateTime       @default(now())
 
+  user      User @relation(fields: [userId], references: [id])
+  role      Role @relation(fields: [roleId], references: [id])
+
   @@unique([userId, roleId])
   @@index([userId])
   @@index([roleId])
 }
 
 model AuthGroupRoleMapping {
-  id        String   @id @default(uuid()) @db.Uuid
-  authGroup String   @db.VarChar(255)
-  role      Role     @relation(fields: [roleId], references: [id], onDelete: Cascade)
-  roleId    String   @db.Uuid
+  id        String   @id @default(uuid())
+  authGroup String
+  roleId    String
   createdAt DateTime @default(now())
-  updatedAt DateTime @updatedAt
+  updatedAt DateTime @default(now())
 
-  @@index([authGroup])
+  role      Role @relation(fields: [roleId], references: [id])
 }
 
 model AuditLog {
-  id         String   @id @default(uuid()) @db.Uuid
-  user       User?    @relation(fields: [userId], references: [id], onDelete: SetNull)
-  userId     String?  @db.Uuid
-  action     String   @db.VarChar(200)
-  resource   String?  @db.VarChar(200)
+  id         String   @id @default(uuid())
+  userId     String?
+  action     String
+  resource   String?
   resourceId String?
   details    Json?
   createdAt  DateTime @default(now())
 
+  user       User?    @relation("AuditUser", fields: [userId], references: [id])
+
   @@index([userId])
   @@index([action])
 }
 
 model ScheduledJob {
-  id        String    @id @default(uuid()) @db.Uuid
-  name      String    @db.VarChar(255)
+  id        String   @id @default(uuid())
+  name      String
   payload   Json?
   cron      String?
   runAt     DateTime?
-  status    String    @default("pending") @db.VarChar(50)
+  status    String   @default("pending")
   attempts  Int      @default(0)
   lastRunAt DateTime?
   createdAt DateTime @default(now())
-  updatedAt DateTime  @updatedAt
-
-  @@index([name])
-  @@index([status])
+  updatedAt DateTime @default(now())
 }
 
 model MediaObject {
-  id          String   @id @default(uuid()) @db.Uuid
-  ownerUserId String?  @db.Uuid
-  owner       User?    @relation(fields: [ownerUserId], references: [id], onDelete: SetNull)
-  storageKey  String   @db.VarChar(1024)
-  filename    String?  @db.VarChar(1024)
-  mimeType    String?  @db.VarChar(255)
+  id           String   @id @default(uuid())
+  ownerUserId  String?
+  storageKey   String
+  filename     String?
+  mimeType     String?
   size         BigInt?
   isPublic     Boolean  @default(false)
   metadata     Json?
   createdAt    DateTime @default(now())
-  updatedAt   DateTime @updatedAt
+  updatedAt    DateTime @default(now())
+
+  owner        User?    @relation(fields: [ownerUserId], references: [id])
 
   @@index([ownerUserId])
   @@index([storageKey])
 }
 
 model Application {
-  id                String   @id @default(dbgenerated("gen_random_uuid()")) @map("id") @db.Uuid
-  code              String   @unique @map("code") @db.VarChar(100)
-  name              String   @map("name") @db.VarChar(255)
-  description       String?  @map("description") @db.Text
-  icon              String?  @map("icon") @db.Text
-  url               String?  @map("url") @db.Text
-  applicationsClaim String   @unique @map("applicationsClaim") @db.VarChar(255)
-  isActive          Boolean  @default(true) @map("isActive")
-  displayOrder      Int      @default(0) @map("displayOrder") @db.Integer
-  createdAt         DateTime @default(dbgenerated("now()")) @map("createdAt") @db.Timestamptz
-  updatedAt         DateTime @default(dbgenerated("now()")) @map("updatedAt") @db.Timestamptz
-
-  @@index([code], name: "Application_code_idx")
-  @@index([applicationsClaim], name: "Application_applicationsClaim_idx")
-  @@map("Application")
-}
-
-// Debt management models for /api/bot/debt
-
-enum DebtTransactionType {
-  DEBT
-  PAYMENT
+  id               String   @id @default(uuid())
+  code             String   @unique
+  name             String
+  description      String?
+  icon             String?
+  url              String?
+  applicationsClaim String  @unique
+  isActive         Boolean  @default(true)
+  displayOrder     Int      @default(0)
+  createdAt        DateTime @default(now())
+  updatedAt        DateTime @default(now())
 }
 
+// Debt models used by bot-debt module
 model DebtGroup {
-  id         String        @id @default(uuid()) @db.Uuid
-  publicId   String        @unique @db.VarChar(20) // e.g. RL-X7K29P
-  name       String        @db.VarChar(255)
-  ownerId    String        @db.Uuid
-  owner      User          @relation(fields: [ownerId], references: [id], onDelete: Cascade)
+  id        String   @id @default(uuid())
+  name      String
+  ownerId   String
+  publicId  String   @unique
+  createdAt DateTime @default(now())
+  updatedAt DateTime @default(now())
+
   members   DebtGroupMember[]
   people    DebtPerson[]
   transactions DebtTransaction[]
-  createdAt  DateTime      @default(now())
-  updatedAt  DateTime      @updatedAt
-
-  @@index([publicId])
-  @@index([ownerId])
 }
 
 model DebtGroupMember {
-  id        String   @id @default(uuid()) @db.Uuid
-  group     DebtGroup @relation(fields: [groupId], references: [id], onDelete: Cascade)
-  groupId   String   @db.Uuid
-  user      User     @relation(fields: [userId], references: [id], onDelete: Cascade)
-  userId    String   @db.Uuid
+  id        String   @id @default(uuid())
+  groupId   String
+  userId    String
   createdAt DateTime @default(now())
 
-  @@unique([groupId, userId])
-  @@index([groupId])
-  @@index([userId])
+  group     DebtGroup @relation(fields: [groupId], references: [id])
+  user      User      @relation(fields: [userId], references: [id])
+
+  @@unique([groupId, userId], name: "groupId_userId")
 }
 
 model DebtPerson {
-  id        String   @id @default(uuid()) @db.Uuid
-  group     DebtGroup @relation(fields: [groupId], references: [id], onDelete: Cascade)
-  groupId   String   @db.Uuid
-  name      String   @db.VarChar(255)
+  id        String   @id @default(uuid())
+  groupId   String
+  name      String
   isDeleted Boolean  @default(false)
-  // relations back to transactions
-  transactionsFrom DebtTransaction[] @relation("fromPerson")
-  transactionsTo   DebtTransaction[] @relation("toPerson")
   createdAt DateTime @default(now())
-  updatedAt DateTime @updatedAt
 
-  @@unique([groupId, name])
-  @@index([groupId])
+  group     DebtGroup @relation(fields: [groupId], references: [id])
+  fromTransactions DebtTransaction[] @relation("fromPerson")
+  toTransactions   DebtTransaction[] @relation("toPerson")
 }
 
 model DebtTransaction {
-  id                 String               @id @default(uuid()) @db.Uuid
-  group              DebtGroup            @relation(fields: [groupId], references: [id], onDelete: Cascade)
-  groupId            String               @db.Uuid
-  fromPerson         DebtPerson           @relation("fromPerson", fields: [fromPersonId], references: [id], onDelete: Restrict)
-  fromPersonId       String               @db.Uuid
-  toPerson           DebtPerson           @relation("toPerson", fields: [toPersonId], references: [id], onDelete: Restrict)
-  toPersonId         String               @db.Uuid
-  amount             BigInt               @db.BigInt
-  type               DebtTransactionType
+  id              String   @id @default(uuid())
+  groupId         String
+  fromPersonId    String
+  toPersonId      String
+  amount          BigInt
+  type            String
   description     String?
-  transactionDate    DateTime             @db.Date
+  transactionDate DateTime
+  createdByUserId String
+  requestId       String?
   createdAt       DateTime @default(now())
-  createdByUserId    String               @db.Uuid
-  createdByUser      User                 @relation(fields: [createdByUserId], references: [id], onDelete: SetNull)
-  requestId          String?              @db.VarChar(255)
+
+  group          DebtGroup  @relation(fields: [groupId], references: [id])
+  fromPerson     DebtPerson @relation("fromPerson", fields: [fromPersonId], references: [id])
+  toPerson       DebtPerson @relation("toPerson", fields: [toPersonId], references: [id])
+  createdByUser  User       @relation("createdBy", fields: [createdByUserId], references: [id])
 
   @@index([groupId])
-  @@index([fromPersonId])
-  @@index([toPersonId])
-  @@unique([groupId, requestId])
+  @@index([requestId])
 }
 

prisma/seed.ts

@@ -1,171 +1,44 @@
-/**
- * Prisma seed script for RayLab Core - Phase 1
- * Run with: npx ts-node prisma/seed.ts
- * Requires DATABASE_URL env var.
- */
 import { PrismaClient } from '@prisma/client';
+import * as bcrypt from 'bcrypt';
+import crypto from 'crypto';
 
 const prisma = new PrismaClient();
 
 async function main() {
-  console.log('Seeding default roles, permissions, and mappings...');
+  const clientId = 'raylab-telegram-bot';
+  const clientSecret = crypto.randomBytes(32).toString('hex');
+  const saltRounds = parseInt(process.env.BCRYPT_SALT_ROUNDS ?? '10', 10);
+  const clientSecretHash = await bcrypt.hash(clientSecret, saltRounds);
 
-  // Default roles
-  const roles = [
-    { name: 'Owner', displayName: 'Owner', description: 'Platform owner with full access' },
-    { name: 'Employee', displayName: 'Employee', description: 'Employee role with internal permissions' },
-    { name: 'Family', displayName: 'Family', description: 'Family role with limited access' },
-  ];
+  // Create service account only if not exists
+  const existing = await prisma.serviceAccount.findUnique({ where: { client_id: clientId } });
 
-    for (const r of roles) {
-    const code = r.name.toLowerCase();
-    await prisma.role.upsert({
-      where: { code },
-      update: { name: r.name, displayName: r.displayName, description: r.description },
-      create: { code, name: r.name, displayName: r.displayName, description: r.description },
-    });
-  }
-
-  // Default permissions (resource.action lowercase as requested)
-  const permissions = [
-    'users.create',
-    'users.read',
-    'users.update',
-    'users.delete',
-    'roles.create',
-    'roles.read',
-    'roles.update',
-    'roles.delete',
-    'permissions.create',
-    'permissions.read',
-    'permissions.update',
-    'permissions.delete',
-    'audit.read',
-    'storage.read',
-    'storage.write',
-    'storage.delete',
-    'media.read',
-    'media.write',
-    'media.delete',
-    'scheduler.read',
-    'scheduler.manage',
-  ];
-
-    for (const p of permissions) {
-    // Use code as canonical identifier (resource.action). Use name == code for now.
-    const code = p;
-    await prisma.permission.upsert({
-      where: { code },
-      update: { name: p, description: null },
-      create: { code, name: p, description: null },
-    });
-  }
-
-  // Assign permissions to roles (example mapping)
-    const owner = await prisma.role.findUnique({ where: { code: 'owner' } });
-  const employee = await prisma.role.findUnique({ where: { code: 'employee' } });
-  const family = await prisma.role.findUnique({ where: { code: 'family' } });
-
-  if (!owner || !employee || !family) {
-    throw new Error('Default roles missing after upsert');
-  }
-
-  // Owner -> all permissions
-  const allPerms = await prisma.permission.findMany();
-  for (const perm of allPerms) {
-    await prisma.rolePermission.upsert({
-      where: { roleId_permissionId: { roleId: owner.id, permissionId: perm.id } },
-      update: {},
-      create: { roleId: owner.id, permissionId: perm.id },
-    });
-  }
-
-  // Employee -> a subset
-  const employeePerms = [
-    'users.read',
-    'permissions.read',
-    'scheduler.read',
-    'scheduler.manage',
-    'media.read',
-    'media.write',
-  ];
-  for (const p of employeePerms) {
-        const perm = await prisma.permission.findUnique({ where: { code: p } });
-    if (perm) {
-      await prisma.rolePermission.upsert({
-        where: { roleId_permissionId: { roleId: employee.id, permissionId: perm.id } },
-        update: {},
-        create: { roleId: employee.id, permissionId: perm.id },
-      });
-    }
-  }
-
-  // Family -> limited
-  const familyPerms = [
-    'media.read',
-    'media.write',
-    'media.delete',
-  ];
-  for (const p of familyPerms) {
-        const perm = await prisma.permission.findUnique({ where: { code: p } });
-    if (perm) {
-      await prisma.rolePermission.upsert({
-        where: { roleId_permissionId: { roleId: family.id, permissionId: perm.id } },
-        update: {},
-        create: { roleId: family.id, permissionId: perm.id },
-      });
-    }
-  }
-
-  // Authentik group mappings
-    const mappings = [
-    { authGroup: 'RL-Owner', roleName: 'Owner' },
-    { authGroup: 'RL-Employee', roleName: 'Employee' },
-    { authGroup: 'RL-Family', roleName: 'Family' },
-  ];
-
-  for (const m of mappings) {
-    const role = await prisma.role.findUnique({ where: { name: m.roleName } });
-    if (!role) continue;
-    // Ensure mapping exists (authGroup + roleId). AuthGroup can map to multiple roles.
-    const existing = await prisma.authGroupRoleMapping.findFirst({ where: { authGroup: m.authGroup, roleId: role.id } });
   if (!existing) {
-      await prisma.authGroupRoleMapping.create({ data: { authGroup: m.authGroup, roleId: role.id } });
-    }
-  }
-
-    // Seed application catalog
-  const apps = [
-    { code: 'core', name: 'Core', description: 'RayLab Core Dashboard', icon: 'mdi-apps', url: '/', applicationsClaim: 'core', displayOrder: 0 },
-    { code: 'warung', name: 'Warung', description: 'Warung app', icon: 'mdi-store', url: '/warung', applicationsClaim: 'warung', displayOrder: 10 },
-    { code: 'nextcloud', name: 'Nextcloud', description: 'Nextcloud', icon: 'mdi-cloud', url: 'https://nextcloud.example', applicationsClaim: 'nextcloud', displayOrder: 20 },
-    { code: 'jellyfin', name: 'Jellyfin', description: 'Jellyfin media server', icon: 'mdi-movie', url: 'https://jellyfin.example', applicationsClaim: 'jellyfin', displayOrder: 30 },
-    { code: 'forgejo', name: 'Forgejo', description: 'Forgejo git server', icon: 'mdi-source-repository', url: 'https://forgejo.example', applicationsClaim: 'forgejo', displayOrder: 40 },
-    { code: 'immich', name: 'Immich', description: 'Immich photo server', icon: 'mdi-image', url: 'https://immich.example', applicationsClaim: 'immich', displayOrder: 50 },
-    { code: 'grafana', name: 'Grafana', description: 'Grafana monitoring', icon: 'mdi-chart-line', url: 'https://grafana.example', applicationsClaim: 'grafana', displayOrder: 60 },
-    { code: 'vaultwarden', name: 'Vaultwarden', description: 'Vaultwarden password manager', icon: 'mdi-lock', url: 'https://vaultwarden.example', applicationsClaim: 'vaultwarden', displayOrder: 70 },
-    { code: 'homepage', name: 'Homepage', description: 'Homepage', icon: 'mdi-home', url: 'https://home.example', applicationsClaim: 'homepage', displayOrder: 80 },
-  ];
-
-  for (const a of apps) {
-    await prisma.application.upsert({
-      where: { code: a.code },
-      update: { name: a.name, description: a.description, icon: a.icon, url: a.url, applicationsClaim: a.applicationsClaim, isActive: true, displayOrder: a.displayOrder },
-      create: { code: a.code, name: a.name, description: a.description, icon: a.icon, url: a.url, applicationsClaim: a.applicationsClaim, isActive: true, displayOrder: a.displayOrder },
+    const sa = await prisma.serviceAccount.create({
+      data: {
+        client_id: clientId,
+        client_secret_hash: clientSecretHash,
+        name: 'Telegram Bot',
+        role: 'BOT',
+        permissions: ['DEBT_CREATE', 'DEBT_READ', 'DEBT_SETTLE'],
+        status: 'ACTIVE',
+      },
     });
-  }
 
-  console.log('Seeding completed.');
+    console.log('Service account created for development/testing.');
+    console.log('Client ID:', clientId);
+    console.log('Client Secret (one-time):', clientSecret);
+    console.log('Please store the client secret securely.');
+  } else {
+    console.log('Service account already exists.');
+  }
 }
 
 main()
-  .catch(async (e) => {
+  .catch(e => {
     console.error(e);
-    await prisma.$disconnect();
     process.exit(1);
   })
   .finally(async () => {
     await prisma.$disconnect();
   });
-
-

src/adapters/notification/core-api-client.ts

@@ -0,0 +1,149 @@
+export type TokenResponse = {
+  access_token: string;
+  token_type: string;
+  expires_in: number;
+};
+
+export class CoreApiClientError extends Error {
+  public status?: number;
+  constructor(message: string, status?: number) {
+    super(message);
+    this.name = 'CoreApiClientError';
+    this.status = status;
+  }
+}
+
+export class CoreApiClient {
+  private apiUrl: string;
+  private clientId: string;
+  private clientSecret: string;
+  private timeoutMs: number;
+
+  private cachedToken: string | null = null;
+  private tokenExpiry: number = 0; // epoch ms
+  private tokenMarginSec = 60; // safety margin in seconds
+
+  constructor(options?: { apiUrl?: string; clientId?: string; clientSecret?: string; timeoutMs?: number }) {
+    this.apiUrl = options?.apiUrl ?? process.env.RAYLAB_CORE_API_URL ?? 'http://localhost:3000';
+    this.clientId = options?.clientId ?? process.env.RAYLAB_BOT_CLIENT_ID ?? '';
+    this.clientSecret = options?.clientSecret ?? process.env.RAYLAB_BOT_CLIENT_SECRET ?? '';
+    this.timeoutMs = options?.timeoutMs ?? 5000;
+
+    if (!this.clientId || !this.clientSecret) {
+      // keep construction allowed but operations will fail with clear errors
+    }
+  }
+
+  private async fetchWithTimeout(url: string, init: RequestInit) {
+    const controller = new AbortController();
+    const id = setTimeout(() => controller.abort(), this.timeoutMs);
+    try {
+      const res = await fetch(url, { ...init, signal: controller.signal });
+      return res;
+    } finally {
+      clearTimeout(id);
+    }
+  }
+
+  private isTokenValid() {
+    return !!this.cachedToken && Date.now() < this.tokenExpiry;
+  }
+
+  public async requestAccessToken(): Promise<TokenResponse> {
+    if (!this.clientId || !this.clientSecret) {
+      throw new CoreApiClientError('Missing client credentials');
+    }
+
+    const url = `${this.apiUrl.replace(/\/$/, '')}/api/v1/auth/token`;
+
+    const body = JSON.stringify({ client_id: this.clientId, client_secret: this.clientSecret, grant_type: 'client_credentials' });
+
+    let res: Response;
+    try {
+      res = await this.fetchWithTimeout(url, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body,
+      });
+    } catch (err: any) {
+      if (err.name === 'AbortError') {
+        throw new CoreApiClientError('Request timeout');
+      }
+      throw new CoreApiClientError('Network error');
+    }
+
+    if (res.status === 401) {
+      throw new CoreApiClientError('Invalid client credentials', 401);
+    }
+
+    if (res.status >= 400) {
+      throw new CoreApiClientError(`Token request failed with status ${res.status}`, res.status);
+    }
+
+    const payload = await res.json();
+    // Expecting { success: true, data: { access_token, token_type, expires_in }, ... }
+    const data = payload?.data;
+    if (!data || !data.access_token) {
+      throw new CoreApiClientError('Invalid token response');
+    }
+
+    // Cache token
+    this.cachedToken = data.access_token;
+    const expiresIn = typeof data.expires_in === 'number' ? data.expires_in : parseInt(data.expires_in, 10) || 3600;
+    const effective = Math.max(0, expiresIn - this.tokenMarginSec);
+    this.tokenExpiry = Date.now() + effective * 1000;
+
+    return { access_token: data.access_token, token_type: data.token_type ?? 'Bearer', expires_in: expiresIn };
+  }
+
+  public async getToken(): Promise<string> {
+    if (this.isTokenValid()) {
+      return this.cachedToken as string;
+    }
+
+    const tokenResp = await this.requestAccessToken();
+    return tokenResp.access_token;
+  }
+
+  public async authenticatedRequest(input: RequestInfo, init?: RequestInit, retry = true): Promise<Response> {
+    const token = await this.getToken();
+
+    const headers = new Headers(init?.headers as HeadersInit);
+    headers.set('Authorization', `Bearer ${token}`);
+    headers.set('Accept', 'application/json');
+
+    let res: Response;
+    try {
+      res = await this.fetchWithTimeout(typeof input === 'string' ? input : (input as Request).url, {
+        ...init,
+        headers,
+      });
+    } catch (err: any) {
+      if (err.name === 'AbortError') {
+        throw new CoreApiClientError('Request timeout');
+      }
+      throw new CoreApiClientError('Network error');
+    }
+
+    if (res.status === 401 && retry) {
+      // invalidate token and retry once
+      this.cachedToken = null;
+      this.tokenExpiry = 0;
+      try {
+        const newToken = await this.getToken();
+        const headers2 = new Headers(init?.headers as HeadersInit);
+        headers2.set('Authorization', `Bearer ${newToken}`);
+        headers2.set('Accept', 'application/json');
+        const res2 = await this.fetchWithTimeout(typeof input === 'string' ? input : (input as Request).url, {
+          ...init,
+          headers: headers2,
+        });
+        return res2;
+      } catch (e) {
+        throw e;
+      }
+    }
+
+    return res;
+  }
+}

src/modules/identity/application/handlers/create-user.handler.ts

@@ -0,0 +1,12 @@
+import { Injectable, BadRequestException } from '@nestjs/common';
+import { CreateUserDto } from '../../presentation/dto/create-user.dto';
+
+@Injectable()
+export class CreateUserHandler {
+  constructor() {}
+
+  async execute(dto: CreateUserDto): Promise<any> {
+    // Legacy handler - creation via this path is deprecated. Use the new handlers under application/handlers/user.
+    throw new BadRequestException('Deprecated handler. User creation via this endpoint is not supported.');
+  }
+}

src/modules/identity/application/handlers/login.handler.ts

@@ -0,0 +1,57 @@
+import { Injectable, UnauthorizedException } from '@nestjs/common';
+import * as bcrypt from 'bcrypt';
+import { JwtService } from '@nestjs/jwt';
+
+import { LoginDto } from '../../presentation/dto/login.dto';
+import { UserRepository } from '../../domain/repositories/user.repository.interface';
+
+@Injectable()
+export class LoginHandler {
+  constructor(
+    private readonly userRepository: UserRepository,
+    private readonly jwtService: JwtService,
+  ) {}
+
+  async execute(dto: LoginDto) {
+    const user = await this.userRepository.findByEmail(dto.email);
+
+    // Generic error message for security
+    const unauthorizedMsg = 'Invalid credentials.';
+
+    if (!user) {
+      throw new UnauthorizedException(unauthorizedMsg);
+    }
+
+    const isMatch = await bcrypt.compare(dto.password, user.password);
+
+    if (!isMatch) {
+      throw new UnauthorizedException(unauthorizedMsg);
+    }
+
+    // Build payload according to existing JwtPayload interface
+    const metadata = user.metadata ?? {};
+
+    const role = typeof metadata.role === 'string' ? metadata.role : 'USER';
+
+    const permissions = Array.isArray(metadata.permissions) ? metadata.permissions : [];
+
+    const payload = {
+      sub: user.id,
+      email: user.email,
+      role,
+      permissions,
+    };
+
+    const accessToken = await this.jwtService.signAsync(payload);
+
+    return {
+      access_token: accessToken,
+      expires_in: '1d',
+      user: {
+        id: user.id,
+        name: user.name,
+        email: user.email,
+      },
+    };
+  }
+}

src/modules/identity/application/handlers/token.handler.ts

@@ -0,0 +1,63 @@
+import { Injectable, BadRequestException, UnauthorizedException } from '@nestjs/common';
+import * as bcrypt from 'bcrypt';
+import { JwtService } from '@nestjs/jwt';
+import { ServiceAccountRepository } from '../../domain/repositories/service-account.repository.interface';
+
+@Injectable()
+export class TokenHandler {
+  constructor(
+    private readonly serviceAccountRepository: ServiceAccountRepository,
+    private readonly jwtService: JwtService,
+  ) {}
+
+  async execute(body: { client_id?: string; client_secret?: string; grant_type?: string }) {
+    const { client_id, client_secret, grant_type } = body;
+
+    if (grant_type !== 'client_credentials') {
+      throw new BadRequestException('Invalid grant_type.');
+    }
+
+    const unauthorizedMsg = 'Invalid client credentials.';
+
+    if (!client_id || !client_secret) {
+      throw new UnauthorizedException(unauthorizedMsg);
+    }
+
+    const serviceAccount = await this.serviceAccountRepository.findByClientId(client_id);
+
+    if (!serviceAccount) {
+      // generic error
+      throw new UnauthorizedException(unauthorizedMsg);
+    }
+
+    // check status
+    if (serviceAccount.status !== 'ACTIVE') {
+      throw new UnauthorizedException(unauthorizedMsg);
+    }
+
+    const match = await bcrypt.compare(client_secret, serviceAccount.clientSecretHash);
+
+    if (!match) {
+      throw new UnauthorizedException(unauthorizedMsg);
+    }
+
+    const payload: any = {
+      sub: serviceAccount.id,
+      client_id: serviceAccount.clientId,
+      // existing JwtPayload expects email; provide empty string to remain compatible
+      email: '',
+      role: serviceAccount.role,
+      permissions: serviceAccount.permissions ?? [],
+    };
+
+    const accessToken = await this.jwtService.signAsync(payload, {
+      expiresIn: '1h',
+    });
+
+    return {
+      access_token: accessToken,
+      token_type: 'Bearer',
+      expires_in: 3600,
+    };
+  }
+}

src/modules/identity/application/handlers/update-user.handler.ts

@@ -0,0 +1,12 @@
+import { Injectable, BadRequestException } from '@nestjs/common';
+import { UpdateUserDto } from '../../presentation/dto/update-user.dto';
+
+@Injectable()
+export class UpdateUserHandler {
+  constructor() {}
+
+  async execute(id: string, dto: UpdateUserDto): Promise<any> {
+    // Legacy handler - deprecated. Use new handlers under application/handlers/user.
+    throw new BadRequestException('Deprecated handler.');
+  }
+}

src/modules/identity/domain/entities/service-account.entity.ts

@@ -0,0 +1,62 @@
+export class ServiceAccount {
+  private constructor(
+    public readonly id: string,
+    public clientId: string,
+    public clientSecretHash: string,
+    public name: string,
+    public role: string,
+    public permissions: string[],
+    public status: string,
+    public metadata?: Record<string, any>,
+  ) {}
+
+  static create(data: {
+    clientId: string;
+    clientSecretHash: string;
+    name: string;
+    role: string;
+    permissions: string[];
+    metadata?: Record<string, any>;
+  }): ServiceAccount {
+    return new ServiceAccount(
+      crypto.randomUUID(),
+      data.clientId,
+      data.clientSecretHash,
+      data.name,
+      data.role,
+      data.permissions,
+      'ACTIVE',
+      data.metadata,
+    );
+  }
+
+  static restore(data: {
+    id: string;
+    clientId: string;
+    clientSecretHash: string;
+    name: string;
+    role: string;
+    permissions: string[];
+    status: string;
+    metadata?: Record<string, any>;
+  }): ServiceAccount {
+    return new ServiceAccount(
+      data.id,
+      data.clientId,
+      data.clientSecretHash,
+      data.name,
+      data.role,
+      data.permissions,
+      data.status,
+      data.metadata,
+    );
+  }
+
+  disable() {
+    this.status = 'DISABLED';
+  }
+
+  enable() {
+    this.status = 'ACTIVE';
+  }
+}

src/modules/identity/domain/entities/user.entity.ts

@@ -1,6 +1,59 @@
-import { RoleData } from "./role.entity";
-import { PermissionData } from "./permission.entity";
-import crypto from 'crypto';
+export class User {
+  private constructor(
+    public readonly id: string,
+    public name: string,
+    public email: string,
+    public password: string,
+    public metadata?: Record<string, any>,
+  ) {}
+
+  static create(data: {
+    name: string;
+    email: string;
+    password: string;
+    metadata?: Record<string, any>;
+  }): User {
+    return new User(
+      crypto.randomUUID(),
+      data.name,
+      data.email,
+      data.password,
+      data.metadata,
+    );
+  }
+
+  delete() {
+    // Business Rule
+  }
+
+  changeEmail(email: string) {
+    this.email = email;
+  }
+
+  changeName(name: string) {
+    this.name = name;
+  }
+
+  changePassword(newPassword: string) {
+    this.password = newPassword;
+  }
+
+  static restore(data: {
+    id: string;
+    name: string;
+    email: string;
+    password: string;
+    metadata?: Record<string, any>;
+  }): User {
+    return new User(
+      data.id,
+      data.name,
+      data.email,
+      data.password,
+      data.metadata,
+    );
+  }
+}
 
 export class UserData {
   private constructor(
@@ -8,78 +61,100 @@ export class UserData {
     public authentikId: string | null,
     public username: string,
     public email: string,
-    public roles: RoleData[],
-    public permissions: PermissionData[],
+    public name: string | null,
+    public roles: any[],
+    public permissions: any[],
     public isActive: boolean,
     public deletedAt: Date | null,
-    public lastSeenAt: Date | null,
-    public storageQuota: number,
-    public storageUsed: number,
+    public lastSeenAt?: Date | null,
+    public lastSyncedAt?: Date | null,
+    public syncStatus?: string | null,
+    public storageQuota?: number | null,
+    public storageUsed?: number | null,
   ) {}
 
-    //#region Create
-
   static create(data: {
     username: string;
-    email: string;
+    email?: string;
+    name?: string;
     authentikId?: string | null;
-    storageQuota?: number;
-    storageUsed?: number;
+    storageQuota?: number | null;
+    storageUsed?: number | null;
   }): UserData {
-    const quota = data.storageQuota !== undefined ? data.storageQuota : 10737418240; // 10 GB
-    const used = data.storageUsed !== undefined ? data.storageUsed : 0;
     return new UserData(
       crypto.randomUUID(),
-      data.authentikId || null,
+      data.authentikId ?? null,
       data.username,
-      data.email,
+      data.email ?? '',
+      data.name ?? data.username,
       [],
       [],
       true,
       null,
       null,
-      quota,
-      used,
+      null,
+      null,
+      data.storageQuota ?? null,
+      data.storageUsed ?? null,
     );
   }
 
-  //#endregion
-
-  //#region Read
-
-  hasRole(roleId: string) : boolean {
-    return this.roles.some(x => x.id.toLowerCase() === roleId.toLowerCase())
+    static restore(props: {
+    id: string;
+    authentikId?: string | null;
+    username: string;
+    email: string;
+    name?: string | null;
+    roles?: any[];
+    permissions?: any[];
+    isActive?: boolean;
+    deletedAt?: Date | null;
+    lastSeenAt?: Date | null;
+    lastSyncedAt?: Date | null;
+    syncStatus?: string | null;
+    storageQuota?: number | null;
+    storageUsed?: number | null;
+  }): UserData {
+    return new UserData(
+      props.id,
+      props.authentikId ?? null,
+      props.username,
+      props.email,
+      props.name ?? props.username,
+      props.roles || [],
+      props.permissions || [],
+      props.isActive ?? true,
+      props.deletedAt ?? null,
+      props.lastSeenAt ?? null,
+      props.lastSyncedAt ?? null,
+      props.syncStatus ?? null,
+      props.storageQuota ?? null,
+      props.storageUsed ?? null,
+    );
   }
 
-  assignRole(roleData : RoleData) : void {
-    if (this.hasRole(roleData.id))
-      throw new Error("Role Sudah dimiliki.");
-
-    this.roles.push(roleData);
+  assignRole(role: any) {
+    if (this.roles.some(r => r.id && r.id === role.id)) return;
+    this.roles.push(role);
   }
 
-    hasPermissions(permissionId : string) : boolean {
-    return this.permissions.some(x => x.id.toLowerCase() === permissionId.toLowerCase())
+  removeRole(roleId: string) {
+    const idx = this.roles.findIndex(r => r.id === roleId);
+    if (idx === -1) return;
+    this.roles.splice(idx, 1);
   }
 
-  hasPermission(permission: string) : boolean {
-    const byPerm = this.permissions.some(x => x.id.toLowerCase() === permission.toLowerCase() || x.name.toLowerCase() === permission.toLowerCase());
-    if (byPerm) return true;
-
-    // check roles
-    return this.roles.some(r => r.permissions.some(p => p.id.toLowerCase() === permission.toLowerCase() || p.name.toLowerCase() === permission.toLowerCase()));
+  assignPermission(permission: any) {
+    if (this.permissions.some(p => p.id && p.id === permission.id)) return;
+    this.permissions.push(permission);
   }
 
-  assignPermission(permissionData : PermissionData) : void {
-    if (this.hasPermissions(permissionData.id))
-      throw new Error("Permission sudah dimiliki.")
-
-    this.permissions.push(permissionData);
+  removePermission(permissionId: string) {
+    const idx = this.permissions.findIndex(p => p.id === permissionId);
+    if (idx === -1) return;
+    this.permissions.splice(idx, 1);
   }
 
-  //#endregion
-
-  //#region Update
   changeEmail(email: string) {
     this.email = email;
   }
@@ -92,101 +167,11 @@ export class UserData {
     this.lastSeenAt = new Date();
   }
 
-    enable() {
-    this.isActive = true;
+  setStorageQuota(q: number) {
+    this.storageQuota = q;
   }
 
-  disable() {
-    this.isActive = false;
-  }
-  //#endregion
-
-  //#region Delete
-  softDelete() {
-    this.deletedAt = new Date();
-    this.isActive = false;
-  }
-
-  restoreInstance() {
-    this.deletedAt = null;
-  }
-  //#endregion
-
-    public static restore(props: {
-      id: string;
-      authentikId?: string | null;
-      username: string;
-            email: string;
-      roles?: RoleData[];
-      permissions?: PermissionData[];
-      isActive?: boolean;
-      deletedAt?: Date | null;
-      lastSeenAt?: Date | null;
-      storageQuota?: number | null;
-      storageUsed?: number | null;
-  }): UserData {
-
-      return new UserData(
-          props.id,
-          props.authentikId || null,
-          props.username,
-                    props.email,
-          props.roles || [],
-          props.permissions || [],
-          props.isActive !== undefined ? props.isActive : true,
-          props.deletedAt || null,
-          props.lastSeenAt || null,
-          props.storageQuota !== undefined && props.storageQuota !== null ? props.storageQuota : 10737418240,
-          props.storageUsed !== undefined && props.storageUsed !== null ? props.storageUsed : 0,
-      );
-  }
-
-  removeRole(roleId: string) {
-    const idx = this.roles.findIndex(r => r.id.toLowerCase() === roleId.toLowerCase());
-    if (idx === -1) throw new Error('Role tidak ditemukan pada user.');
-    this.roles.splice(idx, 1);
-  }
-
-    removePermission(permissionId: string) {
-    const idx = this.permissions.findIndex(p => p.id.toLowerCase() === permissionId.toLowerCase());
-    if (idx === -1) throw new Error('Permission tidak ditemukan pada user.');
-    this.permissions.splice(idx, 1);
-  }
-
-  // Storage helpers
-  setStorageQuota(bytes: number) {
-    if (bytes < 0) throw new Error('storageQuota must be >= 0');
-    if (this.storageUsed > bytes) throw new Error('storageQuota cannot be less than storageUsed');
-    this.storageQuota = bytes;
-  }
-
-  setStorageUsed(bytes: number) {
-    if (bytes < 0) throw new Error('storageUsed must be >= 0');
-    if (bytes > this.storageQuota) throw new Error('storageUsed cannot exceed storageQuota');
-    this.storageUsed = bytes;
-  }
-
-  // Response helper for API
-  toResponse() {
-    const remaining = this.storageQuota - this.storageUsed;
-    const usagePercentage = this.storageQuota > 0 ? Math.round((this.storageUsed / this.storageQuota) * 100) : 0;
-
-    return {
-      id: this.id,
-      authentikId: this.authentikId,
-      username: this.username,
-      email: this.email,
-      roles: this.roles,
-      permissions: this.permissions,
-      isActive: this.isActive,
-      deletedAt: this.deletedAt,
-      lastSeenAt: this.lastSeenAt,
-      storage: {
-        quota: this.storageQuota,
-        used: this.storageUsed,
-        remaining,
-        usagePercentage,
-      },
-    };
+  setStorageUsed(u: number) {
+    this.storageUsed = u;
   }
 }

src/modules/identity/domain/repositories/service-account.repository.interface.ts

@@ -0,0 +1,11 @@
+import { ServiceAccount } from '../entities/service-account.entity';
+
+export abstract class ServiceAccountRepository {
+  abstract create(serviceAccount: ServiceAccount): Promise<ServiceAccount>;
+
+  abstract update(serviceAccount: ServiceAccount): Promise<ServiceAccount>;
+
+  abstract findById(id: string): Promise<ServiceAccount | null>;
+
+  abstract findByClientId(clientId: string): Promise<ServiceAccount | null>;
+}

src/modules/identity/domain/repositories/user.repository.interface.ts

@@ -0,0 +1,19 @@
+import { User } from '../entities/user.entity';
+
+export abstract class UserRepository {
+  abstract create(user: User): Promise<User>;
+
+  abstract update(user: User): Promise<User>;
+
+  abstract findById(
+    id: string,
+  ): Promise<User | null>;
+
+  abstract findByEmail(email: string): Promise<User | null>;
+
+  abstract findAll(): Promise<User[]>;
+
+  abstract existsByEmail(
+    email: string,
+  ): Promise<boolean>;
+}

src/modules/identity/identity.module.ts

@@ -1,120 +1,64 @@
 import { Module } from '@nestjs/common';
 import { UsersController } from './presentation/controllers/users.controller';
-import { RolesController } from './presentation/controllers/roles.controller';
-import { PermissionsController } from './presentation/controllers/permissions.controller';
 import { PrismaService } from '../../shared/prisma.service';
-import { UserService } from './application/services/user.service';
 import { PrismaUserRepository } from './infrastructure/repositories/prisma-user.repository';
 import { IUser } from './domain/repositories/user.interface';
-
-
+import { EventDispatcher } from '../../core/events/event-dispatcher';
 import { JwtAuthGuard } from '../../core/auth/guards/jwt-auth.guard';
+import { JwtModule } from '@nestjs/jwt';
 import { CreateUserHandler } from './application/handlers/user/create-user.handler';
+import { GetUserHandler as FindUserHandler } from './application/handlers/user/get-user.handler';
+import { DeleteUserHandler } from './application/handlers/user/delete-user.handler';
+import { GetUsersHandler as FindUsersHandler } from './application/handlers/user/get-users.handler';
+import { UpdateUserHandler } from './application/handlers/user/update-user.handler';
 import { PermissionGuard } from '../authorization/presentation/guards/permission.guard';
 import { Reflector } from '@nestjs/core';
-import { SyncIdentityHandler } from './application/handlers/user/sync-identity.handler';
-import { CurrentUserGuard } from './presentation/guards/current-user.guard';
-import { PrismaRoleRepository } from './infrastructure/repositories/prisma-role.repository';
-import { PrismaPermissionRepository } from './infrastructure/repositories/prisma-permission.repository';
-import { IRole } from './domain/repositories/role.interface';
-import { IPermission } from './domain/repositories/permission.interface';
-import { IAuthConfig } from './application/config/i-auth-config';
-import { EnvAuthConfig } from './application/config/env-auth-config';
-import { AuthModule } from '../auth/auth.module';
-import { AuthorizationModule } from '../authorization/authorization.module';
-import { EventBus } from '../../core/event-bus/event-bus.service';
+import { LoginHandler } from './application/handlers/login.handler';
+import { AuthController } from './presentation/controllers/auth.controller';
+import { TokenHandler } from './application/handlers/token.handler';
+import { PrismaServiceAccountRepository } from './infrastructure/repositories/prisma-service-account.repository';
+import { ServiceAccountRepository } from './domain/repositories/service-account.repository.interface';
 
-import { GetUsersHandler } from './application/handlers/user/get-users.handler';
-import { GetUserHandler } from './application/handlers/user/get-user.handler';
-import { GetCurrentUserHandler } from './application/handlers/user/get-current-user.handler';
-import { EnableUserHandler } from './application/handlers/user/enable-user.handler';
-import { DisableUserHandler } from './application/handlers/user/disable-user.handler';
-import { DeleteUserHandler } from './application/handlers/user/delete-user.handler';
-import { RestoreUserHandler } from './application/handlers/user/restore-user.handler';
-import { UpdateUserHandler } from './application/handlers/user/update-user.handler';
-
-
-
-import { GetRolesHandler } from './application/handlers/role/get-roles.handler';
-import { GetRoleHandler } from './application/handlers/role/get-role.handler';
-import { CreateRoleHandler } from './application/handlers/role/create-role.handler';
-import { UpdateRoleHandler } from './application/handlers/role/update-role.handler';
-import { DeleteRoleHandler } from './application/handlers/role/delete-role.handler';
-import { RoleAssignPermissionHandler } from './application/handlers/role/assign-permission.handler';
-import { RoleRemovePermissionHandler } from './application/handlers/role/remove-permission.handler';
-
-import { GetPermissionsHandler } from './application/handlers/permission/get-permissions.handler';
-import { GetPermissionHandler } from './application/handlers/permission/get-permission.handler';
-import { CreatePermissionHandler } from './application/handlers/permission/create-permission.handler';
-import { UpdatePermissionHandler } from './application/handlers/permission/update-permission.handler';
-import { DeletePermissionHandler } from './application/handlers/permission/delete-permission.handler';
 
 @Module({
-    imports: [AuthModule, AuthorizationModule],
+  imports: [
+    JwtModule.register({
+      secret: process.env.JWT_SECRET,
+      signOptions: {
+        expiresIn: '1d',
+      },
+    }),
+  ],
+  controllers: [UsersController, AuthController],
   providers: [
-
     //#region User 
-    // CreateUserHandler has been removed: provisioning disabled; users must be created in Authentik.
-    SyncIdentityHandler,
-    GetUsersHandler,
-
-    GetUserHandler,
-    GetCurrentUserHandler,
-    EnableUserHandler,
-    DisableUserHandler,
-    DeleteUserHandler,
-        RestoreUserHandler,
+    CreateUserHandler,
+    FindUserHandler,
+    FindUsersHandler,
     UpdateUserHandler,
-
+    DeleteUserHandler,
+    LoginHandler,
+    TokenHandler,
     //#endregion
 
-    // role & permission handlers
-    GetRolesHandler,
-    GetRoleHandler,
-    CreateRoleHandler,
-    UpdateRoleHandler,
-    DeleteRoleHandler,
-    RoleAssignPermissionHandler,
-    RoleRemovePermissionHandler,
-
-        GetPermissionsHandler,
-    GetPermissionHandler,
-    CreatePermissionHandler,
-    UpdatePermissionHandler,
-    DeletePermissionHandler,
-
     JwtAuthGuard,
-
-    CurrentUserGuard,
     PermissionGuard,
     Reflector,
         PrismaService,
     PrismaUserRepository,
-    PrismaRoleRepository,
-    PrismaPermissionRepository,
-        UserService,
-    UpdateUserHandler,
-
+    PrismaServiceAccountRepository,
     {   
       provide: IUser,
       useClass: PrismaUserRepository,
     },
     {
-      provide: IRole,
-      useClass: PrismaRoleRepository,
+      provide: ServiceAccountRepository,
+      useClass: PrismaServiceAccountRepository,
     },
     {
-      provide: IPermission,
-      useClass: PrismaPermissionRepository,
-    },
-    {
-      provide: IAuthConfig,
-      useClass: EnvAuthConfig,
+      provide: 'EVENT_DISPATCHER',
+      useValue: new EventDispatcher(),
     },
   ],
-  exports: [SyncIdentityHandler, CurrentUserGuard, { provide: IUser, useClass: PrismaUserRepository }],
-  controllers: [UsersController, RolesController, PermissionsController],
 })
 export class IdentityModule {}
-
-

src/modules/identity/infrastructure/mappers/prisma-user.mapper.ts

@@ -4,8 +4,8 @@ import { PermissionData } from '../../domain/entities/permission.entity';
 
 export class PrismaUserMapper {
     static toDomain(model: any): UserData {
-    const roles: RoleData[] = (model.roles || []).map((ur: any) => {
-          const r = ur.role;
+    const roles: RoleData[] = (model.userRoles || model.roles || []).map((ur: any) => {
+          const r = ur.role || ur.role;
           const permissions: PermissionData[] = (r?.permissions || []).map((rp: any) =>
             PermissionData.restore({
               id: rp.permission.id,
@@ -27,13 +27,13 @@ export class PrismaUserMapper {
           });
         });
 
-    const permissions: PermissionData[] = (model.permissions || []).map((up: any) =>
+    const permissions: PermissionData[] = (model.userPermissions || model.permissions || []).map((up: any) =>
           PermissionData.restore({
-            id: up.permission.id,
-            name: up.permission.name,
-            description: up.permission.description,
-            createdAt: up.permission.createdAt,
-            updatedAt: up.permission.updatedAt,
+            id: up.permission?.id || up.id,
+            name: up.permission?.name || up.name,
+            description: up.permission?.description || up.description,
+            createdAt: up.permission?.createdAt || up.createdAt,
+            updatedAt: up.permission?.updatedAt || up.updatedAt,
           }),
         );
 

src/modules/identity/infrastructure/repositories/prisma-service-account.repository.ts

@@ -0,0 +1,99 @@
+import { Injectable } from '@nestjs/common';
+import { PrismaService } from '../../../../shared/prisma.service';
+import { ServiceAccountRepository } from '../../domain/repositories/service-account.repository.interface';
+import { ServiceAccount } from '../../domain/entities/service-account.entity';
+
+@Injectable()
+export class PrismaServiceAccountRepository implements ServiceAccountRepository {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async create(serviceAccount: ServiceAccount): Promise<ServiceAccount> {
+    const created = await this.prisma.serviceAccount.create({
+      data: {
+        id: serviceAccount.id,
+        client_id: serviceAccount.clientId,
+        client_secret_hash: serviceAccount.clientSecretHash,
+        name: serviceAccount.name,
+        role: serviceAccount.role,
+        permissions: serviceAccount.permissions,
+        status: serviceAccount.status,
+        metadata: serviceAccount.metadata ?? {},
+      },
+    });
+
+    return ServiceAccount.restore({
+      id: created.id,
+      clientId: created.client_id,
+      clientSecretHash: created.client_secret_hash,
+      name: created.name,
+      role: created.role,
+      permissions: created.permissions as string[],
+      status: created.status,
+      metadata: (created.metadata ?? {}) as any,
+    });
+  }
+
+  async update(serviceAccount: ServiceAccount): Promise<ServiceAccount> {
+    const updated = await this.prisma.serviceAccount.update({
+      where: { id: serviceAccount.id },
+      data: {
+        client_id: serviceAccount.clientId,
+        client_secret_hash: serviceAccount.clientSecretHash,
+        name: serviceAccount.name,
+        role: serviceAccount.role,
+        permissions: serviceAccount.permissions,
+        status: serviceAccount.status,
+        metadata: serviceAccount.metadata ?? {},
+      },
+    });
+
+    return ServiceAccount.restore({
+      id: updated.id,
+      clientId: updated.client_id,
+      clientSecretHash: updated.client_secret_hash,
+      name: updated.name,
+      role: updated.role,
+      permissions: updated.permissions as string[],
+      status: updated.status,
+      metadata: (updated.metadata ?? {}) as any,
+    });
+  }
+
+  async findById(id: string): Promise<ServiceAccount | null> {
+    const model = await this.prisma.serviceAccount.findUnique({
+      where: { id },
+    });
+
+    if (!model) return null;
+
+    return ServiceAccount.restore({
+      id: model.id,
+      clientId: model.client_id,
+      clientSecretHash: model.client_secret_hash,
+      name: model.name,
+      role: model.role,
+      permissions: model.permissions as string[],
+      status: model.status,
+      metadata: (model.metadata ?? {}) as any,
+    });
+  }
+
+  async findByClientId(clientId: string): Promise<ServiceAccount | null> {
+    const model = await this.prisma.serviceAccount.findUnique({
+      where: { client_id: clientId },
+    });
+
+    if (!model) return null;
+
+    return ServiceAccount.restore({
+      id: model.id,
+      clientId: model.client_id,
+      clientSecretHash: model.client_secret_hash,
+      name: model.name,
+      role: model.role,
+      permissions: model.permissions as string[],
+      status: model.status,
+      metadata: (model.metadata ?? {}) as any,
+    });
+  }
+}

src/modules/identity/infrastructure/repositories/prisma-user.repository.ts

@@ -1,4 +1,4 @@
-import { Injectable } from '@nestjs/common';
+import { Injectable, NotFoundException } from '@nestjs/common';
 import { PrismaService } from '../../../../shared/prisma.service';
 import { IUser } from '../../domain/repositories/user.interface';
 import { UserData } from '../../domain/entities/user.entity';
@@ -8,110 +8,53 @@ import { PrismaUserMapper } from '../mappers/prisma-user.mapper';
 export class PrismaUserRepository implements IUser {
   constructor(private readonly prisma: PrismaService) {}
 
-  //#region  Create
-
-  async create(userData: UserData): Promise<UserData> {
-    const base = PrismaUserMapper.toPersistence(userData);
-
-    const data: any = { ...base };
-
-    if (userData.roles && userData.roles.length > 0) {
-      data.roles = {
-        create: userData.roles.map(r => ({ role: { connect: { id: r.id } }, assignedBy: 'system' })),
-      };
-    }
-
-    const created = await this.prisma.user.create({
-      data,
-      include: {
-        roles: { include: { role: { include: { permissions: { include: { permission: true } } } } } },
-        permissions: { include: { permission: true } },
-      },
-    });
-
+  async create(user: UserData): Promise<UserData> {
+    const created = await this.prisma.user.create({ data: PrismaUserMapper.toPersistence(user) as any });
     return PrismaUserMapper.toDomain(created)!;
   }
 
-  //#endregion
-
-  //#region Read
-
   async existsById(userId: string): Promise<boolean> {
-    return (
-      (await this.prisma.user.findUnique({
-        where: { id: userId },
-        select: { id: true },
-      })) !== null
-    );
+    const cnt = await this.prisma.user.count({ where: { id: userId } });
+    return cnt > 0;
   }
 
   async existByEmail(userEmail: string): Promise<boolean> {
-    return (
-      (await this.prisma.user.findUnique({
-        where: { email: userEmail },
-        select: { email: true },
-      })) !== null
-    );
+    const u = await this.prisma.user.findFirst({ where: { email: userEmail } });
+    return !!u;
   }
 
   async getById(userId: string): Promise<UserData> {
-    const userData = await this.prisma.user.findUnique({
-      where: { id: userId },
-      include: {
-        roles: { include: { role: { include: { permissions: { include: { permission: true } } } } } },
-        permissions: { include: { permission: true } },
-      },
-    });
-
-    if (userData === null) throw new Error('User tidak ditemukan.');
-
-    return PrismaUserMapper.toDomain(userData);
+    const row = await this.prisma.user.findUnique({ where: { id: userId }, include: { userRoles: { include: { role: { include: { permissions: { include: { permission: true } } } } } }, userPermissions: { include: { permission: true } } } });
+    if (!row) throw new NotFoundException('User not found.');
+    return PrismaUserMapper.toDomain(row)!;
   }
 
   async getByEmail(userEmail: string): Promise<UserData> {
-    const userData = await this.prisma.user.findUnique({
-      where: { email: userEmail },
-      include: {
-        roles: { include: { role: { include: { permissions: { include: { permission: true } } } } } },
-        permissions: { include: { permission: true } },
-      },
-    });
-
-    if (userData === null) throw new Error('User tidak ditemukan.');
-
-    return PrismaUserMapper.toDomain(userData);
+    const row = await this.prisma.user.findUnique({ where: { email: userEmail }, include: { userRoles: { include: { role: { include: { permissions: { include: { permission: true } } } } } }, userPermissions: { include: { permission: true } } } });
+    if (!row) throw new NotFoundException('User not found.');
+    return PrismaUserMapper.toDomain(row)!;
   }
 
   async findByAuthentikId(authentikId: string): Promise<UserData | null> {
-    const userData = await this.prisma.user.findUnique({
-      where: { authentikId },
-      include: {
-        roles: { include: { role: { include: { permissions: { include: { permission: true } } } } } },
-        permissions: { include: { permission: true } },
-      },
-    });
-
-    if (!userData) return null;
-
-    return PrismaUserMapper.toDomain(userData);
+    const row = await this.prisma.user.findFirst({ where: { OR: [{ authentikId }, { authentikUserId: authentikId }] }, include: { userRoles: { include: { role: { include: { permissions: { include: { permission: true } } } } } }, userPermissions: { include: { permission: true } } } });
+    if (!row) return null;
+    return PrismaUserMapper.toDomain(row)!;
   }
 
-  async find(params: {
-    page?: number;
-    limit?: number;
-    search?: string | null;
-    isActive?: boolean | null;
-    deleted?: boolean | null;
-    roleId?: string | null;
-  }): Promise<{ data: UserData[]; total: number }> {
+  async update(user: UserData): Promise<UserData> {
+    const updated = await this.prisma.user.update({ where: { id: user.id }, data: PrismaUserMapper.toPersistence(user) as any, include: { userRoles: { include: { role: { include: { permissions: { include: { permission: true } } } } } }, userPermissions: { include: { permission: true } } } });
+    return PrismaUserMapper.toDomain(updated)!;
+  }
+
+  async find(params: { page?: number; limit?: number; search?: string | null; isActive?: boolean | null; deleted?: boolean | null; roleId?: string | null; }): Promise<{ data: UserData[]; total: number }> {
     const page = params.page && params.page > 0 ? params.page : 1;
-    const limit = params.limit && params.limit > 0 ? params.limit : 10;
+    const limit = params.limit && params.limit > 0 ? params.limit : 25;
 
     const where: any = {};
-
     if (params.search) {
       where.OR = [
         { username: { contains: params.search, mode: 'insensitive' } },
+        { name: { contains: params.search, mode: 'insensitive' } },
         { email: { contains: params.search, mode: 'insensitive' } },
       ];
     }
@@ -126,132 +69,34 @@ export class PrismaUserRepository implements IUser {
     }
 
     if (params.roleId) {
-      where.roles = { some: { roleId: params.roleId } };
+      where.userRoles = { some: { roleId: params.roleId } };
     }
 
     const [total, items] = await Promise.all([
       this.prisma.user.count({ where }),
-      this.prisma.user.findMany({
-        where,
-        include: {
-          roles: { include: { role: { include: { permissions: { include: { permission: true } } } } } },
-          permissions: { include: { permission: true } },
-        },
-        skip: (page - 1) * limit,
-        take: limit,
-        orderBy: { createdAt: 'desc' },
-      }),
+      this.prisma.user.findMany({ where, skip: (page - 1) * limit, take: limit, orderBy: { createdAt: 'desc' }, include: { userRoles: { include: { role: { include: { permissions: { include: { permission: true } } } } } }, userPermissions: { include: { permission: true } } } }),
     ]);
 
     return { data: items.map(i => PrismaUserMapper.toDomain(i)!), total };
   }
 
   async softDelete(userId: string): Promise<void> {
-    await this.prisma.user.update({ where: { id: userId }, data: { deletedAt: new Date(), isActive: false } });
+    await this.prisma.user.update({ where: { id: userId }, data: { deletedAt: new Date() } });
   }
 
   async restore(userId: string): Promise<UserData> {
-    const updated = await this.prisma.user.update({
-      where: { id: userId },
-      data: { deletedAt: null },
-      include: {
-        roles: { include: { role: { include: { permissions: { include: { permission: true } } } } } },
-        permissions: { include: { permission: true } },
-      },
-    });
-
+    const updated = await this.prisma.user.update({ where: { id: userId }, data: { deletedAt: null }, include: { userRoles: { include: { role: { include: { permissions: { include: { permission: true } } } } } }, userPermissions: { include: { permission: true } } } });
     return PrismaUserMapper.toDomain(updated)!;
   }
 
   async enable(userId: string): Promise<UserData> {
-    const updated = await this.prisma.user.update({
-      where: { id: userId },
-      data: { isActive: true },
-      include: {
-        roles: { include: { role: { include: { permissions: { include: { permission: true } } } } } },
-        permissions: { include: { permission: true } },
-      },
-    });
-
+    const updated = await this.prisma.user.update({ where: { id: userId }, data: { isActive: true }, include: { userRoles: { include: { role: { include: { permissions: { include: { permission: true } } } } } }, userPermissions: { include: { permission: true } } } });
     return PrismaUserMapper.toDomain(updated)!;
   }
 
   async disable(userId: string): Promise<UserData> {
-    const updated = await this.prisma.user.update({
-      where: { id: userId },
-      data: { isActive: false },
-      include: {
-        roles: { include: { role: { include: { permissions: { include: { permission: true } } } } } },
-        permissions: { include: { permission: true } },
-      },
-    });
-
+    const updated = await this.prisma.user.update({ where: { id: userId }, data: { isActive: false }, include: { userRoles: { include: { role: { include: { permissions: { include: { permission: true } } } } } }, userPermissions: { include: { permission: true } } } });
     return PrismaUserMapper.toDomain(updated)!;
   }
-
-  async update(userData: UserData): Promise<UserData> {
-    const base = PrismaUserMapper.toPersistence(userData);
-
-    const data: any = { ...base };
-
-    // sync roles and permissions using transaction
-    const roleIds = userData.roles ? userData.roles.map(r => r.id) : [];
-    const permissionIds = userData.permissions ? userData.permissions.map(p => p.id) : [];
-
-    // perform transaction: delete removed relations, create missing ones, update user
-    await this.prisma.$transaction(async (prisma) => {
-      // current roles
-      const currentRoles = await prisma.userRole.findMany({ where: { userId: userData.id } });
-      const currentRoleIds = currentRoles.map(r => r.roleId);
-
-      const toAddRoles = roleIds.filter(id => !currentRoleIds.includes(id));
-      const toRemoveRoles = currentRoleIds.filter(id => !roleIds.includes(id));
-
-      if (toRemoveRoles.length > 0) {
-        await prisma.userRole.deleteMany({ where: { userId: userData.id, roleId: { in: toRemoveRoles } } });
-      }
-
-      if (toAddRoles.length > 0) {
-        await prisma.userRole.createMany({
-          data: toAddRoles.map(rid => ({ userId: userData.id, roleId: rid, assignedBy: 'system' })) as any,
-          skipDuplicates: true,
-        });
-      }
-
-      // permissions
-      const currentPerms = await prisma.userPermission.findMany({ where: { userId: userData.id } });
-      const currentPermIds = currentPerms.map(p => p.permissionId);
-
-      const toAddPerms = permissionIds.filter(id => !currentPermIds.includes(id));
-      const toRemovePerms = currentPermIds.filter(id => !permissionIds.includes(id));
-
-      if (toRemovePerms.length > 0) {
-        await prisma.userPermission.deleteMany({ where: { userId: userData.id, permissionId: { in: toRemovePerms } } });
-      }
-
-      if (toAddPerms.length > 0) {
-        await prisma.userPermission.createMany({
-          data: toAddPerms.map(pid => ({ userId: userData.id, permissionId: pid, assignedBy: 'system' })) as any,
-          skipDuplicates: true,
-        });
-      }
-
-      // update base user fields
-      await prisma.user.update({ where: { id: userData.id }, data });
-    });
-
-    const updated = await this.prisma.user.findUnique({
-      where: { id: userData.id },
-      include: {
-        roles: { include: { role: { include: { permissions: { include: { permission: true } } } } } },
-        permissions: { include: { permission: true } },
-      },
-    });
-
-    return PrismaUserMapper.toDomain(updated)!;
-  }
-
-  //#endregion
 }
 
-

src/modules/identity/presentation/controllers/auth.controller.ts

@@ -0,0 +1,40 @@
+import { Controller, Post, Body } from '@nestjs/common';
+import { ApiTags, ApiOperation } from '@nestjs/swagger';
+
+import { LoginDto } from '../dto/login.dto';
+import { LoginHandler } from '../../application/handlers/login.handler';
+import { TokenHandler } from '../../application/handlers/token.handler';
+
+@ApiTags('Auth')
+@Controller('api/v1/auth')
+export class AuthController {
+  constructor(
+    private readonly loginHandler: LoginHandler,
+    private readonly tokenHandler: TokenHandler,
+  ) {}
+
+  @Post('login')
+  @ApiOperation({ summary: 'Login and obtain access token' })
+  async login(@Body() dto: LoginDto) {
+    const data = await this.loginHandler.execute(dto);
+
+    return {
+      success: true,
+      data,
+      meta: {},
+    };
+  }
+
+  @Post('token')
+  @ApiOperation({ summary: 'Obtain access token using client credentials' })
+  async token(@Body() body: any) {
+    const data = await this.tokenHandler.execute(body);
+
+    return {
+      success: true,
+      data,
+      meta: {},
+    };
+  }
+}
+

src/modules/identity/presentation/controllers/users.controller.ts

@@ -1,105 +1,113 @@
-import { Controller, Get, Param, UseGuards, Query, Patch, Delete, Post, Body, Req } from '@nestjs/common';
+import {
+  Controller,
+  Get,
+  Post,
+  Delete,
+  Param,
+  UseGuards,
+  Body,
+  Patch
+} from '@nestjs/common';
 import { ApiOperation, ApiTags } from '@nestjs/swagger';
 
 import { JwtAuthGuard } from '../../../../core/auth/guards/jwt-auth.guard';
 import { PermissionGuard } from '../../../authorization/presentation/guards/permission.guard';
-import { CurrentUserGuard } from '../guards/current-user.guard';
 import { Permissions } from '../../../authorization/presentation/decorators/permission.decorator';
-import { PermissionType } from '../../../../common/constants/permission.constants';
 
-import { GetUsersHandler } from '../../application/handlers/user/get-users.handler';
-import { GetUserHandler } from '../../application/handlers/user/get-user.handler';
-import { GetCurrentUserHandler } from '../../application/handlers/user/get-current-user.handler';
-import { EnableUserHandler } from '../../application/handlers/user/enable-user.handler';
-import { DisableUserHandler } from '../../application/handlers/user/disable-user.handler';
-import { DeleteUserHandler } from '../../application/handlers/user/delete-user.handler';
-import { RestoreUserHandler } from '../../application/handlers/user/restore-user.handler';
+import { GetUserHandler as FindUserHandler } from '../../application/handlers/user/get-user.handler';
+import { GetUsersHandler as FindUsersHandler } from '../../application/handlers/user/get-users.handler';
+import { CreateUserHandler } from '../../application/handlers/user/create-user.handler';
 import { UpdateUserHandler } from '../../application/handlers/user/update-user.handler';
-
+import { DeleteUserHandler } from '../../application/handlers/user/delete-user.handler';
+import { CreateUserDto } from '../dto/create-user.dto';
+import { UpdateUserDto } from '../dto/update-user.dto';
 
 @ApiTags('Users')
-@Controller('users')
-@UseGuards(JwtAuthGuard, CurrentUserGuard, PermissionGuard)
+@Controller('api/v1/users')
+@UseGuards(JwtAuthGuard, PermissionGuard)
 export class UsersController {
   constructor(
-    private readonly getUsersHandler: GetUsersHandler,
-    private readonly getUserHandler: GetUserHandler,
-    private readonly getCurrentUserHandler: GetCurrentUserHandler,
-    private readonly enableUserHandler: EnableUserHandler,
-    private readonly disableUserHandler: DisableUserHandler,
-    private readonly deleteUserHandler: DeleteUserHandler,
-    private readonly restoreUserHandler: RestoreUserHandler,
+    private readonly createUserHandler: CreateUserHandler,
+    private readonly findUserHandler: FindUserHandler,
+    private readonly findUsersHandler: FindUsersHandler,
     private readonly updateUserHandler: UpdateUserHandler,
+    private readonly deleteUserHandler: DeleteUserHandler,
   ) {}
 
-  @Get()
-  @Permissions(PermissionType.USER_READ)
-  @ApiOperation({ summary: 'List users' })
-  async findAll(@Query() query: any) {
-    const res = await this.getUsersHandler.execute(query);
+  private sanitizeUser(user: any) {
+    if (!user) return user;
+    if (Array.isArray(user)) {
+      return user.map(u => {
+        const { password, ...rest } = u as any;
+        return rest;
+      });
+    }
+    const { password, ...rest } = user as any;
+    return rest;
+  }
+
+  @Post()
+  @Permissions('USER_CREATE')
+  @ApiOperation({ summary: 'Create user' })
+  async create(@Body() dto: CreateUserDto) {
+    const data = await this.createUserHandler.execute(dto);
 
     return {
       success: true,
-      data: res.data.map(u => (u as any).toResponse ? (u as any).toResponse() : u),
-      meta: { total: res.total },
-    };
+      data: this.sanitizeUser(data),
+      meta: {},
     }
-
-  @Get('me')
-  @ApiOperation({ summary: 'Get current user' })
-  async me(@Req() req: any) {
-    const user = await this.getCurrentUserHandler.execute(req.currentUser);
-
-    return { success: true, data: (user as any).toResponse ? (user as any).toResponse() : user, meta: {} };
   }
 
   @Get(':id')
-  @Permissions(PermissionType.USER_READ)
+  @Permissions('USER_READ')
   @ApiOperation({ summary: 'Get user by id' })
-  async findOne(@Param('id') id: string) {
-    const user = await this.getUserHandler.execute(id);
-    return { success: true, data: (user as any).toResponse ? (user as any).toResponse() : user, meta: {} };
+  async getById(@Param('id') id: string) {
+    const data = await this.findUserHandler.execute(id);
+
+    return {
+      success: true,
+      data: this.sanitizeUser(data),
+      meta: {},
+    };
   }
 
-  @Patch(':id/enable')
-  @Permissions(PermissionType.USER_UPDATE)
-  @ApiOperation({ summary: 'Enable user' })
-  async enable(@Param('id') id: string) {
-    const updated = await this.enableUserHandler.execute(id);
-    return { success: true, data: (updated as any).toResponse ? (updated as any).toResponse() : updated, meta: {} };
-  }
+  @Get()
+  @Permissions('USER_READ_ADMIN')
+  @ApiOperation({ summary: 'Get All User' })
+  async getAll() {
+    const data = await this.findUsersHandler.execute({});
 
-  @Patch(':id/disable')
-  @Permissions(PermissionType.USER_UPDATE)
-  @ApiOperation({ summary: 'Disable user' })
-  async disable(@Param('id') id: string) {
-    const updated = await this.disableUserHandler.execute(id);
-    return { success: true, data: (updated as any).toResponse ? (updated as any).toResponse() : updated, meta: {} };
+    return {
+      success: true,
+      data: this.sanitizeUser(data),
+      meta: {},
+    };
   }
 
   @Patch(':id')
-  @Permissions(PermissionType.USER_UPDATE)
-  @ApiOperation({ summary: 'Update user profile' })
-  async update(@Param('id') id: string, @Body() body: any) {
-    const updated = await this.updateUserHandler.execute(id, body);
-    return { success: true, data: (updated as any).toResponse ? (updated as any).toResponse() : updated, meta: {} };
+  @Permissions('USER_UPDATE')
+  @ApiOperation({ summary: 'Update User' })
+  async update(@Param('id') id:string, @Body() dto:UpdateUserDto) {
+    const data = await this.updateUserHandler.execute(id, dto);
+
+    return {
+      success: true,
+      data: this.sanitizeUser(data),
+      meta: {},
+    } 
   }
 
   @Delete(':id')
-  @Permissions(PermissionType.USER_DELETE)
-  @ApiOperation({ summary: 'Soft delete user' })
-  async remove(@Param('id') id: string) {
+  @Permissions('USER_DELETE')
+  @ApiOperation({ summary: 'Delete user by id' })
+  async delete(@Param('id') id: string) {
     await this.deleteUserHandler.execute(id);
-    return { success: true, data: null, meta: {} };
+
+    return {
+      success: true,
+      data: null,
+      meta: {},
+    };
   }
-
-  @Post(':id/restore')
-  @Permissions(PermissionType.USER_UPDATE)
-  @ApiOperation({ summary: 'Restore user' })
-  async restore(@Param('id') id: string) {
-    const restored = await this.restoreUserHandler.execute(id);
-    return { success: true, data: (restored as any).toResponse ? (restored as any).toResponse() : restored, meta: {} };
-  }
-
-
 }

src/modules/identity/presentation/dto/login.dto.ts

@@ -0,0 +1,13 @@
+import { IsEmail, IsString, Length } from 'class-validator';
+import { ApiProperty } from '@nestjs/swagger';
+
+export class LoginDto {
+  @ApiProperty({ example: 'user@example.com' })
+  @IsEmail()
+  email!: string;
+
+  @ApiProperty({ example: 'strongpassword' })
+  @IsString()
+  @Length(8, 128)
+  password!: string;
+}