diff --git a/modules/catalogs/src/api/infrastructure/payment-methods/express/controllers/create-payment-method.controller.ts b/modules/catalogs/src/api/infrastructure/payment-methods/express/controllers/create-payment-method.controller.ts index 88882eb2..38c0bd75 100644 --- a/modules/catalogs/src/api/infrastructure/payment-methods/express/controllers/create-payment-method.controller.ts +++ b/modules/catalogs/src/api/infrastructure/payment-methods/express/controllers/create-payment-method.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { CreatePaymentMethodRequestDTO } from "../../../../../common"; import type { CreatePaymentMethodUseCase } from "../../../../application"; @@ -16,11 +11,6 @@ export class CreatePaymentMethodController extends ExpressController { this.errorMapper = paymentMethodsApiErrorMapper; // 🔐 Reutiliza guards de auth/tenant y prohíbe 'companyId' en query - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/catalogs/src/api/infrastructure/payment-methods/express/controllers/delete-payment-method-by-id.controller.ts b/modules/catalogs/src/api/infrastructure/payment-methods/express/controllers/delete-payment-method-by-id.controller.ts index 44ff8e24..c78a3021 100644 --- a/modules/catalogs/src/api/infrastructure/payment-methods/express/controllers/delete-payment-method-by-id.controller.ts +++ b/modules/catalogs/src/api/infrastructure/payment-methods/express/controllers/delete-payment-method-by-id.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { DeletePaymentMethodByIdUseCase } from "../../../../application"; import { paymentMethodsApiErrorMapper } from "../payment-methods-api-error-mapper"; @@ -15,11 +10,6 @@ export class DeletePaymentMethodByIdController extends ExpressController { this.errorMapper = paymentMethodsApiErrorMapper; // 🔐 Reutiliza guards de auth/tenant y prohíbe 'companyId' en query - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/catalogs/src/api/infrastructure/payment-methods/express/controllers/disable-payment-method-by-id.controller.ts b/modules/catalogs/src/api/infrastructure/payment-methods/express/controllers/disable-payment-method-by-id.controller.ts index e321153a..517bb2e4 100644 --- a/modules/catalogs/src/api/infrastructure/payment-methods/express/controllers/disable-payment-method-by-id.controller.ts +++ b/modules/catalogs/src/api/infrastructure/payment-methods/express/controllers/disable-payment-method-by-id.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { DisablePaymentMethodByIdUseCase } from "../../../../application"; import { paymentMethodsApiErrorMapper } from "../payment-methods-api-error-mapper"; @@ -15,11 +10,6 @@ export class DisablePaymentMethodByIdController extends ExpressController { this.errorMapper = paymentMethodsApiErrorMapper; // 🔐 Reutiliza guards de auth/tenant y prohíbe 'companyId' en query - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/catalogs/src/api/infrastructure/payment-methods/express/controllers/enable-payment-method-by-id.controller.ts b/modules/catalogs/src/api/infrastructure/payment-methods/express/controllers/enable-payment-method-by-id.controller.ts index ab3177a8..deb743fc 100644 --- a/modules/catalogs/src/api/infrastructure/payment-methods/express/controllers/enable-payment-method-by-id.controller.ts +++ b/modules/catalogs/src/api/infrastructure/payment-methods/express/controllers/enable-payment-method-by-id.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { EnablePaymentMethodByIdUseCase } from "../../../../application"; import { paymentMethodsApiErrorMapper } from "../payment-methods-api-error-mapper"; @@ -15,11 +10,6 @@ export class EnablePaymentMethodByIdController extends ExpressController { this.errorMapper = paymentMethodsApiErrorMapper; // 🔐 Reutiliza guards de auth/tenant y prohíbe 'companyId' en query - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/catalogs/src/api/infrastructure/payment-methods/express/controllers/get-payment-method-by-id.controller.ts b/modules/catalogs/src/api/infrastructure/payment-methods/express/controllers/get-payment-method-by-id.controller.ts index 6fcb8766..190e7ee9 100644 --- a/modules/catalogs/src/api/infrastructure/payment-methods/express/controllers/get-payment-method-by-id.controller.ts +++ b/modules/catalogs/src/api/infrastructure/payment-methods/express/controllers/get-payment-method-by-id.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { GetPaymentMethodByIdUseCase } from "../../../../application"; import { paymentMethodsApiErrorMapper } from "../payment-methods-api-error-mapper"; @@ -15,11 +10,6 @@ export class GetPaymentMethodByIdController extends ExpressController { this.errorMapper = paymentMethodsApiErrorMapper; // 🔐 Reutiliza guards de auth/tenant y prohíbe 'companyId' en query - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/catalogs/src/api/infrastructure/payment-methods/express/controllers/list-payment-methods.controller.ts b/modules/catalogs/src/api/infrastructure/payment-methods/express/controllers/list-payment-methods.controller.ts index 6c1c8476..8c562f43 100644 --- a/modules/catalogs/src/api/infrastructure/payment-methods/express/controllers/list-payment-methods.controller.ts +++ b/modules/catalogs/src/api/infrastructure/payment-methods/express/controllers/list-payment-methods.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import { Criteria } from "@repo/rdx-criteria/server"; import type { ListPaymentMethodsUseCase } from "../../../../application"; @@ -15,11 +10,6 @@ export class ListPaymentMethodsController extends ExpressController { this.errorMapper = paymentMethodsApiErrorMapper; // 🔐 Reutiliza guards de auth/tenant y prohíbe 'companyId' en query - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } private getCriteriaWithDefaultOrder() { diff --git a/modules/catalogs/src/api/infrastructure/payment-methods/express/controllers/set-default-payment-method-by-id.controller.ts b/modules/catalogs/src/api/infrastructure/payment-methods/express/controllers/set-default-payment-method-by-id.controller.ts index 701c7b94..5c443665 100644 --- a/modules/catalogs/src/api/infrastructure/payment-methods/express/controllers/set-default-payment-method-by-id.controller.ts +++ b/modules/catalogs/src/api/infrastructure/payment-methods/express/controllers/set-default-payment-method-by-id.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { SetDefaultPaymentMethodByIdUseCase } from "../../../../application"; import { paymentMethodsApiErrorMapper } from "../payment-methods-api-error-mapper"; @@ -13,12 +8,6 @@ export class SetDefaultPaymentMethodByIdController extends ExpressController { super(); this.errorMapper = paymentMethodsApiErrorMapper; - - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/catalogs/src/api/infrastructure/payment-methods/express/controllers/update-payment-method-by-id.controller.ts b/modules/catalogs/src/api/infrastructure/payment-methods/express/controllers/update-payment-method-by-id.controller.ts index c01285c1..4a4b4a61 100644 --- a/modules/catalogs/src/api/infrastructure/payment-methods/express/controllers/update-payment-method-by-id.controller.ts +++ b/modules/catalogs/src/api/infrastructure/payment-methods/express/controllers/update-payment-method-by-id.controller.ts @@ -1,10 +1,5 @@ import type { UpdatePaymentMethodByIdRequestDTO } from "@erp/catalogs/common"; -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { UpdatePaymentMethodByIdUseCase } from "../../../../application"; import { paymentMethodsApiErrorMapper } from "../payment-methods-api-error-mapper"; @@ -16,11 +11,6 @@ export class UpdatePaymentMethodByIdController extends ExpressController { this.errorMapper = paymentMethodsApiErrorMapper; // 🔐 Reutiliza guards de auth/tenant y prohíbe 'companyId' en query - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { const companyId = this.getTenantId(); diff --git a/modules/catalogs/src/api/infrastructure/payment-methods/express/payment-methods.routes.ts b/modules/catalogs/src/api/infrastructure/payment-methods/express/payment-methods.routes.ts index 981f6838..f86dff1a 100644 --- a/modules/catalogs/src/api/infrastructure/payment-methods/express/payment-methods.routes.ts +++ b/modules/catalogs/src/api/infrastructure/payment-methods/express/payment-methods.routes.ts @@ -1,4 +1,4 @@ -import { type StartParams, validateRequest } from "@erp/core/api"; +import { type StartParams, forbidQueryFieldGuard, validateRequest } from "@erp/core/api"; import { requireIdentityTenantMembership } from "@erp/identity/api"; import { type NextFunction, type Request, type Response, Router } from "express"; @@ -33,6 +33,7 @@ export const paymentMethodsRouter = (params: StartParams) => { // ---------------------------------------------- router.use(...requireIdentityTenantMembership(params)); + router.use(forbidQueryFieldGuard("companyId")); // ---------------------------------------------- diff --git a/modules/catalogs/src/api/infrastructure/payment-terms/express/controllers/create-payment-term.controller.ts b/modules/catalogs/src/api/infrastructure/payment-terms/express/controllers/create-payment-term.controller.ts index 53df2e4c..de83466f 100644 --- a/modules/catalogs/src/api/infrastructure/payment-terms/express/controllers/create-payment-term.controller.ts +++ b/modules/catalogs/src/api/infrastructure/payment-terms/express/controllers/create-payment-term.controller.ts @@ -1,10 +1,5 @@ import type { CreatePaymentTermRequestDTO } from "@erp/catalogs/common"; -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { CreatePaymentTermUseCase } from "../../../../application/payment-terms"; import { paymentTermsApiErrorMapper } from "../payment-terms-api-error-mapper"; @@ -14,12 +9,6 @@ export class CreatePaymentTermController extends ExpressController { super(); this.errorMapper = paymentTermsApiErrorMapper; - - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/catalogs/src/api/infrastructure/payment-terms/express/controllers/delete-payment-term-by-id.controller.ts b/modules/catalogs/src/api/infrastructure/payment-terms/express/controllers/delete-payment-term-by-id.controller.ts index ab464eae..a57e89d7 100644 --- a/modules/catalogs/src/api/infrastructure/payment-terms/express/controllers/delete-payment-term-by-id.controller.ts +++ b/modules/catalogs/src/api/infrastructure/payment-terms/express/controllers/delete-payment-term-by-id.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { DeletePaymentTermByIdUseCase } from "../../../../application/payment-terms"; import { paymentTermsApiErrorMapper } from "../payment-terms-api-error-mapper"; @@ -13,12 +8,6 @@ export class DeletePaymentTermByIdController extends ExpressController { super(); this.errorMapper = paymentTermsApiErrorMapper; - - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/catalogs/src/api/infrastructure/payment-terms/express/controllers/disable-payment-term-by-id.controller.ts b/modules/catalogs/src/api/infrastructure/payment-terms/express/controllers/disable-payment-term-by-id.controller.ts index 101417ba..e88db752 100644 --- a/modules/catalogs/src/api/infrastructure/payment-terms/express/controllers/disable-payment-term-by-id.controller.ts +++ b/modules/catalogs/src/api/infrastructure/payment-terms/express/controllers/disable-payment-term-by-id.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { DisablePaymentTermByIdUseCase } from "../../../../application/payment-terms"; import { paymentTermsApiErrorMapper } from "../payment-terms-api-error-mapper"; @@ -13,12 +8,6 @@ export class DisablePaymentTermByIdController extends ExpressController { super(); this.errorMapper = paymentTermsApiErrorMapper; - - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/catalogs/src/api/infrastructure/payment-terms/express/controllers/enable-payment-term-by-id.controller.ts b/modules/catalogs/src/api/infrastructure/payment-terms/express/controllers/enable-payment-term-by-id.controller.ts index d5bc9987..c23430b1 100644 --- a/modules/catalogs/src/api/infrastructure/payment-terms/express/controllers/enable-payment-term-by-id.controller.ts +++ b/modules/catalogs/src/api/infrastructure/payment-terms/express/controllers/enable-payment-term-by-id.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { EnablePaymentTermByIdUseCase } from "../../../../application/payment-terms"; import { paymentTermsApiErrorMapper } from "../payment-terms-api-error-mapper"; @@ -13,12 +8,6 @@ export class EnablePaymentTermByIdController extends ExpressController { super(); this.errorMapper = paymentTermsApiErrorMapper; - - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/catalogs/src/api/infrastructure/payment-terms/express/controllers/get-payment-term-by-id.controller.ts b/modules/catalogs/src/api/infrastructure/payment-terms/express/controllers/get-payment-term-by-id.controller.ts index 211f8b70..a3dba3ae 100644 --- a/modules/catalogs/src/api/infrastructure/payment-terms/express/controllers/get-payment-term-by-id.controller.ts +++ b/modules/catalogs/src/api/infrastructure/payment-terms/express/controllers/get-payment-term-by-id.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { GetPaymentTermByIdUseCase } from "../../../../application/payment-terms"; import { paymentTermsApiErrorMapper } from "../payment-terms-api-error-mapper"; @@ -13,12 +8,6 @@ export class GetPaymentTermByIdController extends ExpressController { super(); this.errorMapper = paymentTermsApiErrorMapper; - - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/catalogs/src/api/infrastructure/payment-terms/express/controllers/list-payment-terms.controller.ts b/modules/catalogs/src/api/infrastructure/payment-terms/express/controllers/list-payment-terms.controller.ts index de4eed17..e6bada08 100644 --- a/modules/catalogs/src/api/infrastructure/payment-terms/express/controllers/list-payment-terms.controller.ts +++ b/modules/catalogs/src/api/infrastructure/payment-terms/express/controllers/list-payment-terms.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import { Criteria } from "@repo/rdx-criteria/server"; import type { ListPaymentTermsUseCase } from "../../../../application/payment-terms"; @@ -14,12 +9,6 @@ export class ListPaymentTermsController extends ExpressController { super(); this.errorMapper = paymentTermsApiErrorMapper; - - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } private getCriteriaWithDefaultOrder() { diff --git a/modules/catalogs/src/api/infrastructure/payment-terms/express/controllers/update-payment-term-by-id.controller.ts b/modules/catalogs/src/api/infrastructure/payment-terms/express/controllers/update-payment-term-by-id.controller.ts index 1de6e58d..4f9778c5 100644 --- a/modules/catalogs/src/api/infrastructure/payment-terms/express/controllers/update-payment-term-by-id.controller.ts +++ b/modules/catalogs/src/api/infrastructure/payment-terms/express/controllers/update-payment-term-by-id.controller.ts @@ -1,10 +1,5 @@ import type { UpdatePaymentTermByIdRequestDTO } from "@erp/catalogs/common"; -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { UpdatePaymentTermByIdUseCase } from "../../../../application/payment-terms"; import { paymentTermsApiErrorMapper } from "../payment-terms-api-error-mapper"; @@ -14,12 +9,6 @@ export class UpdatePaymentTermByIdController extends ExpressController { super(); this.errorMapper = paymentTermsApiErrorMapper; - - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/catalogs/src/api/infrastructure/payment-terms/express/payment-terms.routes.ts b/modules/catalogs/src/api/infrastructure/payment-terms/express/payment-terms.routes.ts index 8b706e85..6897f956 100644 --- a/modules/catalogs/src/api/infrastructure/payment-terms/express/payment-terms.routes.ts +++ b/modules/catalogs/src/api/infrastructure/payment-terms/express/payment-terms.routes.ts @@ -1,4 +1,4 @@ -import { type StartParams, validateRequest } from "@erp/core/api"; +import { type StartParams, forbidQueryFieldGuard, validateRequest } from "@erp/core/api"; import { requireIdentityTenantMembership } from "@erp/identity/api"; import type { NextFunction, Request, Response } from "express"; import { Router } from "express"; @@ -30,6 +30,7 @@ export const paymentTermsRouter = (params: StartParams) => { const router = Router({ mergeParams: true }); router.use(...requireIdentityTenantMembership(params)); + router.use(forbidQueryFieldGuard("companyId")); router.get( "/", diff --git a/modules/catalogs/src/api/infrastructure/tax-definitions/express/controllers/create-tax-definition.controller.ts b/modules/catalogs/src/api/infrastructure/tax-definitions/express/controllers/create-tax-definition.controller.ts index 90db7576..747898ca 100644 --- a/modules/catalogs/src/api/infrastructure/tax-definitions/express/controllers/create-tax-definition.controller.ts +++ b/modules/catalogs/src/api/infrastructure/tax-definitions/express/controllers/create-tax-definition.controller.ts @@ -1,10 +1,5 @@ import type { CreateTaxDefinitionRequestDTO } from "@erp/catalogs/common"; -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { CreateTaxDefinitionUseCase } from "../../../../application/tax-definitions"; import { taxDefinitionsApiErrorMapper } from "../tax-definitions-api-error-mapper"; @@ -14,12 +9,6 @@ export class CreateTaxDefinitionController extends ExpressController { super(); this.errorMapper = taxDefinitionsApiErrorMapper; - - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/catalogs/src/api/infrastructure/tax-definitions/express/controllers/delete-tax-definition-by-id.controller.ts b/modules/catalogs/src/api/infrastructure/tax-definitions/express/controllers/delete-tax-definition-by-id.controller.ts index 8d436c58..5e5eb7ea 100644 --- a/modules/catalogs/src/api/infrastructure/tax-definitions/express/controllers/delete-tax-definition-by-id.controller.ts +++ b/modules/catalogs/src/api/infrastructure/tax-definitions/express/controllers/delete-tax-definition-by-id.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { DeleteTaxDefinitionByIdUseCase } from "../../../../application/tax-definitions"; import { taxDefinitionsApiErrorMapper } from "../tax-definitions-api-error-mapper"; @@ -13,12 +8,6 @@ export class DeleteTaxDefinitionByIdController extends ExpressController { super(); this.errorMapper = taxDefinitionsApiErrorMapper; - - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/catalogs/src/api/infrastructure/tax-definitions/express/controllers/disable-tax-definition-by-id.controller.ts b/modules/catalogs/src/api/infrastructure/tax-definitions/express/controllers/disable-tax-definition-by-id.controller.ts index 24df8959..121f65f7 100644 --- a/modules/catalogs/src/api/infrastructure/tax-definitions/express/controllers/disable-tax-definition-by-id.controller.ts +++ b/modules/catalogs/src/api/infrastructure/tax-definitions/express/controllers/disable-tax-definition-by-id.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { DisableTaxDefinitionByIdUseCase } from "../../../../application/tax-definitions"; import { taxDefinitionsApiErrorMapper } from "../tax-definitions-api-error-mapper"; @@ -13,12 +8,6 @@ export class DisableTaxDefinitionByIdController extends ExpressController { super(); this.errorMapper = taxDefinitionsApiErrorMapper; - - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/catalogs/src/api/infrastructure/tax-definitions/express/controllers/enable-tax-definition-by-id.controller.ts b/modules/catalogs/src/api/infrastructure/tax-definitions/express/controllers/enable-tax-definition-by-id.controller.ts index 3dc47a27..c9a2153c 100644 --- a/modules/catalogs/src/api/infrastructure/tax-definitions/express/controllers/enable-tax-definition-by-id.controller.ts +++ b/modules/catalogs/src/api/infrastructure/tax-definitions/express/controllers/enable-tax-definition-by-id.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { EnableTaxDefinitionByIdUseCase } from "../../../../application/tax-definitions"; import { taxDefinitionsApiErrorMapper } from "../tax-definitions-api-error-mapper"; @@ -13,12 +8,6 @@ export class EnableTaxDefinitionByIdController extends ExpressController { super(); this.errorMapper = taxDefinitionsApiErrorMapper; - - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/catalogs/src/api/infrastructure/tax-definitions/express/controllers/get-tax-definition-by-id.controller.ts b/modules/catalogs/src/api/infrastructure/tax-definitions/express/controllers/get-tax-definition-by-id.controller.ts index 44070907..099bb327 100644 --- a/modules/catalogs/src/api/infrastructure/tax-definitions/express/controllers/get-tax-definition-by-id.controller.ts +++ b/modules/catalogs/src/api/infrastructure/tax-definitions/express/controllers/get-tax-definition-by-id.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { GetTaxDefinitionByIdUseCase } from "../../../../application/tax-definitions"; import { taxDefinitionsApiErrorMapper } from "../tax-definitions-api-error-mapper"; @@ -13,12 +8,6 @@ export class GetTaxDefinitionByIdController extends ExpressController { super(); this.errorMapper = taxDefinitionsApiErrorMapper; - - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/catalogs/src/api/infrastructure/tax-definitions/express/controllers/list-tax-definitions.controller.ts b/modules/catalogs/src/api/infrastructure/tax-definitions/express/controllers/list-tax-definitions.controller.ts index 98049570..4620f86a 100644 --- a/modules/catalogs/src/api/infrastructure/tax-definitions/express/controllers/list-tax-definitions.controller.ts +++ b/modules/catalogs/src/api/infrastructure/tax-definitions/express/controllers/list-tax-definitions.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import { Criteria } from "@repo/rdx-criteria/server"; import type { ListTaxDefinitionsUseCase } from "../../../../application/tax-definitions"; @@ -14,12 +9,6 @@ export class ListTaxDefinitionsController extends ExpressController { super(); this.errorMapper = taxDefinitionsApiErrorMapper; - - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } private getCriteriaWithDefaultOrder() { diff --git a/modules/catalogs/src/api/infrastructure/tax-definitions/express/controllers/update-tax-definition-by-id.controller.ts b/modules/catalogs/src/api/infrastructure/tax-definitions/express/controllers/update-tax-definition-by-id.controller.ts index c2aba57c..0d1bb872 100644 --- a/modules/catalogs/src/api/infrastructure/tax-definitions/express/controllers/update-tax-definition-by-id.controller.ts +++ b/modules/catalogs/src/api/infrastructure/tax-definitions/express/controllers/update-tax-definition-by-id.controller.ts @@ -1,10 +1,5 @@ import type { UpdateTaxDefinitionByIdRequestDTO } from "@erp/catalogs/common"; -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { UpdateTaxDefinitionByIdUseCase } from "../../../../application/tax-definitions"; import { taxDefinitionsApiErrorMapper } from "../tax-definitions-api-error-mapper"; @@ -14,12 +9,6 @@ export class UpdateTaxDefinitionByIdController extends ExpressController { super(); this.errorMapper = taxDefinitionsApiErrorMapper; - - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/catalogs/src/api/infrastructure/tax-definitions/express/tax-definitions.routes.ts b/modules/catalogs/src/api/infrastructure/tax-definitions/express/tax-definitions.routes.ts index 055c9593..80678aed 100644 --- a/modules/catalogs/src/api/infrastructure/tax-definitions/express/tax-definitions.routes.ts +++ b/modules/catalogs/src/api/infrastructure/tax-definitions/express/tax-definitions.routes.ts @@ -1,4 +1,4 @@ -import { type StartParams, validateRequest } from "@erp/core/api"; +import { type StartParams, forbidQueryFieldGuard, validateRequest } from "@erp/core/api"; import { requireIdentityTenantMembership } from "@erp/identity/api"; import type { NextFunction, Request, Response } from "express"; import { Router } from "express"; @@ -30,6 +30,7 @@ export const taxDefinitionsRouter = (params: StartParams) => { const router = Router({ mergeParams: true }); router.use(...requireIdentityTenantMembership(params)); + router.use(forbidQueryFieldGuard("companyId")); router.get( "/", diff --git a/modules/catalogs/src/api/infrastructure/tax-regimes/express/controllers/create-tax-regime.controller.ts b/modules/catalogs/src/api/infrastructure/tax-regimes/express/controllers/create-tax-regime.controller.ts index 94f5d198..49498bc3 100644 --- a/modules/catalogs/src/api/infrastructure/tax-regimes/express/controllers/create-tax-regime.controller.ts +++ b/modules/catalogs/src/api/infrastructure/tax-regimes/express/controllers/create-tax-regime.controller.ts @@ -1,10 +1,5 @@ import type { CreateTaxRegimeRequestDTO } from "@erp/catalogs/common"; -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { CreateTaxRegimeUseCase } from "../../../../application/tax-regimes"; import { taxRegimesApiErrorMapper } from "../tax-regime-api-error-mapper"; @@ -14,12 +9,6 @@ export class CreateTaxRegimeController extends ExpressController { super(); this.errorMapper = taxRegimesApiErrorMapper; - - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/catalogs/src/api/infrastructure/tax-regimes/express/controllers/delete-tax-regime-by-id.controller.ts b/modules/catalogs/src/api/infrastructure/tax-regimes/express/controllers/delete-tax-regime-by-id.controller.ts index aff945bd..04a761fb 100644 --- a/modules/catalogs/src/api/infrastructure/tax-regimes/express/controllers/delete-tax-regime-by-id.controller.ts +++ b/modules/catalogs/src/api/infrastructure/tax-regimes/express/controllers/delete-tax-regime-by-id.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { DeleteTaxRegimeByIdUseCase } from "../../../../application"; import { taxRegimesApiErrorMapper } from "../tax-regime-api-error-mapper"; @@ -13,12 +8,6 @@ export class DeleteTaxRegimeByIdController extends ExpressController { super(); this.errorMapper = taxRegimesApiErrorMapper; - - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/catalogs/src/api/infrastructure/tax-regimes/express/controllers/disable-tax-regime-by-id.controller.ts b/modules/catalogs/src/api/infrastructure/tax-regimes/express/controllers/disable-tax-regime-by-id.controller.ts index 3df46a0a..4f1783a4 100644 --- a/modules/catalogs/src/api/infrastructure/tax-regimes/express/controllers/disable-tax-regime-by-id.controller.ts +++ b/modules/catalogs/src/api/infrastructure/tax-regimes/express/controllers/disable-tax-regime-by-id.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { DisableTaxRegimeByIdUseCase } from "../../../../application"; import { taxRegimesApiErrorMapper } from "../tax-regime-api-error-mapper"; @@ -13,12 +8,6 @@ export class DisableTaxRegimeByIdController extends ExpressController { super(); this.errorMapper = taxRegimesApiErrorMapper; - - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/catalogs/src/api/infrastructure/tax-regimes/express/controllers/enable-tax-regime-by-id.controller.ts b/modules/catalogs/src/api/infrastructure/tax-regimes/express/controllers/enable-tax-regime-by-id.controller.ts index 75604edf..fde475fb 100644 --- a/modules/catalogs/src/api/infrastructure/tax-regimes/express/controllers/enable-tax-regime-by-id.controller.ts +++ b/modules/catalogs/src/api/infrastructure/tax-regimes/express/controllers/enable-tax-regime-by-id.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { EnableTaxRegimeByIdUseCase } from "../../../../application"; import { taxRegimesApiErrorMapper } from "../tax-regime-api-error-mapper"; @@ -13,12 +8,6 @@ export class EnableTaxRegimeByIdController extends ExpressController { super(); this.errorMapper = taxRegimesApiErrorMapper; - - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/catalogs/src/api/infrastructure/tax-regimes/express/controllers/get-tax-regime-by-id.controller.ts b/modules/catalogs/src/api/infrastructure/tax-regimes/express/controllers/get-tax-regime-by-id.controller.ts index def1b721..b8bc2159 100644 --- a/modules/catalogs/src/api/infrastructure/tax-regimes/express/controllers/get-tax-regime-by-id.controller.ts +++ b/modules/catalogs/src/api/infrastructure/tax-regimes/express/controllers/get-tax-regime-by-id.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { GetTaxRegimeByIdUseCase } from "../../../../application"; import { taxRegimesApiErrorMapper } from "../tax-regime-api-error-mapper"; @@ -13,12 +8,6 @@ export class GetTaxRegimeByIdController extends ExpressController { super(); this.errorMapper = taxRegimesApiErrorMapper; - - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/catalogs/src/api/infrastructure/tax-regimes/express/controllers/list-tax-regimes.controller.ts b/modules/catalogs/src/api/infrastructure/tax-regimes/express/controllers/list-tax-regimes.controller.ts index 6c223f5e..81f62531 100644 --- a/modules/catalogs/src/api/infrastructure/tax-regimes/express/controllers/list-tax-regimes.controller.ts +++ b/modules/catalogs/src/api/infrastructure/tax-regimes/express/controllers/list-tax-regimes.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import { Criteria } from "@repo/rdx-criteria/server"; import type { ListTaxRegimesUseCase } from "../../../../application"; @@ -14,12 +9,6 @@ export class ListTaxRegimesController extends ExpressController { super(); this.errorMapper = taxRegimesApiErrorMapper; - - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } private getCriteriaWithDefaultOrder() { diff --git a/modules/catalogs/src/api/infrastructure/tax-regimes/express/controllers/update-tax-regime-by-id.controller.ts b/modules/catalogs/src/api/infrastructure/tax-regimes/express/controllers/update-tax-regime-by-id.controller.ts index dcca5b59..652a9b01 100644 --- a/modules/catalogs/src/api/infrastructure/tax-regimes/express/controllers/update-tax-regime-by-id.controller.ts +++ b/modules/catalogs/src/api/infrastructure/tax-regimes/express/controllers/update-tax-regime-by-id.controller.ts @@ -1,10 +1,5 @@ import type { UpdateTaxRegimeByIdRequestDTO } from "@erp/catalogs/common"; -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { UpdateTaxRegimeByIdUseCase } from "../../../../application"; import { taxRegimesApiErrorMapper } from "../tax-regime-api-error-mapper"; @@ -14,12 +9,6 @@ export class UpdateTaxRegimeByIdController extends ExpressController { super(); this.errorMapper = taxRegimesApiErrorMapper; - - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/catalogs/src/api/infrastructure/tax-regimes/express/tax-regimes.routes.ts b/modules/catalogs/src/api/infrastructure/tax-regimes/express/tax-regimes.routes.ts index 7e646f73..8e30d496 100644 --- a/modules/catalogs/src/api/infrastructure/tax-regimes/express/tax-regimes.routes.ts +++ b/modules/catalogs/src/api/infrastructure/tax-regimes/express/tax-regimes.routes.ts @@ -1,4 +1,4 @@ -import { type StartParams, validateRequest } from "@erp/core/api"; +import { type StartParams, forbidQueryFieldGuard, validateRequest } from "@erp/core/api"; import { requireIdentityTenantMembership } from "@erp/identity/api"; import type { NextFunction, Request, Response } from "express"; import { Router } from "express"; @@ -30,6 +30,7 @@ export const taxRegimesRouter = (params: StartParams) => { const router = Router({ mergeParams: true }); router.use(...requireIdentityTenantMembership(params)); + router.use(forbidQueryFieldGuard("companyId")); router.get( "/", diff --git a/modules/companies/src/api/infrastructure/express/controllers/create-company.controller.ts b/modules/companies/src/api/infrastructure/express/controllers/create-company.controller.ts index c176b3f5..0b03f83a 100644 --- a/modules/companies/src/api/infrastructure/express/controllers/create-company.controller.ts +++ b/modules/companies/src/api/infrastructure/express/controllers/create-company.controller.ts @@ -1,4 +1,4 @@ -import { ExpressController, requireAuthenticatedGuard } from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { CreateCompanyRequestDTO } from "../../../../common"; import type { CreateCompanyUseCase } from "../../../application"; @@ -8,7 +8,6 @@ export class CreateCompanyController extends ExpressController { public constructor(private readonly useCase: CreateCompanyUseCase) { super(); this.errorMapper = companiesApiErrorMapper; - this.registerGuards(requireAuthenticatedGuard()); } protected async executeImpl() { diff --git a/modules/companies/src/api/infrastructure/express/controllers/disable-company.controller.ts b/modules/companies/src/api/infrastructure/express/controllers/disable-company.controller.ts index efd13111..692cca7f 100644 --- a/modules/companies/src/api/infrastructure/express/controllers/disable-company.controller.ts +++ b/modules/companies/src/api/infrastructure/express/controllers/disable-company.controller.ts @@ -1,8 +1,4 @@ -import { - ExpressController, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { DisableCompanyUseCase } from "../../../application"; import { companiesApiErrorMapper } from "../companies-api-error-mapper"; @@ -11,13 +7,12 @@ export class DisableCompanyController extends ExpressController { public constructor(private readonly useCase: DisableCompanyUseCase) { super(); this.errorMapper = companiesApiErrorMapper; - this.registerGuards(requireAuthenticatedGuard(), requireCompanyContextGuard()); } protected async executeImpl() { const tenantId = this.getTenantId(); const { company_id } = this.req.params; - if (!company_id || !tenantId) { + if (!(company_id && tenantId)) { return this.invalidInputError("Company ID missing"); } diff --git a/modules/companies/src/api/infrastructure/express/controllers/enable-company.controller.ts b/modules/companies/src/api/infrastructure/express/controllers/enable-company.controller.ts index f120c594..7808e062 100644 --- a/modules/companies/src/api/infrastructure/express/controllers/enable-company.controller.ts +++ b/modules/companies/src/api/infrastructure/express/controllers/enable-company.controller.ts @@ -1,8 +1,4 @@ -import { - ExpressController, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { EnableCompanyUseCase } from "../../../application"; import { companiesApiErrorMapper } from "../companies-api-error-mapper"; @@ -11,13 +7,12 @@ export class EnableCompanyController extends ExpressController { public constructor(private readonly useCase: EnableCompanyUseCase) { super(); this.errorMapper = companiesApiErrorMapper; - this.registerGuards(requireAuthenticatedGuard(), requireCompanyContextGuard()); } protected async executeImpl() { const tenantId = this.getTenantId(); const { company_id } = this.req.params; - if (!company_id || !tenantId) { + if (!(company_id && tenantId)) { return this.invalidInputError("Company ID missing"); } diff --git a/modules/companies/src/api/infrastructure/express/controllers/find-available-companies.controller.ts b/modules/companies/src/api/infrastructure/express/controllers/find-available-companies.controller.ts index 324e3eab..08749d69 100644 --- a/modules/companies/src/api/infrastructure/express/controllers/find-available-companies.controller.ts +++ b/modules/companies/src/api/infrastructure/express/controllers/find-available-companies.controller.ts @@ -1,4 +1,4 @@ -import { ExpressController, requireAuthenticatedGuard } from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { FindAvailableCompaniesForAccountUseCase } from "../../../application"; import { companiesApiErrorMapper } from "../companies-api-error-mapper"; @@ -7,7 +7,6 @@ export class FindAvailableCompaniesController extends ExpressController { public constructor(private readonly useCase: FindAvailableCompaniesForAccountUseCase) { super(); this.errorMapper = companiesApiErrorMapper; - this.registerGuards(requireAuthenticatedGuard()); } protected async executeImpl() { diff --git a/modules/companies/src/api/infrastructure/express/controllers/get-company-by-id.controller.ts b/modules/companies/src/api/infrastructure/express/controllers/get-company-by-id.controller.ts index c49fea61..c6d7755d 100644 --- a/modules/companies/src/api/infrastructure/express/controllers/get-company-by-id.controller.ts +++ b/modules/companies/src/api/infrastructure/express/controllers/get-company-by-id.controller.ts @@ -1,8 +1,4 @@ -import { - ExpressController, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { GetCompanyByIdUseCase } from "../../../application"; import { companiesApiErrorMapper } from "../companies-api-error-mapper"; @@ -11,13 +7,12 @@ export class GetCompanyByIdController extends ExpressController { public constructor(private readonly useCase: GetCompanyByIdUseCase) { super(); this.errorMapper = companiesApiErrorMapper; - this.registerGuards(requireAuthenticatedGuard(), requireCompanyContextGuard()); } protected async executeImpl() { const tenantId = this.getTenantId(); const { company_id } = this.req.params; - if (!company_id || !tenantId) { + if (!(company_id && tenantId)) { return this.invalidInputError("Company ID missing"); } diff --git a/modules/companies/src/api/infrastructure/express/controllers/get-current-company.controller.ts b/modules/companies/src/api/infrastructure/express/controllers/get-current-company.controller.ts index d5136833..cb6fa654 100644 --- a/modules/companies/src/api/infrastructure/express/controllers/get-current-company.controller.ts +++ b/modules/companies/src/api/infrastructure/express/controllers/get-current-company.controller.ts @@ -1,8 +1,4 @@ -import { - ExpressController, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { GetCurrentCompanyUseCase } from "../../../application"; import { companiesApiErrorMapper } from "../companies-api-error-mapper"; @@ -11,7 +7,6 @@ export class GetCurrentCompanyController extends ExpressController { public constructor(private readonly useCase: GetCurrentCompanyUseCase) { super(); this.errorMapper = companiesApiErrorMapper; - this.registerGuards(requireAuthenticatedGuard(), requireCompanyContextGuard()); } protected async executeImpl() { diff --git a/modules/companies/src/api/infrastructure/express/controllers/update-company.controller.ts b/modules/companies/src/api/infrastructure/express/controllers/update-company.controller.ts index 923d9f21..59073bef 100644 --- a/modules/companies/src/api/infrastructure/express/controllers/update-company.controller.ts +++ b/modules/companies/src/api/infrastructure/express/controllers/update-company.controller.ts @@ -1,8 +1,4 @@ -import { - ExpressController, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { UpdateCompanyRequestDTO } from "../../../../common"; import type { UpdateCompanyUseCase } from "../../../application"; @@ -12,13 +8,12 @@ export class UpdateCompanyController extends ExpressController { public constructor(private readonly useCase: UpdateCompanyUseCase) { super(); this.errorMapper = companiesApiErrorMapper; - this.registerGuards(requireAuthenticatedGuard(), requireCompanyContextGuard()); } protected async executeImpl() { const tenantId = this.getTenantId(); const { company_id } = this.req.params; - if (!company_id || !tenantId) { + if (!(company_id && tenantId)) { return this.invalidInputError("Company ID missing"); } diff --git a/modules/companies/src/api/infrastructure/express/controllers/update-current-company.controller.ts b/modules/companies/src/api/infrastructure/express/controllers/update-current-company.controller.ts index 21f22b71..dae6d67b 100644 --- a/modules/companies/src/api/infrastructure/express/controllers/update-current-company.controller.ts +++ b/modules/companies/src/api/infrastructure/express/controllers/update-current-company.controller.ts @@ -1,8 +1,4 @@ -import { - ExpressController, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { UpdateCurrentCompanyRequestDTO } from "../../../../common"; import type { UpdateCurrentCompanyUseCase } from "../../../application"; @@ -12,7 +8,6 @@ export class UpdateCurrentCompanyController extends ExpressController { public constructor(private readonly useCase: UpdateCurrentCompanyUseCase) { super(); this.errorMapper = companiesApiErrorMapper; - this.registerGuards(requireAuthenticatedGuard(), requireCompanyContextGuard()); } protected async executeImpl() { diff --git a/modules/core/src/api/infrastructure/express/express-guards.ts b/modules/core/src/api/infrastructure/express/express-guards.ts index 64a9ac62..247973f8 100644 --- a/modules/core/src/api/infrastructure/express/express-guards.ts +++ b/modules/core/src/api/infrastructure/express/express-guards.ts @@ -1,5 +1,5 @@ import type { Criteria } from "@repo/rdx-criteria/server"; -import type { NextFunction, Request, Response } from "express"; +import type { NextFunction, Request, RequestHandler, Response } from "express"; import { type ApiError, @@ -7,7 +7,7 @@ import { UnauthorizedApiError, ValidationApiError, } from "./errors"; -import type { ExpressController } from "./express-controller"; +import { ExpressController } from "./express-controller"; export type GuardResultLike = { isFailure: boolean; error?: ApiError }; @@ -53,12 +53,16 @@ export function requireCompanyContextGuard(): GuardFn { Impide que el cliente intente fijar el 'companyId' vía query (?companyId=...). La política de scoping real debe hacerse en repos/servicios; esto es defensa adicional. */ -export function forbidQueryFieldGuard(field = "companyId"): GuardFn { - return ({ req }: GuardContext) => { - if (Object.hasOwn(req.query, field)) { - return guardFail(new ValidationApiError(`Query param "${field}" is not allowed`)); +export function forbidQueryFieldGuard(field = "companyId"): RequestHandler { + return (req, res, next) => { + if (Object.hasOwn(req.query ?? {}, field)) { + return ExpressController.errorResponse( + new ValidationApiError(`Query param "${field}" is not allowed`), + req, + res + ); } - return guardOk(); + return next(); }; } diff --git a/modules/customer-invoices/src/api/infrastructure/company-verifactu-profile/express/company-verifactu-profile.routes.ts b/modules/customer-invoices/src/api/infrastructure/company-verifactu-profile/express/company-verifactu-profile.routes.ts index 56a11ca6..7f443f19 100644 --- a/modules/customer-invoices/src/api/infrastructure/company-verifactu-profile/express/company-verifactu-profile.routes.ts +++ b/modules/customer-invoices/src/api/infrastructure/company-verifactu-profile/express/company-verifactu-profile.routes.ts @@ -1,9 +1,10 @@ -import { type StartParams, validateRequest } from "@erp/core/api"; +import { type StartParams, forbidQueryFieldGuard, validateRequest } from "@erp/core/api"; import { requireIdentityTenant } from "@erp/identity/api"; import { type NextFunction, type Request, type Response, Router } from "express"; import { UpdateCompanyVerifactuProfileRequestSchema } from "../../../../common"; import type { CompanyVerifactuProfileInternalDeps } from "../di"; + import { GetCompanyVerifactuProfileController, UpdateCompanyVerifactuProfileController, @@ -19,6 +20,8 @@ export const companyVerifactuProfileRouter = (params: StartParams) => { const router = Router({ mergeParams: true }); router.use(...requireIdentityTenant(params)); + router.use(forbidQueryFieldGuard("companyId")); + router.use(forbidQueryFieldGuard("company_id")); router.get("/", (req: Request, res: Response, next: NextFunction) => { const controller = new GetCompanyVerifactuProfileController( diff --git a/modules/customer-invoices/src/api/infrastructure/company-verifactu-profile/express/controllers/get-company-verifactu-profile.controller.ts b/modules/customer-invoices/src/api/infrastructure/company-verifactu-profile/express/controllers/get-company-verifactu-profile.controller.ts index 14c7280c..a7d6a577 100644 --- a/modules/customer-invoices/src/api/infrastructure/company-verifactu-profile/express/controllers/get-company-verifactu-profile.controller.ts +++ b/modules/customer-invoices/src/api/infrastructure/company-verifactu-profile/express/controllers/get-company-verifactu-profile.controller.ts @@ -1,21 +1,10 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { GetCompanyVerifactuProfileUseCase } from "../../../../application"; export class GetCompanyVerifactuProfileController extends ExpressController { public constructor(private readonly useCase: GetCompanyVerifactuProfileUseCase) { super(); - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId"), - forbidQueryFieldGuard("company_id") - ); } protected async executeImpl() { diff --git a/modules/customer-invoices/src/api/infrastructure/company-verifactu-profile/express/controllers/update-company-verifactu-profile.controller.ts b/modules/customer-invoices/src/api/infrastructure/company-verifactu-profile/express/controllers/update-company-verifactu-profile.controller.ts index 5a694605..f988bc6e 100644 --- a/modules/customer-invoices/src/api/infrastructure/company-verifactu-profile/express/controllers/update-company-verifactu-profile.controller.ts +++ b/modules/customer-invoices/src/api/infrastructure/company-verifactu-profile/express/controllers/update-company-verifactu-profile.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { UpdateCompanyVerifactuProfileRequestDTO } from "../../../../../common"; import type { UpdateCompanyVerifactuProfileUseCase } from "../../../../application"; @@ -11,12 +6,6 @@ import type { UpdateCompanyVerifactuProfileUseCase } from "../../../../applicati export class UpdateCompanyVerifactuProfileController extends ExpressController { public constructor(private readonly useCase: UpdateCompanyVerifactuProfileUseCase) { super(); - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId"), - forbidQueryFieldGuard("company_id") - ); } protected async executeImpl() { diff --git a/modules/customer-invoices/src/api/infrastructure/issued-invoices/express/controllers/get-issued-invoice-by-id.controller.ts b/modules/customer-invoices/src/api/infrastructure/issued-invoices/express/controllers/get-issued-invoice-by-id.controller.ts index e83490b3..4a59af0e 100644 --- a/modules/customer-invoices/src/api/infrastructure/issued-invoices/express/controllers/get-issued-invoice-by-id.controller.ts +++ b/modules/customer-invoices/src/api/infrastructure/issued-invoices/express/controllers/get-issued-invoice-by-id.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { GetIssuedInvoiceByIdUseCase } from "../../../../application/issued-invoices/index.ts"; import { issuedInvoicesApiErrorMapper } from "../issued-invoices-api-error-mapper.ts"; @@ -14,11 +9,6 @@ export class GetIssuedInvoiceByIdController extends ExpressController { this.errorMapper = issuedInvoicesApiErrorMapper; // 🔐 Reutiliza guards de auth/tenant y prohíbe 'companyId' en query - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/customer-invoices/src/api/infrastructure/issued-invoices/express/controllers/list-issued-invoices.controller.ts b/modules/customer-invoices/src/api/infrastructure/issued-invoices/express/controllers/list-issued-invoices.controller.ts index 645bb012..172b2295 100644 --- a/modules/customer-invoices/src/api/infrastructure/issued-invoices/express/controllers/list-issued-invoices.controller.ts +++ b/modules/customer-invoices/src/api/infrastructure/issued-invoices/express/controllers/list-issued-invoices.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import { Criteria } from "@repo/rdx-criteria/server"; import { ListIssuedInvoicesResponseSchema } from "../../../../../common/index.ts"; @@ -16,11 +11,6 @@ export class ListIssuedInvoicesController extends ExpressController { this.errorMapper = issuedInvoicesApiErrorMapper; // 🔐 Reutiliza guards de auth/tenant y prohíbe 'companyId' en query - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } private getCriteriaWithDefaultOrder() { diff --git a/modules/customer-invoices/src/api/infrastructure/issued-invoices/express/controllers/report-issued-invoice.controller.ts b/modules/customer-invoices/src/api/infrastructure/issued-invoices/express/controllers/report-issued-invoice.controller.ts index eccae37e..6f7f27aa 100644 --- a/modules/customer-invoices/src/api/infrastructure/issued-invoices/express/controllers/report-issued-invoice.controller.ts +++ b/modules/customer-invoices/src/api/infrastructure/issued-invoices/express/controllers/report-issued-invoice.controller.ts @@ -1,10 +1,4 @@ -import { - ExpressController, - type RendererFormat, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { ReportIssueInvoiceByIdQueryRequestDTO } from "../../../../../common"; import type { ReportIssuedInvoiceUseCase } from "../../../../application/index.ts"; @@ -16,11 +10,6 @@ export class ReportIssuedInvoiceController extends ExpressController { this.errorMapper = issuedInvoicesApiErrorMapper; // 🔐 Reutiliza guards de auth/tenant y prohíbe 'companyId' en query - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/customer-invoices/src/api/infrastructure/issued-invoices/express/issued-invoices.routes.ts b/modules/customer-invoices/src/api/infrastructure/issued-invoices/express/issued-invoices.routes.ts index b0e20248..d1140676 100644 --- a/modules/customer-invoices/src/api/infrastructure/issued-invoices/express/issued-invoices.routes.ts +++ b/modules/customer-invoices/src/api/infrastructure/issued-invoices/express/issued-invoices.routes.ts @@ -1,4 +1,4 @@ -import { type StartParams, validateRequest } from "@erp/core/api"; +import { type StartParams, forbidQueryFieldGuard, validateRequest } from "@erp/core/api"; import { requireIdentityTenant } from "@erp/identity/api"; import { type NextFunction, type Request, type Response, Router } from "express"; @@ -17,7 +17,7 @@ import { } from "./controllers"; export const issuedInvoicesRouter = (params: StartParams) => { - const { app, config, getService, getInternal } = params; + const { app, config, getInternal } = params; const deps = getInternal("customer-invoices", "issuedInvoices"); @@ -26,6 +26,7 @@ export const issuedInvoicesRouter = (params: StartParams) => { // ---------------------------------------------- router.use(...requireIdentityTenant(params)); + router.use(forbidQueryFieldGuard("companyId")); // ---------------------------------------------- diff --git a/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/archive-proforma-by-id.controller.ts b/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/archive-proforma-by-id.controller.ts index b0b05fc2..e255b6f8 100644 --- a/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/archive-proforma-by-id.controller.ts +++ b/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/archive-proforma-by-id.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { ArchiveProformaByIdUseCase } from "../../../../application"; import { proformasApiErrorMapper } from "../proformas-api-error-mapper"; @@ -12,11 +7,6 @@ export class ArchiveProformaByIdController extends ExpressController { public constructor(private readonly useCase: ArchiveProformaByIdUseCase) { super(); this.errorMapper = proformasApiErrorMapper; - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/change-status-proforma.controller.ts b/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/change-status-proforma.controller.ts index 451d71f4..68830cd8 100644 --- a/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/change-status-proforma.controller.ts +++ b/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/change-status-proforma.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { ChangeStatusProformaByIdRequestDTO } from "../../../../../common/dto"; import type { ChangeStatusProformaUseCase } from "../../../../application"; @@ -15,11 +10,6 @@ export class ChangeStatusProformaController extends ExpressController { this.errorMapper = proformasApiErrorMapper; // 🔐 Reutiliza guards de auth/tenant y prohíbe 'companyId' en query - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/create-proforma.controller.ts b/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/create-proforma.controller.ts index c5e10c8f..a62f258a 100644 --- a/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/create-proforma.controller.ts +++ b/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/create-proforma.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { CreateProformaRequestDTO } from "../../../../../common/dto/index.ts"; import type { CreateProformaUseCase } from "../../../../application/index.ts"; @@ -15,11 +10,6 @@ export class CreateProformaController extends ExpressController { this.errorMapper = proformasApiErrorMapper; // 🔐 Reutiliza guards de auth/tenant y prohíbe 'companyId' en query - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/delete-proforma.controller.ts b/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/delete-proforma.controller.ts index a5ed056b..089ab2bf 100644 --- a/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/delete-proforma.controller.ts +++ b/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/delete-proforma.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { DeleteProformaByIdUseCase } from "../../../../application/index.ts"; import { proformasApiErrorMapper } from "../proformas-api-error-mapper.ts"; @@ -14,11 +9,6 @@ export class DeleteProformaController extends ExpressController { this.errorMapper = proformasApiErrorMapper; // 🔐 Reutiliza guards de auth/tenant y prohíbe 'companyId' en query - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/duplicate-proforma-by-id.controller.ts b/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/duplicate-proforma-by-id.controller.ts index 157a2cdf..29157e8b 100644 --- a/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/duplicate-proforma-by-id.controller.ts +++ b/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/duplicate-proforma-by-id.controller.ts @@ -1,14 +1,9 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import { + type DuplicateProformaByIdParamsRequestDTO, DuplicateProformaByIdParamsRequestSchema, DuplicateProformaByIdResponseSchema, - type DuplicateProformaByIdParamsRequestDTO, } from "../../../../../common"; import type { DuplicateProformaByIdUseCase } from "../../../../application"; import { proformasApiErrorMapper } from "../proformas-api-error-mapper"; @@ -17,12 +12,6 @@ export class DuplicateProformaByIdController extends ExpressController { public constructor(private readonly useCase: DuplicateProformaByIdUseCase) { super(); this.errorMapper = proformasApiErrorMapper; - - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/get-proforma-by-id.controller.ts b/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/get-proforma-by-id.controller.ts index 2d064b66..94e4d375 100644 --- a/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/get-proforma-by-id.controller.ts +++ b/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/get-proforma-by-id.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { GetProformaByIdUseCase } from "../../../../application/index.ts"; import { proformasApiErrorMapper } from "../proformas-api-error-mapper.ts"; @@ -14,11 +9,6 @@ export class GetProformaByIdController extends ExpressController { this.errorMapper = proformasApiErrorMapper; // 🔐 Reutiliza guards de auth/tenant y prohíbe 'companyId' en query - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/get-proforma-issuance-readiness.controller.ts b/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/get-proforma-issuance-readiness.controller.ts index c0d2626e..eab11416 100644 --- a/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/get-proforma-issuance-readiness.controller.ts +++ b/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/get-proforma-issuance-readiness.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import { GetProformaIssuanceReadinessResponseSchema } from "../../../../../common"; import type { GetProformaIssuanceReadinessUseCase } from "../../../../application"; @@ -13,12 +8,6 @@ export class GetProformaIssuanceReadinessController extends ExpressController { public constructor(private readonly useCase: GetProformaIssuanceReadinessUseCase) { super(); this.errorMapper = proformasApiErrorMapper; - - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/issue-proforma.controller.ts b/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/issue-proforma.controller.ts index e9c40c33..89ed7938 100644 --- a/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/issue-proforma.controller.ts +++ b/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/issue-proforma.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import { IssueProformaByIdResponseSchema } from "../../../../../common"; import type { IssueProformaUseCase } from "../../../../application/proformas"; @@ -19,11 +14,6 @@ export class IssueProformaController extends ExpressController { this.errorMapper = proformasApiErrorMapper; // 🔐 Reutiliza guards de auth/tenant y prohíbe 'companyId' en query - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/list-proformas.controller.ts b/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/list-proformas.controller.ts index c93f902a..04147618 100644 --- a/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/list-proformas.controller.ts +++ b/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/list-proformas.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import { Criteria } from "@repo/rdx-criteria/server"; import type { ListProformasUseCase, ProformaListScope } from "../../../../application/index.ts"; @@ -31,11 +26,6 @@ export class ListProformasController extends ExpressController { this.errorMapper = proformasApiErrorMapper; // 🔐 Reutiliza guards de auth/tenant y prohíbe 'companyId' en query - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } private getCriteriaWithDefaultOrder() { diff --git a/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/preview-proforma-report.controller.ts b/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/preview-proforma-report.controller.ts index ba7ba4bf..4d14c32c 100644 --- a/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/preview-proforma-report.controller.ts +++ b/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/preview-proforma-report.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { PreviewProformaReportUseCase } from "../../../../application"; import { proformasApiErrorMapper } from "../proformas-api-error-mapper.ts"; @@ -12,11 +7,6 @@ export class PreviewProformaReportController extends ExpressController { public constructor(private readonly useCase: PreviewProformaReportUseCase) { super(); this.errorMapper = proformasApiErrorMapper; - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/report-proforma-pdf.controller.ts b/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/report-proforma-pdf.controller.ts index 7d825f02..72194b4a 100644 --- a/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/report-proforma-pdf.controller.ts +++ b/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/report-proforma-pdf.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { ReportProformaPdfUseCase } from "../../../../application"; import { proformasApiErrorMapper } from "../proformas-api-error-mapper.ts"; @@ -12,11 +7,6 @@ export class ReportProformaPdfController extends ExpressController { public constructor(private readonly useCase: ReportProformaPdfUseCase) { super(); this.errorMapper = proformasApiErrorMapper; - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/unarchive-proforma-by-id.controller.ts b/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/unarchive-proforma-by-id.controller.ts index a8180520..57e360b1 100644 --- a/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/unarchive-proforma-by-id.controller.ts +++ b/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/unarchive-proforma-by-id.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { UnarchiveProformaByIdUseCase } from "../../../../application"; import { proformasApiErrorMapper } from "../proformas-api-error-mapper"; @@ -12,11 +7,6 @@ export class UnarchiveProformaByIdController extends ExpressController { public constructor(private readonly useCase: UnarchiveProformaByIdUseCase) { super(); this.errorMapper = proformasApiErrorMapper; - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/update-proforma.controller.ts b/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/update-proforma.controller.ts index 4f3d6cf5..d831ffcc 100644 --- a/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/update-proforma.controller.ts +++ b/modules/customer-invoices/src/api/infrastructure/proformas/express/controllers/update-proforma.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { UpdateProformaByIdRequestDTO } from "../../../../../common/dto"; import type { UpdateProformaByIdUseCase } from "../../../../application"; @@ -15,11 +10,6 @@ export class UpdateProformaController extends ExpressController { this.errorMapper = proformasApiErrorMapper; // 🔐 Reutiliza guards de auth/tenant y prohíbe 'companyId' en query - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/customer-invoices/src/api/infrastructure/proformas/express/proformas.routes.ts b/modules/customer-invoices/src/api/infrastructure/proformas/express/proformas.routes.ts index 758d8d16..8b449d51 100644 --- a/modules/customer-invoices/src/api/infrastructure/proformas/express/proformas.routes.ts +++ b/modules/customer-invoices/src/api/infrastructure/proformas/express/proformas.routes.ts @@ -1,4 +1,4 @@ -import { type StartParams, validateRequest } from "@erp/core/api"; +import { type StartParams, forbidQueryFieldGuard, validateRequest } from "@erp/core/api"; import { requireIdentityTenant } from "@erp/identity/api"; import { type NextFunction, type Request, type Response, Router } from "express"; @@ -20,6 +20,7 @@ import { ChangeStatusProformaByIdParamsRequestSchema, ChangeStatusProformaByIdRequestSchema, CreateProformaRequestSchema, + CreateRecurringProformaFromProformaRequestSchema, DeleteProformaByIdParamsRequestSchema, DuplicateProformaByIdParamsRequestSchema, GetProformaByIdRequestSchema, @@ -32,7 +33,6 @@ import { UnarchiveProformaByIdParamsRequestSchema, UpdateProformaByIdParamsRequestSchema, UpdateProformaByIdRequestSchema, - CreateRecurringProformaFromProformaRequestSchema, } from "../../../../common"; import type { IIssuedInvoicePublicServices } from "../../../application"; import { CreateRecurringProformaFromProformaController } from "../../recurring-proformas/express/controllers"; @@ -59,6 +59,7 @@ export const proformasRouter = (params: StartParams) => { // ---------------------------------------------- router.use(...requireIdentityTenant(params)); + router.use(forbidQueryFieldGuard("companyId")); // ---------------------------------------------- @@ -181,6 +182,7 @@ export const proformasRouter = (params: StartParams) => { router.post( "/:proforma_id/recurring-proforma", validateRequest(GetProformaByIdRequestSchema, "params"), + forbidQueryFieldGuard("company_id"), validateRequest(CreateRecurringProformaFromProformaRequestSchema, "body"), (req: Request, res: Response, next: NextFunction) => { const controller = new CreateRecurringProformaFromProformaController( diff --git a/modules/customer-invoices/src/api/infrastructure/recurring-proformas/express/controllers/create-recurring-proforma-from-proforma.controller.ts b/modules/customer-invoices/src/api/infrastructure/recurring-proformas/express/controllers/create-recurring-proforma-from-proforma.controller.ts index f11609a7..bfeb69ef 100644 --- a/modules/customer-invoices/src/api/infrastructure/recurring-proformas/express/controllers/create-recurring-proforma-from-proforma.controller.ts +++ b/modules/customer-invoices/src/api/infrastructure/recurring-proformas/express/controllers/create-recurring-proforma-from-proforma.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import { UniqueID } from "@repo/rdx-ddd"; import type { CreateRecurringProformaFromProformaRequestDTO } from "../../../../../common"; @@ -12,17 +7,9 @@ import { proformasApiErrorMapper } from "../../../proformas/express/proformas-ap import { parseDateOnly } from "../mappers/parse-date-only"; export class CreateRecurringProformaFromProformaController extends ExpressController { - public constructor( - private readonly fromProforma: RecurringProformaCommands["fromProforma"] - ) { + public constructor(private readonly fromProforma: RecurringProformaCommands["fromProforma"]) { super(); this.errorMapper = proformasApiErrorMapper; - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId"), - forbidQueryFieldGuard("company_id") - ); } protected async executeImpl() { @@ -37,8 +24,7 @@ export class CreateRecurringProformaFromProformaController extends ExpressContro if (startDate.isFailure) return this.invalidInputError(startDate.error.message); const endDate = body.schedule.endDate; - const parsedEndDate = - typeof endDate === "string" ? parseDateOnly(endDate) : undefined; + const parsedEndDate = typeof endDate === "string" ? parseDateOnly(endDate) : undefined; if (parsedEndDate?.isFailure) { return this.invalidInputError(parsedEndDate.error.message); } diff --git a/modules/customers/src/api/infrastructure/express/controllers/create-customer.controller.ts b/modules/customers/src/api/infrastructure/express/controllers/create-customer.controller.ts index 3d2d0f41..8e0bd42d 100644 --- a/modules/customers/src/api/infrastructure/express/controllers/create-customer.controller.ts +++ b/modules/customers/src/api/infrastructure/express/controllers/create-customer.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { CreateCustomerRequestDTO } from "../../../../common/dto"; import type { CreateCustomerUseCase } from "../../../application"; @@ -13,13 +8,6 @@ export class CreateCustomerController extends ExpressController { public constructor(private readonly useCase: CreateCustomerUseCase) { super(); this.errorMapper = customersApiErrorMapper; - - // 🔐 Reutiliza guards de auth/tenant y prohíbe 'companyId' en query - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/customers/src/api/infrastructure/express/controllers/delete-customer.controller.ts b/modules/customers/src/api/infrastructure/express/controllers/delete-customer.controller.ts index 7482ccb6..4484ee0a 100644 --- a/modules/customers/src/api/infrastructure/express/controllers/delete-customer.controller.ts +++ b/modules/customers/src/api/infrastructure/express/controllers/delete-customer.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { DeleteCustomerUseCase } from "../../../application"; import { customersApiErrorMapper } from "../customer-api-error-mapper"; @@ -12,13 +7,6 @@ export class DeleteCustomerController extends ExpressController { public constructor(private readonly useCase: DeleteCustomerUseCase) { super(); this.errorMapper = customersApiErrorMapper; - - // 🔐 Reutiliza guards de auth/tenant y prohíbe 'companyId' en query - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } async executeImpl(): Promise { diff --git a/modules/customers/src/api/infrastructure/express/controllers/get-customer.controller.ts b/modules/customers/src/api/infrastructure/express/controllers/get-customer.controller.ts index cd990d6a..a933c1de 100644 --- a/modules/customers/src/api/infrastructure/express/controllers/get-customer.controller.ts +++ b/modules/customers/src/api/infrastructure/express/controllers/get-customer.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { GetCustomerByIdUseCase } from "@erp/customers/api/application"; import { customersApiErrorMapper } from "../customer-api-error-mapper"; @@ -12,13 +7,6 @@ export class GetCustomerController extends ExpressController { public constructor(private readonly useCase: GetCustomerByIdUseCase) { super(); this.errorMapper = customersApiErrorMapper; - - // 🔐 Reutiliza guards de auth/tenant y prohíbe 'companyId' en query - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/customers/src/api/infrastructure/express/controllers/list-customers.controller.ts b/modules/customers/src/api/infrastructure/express/controllers/list-customers.controller.ts index e0144b5f..a13c40a7 100644 --- a/modules/customers/src/api/infrastructure/express/controllers/list-customers.controller.ts +++ b/modules/customers/src/api/infrastructure/express/controllers/list-customers.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import { Criteria } from "@repo/rdx-criteria/server"; import type { ListCustomersUseCase } from "../../../application"; @@ -13,13 +8,6 @@ export class ListCustomersController extends ExpressController { public constructor(private readonly useCase: ListCustomersUseCase) { super(); this.errorMapper = customersApiErrorMapper; - - // 🔐 Reutiliza guards de auth/tenant y prohíbe 'companyId' en query - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } private getCriteriaWithDefaultOrder() { diff --git a/modules/customers/src/api/infrastructure/express/controllers/update-customer.controller.ts b/modules/customers/src/api/infrastructure/express/controllers/update-customer.controller.ts index bd403d84..c101d7d7 100644 --- a/modules/customers/src/api/infrastructure/express/controllers/update-customer.controller.ts +++ b/modules/customers/src/api/infrastructure/express/controllers/update-customer.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { UpdateCustomerByIdRequestDTO } from "../../../../common/dto"; import type { UpdateCustomerUseCase } from "../../../application"; @@ -13,13 +8,6 @@ export class UpdateCustomerController extends ExpressController { public constructor(private readonly useCase: UpdateCustomerUseCase) { super(); this.errorMapper = customersApiErrorMapper; - - // 🔐 Reutiliza guards de auth/tenant y prohíbe 'companyId' en query - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/customers/src/api/infrastructure/express/customers.routes.ts b/modules/customers/src/api/infrastructure/express/customers.routes.ts index bcde567e..7f56a64c 100644 --- a/modules/customers/src/api/infrastructure/express/customers.routes.ts +++ b/modules/customers/src/api/infrastructure/express/customers.routes.ts @@ -1,4 +1,4 @@ -import { type StartParams, validateRequest } from "@erp/core/api"; +import { type StartParams, forbidQueryFieldGuard, validateRequest } from "@erp/core/api"; import { requireIdentityTenant } from "@erp/identity/api"; import { type NextFunction, type Request, type Response, Router } from "express"; @@ -30,6 +30,7 @@ export const customersRouter = (params: StartParams) => { // 🔐 Autenticación + Tenancy para TODO el router router.use(...requireIdentityTenant(params)); + router.use(forbidQueryFieldGuard("companyId")); // ---------------------------------------------- diff --git a/modules/document-series/src/api/infrastructure/express/controllers/assign-next-document-number.controller.ts b/modules/document-series/src/api/infrastructure/express/controllers/assign-next-document-number.controller.ts index ddd35fe5..a0003a6c 100644 --- a/modules/document-series/src/api/infrastructure/express/controllers/assign-next-document-number.controller.ts +++ b/modules/document-series/src/api/infrastructure/express/controllers/assign-next-document-number.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; -import { buildTransactionManager } from "@erp/core/api"; +import { ExpressController, type buildTransactionManager } from "@erp/core/api"; import type { AssignNextDocumentNumberRequestDTO } from "../../../../common"; import type { AssignNextDocumentNumberUseCase } from "../../../application"; @@ -16,15 +11,11 @@ export class AssignNextDocumentNumberController extends ExpressController { ) { super(); this.errorMapper = documentSeriesApiErrorMapper; - this.registerGuards(requireAuthenticatedGuard(), requireCompanyContextGuard()); } protected async executeImpl() { const companyId = this.getTenantId(); - if (!companyId) { - return this.forbiddenError("Tenant ID not found"); - } - + if (!companyId) return this.forbiddenError("Tenant ID not found"); const result = await this.transactionManager.complete((transaction: unknown) => this.useCase.execute({ companyId: companyId.toString(), @@ -32,7 +23,6 @@ export class AssignNextDocumentNumberController extends ExpressController { transaction, }) ); - return result.match( (data) => this.ok(data), (error) => this.handleError(error) diff --git a/modules/document-series/src/api/infrastructure/express/controllers/create-document-series.controller.ts b/modules/document-series/src/api/infrastructure/express/controllers/create-document-series.controller.ts index 0c240e6a..df2804cc 100644 --- a/modules/document-series/src/api/infrastructure/express/controllers/create-document-series.controller.ts +++ b/modules/document-series/src/api/infrastructure/express/controllers/create-document-series.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { CreateDocumentSeriesRequestDTO } from "../../../../common"; import type { CreateDocumentSeriesUseCase } from "../../../application"; @@ -13,12 +8,6 @@ export class CreateDocumentSeriesController extends ExpressController { public constructor(private readonly useCase: CreateDocumentSeriesUseCase) { super(); this.errorMapper = documentSeriesApiErrorMapper; - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId"), - forbidQueryFieldGuard("company_id") - ); } protected async executeImpl() { diff --git a/modules/document-series/src/api/infrastructure/express/controllers/disable-document-series.controller.ts b/modules/document-series/src/api/infrastructure/express/controllers/disable-document-series.controller.ts index 21dcfec5..874d4f6e 100644 --- a/modules/document-series/src/api/infrastructure/express/controllers/disable-document-series.controller.ts +++ b/modules/document-series/src/api/infrastructure/express/controllers/disable-document-series.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { DisableDocumentSeriesUseCase } from "../../../application"; import { documentSeriesApiErrorMapper } from "../document-series-api-error-mapper"; @@ -12,12 +7,6 @@ export class DisableDocumentSeriesController extends ExpressController { public constructor(private readonly useCase: DisableDocumentSeriesUseCase) { super(); this.errorMapper = documentSeriesApiErrorMapper; - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId"), - forbidQueryFieldGuard("company_id") - ); } protected async executeImpl() { diff --git a/modules/document-series/src/api/infrastructure/express/controllers/get-document-series-by-id.controller.ts b/modules/document-series/src/api/infrastructure/express/controllers/get-document-series-by-id.controller.ts index 537080b3..3761f6b0 100644 --- a/modules/document-series/src/api/infrastructure/express/controllers/get-document-series-by-id.controller.ts +++ b/modules/document-series/src/api/infrastructure/express/controllers/get-document-series-by-id.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { GetDocumentSeriesByIdUseCase } from "../../../application"; import { documentSeriesApiErrorMapper } from "../document-series-api-error-mapper"; @@ -12,12 +7,6 @@ export class GetDocumentSeriesByIdController extends ExpressController { public constructor(private readonly useCase: GetDocumentSeriesByIdUseCase) { super(); this.errorMapper = documentSeriesApiErrorMapper; - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId"), - forbidQueryFieldGuard("company_id") - ); } protected async executeImpl() { diff --git a/modules/document-series/src/api/infrastructure/express/controllers/list-document-series.controller.ts b/modules/document-series/src/api/infrastructure/express/controllers/list-document-series.controller.ts index 6f086c45..4ed4895c 100644 --- a/modules/document-series/src/api/infrastructure/express/controllers/list-document-series.controller.ts +++ b/modules/document-series/src/api/infrastructure/express/controllers/list-document-series.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import { Criteria } from "@repo/rdx-criteria/server"; import type { ListDocumentSeriesUseCase } from "../../../application"; @@ -13,12 +8,6 @@ export class ListDocumentSeriesController extends ExpressController { public constructor(private readonly useCase: ListDocumentSeriesUseCase) { super(); this.errorMapper = documentSeriesApiErrorMapper; - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId"), - forbidQueryFieldGuard("company_id") - ); } protected async executeImpl() { @@ -28,7 +17,14 @@ export class ListDocumentSeriesController extends ExpressController { } const { filters, pageNumber, pageSize, quickSearch } = this.criteria; - const criteria = Criteria.fromPrimitives(filters.toPrimitives(), "code", "ASC", pageSize, pageNumber, quickSearch); + const criteria = Criteria.fromPrimitives( + filters.toPrimitives(), + "code", + "ASC", + pageSize, + pageNumber, + quickSearch + ); const result = await this.useCase.execute({ companyId: companyId.toString(), diff --git a/modules/document-series/src/api/infrastructure/express/controllers/update-document-series.controller.ts b/modules/document-series/src/api/infrastructure/express/controllers/update-document-series.controller.ts index 292b69d1..1cef27f9 100644 --- a/modules/document-series/src/api/infrastructure/express/controllers/update-document-series.controller.ts +++ b/modules/document-series/src/api/infrastructure/express/controllers/update-document-series.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { UpdateDocumentSeriesRequestDTO } from "../../../../common"; import type { UpdateDocumentSeriesUseCase } from "../../../application"; @@ -13,12 +8,6 @@ export class UpdateDocumentSeriesController extends ExpressController { public constructor(private readonly useCase: UpdateDocumentSeriesUseCase) { super(); this.errorMapper = documentSeriesApiErrorMapper; - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId"), - forbidQueryFieldGuard("company_id") - ); } protected async executeImpl() { diff --git a/modules/document-series/src/api/infrastructure/express/document-series.routes.ts b/modules/document-series/src/api/infrastructure/express/document-series.routes.ts index af1d7e76..7445ec7b 100644 --- a/modules/document-series/src/api/infrastructure/express/document-series.routes.ts +++ b/modules/document-series/src/api/infrastructure/express/document-series.routes.ts @@ -1,4 +1,9 @@ -import { type StartParams, buildTransactionManager, validateRequest } from "@erp/core/api"; +import { + type StartParams, + buildTransactionManager, + forbidQueryFieldGuard, + validateRequest, +} from "@erp/core/api"; import { requireIdentityTenant } from "@erp/identity/api"; import { type NextFunction, type Request, type Response, Router } from "express"; @@ -28,13 +33,20 @@ export const documentSeriesRouter = (params: StartParams) => { router.use(...requireIdentityTenant(params)); - router.get("/", (req: Request, res: Response, next: NextFunction) => { - const controller = new ListDocumentSeriesController(deps.useCases.listDocumentSeries()); - return controller.execute(req, res, next); - }); + router.get( + "/", + forbidQueryFieldGuard("companyId"), + forbidQueryFieldGuard("company_id"), + (req: Request, res: Response, next: NextFunction) => { + const controller = new ListDocumentSeriesController(deps.useCases.listDocumentSeries()); + return controller.execute(req, res, next); + } + ); router.get( "/:id", + forbidQueryFieldGuard("companyId"), + forbidQueryFieldGuard("company_id"), validateRequest(GetDocumentSeriesByIdRequestSchema, "params"), (req: Request, res: Response, next: NextFunction) => { const controller = new GetDocumentSeriesByIdController(deps.useCases.getDocumentSeriesById()); @@ -44,6 +56,8 @@ export const documentSeriesRouter = (params: StartParams) => { router.post( "/", + forbidQueryFieldGuard("companyId"), + forbidQueryFieldGuard("company_id"), validateRequest(CreateDocumentSeriesRequestSchema, "body"), (req: Request, res: Response, next: NextFunction) => { const controller = new CreateDocumentSeriesController(deps.useCases.createDocumentSeries()); diff --git a/modules/factuges/src/api/infraestructure/express/controllers/create-proforma-from-factuges.controller.ts b/modules/factuges/src/api/infraestructure/express/controllers/create-proforma-from-factuges.controller.ts index 342712aa..79fff89e 100644 --- a/modules/factuges/src/api/infraestructure/express/controllers/create-proforma-from-factuges.controller.ts +++ b/modules/factuges/src/api/infraestructure/express/controllers/create-proforma-from-factuges.controller.ts @@ -9,13 +9,6 @@ export class CreateProformaFromFactugesController extends ExpressController { public constructor(private readonly useCase: CreateProformaFromFactugesUseCase) { super(); this.errorMapper = factugesApiErrorMapper; - - // 🔐 Reutiliza guards de auth/tenant y prohíbe 'companyId' en query - /*this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - );*/ } protected async executeImpl() { diff --git a/modules/identity/src/api/infrastructure/express/controllers/change-current-account-password.controller.ts b/modules/identity/src/api/infrastructure/express/controllers/change-current-account-password.controller.ts index b15f1c8f..871a65ad 100644 --- a/modules/identity/src/api/infrastructure/express/controllers/change-current-account-password.controller.ts +++ b/modules/identity/src/api/infrastructure/express/controllers/change-current-account-password.controller.ts @@ -1,7 +1,10 @@ -import { ExpressController, requireAuthenticatedGuard } from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { UtcDateTime } from "@repo/rdx-ddd"; -import type { ChangeAccountPasswordRequestDTO, ChangeAccountPasswordResponseDTO } from "../../../../common"; +import type { + ChangeAccountPasswordRequestDTO, + ChangeAccountPasswordResponseDTO, +} from "../../../../common"; import type { ChangeCurrentAccountPasswordUseCase } from "../../../application/accounts"; import { identityAccountApiErrorMapper } from "../identity-account-api-error-mapper"; @@ -12,7 +15,6 @@ export class ChangeCurrentAccountPasswordController extends ExpressController { ) { super(); this.errorMapper = identityAccountApiErrorMapper; - this.registerGuards(requireAuthenticatedGuard()); } protected async executeImpl() { diff --git a/modules/identity/src/api/infrastructure/express/controllers/get-current-account.controller.ts b/modules/identity/src/api/infrastructure/express/controllers/get-current-account.controller.ts index ac3e19e6..bf6e2c97 100644 --- a/modules/identity/src/api/infrastructure/express/controllers/get-current-account.controller.ts +++ b/modules/identity/src/api/infrastructure/express/controllers/get-current-account.controller.ts @@ -1,4 +1,4 @@ -import { ExpressController, requireAuthenticatedGuard } from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { GetAccountProfileResponseDTO } from "../../../../common"; import type { GetCurrentAccountUseCase } from "../../../application/accounts"; @@ -8,7 +8,6 @@ export class GetCurrentAccountController extends ExpressController { public constructor(private readonly useCase: GetCurrentAccountUseCase) { super(); this.errorMapper = identityAccountApiErrorMapper; - this.registerGuards(requireAuthenticatedGuard()); } protected async executeImpl() { diff --git a/modules/identity/src/api/infrastructure/express/controllers/get-current-session.controller.ts b/modules/identity/src/api/infrastructure/express/controllers/get-current-session.controller.ts index 5ebc79cc..9761243a 100644 --- a/modules/identity/src/api/infrastructure/express/controllers/get-current-session.controller.ts +++ b/modules/identity/src/api/infrastructure/express/controllers/get-current-session.controller.ts @@ -1,4 +1,4 @@ -import { ExpressController, requireAuthenticatedGuard } from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { CurrentSessionResponseDTO } from "../../../../common"; import type { GetCurrentSessionUseCase } from "../../../application"; @@ -8,7 +8,6 @@ export class GetCurrentSessionController extends ExpressController { public constructor(private readonly useCase: GetCurrentSessionUseCase) { super(); this.errorMapper = identityAuthApiErrorMapper; - this.registerGuards(requireAuthenticatedGuard()); } protected async executeImpl() { diff --git a/modules/identity/src/api/infrastructure/express/controllers/logout.controller.ts b/modules/identity/src/api/infrastructure/express/controllers/logout.controller.ts index 15f7a8fe..8838bba0 100644 --- a/modules/identity/src/api/infrastructure/express/controllers/logout.controller.ts +++ b/modules/identity/src/api/infrastructure/express/controllers/logout.controller.ts @@ -1,4 +1,4 @@ -import { ExpressController, requireAuthenticatedGuard } from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { UtcDateTime } from "@repo/rdx-ddd"; import type { LogoutRequestDTO, LogoutResponseDTO } from "../../../../common"; @@ -12,7 +12,6 @@ export class LogoutController extends ExpressController { ) { super(); this.errorMapper = identityAuthApiErrorMapper; - this.registerGuards(requireAuthenticatedGuard()); } protected async executeImpl() { diff --git a/modules/identity/src/api/infrastructure/express/controllers/update-current-account.controller.ts b/modules/identity/src/api/infrastructure/express/controllers/update-current-account.controller.ts index 312a8b05..bc49270b 100644 --- a/modules/identity/src/api/infrastructure/express/controllers/update-current-account.controller.ts +++ b/modules/identity/src/api/infrastructure/express/controllers/update-current-account.controller.ts @@ -1,7 +1,10 @@ -import { ExpressController, requireAuthenticatedGuard } from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { UtcDateTime } from "@repo/rdx-ddd"; -import type { UpdateAccountProfileRequestDTO, UpdateAccountProfileResponseDTO } from "../../../../common"; +import type { + UpdateAccountProfileRequestDTO, + UpdateAccountProfileResponseDTO, +} from "../../../../common"; import type { UpdateCurrentAccountUseCase } from "../../../application/accounts"; import { identityAccountApiErrorMapper } from "../identity-account-api-error-mapper"; @@ -12,7 +15,6 @@ export class UpdateCurrentAccountController extends ExpressController { ) { super(); this.errorMapper = identityAccountApiErrorMapper; - this.registerGuards(requireAuthenticatedGuard()); } protected async executeImpl() { diff --git a/modules/suppliers/src/api/infrastructure/express/controllers/change-supplier-status.controller.ts b/modules/suppliers/src/api/infrastructure/express/controllers/change-supplier-status.controller.ts index 2200e845..413bcd45 100644 --- a/modules/suppliers/src/api/infrastructure/express/controllers/change-supplier-status.controller.ts +++ b/modules/suppliers/src/api/infrastructure/express/controllers/change-supplier-status.controller.ts @@ -1,8 +1,4 @@ -import { - ExpressController, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { ChangeSupplierStatusUseCase } from "../../../application"; import { suppliersApiErrorMapper } from "../supplier-api-error-mapper"; @@ -11,7 +7,6 @@ export class ChangeSupplierStatusController extends ExpressController { public constructor(private readonly useCase: ChangeSupplierStatusUseCase) { super(); this.errorMapper = suppliersApiErrorMapper; - this.registerGuards(requireAuthenticatedGuard(), requireCompanyContextGuard()); } protected async executeImpl() { diff --git a/modules/suppliers/src/api/infrastructure/express/controllers/create-supplier.controller.ts b/modules/suppliers/src/api/infrastructure/express/controllers/create-supplier.controller.ts index 896bb06e..8c09589e 100644 --- a/modules/suppliers/src/api/infrastructure/express/controllers/create-supplier.controller.ts +++ b/modules/suppliers/src/api/infrastructure/express/controllers/create-supplier.controller.ts @@ -1,14 +1,9 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { CreateSupplierRequestDTO } from "../../../../common/dto"; import type { CreateSupplierUseCase } from "../../../application"; -import { suppliersApiErrorMapper } from "../supplier-api-error-mapper"; import type { CreateSupplierRequestMapper } from "../mappers/create-supplier-request.mapper"; +import { suppliersApiErrorMapper } from "../supplier-api-error-mapper"; export class CreateSupplierController extends ExpressController { public constructor( @@ -17,13 +12,6 @@ export class CreateSupplierController extends ExpressController { ) { super(); this.errorMapper = suppliersApiErrorMapper; - - // 🔐 Reutiliza guards de auth/tenant y prohíbe 'companyId' en query - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/suppliers/src/api/infrastructure/express/controllers/get-supplier.controller.ts b/modules/suppliers/src/api/infrastructure/express/controllers/get-supplier.controller.ts index ff413668..bac06485 100644 --- a/modules/suppliers/src/api/infrastructure/express/controllers/get-supplier.controller.ts +++ b/modules/suppliers/src/api/infrastructure/express/controllers/get-supplier.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { GetSupplierByIdUseCase } from "../../../application"; import { suppliersApiErrorMapper } from "../supplier-api-error-mapper"; @@ -12,13 +7,6 @@ export class GetSupplierController extends ExpressController { public constructor(private readonly useCase: GetSupplierByIdUseCase) { super(); this.errorMapper = suppliersApiErrorMapper; - - // 🔐 Reutiliza guards de auth/tenant y prohíbe 'companyId' en query - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/suppliers/src/api/infrastructure/express/controllers/list-suppliers.controller.ts b/modules/suppliers/src/api/infrastructure/express/controllers/list-suppliers.controller.ts index 5abe6a6c..ecc3ca01 100644 --- a/modules/suppliers/src/api/infrastructure/express/controllers/list-suppliers.controller.ts +++ b/modules/suppliers/src/api/infrastructure/express/controllers/list-suppliers.controller.ts @@ -1,9 +1,4 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import { Criteria } from "@repo/rdx-criteria/server"; import type { ListSuppliersUseCase } from "../../../application"; @@ -13,13 +8,6 @@ export class ListSuppliersController extends ExpressController { public constructor(private readonly listSuppliers: ListSuppliersUseCase) { super(); this.errorMapper = suppliersApiErrorMapper; - - // 🔐 Reutiliza guards de auth/tenant y prohíbe 'companyId' en query - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } private getCriteriaWithDefaultOrder() { diff --git a/modules/suppliers/src/api/infrastructure/express/controllers/update-supplier.controller.test.ts b/modules/suppliers/src/api/infrastructure/express/controllers/update-supplier.controller.test.ts index c32e5124..b3363841 100644 --- a/modules/suppliers/src/api/infrastructure/express/controllers/update-supplier.controller.test.ts +++ b/modules/suppliers/src/api/infrastructure/express/controllers/update-supplier.controller.test.ts @@ -10,6 +10,7 @@ import { UpdateSupplierByIdRequestSchema, } from "../../../../common"; import { UpdateSupplierByIdRequestMapper } from "../mappers/update-supplier-by-id-request.mapper"; + import { UpdateSupplierController } from "./update-supplier.controller"; const companyId = UniqueID.create("22222222-2222-4222-8222-222222222222").data; diff --git a/modules/suppliers/src/api/infrastructure/express/controllers/update-supplier.controller.ts b/modules/suppliers/src/api/infrastructure/express/controllers/update-supplier.controller.ts index 9916f2ab..290a41ea 100644 --- a/modules/suppliers/src/api/infrastructure/express/controllers/update-supplier.controller.ts +++ b/modules/suppliers/src/api/infrastructure/express/controllers/update-supplier.controller.ts @@ -1,14 +1,9 @@ -import { - ExpressController, - forbidQueryFieldGuard, - requireAuthenticatedGuard, - requireCompanyContextGuard, -} from "@erp/core/api"; +import { ExpressController } from "@erp/core/api"; import type { UpdateSupplierByIdRequestDTO } from "../../../../common/dto"; import type { UpdateSupplierUseCase } from "../../../application"; -import { suppliersApiErrorMapper } from "../supplier-api-error-mapper"; import type { UpdateSupplierByIdRequestMapper } from "../mappers/update-supplier-by-id-request.mapper"; +import { suppliersApiErrorMapper } from "../supplier-api-error-mapper"; export class UpdateSupplierController extends ExpressController { public constructor( @@ -17,13 +12,6 @@ export class UpdateSupplierController extends ExpressController { ) { super(); this.errorMapper = suppliersApiErrorMapper; - - // 🔐 Reutiliza guards de auth/tenant y prohíbe 'companyId' en query - this.registerGuards( - requireAuthenticatedGuard(), - requireCompanyContextGuard(), - forbidQueryFieldGuard("companyId") - ); } protected async executeImpl() { diff --git a/modules/suppliers/src/api/infrastructure/express/suppliers.routes.ts b/modules/suppliers/src/api/infrastructure/express/suppliers.routes.ts index 25a31987..b9cf7e26 100644 --- a/modules/suppliers/src/api/infrastructure/express/suppliers.routes.ts +++ b/modules/suppliers/src/api/infrastructure/express/suppliers.routes.ts @@ -1,4 +1,4 @@ -import { type StartParams, validateRequest } from "@erp/core/api"; +import { type StartParams, forbidQueryFieldGuard, validateRequest } from "@erp/core/api"; import { requireIdentityTenant } from "@erp/identity/api"; import { type NextFunction, type Request, type Response, Router } from "express"; @@ -34,6 +34,7 @@ export const suppliersRouter = (params: StartParams) => { // Mantiene el mismo pipeline de identidad y tenant que los módulos HTTP actuales. router.use(...requireIdentityTenant(params)); + router.use(forbidQueryFieldGuard("companyId")); // ----------------------------------------------