chore: address remaining PR feedback for types, ESM resolution, and tech debt

TECHNICAL_DEBT.md

@@ -18,11 +18,12 @@ This document tracks known technical debt items that should be addressed in futu
 - The `session` table currently exposes raw `ipAddress` and `userAgent` fields indefinitely.
 - There is no automated cleanup or anonymization of this Personally Identifiable Information (PII).
 
-**Recommended Solution**:
+**Recommended Solution (Time-bounded retention model chosen)**:
 
-- Update the schema with `anonymizeIp` and `anonymizeUserAgent` helpers to hash/truncate data before insert.
-- Create a `background` (or `jobs`) module in `apps/api` using `@nestjs/schedule`.
-- Implement `runPIICleanup` to run daily, finding sessions older than 30 days and anonymizing their PII, emitting audit logs.
+- Keep raw IP/user-agent on insert for security auditing.
+- Remove or rename the legacy `anonymizeIp` and `anonymizeUserAgent` pre-insert helpers if they exist.
+- Implement `runPIICleanup` inside the `background`/`jobs` module using `@nestjs/schedule` to run daily.
+- This job will find sessions older than 30 days and anonymize their PII (nullify or hash), emitting audit logs.
 - Add a Drizzle migration to backfill and anonymize existing old sessions.
 
 ### 2. Permission Caching Architecture

apps/api/src/db/database-manager.spec.ts

@@ -58,7 +58,7 @@ vi.mock('@nexiom/identity/utils/rbac-seeding', () => ({
   seedSystemRbac: rbacMocks.seedSystemRbac,
 }));
 
-vi.mock('../constants', () => constantMocks);
+vi.mock('../constants.js', () => constantMocks);
 
 describe('DatabaseManager', () => {
   let manager: DatabaseManager;

apps/api/src/db/reset-e2e.ts

@@ -3,8 +3,12 @@ import * as bcrypt from 'bcryptjs';
 import { v4 as uuidv4 } from 'uuid';
 import * as dotEnv from 'dotenv';
 import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { ALL_PERMISSIONS, isSystemPermission } from '../constants.js';
 
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
 // Load .env from apps/api root
 dotEnv.config({ path: path.resolve(__dirname, '../../.env') });
 

apps/api/src/main.ts

@@ -48,14 +48,9 @@ async function bootstrap() {
   );
 }
 
-// Top-level await is not available in CommonJS.
-const start = async () => {
-  try {
-    await bootstrap();
-  } catch (err) {
-    Logger.error('Bootstrap failed', err);
-    process.exit(1);
-  }
-};
-
-void start();
+try {
+  await bootstrap();
+} catch (err) {
+  Logger.error('Bootstrap failed', err);
+  process.exit(1);
+}

apps/api/src/modules/connections/connections/callback.controller.spec.ts

@@ -2,8 +2,9 @@
 import { Test, TestingModule } from '@nestjs/testing';
 import { OAuthCallbackController } from './callback.controller.js';
 import { ProviderRegistryService } from '@nexiom/connectors';
-import { Request, Response } from 'express';
-import { vi, describe, it, expect, beforeEach, Mocked } from 'vitest';
+import type { Request, Response } from 'express';
+import { vi, describe, it, expect, beforeEach } from 'vitest';
+import type { Mocked } from 'vitest';
 import { OauthStateService } from '../oauth-state.service.js';
 import { ConfigService } from '@nestjs/config';
 

apps/api/src/modules/identity/users/users.controller.ts

@@ -13,8 +13,8 @@ import {
   Delete,
   Logger,
 } from '@nestjs/common';
-import { USER_PROVIDER, TENANT_PROVIDER, User } from '@nexiom/identity';
-import type { ITenantProvider, IUserProvider } from '@nexiom/identity';
+import { USER_PROVIDER, TENANT_PROVIDER } from '@nexiom/identity';
+import type { ITenantProvider, IUserProvider, User } from '@nexiom/identity';
 import { InvitationsService } from '../invitations/invitations.service.js';
 import { CreateUser } from './users.validation.js';
 import { Request } from 'express';
@@ -132,7 +132,7 @@ export class UsersController {
         id: inv.id, // Use invitation ID temporarily
         email: inv.email,
         name: '', // Name might not be known yet
-        role: inv.role,
+        role: inv.role ?? 'member',
         status: 'pending', // Explicit status for UI (vs 'active')
         emailVerified: false,
         createdAt: inv.createdAt,

apps/api/src/modules/trigger/trigger.module.ts

@@ -10,7 +10,7 @@ import { WebhooksController } from './webhooks.controller.js';
 import { DATABASE_CONNECTION } from '@nexiom/database';
 import type { DrizzleDb } from '@nexiom/database';
 import { DB_MANAGER } from '../dbmanager/dbmanager.module.js';
-import { DatabaseManager } from '@nexiom/dbmanager';
+import type { DatabaseManager } from '@nexiom/dbmanager';
 
 /**
  * Wires all trigger-related services.

apps/api/src/scripts/admin-bootstrap.ts

@@ -1,11 +1,16 @@
 import * as dotenv from 'dotenv';
 import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
 
 // Load Environment Variables (MUST BE FIRST)
 dotenv.config({ path: path.resolve(__dirname, '../../../../.env') });
 dotenv.config({ path: path.resolve(__dirname, '../../.env') });
 
-import { drizzle, NodePgDatabase } from 'drizzle-orm/node-postgres';
+import { drizzle } from 'drizzle-orm/node-postgres';
+import type { NodePgDatabase } from 'drizzle-orm/node-postgres';
 import { Client } from 'pg';
 import * as schema from '../db/schema.js';
 import { eq, and } from 'drizzle-orm';

packages/connectors/src/crypto/encryption.interface.ts

@@ -0,0 +1,4 @@
+export abstract class EncryptionService {
+    abstract decrypt(val: string): Promise<string>;
+    abstract encrypt(val: string): Promise<string>;
+}

packages/connectors/src/crypto/encryption.service.ts

@@ -1,10 +1,10 @@
 import { Injectable, Logger } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
-import { TokenManagerService } from '../oauth/token-manager.service.js';
+import { EncryptionService } from './encryption.interface.js';
 import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
 
 @Injectable()
-export class AesEncryptionService {
+export class AesEncryptionService extends EncryptionService {
     private readonly logger = new Logger(AesEncryptionService.name);
     private readonly algorithm = 'aes-256-gcm';
     private readonly keyBuffer: Buffer;
@@ -14,6 +14,7 @@ export class AesEncryptionService {
      * Requires ENCRYPTION_KEY to be provided and exactly 32 bytes (raw string)
      */
     constructor(private readonly configService: ConfigService) {
+        super();
         const key = this.configService.get<string>('ENCRYPTION_KEY');
         if (!key) {
             throw new Error('ENCRYPTION_KEY is missing from configuration');

packages/connectors/src/index.ts

@@ -17,6 +17,7 @@ export * from './oauth/token-manager.service.js';
 export * from './oauth/provider-registry.js';
 
 // Crypto utilities
+export * from './crypto/encryption.interface.js';
 export * from './crypto/encryption.service.js';
 
 // Framework — Piece, Action, Trigger, Auth, Property definitions

packages/connectors/src/oauth/token-manager.service.ts

@@ -4,11 +4,7 @@ import { eq } from 'drizzle-orm';
 import { Redis } from 'ioredis';
 import type { DrizzleDb } from '@nexiom/database';
 
-// Abstract contracts — consumers must provide real implementations via DI
-export abstract class EncryptionService {
-    abstract decrypt(val: string): Promise<string>;
-    abstract encrypt(val: string): Promise<string>;
-}
+import { EncryptionService } from '../crypto/encryption.interface.js';
 
 export class OAuthRefreshError extends Error {
     constructor(message: string, public status?: number) {

packages/database/package.json

@@ -6,18 +6,22 @@
   "types": "dist/index.d.ts",
   "exports": {
     ".": {
+      "types": "./dist/index.d.ts",
       "import": "./dist/index.js",
       "default": "./dist/index.js"
     },
     "./schema/identity": {
+      "types": "./dist/schema/identity.d.ts",
       "import": "./dist/schema/identity.js",
       "default": "./dist/schema/identity.js"
     },
     "./schema/tenant": {
+      "types": "./dist/schema/tenant.d.ts",
       "import": "./dist/schema/tenant.js",
       "default": "./dist/schema/tenant.js"
     },
     "./dist/schema/identity": {
+      "types": "./dist/schema/identity.d.ts",
       "import": "./dist/schema/identity.js",
       "default": "./dist/schema/identity.js"
     }
@@ -38,4 +42,4 @@
     "drizzle-kit": "^0.31.8",
     "typescript": "^5.7.3"
   }
-}
+}

packages/identity/src/adapters/drizzle-user.adapter.spec.ts

@@ -128,7 +128,7 @@
   it("create delegates to auth provider", async () => {
     const db = mkDb();
     const auth = mkAuth();
     const adapter = new DrizzleUserAdapter(db, mkOptions(), auth);
 
     const user = await adapter.create({
       email: "a@b.com",
@@ -140,7 +140,7 @@
   it("update handles password via auth provider; updates fields; throws if missing user after update", async () => {
     const db = mkDb();
     const auth = mkAuth();
     const adapter = new DrizzleUserAdapter(db, mkOptions(), auth);
 
     // password path
     db.query.user.findFirst.mockResolvedValueOnce(mkUser({ id: "u1" }));
@@ -158,7 +158,7 @@
     expect(res.name).toBe("A");
 
     // missing setPassword support
     const adapter2 = new DrizzleUserAdapter(db, mkOptions(), {
       createUser: (input: CreateUserInput) => auth.createUser(input),
     } as unknown as IAuthProvider);
     await expect(
@@ -169,35 +169,44 @@
     db.update.mockClear();
     db.query.user.findFirst.mockResolvedValueOnce(mkUser({ id: "u1" }));
     await adapter.update("u1", { password: "pw" } as UpdateUserInput);
+
     expect(db.update).not.toHaveBeenCalled();
   });
 
   it("delete cascades and related tables in a transaction", async () => {
     const db = mkDb();
     const auth = mkAuth();
     const adapter = new DrizzleUserAdapter(db, mkOptions(), auth);
 
     // Access the transaction mock to verify cascade behavior
-    const txCalls: string[] = [];
+    const txCalls: any[] = [];
     db.transaction.mockImplementation((fn: (tx: MockTx) => unknown) => {
       const tx = {
-        delete: vi.fn().mockImplementation(() => {
-          txCalls.push("delete");
+        delete: vi.fn().mockImplementation((table: any) => {
+          txCalls.push(table);
           return { where: vi.fn().mockReturnThis() };
         }),
       } as unknown as MockTx;
       return fn(tx);
     });
 
     await adapter.delete("u1");
+
     expect(db.transaction).toHaveBeenCalled();
-    expect(txCalls.length).toBeGreaterThan(0);
+    expect(txCalls).toHaveLength(5);
+    expect(txCalls).toEqual([
+      schema.member,
+      schema.invitation,
+      schema.session,
+      schema.account,
+      schema.user,
+    ]);
   });
 
   it("findById and findByEmail return mapped or null", async () => {
     const db = mkDb();
     const auth = mkAuth();
     const adapter = new DrizzleUserAdapter(db, mkOptions(), auth);
 
     auth.findById = vi.fn().mockResolvedValue(mkUser({ id: "u1" }));
     const byId = await adapter.findById("u1");
@@ -210,7 +219,7 @@
     const authNoFind = mkAuth();
     // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
     delete (authNoFind as any).findById;
     const adapterFallback = new DrizzleUserAdapter(db, mkOptions(), authNoFind);
 
     db.query.user.findFirst.mockResolvedValueOnce(mkUser({ id: "u2" }));
     const byIdFallback = await adapterFallback.findById("u2");
@@ -240,7 +249,7 @@
   it("deleteIfNotLastAdmin handles various scenarios", async () => {
     const db = mkDb();
     const auth = mkAuth();
     const adapter = new DrizzleUserAdapter(db, mkOptions(), auth);
 
     const mockSelect = vi.fn();
     const mockTx = {
@@ -367,21 +376,23 @@
   it("forceVerifyEmail updates user", async () => {
     const db = mkDb();
     const auth = mkAuth();
     const adapter = new DrizzleUserAdapter(db, mkOptions(), auth);
 
     await adapter.forceVerifyEmail("u1");
 
     expect(db.update).toHaveBeenCalledWith(schema.user);
+
     expect(db.set).toHaveBeenCalledWith(
       expect.objectContaining({ emailVerified: true }),
     );
+
     expect(db.where).toHaveBeenCalled();
   });
 
   it("count returns total users with optional filtering", async () => {
     const db = mkDb();
     const auth = mkAuth();
     const adapter = new DrizzleUserAdapter(db, mkOptions(), auth);
 
     // Mock count result
     const mockCountResult = [{ count: 5 }];
@@ -393,19 +404,21 @@
     // 1. Global count
     const total = await adapter.count();
     expect(total).toBe(5);
+
     expect(db.innerJoin).not.toHaveBeenCalled();
 
     // 2. Tenant count
     db.innerJoin.mockClear();
     const totalTenant = await adapter.count({ tenantId: "t1" });
     expect(totalTenant).toBe(5);
+
     expect(db.innerJoin).toHaveBeenCalled();
   });
 
   it("findAll builds search filters correctly", async () => {
     const db = mkDb();
     const auth = mkAuth();
     const adapter = new DrizzleUserAdapter(db, mkOptions(), auth);
 
     const dataChain = {
       from: vi.fn().mockReturnThis(),
@@ -430,6 +443,7 @@
     await adapter.findAll({ search: "test", limit: 10 });
 
     expect(dataChain.where).toHaveBeenCalled();
+
     expect(countChain.where).toHaveBeenCalled();
   });
 
@@ -466,9 +480,9 @@
     });
 
     await adapter.findAll({ tenantId: "t1" });
-
     expect(dataChain.innerJoin).toHaveBeenCalled();
     expect(countChain.innerJoin).toHaveBeenCalled();
     expect(dataChain.where).toHaveBeenCalled();
+    expect(countChain.where).toHaveBeenCalled();
   });
 });