feat(api): REST API with OpenAPI for other apps, behind Pireon OAuth

A REST adapter next to GraphQL (presenters/http) that calls the same
application services, so validation, permissions and domain errors are the
same: projects (members, board, stats, activity), issues (search, workflow,
assignee, release, links, comments, history), comments, releases and users.
Projects and issues can be addressed by id or key (WEB, WEB-12).

- Swagger UI at /api/docs, document at /api/docs-json and apps/api/openapi.json
  (rewritten by `nx serve api`, like schema.gql) for client generation.
- Every route but health/auth/webhook needs a Pireon token: the document
  declares Pireon OAuth2 (authorization code + PKCE, password) through the
  /api/auth/token proxy, and a bearer scheme for apps with their own client.
- configureApp() shares main.ts setup with the e2e, which now also covers REST.
- SWAGGER_ENABLED / OPENAPI_FILE config; docs 03/05 and library READMEs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
2026-10-03 15:26:47 +02:00
parent b2c9be72c3
commit 341241a52f
36 changed files with 7386 additions and 42 deletions

View File

@@ -0,0 +1,434 @@
import {
ApiProperty,
ApiPropertyOptional,
OmitType,
PartialType,
} from '@nestjs/swagger';
import {
IssueArea,
IssueLinkType,
IssuePriority,
IssueStatus,
IssueType,
ProjectRole,
} from '@task-stream/api/tracker/domain';
import { Transform, Type } from 'class-transformer';
import {
ArrayMaxSize,
IsBoolean,
IsEnum,
IsIn,
IsInt,
IsISO8601,
IsOptional,
IsString,
IsUrl,
Matches,
Max,
MaxLength,
Min,
MinLength,
ValidateIf,
} from 'class-validator';
/* REST request bodies and query strings, validated like the GraphQL inputs. */
/** `?status=TODO&status=DONE` or `?status=TODO,DONE` → ['TODO', 'DONE']. */
const toList = ({ value }: { value: unknown }) =>
value === undefined || value === ''
? undefined
: ([] as unknown[])
.concat(value)
.flatMap((v) => String(v).split(','))
.map((v) => v.trim())
.filter(Boolean);
const toBoolean = ({ value }: { value: unknown }) =>
value === undefined ? undefined : value === true || value === 'true';
// ---- Projects ---------------------------------------------------------------
export class CreateProjectDto {
@ApiProperty({
example: 'WEB',
description:
'2-10 letters/digits starting with a letter → tickets WEB-1, WEB-2…',
})
@Matches(/^[A-Za-z][A-Za-z0-9]{1,9}$/)
key!: string;
@ApiProperty({ example: 'Checkout revamp', maxLength: 120 })
@IsString()
@MinLength(1)
@MaxLength(120)
name!: string;
@ApiPropertyOptional({ type: String, nullable: true, maxLength: 5000 })
@IsOptional()
@IsString()
@MaxLength(5000)
description?: string | null;
}
export class UpdateProjectDto extends PartialType(
OmitType(CreateProjectDto, ['key'] as const),
) {}
export class AddMemberDto {
@ApiProperty({ description: 'Pireon user id (see GET /users)' })
@IsString()
userId!: string;
@ApiPropertyOptional({
enum: ProjectRole,
enumName: 'ProjectRole',
default: ProjectRole.MEMBER,
})
@IsOptional()
@IsEnum(ProjectRole)
role: ProjectRole = ProjectRole.MEMBER;
}
export class ChangeMemberRoleDto {
@ApiProperty({ enum: ProjectRole, enumName: 'ProjectRole' })
@IsEnum(ProjectRole)
role!: ProjectRole;
}
export class BoardQueryDto {
@ApiPropertyOptional({ format: 'uuid', description: 'Only this release' })
@IsOptional()
@IsString()
releaseId?: string;
@ApiPropertyOptional({ description: 'Only this person (Pireon user id)' })
@IsOptional()
@IsString()
assigneeId?: string;
@ApiPropertyOptional({ enum: IssueArea, enumName: 'IssueArea' })
@IsOptional()
@IsEnum(IssueArea)
area?: IssueArea;
@ApiPropertyOptional({ default: 50, minimum: 1, maximum: 200 })
@IsOptional()
@Type(() => Number)
@IsInt()
@Min(1)
@Max(200)
perColumn = 50;
}
export class ActivityQueryDto {
@ApiPropertyOptional({ format: 'uuid', description: 'Only this ticket' })
@IsOptional()
@IsString()
issueId?: string;
@ApiPropertyOptional({ default: 50, minimum: 1, maximum: 200 })
@IsOptional()
@Type(() => Number)
@IsInt()
@Min(1)
@Max(200)
limit = 50;
@ApiPropertyOptional({
format: 'date-time',
description: 'Cursor: entries older than this date',
})
@IsOptional()
@IsISO8601()
before?: string;
}
export class PageQueryDto {
@ApiPropertyOptional({ default: 50, minimum: 1, maximum: 200 })
@IsOptional()
@Type(() => Number)
@IsInt()
@Min(1)
@Max(200)
limit = 50;
@ApiPropertyOptional({ default: 0, minimum: 0 })
@IsOptional()
@Type(() => Number)
@IsInt()
@Min(0)
offset = 0;
}
// ---- Issues -----------------------------------------------------------------
export class IssueSearchQueryDto extends PageQueryDto {
@ApiPropertyOptional({
enum: IssueStatus,
enumName: 'IssueStatus',
isArray: true,
description: 'Repeat the parameter or separate with commas',
})
@IsOptional()
@Transform(toList)
@IsEnum(IssueStatus, { each: true })
status?: IssueStatus[];
@ApiPropertyOptional({
enum: IssueType,
enumName: 'IssueType',
isArray: true,
})
@IsOptional()
@Transform(toList)
@IsEnum(IssueType, { each: true })
type?: IssueType[];
@ApiPropertyOptional({
enum: IssueArea,
enumName: 'IssueArea',
isArray: true,
})
@IsOptional()
@Transform(toList)
@IsEnum(IssueArea, { each: true })
area?: IssueArea[];
@ApiPropertyOptional({
enum: IssuePriority,
enumName: 'IssuePriority',
isArray: true,
})
@IsOptional()
@Transform(toList)
@IsEnum(IssuePriority, { each: true })
priority?: IssuePriority[];
@ApiPropertyOptional({ description: 'Pireon user id' })
@IsOptional()
@IsString()
assigneeId?: string;
@ApiPropertyOptional({ description: 'Only tickets without assignee' })
@IsOptional()
@Transform(toBoolean)
@IsBoolean()
unassigned?: boolean;
@ApiPropertyOptional({ format: 'uuid' })
@IsOptional()
@IsString()
releaseId?: string;
@ApiPropertyOptional({ type: [String] })
@IsOptional()
@Transform(toList)
@IsString({ each: true })
label?: string[];
@ApiPropertyOptional({ description: 'Matches key, title or description' })
@IsOptional()
@IsString()
@MaxLength(200)
search?: string;
}
class IssueFieldsDto {
@ApiPropertyOptional({ type: String, nullable: true, maxLength: 50000 })
@IsOptional()
@IsString()
@MaxLength(50000)
description?: string | null;
@ApiPropertyOptional({
enum: IssueArea,
type: String,
nullable: true,
})
@IsOptional()
@IsEnum(IssueArea)
area?: IssueArea | null;
@ApiPropertyOptional({ enum: IssuePriority, enumName: 'IssuePriority' })
@IsOptional()
@IsEnum(IssuePriority)
priority?: IssuePriority;
@ApiPropertyOptional({ type: [String], maxItems: 20 })
@IsOptional()
@ArrayMaxSize(20)
@IsString({ each: true })
@MaxLength(40, { each: true })
labels?: string[];
@ApiPropertyOptional({
type: String,
nullable: true,
description: 'Figma frame (https) for UI changes',
})
@IsOptional()
@IsUrl({ protocols: ['https'] })
figmaUrl?: string | null;
@ApiPropertyOptional({
type: Number,
nullable: true,
minimum: 0,
maximum: 100,
})
@IsOptional()
@IsInt()
@Min(0)
@Max(100)
storyPoints?: number | null;
@ApiPropertyOptional({ type: String, nullable: true, format: 'date' })
@IsOptional()
@IsISO8601()
dueDate?: string | null;
}
export class CreateIssueDto extends IssueFieldsDto {
@ApiProperty({ enum: IssueType, enumName: 'IssueType' })
@IsEnum(IssueType)
type!: IssueType;
@ApiProperty({
example: 'El botón de pagar no responde en Safari',
maxLength: 255,
})
@IsString()
@MinLength(1)
@MaxLength(255)
title!: string;
@ApiPropertyOptional({
type: String,
nullable: true,
description: 'Pireon user id',
})
@IsOptional()
@IsString()
assigneeId?: string | null;
@ApiPropertyOptional({ type: String, nullable: true, format: 'uuid' })
@IsOptional()
@IsString()
releaseId?: string | null;
}
export class UpdateIssueDto extends IssueFieldsDto {
@ApiPropertyOptional({ enum: IssueType, enumName: 'IssueType' })
@IsOptional()
@IsEnum(IssueType)
type?: IssueType;
@ApiPropertyOptional({ maxLength: 255 })
@IsOptional()
@IsString()
@MinLength(1)
@MaxLength(255)
title?: string;
}
export class ChangeStatusDto {
@ApiProperty({ enum: IssueStatus, enumName: 'IssueStatus' })
@IsEnum(IssueStatus)
status!: IssueStatus;
@ApiPropertyOptional({
type: String,
nullable: true,
description: 'Required for QA_FAILED and CANCELLED',
})
@IsOptional()
@IsString()
@MaxLength(5000)
reason?: string | null;
}
export class AssignIssueDto {
@ApiProperty({
type: String,
nullable: true,
description: 'Pireon user id of a project member, or null to unassign',
})
@ValidateIf((dto: AssignIssueDto) => dto.assigneeId !== null)
@IsString()
assigneeId!: string | null;
}
export class SetIssueReleaseDto {
@ApiProperty({
type: String,
nullable: true,
format: 'uuid',
description: 'Planned release, or null to take the ticket out',
})
@ValidateIf((dto: SetIssueReleaseDto) => dto.releaseId !== null)
@IsString()
releaseId!: string | null;
}
export class LinkIssueDto {
@ApiProperty({ enum: IssueLinkType, enumName: 'IssueLinkType' })
@IsEnum(IssueLinkType)
type!: IssueLinkType;
@ApiProperty({ example: 'API-3', description: 'Other ticket: id or key' })
@IsString()
@MinLength(1)
targetIssue!: string;
}
export class LinkTypeParamDto {
@ApiProperty({ enum: IssueLinkType, enumName: 'IssueLinkType' })
@IsIn(Object.values(IssueLinkType))
type!: IssueLinkType;
}
export class CommentBodyDto {
@ApiProperty({ example: 'Reproducido en Safari 17.', maxLength: 20000 })
@IsString()
@MinLength(1)
@MaxLength(20000)
body!: string;
}
// ---- Releases ---------------------------------------------------------------
export class CreateReleaseDto {
@ApiProperty({ example: 'v1.4.0', maxLength: 60 })
@IsString()
@MinLength(1)
@MaxLength(60)
name!: string;
@ApiPropertyOptional({ type: String, nullable: true, maxLength: 5000 })
@IsOptional()
@IsString()
@MaxLength(5000)
description?: string | null;
@ApiPropertyOptional({
type: String,
nullable: true,
format: 'date',
example: '2026-11-14',
})
@IsOptional()
@IsISO8601()
targetDate?: string | null;
}
export class UpdateReleaseDto extends PartialType(CreateReleaseDto) {}
export class PublishReleaseDto {
@ApiPropertyOptional({
default: false,
description: 'Publish even with unfinished tickets',
})
@IsOptional()
@IsBoolean()
force = false;
}

View File

@@ -0,0 +1,215 @@
import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';
import {
IssueArea,
IssueLinkType,
IssuePriority,
IssueStatus,
IssueType,
ProjectRole,
ReleaseStatus,
} from '@task-stream/api/tracker/domain';
/*
* REST response bodies. Same shapes as the GraphQL types (both are views of
* the read models); here they only document the contract for OpenAPI.
*/
export class UserRefDto {
@ApiProperty({ description: 'Pireon user id' }) id!: string;
@ApiProperty() name!: string;
}
export class ProjectMemberDto {
@ApiProperty({ type: UserRefDto }) user!: UserRefDto;
@ApiProperty({ enum: ProjectRole, enumName: 'ProjectRole' })
role!: ProjectRole;
}
export class ProjectDto {
@ApiProperty({ format: 'uuid' }) id!: string;
@ApiProperty({ example: 'WEB', description: 'Prefix of the ticket keys' })
key!: string;
@ApiProperty({ example: 'Checkout revamp' }) name!: string;
@ApiProperty({ type: String, nullable: true }) description!: string | null;
@ApiProperty({ type: UserRefDto }) owner!: UserRefDto;
@ApiProperty({ type: [ProjectMemberDto] }) members!: ProjectMemberDto[];
@ApiProperty({ format: 'date-time' }) createdAt!: string;
@ApiProperty({ format: 'date-time' }) updatedAt!: string;
@ApiProperty({ description: 'Version of the aggregate (event count)' })
version!: number;
}
export class IssueLinkDto {
@ApiProperty({ enum: IssueLinkType, enumName: 'IssueLinkType' })
type!: IssueLinkType;
@ApiProperty({
enum: ['OUTWARD', 'INWARD'],
enumName: 'LinkDirection',
description: 'OUTWARD: this issue → other. INWARD: other → this issue.',
})
direction!: 'OUTWARD' | 'INWARD';
@ApiProperty({ format: 'uuid' }) issueId!: string;
@ApiProperty({ example: 'WEB-3' }) issueKey!: string;
}
export class ReleaseRefDto {
@ApiProperty({ format: 'uuid' }) id!: string;
@ApiProperty({ example: 'v1.4.0' }) name!: string;
}
export class IssueDto {
@ApiProperty({ format: 'uuid' }) id!: string;
@ApiProperty({ format: 'uuid' }) projectId!: string;
@ApiProperty({ example: 'WEB' }) projectKey!: string;
@ApiProperty({ example: 12 }) number!: number;
@ApiProperty({ example: 'WEB-12', description: 'Human key' }) key!: string;
@ApiProperty({ enum: IssueType, enumName: 'IssueType' }) type!: IssueType;
@ApiProperty({ enum: IssueArea, type: String, nullable: true })
area!: IssueArea | null;
@ApiProperty() title!: string;
@ApiProperty({ type: String, nullable: true }) description!: string | null;
@ApiProperty({ enum: IssueStatus, enumName: 'IssueStatus' })
status!: IssueStatus;
@ApiProperty({
enum: IssueStatus,
enumName: 'IssueStatus',
isArray: true,
description: 'Statuses this ticket can move to next',
})
allowedTransitions!: IssueStatus[];
@ApiProperty({ enum: IssuePriority, enumName: 'IssuePriority' })
priority!: IssuePriority;
@ApiProperty({ type: UserRefDto }) reporter!: UserRefDto;
@ApiProperty({ type: UserRefDto, nullable: true })
assignee!: UserRefDto | null;
@ApiProperty({ type: ReleaseRefDto, nullable: true })
release!: ReleaseRefDto | null;
@ApiProperty({ type: [String] }) labels!: string[];
@ApiProperty({ type: String, nullable: true, description: 'Figma frame' })
figmaUrl!: string | null;
@ApiProperty({ type: Number, nullable: true }) storyPoints!: number | null;
@ApiProperty({ type: String, nullable: true, format: 'date' })
dueDate!: string | null;
@ApiProperty({ type: [IssueLinkDto] }) links!: IssueLinkDto[];
@ApiProperty() commentCount!: number;
@ApiProperty({ format: 'date-time' }) createdAt!: string;
@ApiProperty({ format: 'date-time' }) updatedAt!: string;
@ApiProperty() version!: number;
}
export class IssuePageDto {
@ApiProperty({ type: [IssueDto] }) items!: IssueDto[];
@ApiProperty({ description: 'Total matches (for pagination)' })
total!: number;
}
export class BoardColumnDto {
@ApiProperty({ enum: IssueStatus, enumName: 'IssueStatus' })
status!: IssueStatus;
@ApiProperty({ type: [IssueDto] }) issues!: IssueDto[];
@ApiProperty({ description: 'Tickets in the column (may exceed `issues`)' })
total!: number;
}
export class CommentDto {
@ApiProperty({ format: 'uuid' }) id!: string;
@ApiProperty({ format: 'uuid' }) issueId!: string;
@ApiProperty({ type: UserRefDto }) author!: UserRefDto;
@ApiProperty() body!: string;
@ApiProperty({ format: 'date-time' }) createdAt!: string;
@ApiProperty({ type: String, nullable: true, format: 'date-time' })
editedAt!: string | null;
@ApiProperty() version!: number;
}
export class CommentPageDto {
@ApiProperty({ type: [CommentDto] }) items!: CommentDto[];
@ApiProperty() total!: number;
}
export class ReleaseDto {
@ApiProperty({ format: 'uuid' }) id!: string;
@ApiProperty({ format: 'uuid' }) projectId!: string;
@ApiProperty({ example: 'v1.4.0' }) name!: string;
@ApiProperty({ type: String, nullable: true }) description!: string | null;
@ApiProperty({ type: String, nullable: true, format: 'date' })
targetDate!: string | null;
@ApiProperty({ enum: ReleaseStatus, enumName: 'ReleaseStatus' })
status!: ReleaseStatus;
@ApiProperty({ type: String, nullable: true, format: 'date-time' })
releasedAt!: string | null;
@ApiProperty({ format: 'date-time' }) createdAt!: string;
@ApiProperty() version!: number;
}
export class CountByStatusDto {
@ApiProperty({ enum: IssueStatus, enumName: 'IssueStatus' })
key!: IssueStatus;
@ApiProperty() count!: number;
}
export class CountByKeyDto {
@ApiProperty({ description: 'Type, priority or area ("NONE" = unset)' })
key!: string;
@ApiProperty() count!: number;
}
export class CountByAssigneeDto {
@ApiProperty({
type: UserRefDto,
nullable: true,
description: 'Null = unassigned',
})
user!: UserRefDto | null;
@ApiProperty() count!: number;
}
export class ReleaseProgressDto {
@ApiProperty() total!: number;
@ApiProperty() finished!: number;
@ApiProperty({ minimum: 0, maximum: 100 }) percent!: number;
@ApiProperty({ type: [CountByStatusDto] }) byStatus!: CountByStatusDto[];
}
export class ProjectStatsDto {
@ApiProperty() total!: number;
@ApiProperty({ description: 'Not done nor cancelled' }) open!: number;
@ApiProperty({ type: [CountByStatusDto] }) byStatus!: CountByStatusDto[];
@ApiProperty({ type: [CountByKeyDto] }) byType!: CountByKeyDto[];
@ApiProperty({ type: [CountByKeyDto] }) byPriority!: CountByKeyDto[];
@ApiProperty({ type: [CountByKeyDto] }) byArea!: CountByKeyDto[];
@ApiProperty({
type: [CountByAssigneeDto],
description: 'Open tickets per person',
})
byAssignee!: CountByAssigneeDto[];
}
export class ActivityDto {
@ApiProperty() id!: string;
@ApiProperty({ example: 'IssueStatusChanged' }) type!: string;
@ApiProperty({ format: 'uuid' }) projectId!: string;
@ApiProperty({ type: String, nullable: true }) issueId!: string | null;
@ApiProperty({ type: String, nullable: true, example: 'WEB-12' })
issueKey!: string | null;
@ApiProperty({ type: UserRefDto }) actor!: UserRefDto;
@ApiProperty({ example: 'Ana movió WEB-12 de En curso a En revisión' })
summary!: string;
@ApiProperty({ format: 'date-time' }) occurredAt!: string;
}
export class CommandResultDto {
@ApiProperty({ description: 'Id of the aggregate written' }) id!: string;
@ApiPropertyOptional({
description: 'Human key when one was assigned (project or issue)',
example: 'WEB-13',
})
key?: string;
@ApiProperty({
description:
'Version after the write. Writes are acknowledged at once and the read ' +
'model catches up asynchronously: a GET may briefly return the previous ' +
'version (or 404 right after a create).',
})
version!: number;
}