Experience · Backend · Active

cs-tools api

NestJS BFF for CS Tools, owning catalog persistence and same-origin product APIs while delegating login, setup and session resolution to platform-auth-service.

• NestJS 11
• Prisma
• PostgreSQL
• class-validator
• helmet
• cookie-parser

Spec sheet

Repository path

cs-tools/apps/api

Runtime

NestJS 11 BFF

Default port

3006

Public surface

Same-origin /api on tools host

Database

tools-postgres via Prisma

Responsibilities

• Expose health, auth status/login/setup/logout and catalog APIs.
• Resolve product sessions through platform-auth-service.
• Persist folders, tools and content pages through Prisma.
• Keep catalog controllers thin and domain logic inside services.
• Keep Core HTTP calls isolated in small platform-auth client modules.

Interfaces and contract surface

• GET /api/health
• GET /api/auth/status
• POST /api/auth/setup
• POST /api/auth/login
• POST /api/auth/logout
• GET /api/catalog/navigation
• GET /api/catalog/folders
• GET /api/catalog/folders/:folderSlug/tools/:toolSlug
• GET /api/catalog-admin/tools
• POST /api/catalog-admin/tools

Consumers

• cs tools web

Dependencies and external touchpoints

• platform-auth-service
• cs tools shared
• PostgreSQL

Notes

• The local-stack entrypoint runs Prisma migrate deploy and generate before Nest watch.
• Platform auth outages are surfaced instead of silently dropping the session except for expected 401/403 session failures.

Source references

• cs-tools/apps/api/package.json
• cs-tools/apps/api/prisma/schema.prisma
• cs-tools/apps/api/src/auth
• cs-tools/apps/api/src/catalog

Auth

Il modulo auth delega password login, setup bootstrap e session resolve a platform-auth-service. Il codice prodotto locale e cs-tools; le API continuano a esporre /api/auth/* come superficie BFF same-origin.

POST /api/auth/password/change inoltra il cambio password al Core auth usando il token di sessione corrente e aggiorna il cookie BFF con la sessione ritornata.

Admin users

La console admin usa /api/auth-admin/users/* per lista, creazione, dettaglio, modifica e reset password degli utenti cs-tools. Il BFF resta il boundary prodotto: legge e aggiorna le credenziali locali su platform-auth-service, restituisce la password temporanea in chiaro solo nelle risposte di creazione o reset e imposta passwordChangeRequired=true per obbligare il cambio al primo login.

Catalog bootstrap

npm run catalog:bootstrap -w apps/api registra le entry base del catalogo, incluse Unipol / Monitoring, API / Swagger Viewer e Gothic 1 Remake / Chest Puzzle. Il BFF conserva solo i metadata di catalogo; i tool Swagger e Chest Puzzle non aggiungono endpoint applicativi.