Add issue change history and daily issue stats

Issue changes are recorded per field in the issue_change table, in the same transaction as the issue itself. The new history module exposes: - GET /api/issues/:issueId/history — change timeline grouped by save - GET /api/issues/stats/daily — created, status transitions and status snapshot per day, with time zone support The migration backfills history for existing issues. Setting a field to its current value no longer bumps updatedAt or emits issue.updated.
update issue filter
2026-10-08 09:55:21 +03:00 · 2026-10-06 23:18:00 +03:00 · 2026-10-02 21:43:37 +03:00 · 2026-10-02 09:18:15 +03:00 · 2026-10-02 09:18:08 +03:00 · 2026-10-02 09:18:02 +03:00
175 changed files with 7300 additions and 82 deletions
@@ -10,3 +10,4 @@ coverage
 *.log
 tsconfig.build.tsbuildinfo
 src/generated
 storage
@@ -2,6 +2,7 @@
 /dist
 /node_modules
 /build
 *.tsbuildinfo
 # Logs
 logs
@@ -57,3 +58,6 @@ report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
 /src/generated/prisma
 /src/schema.gql
 # Local file storage (FILE_STORAGE=local)
 /storage
@@ -0,0 +1,214 @@
 # WIP — вложения (2026-10-02)
 Сделано за сегодня: модуль `file` (хранение файлов), модуль `issue-attachment`
 (вложения задач) и вложения в комментариях. Всё в ветке `feature/attachments`
 (не запушена), миграции к БД не применялись.
 ## Архитектура
 Метаданные файла хранятся отдельно от того, к чему файл прикреплён:
 ```
 file  ←──  issue_attachment    (issueId, fileId)    — модуль issue-attachment
      ←──  comment_attachment  (commentId, fileId)  — модуль comment
 ```
 - `file` ничего не знает о владельцах. Новый владелец = своя таблица связей
  + регистрация в `FileOwnerRegistry`; сам `file` при этом не меняется.
 - Удаление задачи/комментария удаляет связи каскадом в БД, а файл без единой
  связи (сирота) удаляет GC.
 - Флоу для клиента в два шага: загрузить файл → прикрепить по `fileId`.
 Почему не полиморфная связь `ownerType + ownerId`: нет FK, нет каскадов, разные
 типы ключей (`Issue.id` — Int, остальные — uuid).
 ## Миграции
 | Миграция | Что |
 |---|---|
 | `20261002045355_file` | таблица `file` |
 | `20261002050156_issue_attachment` | таблица `issue_attachment` |
 | `20261002060755_comment_attachment` | таблица `comment_attachment` |
 Собраны через `prisma migrate diff` без подключения к БД. Применятся при деплое
 (`prisma migrate deploy` в CMD Dockerfile).
 ## Модуль `file` — `src/modules/file/`
 ### API
 | Метод | Путь | Что |
 |---|---|---|
 | POST | `/api/files` | загрузка, multipart, поле `file` → `FileDto` |
 | GET | `/api/files/:id/download` | скачивание (поток) |
 | DELETE | `/api/files/:id` | удалить файл (только загрузивший), 204 |
 `FileDto`: `{ id, fileName, mimeType, size, uploaderId, createdAt }`.
 `storageKey` наружу не отдаётся.
 ### Устройство
 - **domain**:
  - `StoredFile` — не `File`, чтобы не путать с глобальным Web API `File`;
  - VO `FileName`: убирает путь и управляющие символы, обрезает до 255
    с сохранением расширения;
  - порты `IFileStorage`, `IFileTypeDetector`.
 - **application**:
  - use-case'ы upload / download / delete / get-files;
  - `FileAccessService`, `FileOwnerRegistry`, `FileGcService`.
 - **infrastructure**:
  - `FilePrismaRepository`;
  - хранилища `LocalFileStorage` (dev/тесты) и `S3FileStorage`
    (S3 / RustFS / MinIO), выбираются в `file-storage.factory.ts`;
  - `FileTypeDetector` на `file-type`.
 - **presentation**: `FileController`, хелпер `contentDisposition`
  (RFC 5987, кириллица), GraphQL-тип `File`.
 ### Загрузка
 - multer пишет во временный файл (`os.tmpdir()`), а не в память. Лимит —
  `FILE_MAX_SIZE_MB`, при превышении Nest отвечает 413.
 - `defParamCharset: 'utf8'` — иначе multer ломает кириллицу в именах файлов.
 - MIME определяется **по содержимому** (magic bytes). Нераспознанное
  (HTML, SVG, текст) сохраняется как `application/octet-stream`.
 - Ключ в хранилище — `files/{randomUUID}`. Имя от пользователя в ключ не попадает.
 - Порядок записи: объект → строка в БД. Если запись строки упала, объект
  удаляется сразу.
 ### Скачивание и безопасность
 - Inline отдаются только `image/png|jpeg|gif|webp`, всё остальное — как
  `attachment`. Плюс `X-Content-Type-Options: nosniff` — защита от stored XSS.
 - Файл виден загрузившему и всем, кому виден хоть один его владелец (задача,
  комментарий). Иначе 404, чтобы не раскрывать существование файла.
 - `TransformResponseInterceptor` пропускает `StreamableFile`. Без этого обёртка
  `{data, code}` ломала скачивание.
 ### Прикрепление (для модулей-владельцев)
 - `FileAccessService.getAttachableFile(id, userId)`: прикрепить можно только
  **свой** файл. Невидимый файл → 404, чужой → 403. Иначе файл, увиденный
  через одну задачу, можно было бы перенести в другую.
 - `GetFilesUseCase` — метаданные файлов по id, для раскрытия связей в DTO.
 ### GC файлов-сирот
 - `FileGcService`, `@Cron(EVERY_HOUR)`. Подключён `ScheduleModule` в `app.module.ts`.
 - Удаляет файлы старше `FILE_ORPHAN_TTL_HOURS` (по умолчанию 24), на которые
  не ссылается ни один зарегистрированный владелец.
 - Порядок удаления: объект → строка. Удаление объекта идемпотентно, поэтому
  при сбое следующий запуск доделает работу. Тот же порядок в `DeleteFileUseCase`.
 - Безопасен при нескольких инстансах приложения.
 > ⚠️ Новый владелец файлов **обязан** зарегистрироваться в `FileOwnerRegistry`
 > (`onModuleInit`), иначе GC удалит его файлы как сирот.
 ## Модуль `issue-attachment` — `src/modules/issue-attachment/`
 Отдельный модуль, как `comment`: зависит от issue, а issue о нём не знает.
 Иначе получался бы цикл issue ↔ attachment.
 ### API
 | Метод | Путь | Что |
 |---|---|---|
 | GET | `/api/issues/:issueId/attachments` | список → `IssueAttachmentDto[]` |
 | POST | `/api/issues/:issueId/attachments` | `{ fileId }` → `IssueAttachmentDto` |
 | DELETE | `/api/issues/:issueId/attachments/:fileId` | открепить, 204 (файл удалит GC) |
 `IssueAttachmentDto`: `{ issueId, file: FileDto, attachedAt }`.
 GraphQL: поле `IssueDetail.attachments`. Его добавляет `IssueAttachmentResolver`
 через `@ResolveField`, issue-модуль не тронут. В списке задач (`Issue`) этого
 поля нет, чтобы не было N+1.
 ### Правила
 - Прикреплять и откреплять может любой, кому видна задача (то же правило, что
  для правки задачи), но прикрепить можно только свой файл.
 - Повторное прикрепление идемпотентно (`upsert`).
 - Если задачу или файл удалили между проверкой и вставкой (FK violation), ответ 404.
 - `IssueAttachmentFileOwnerService` регистрируется в реестре. Видимость файла
  проверяется через `IIssueRepository.findById`, поэтому правило
  «reporter/assignee» живёт в одном месте.
 ## Вложения в комментариях — модуль `comment`
 Вложения — часть агрегата `Comment` (`fileIds`). Отдельных эндпоинтов нет:
 ```
 POST  /api/issues/:issueId/comments  { "content": "...", "fileIds": ["…"] }
 PATCH /api/comments/:id              { "content": "...", "fileIds": [...] }
 ```
 - **Ответы.** `CommentDto.attachments: FileDto[]` — в create, update, списке
  и SSE-событиях.
 - **Правка.** `fileIds` при update задаёт набор целиком; не передан — вложения
  не меняются.
  - Синхронизация связей идёт в одной транзакции с правкой текста.
  - Изменение только набора файлов тоже считается правкой
    (`editedAt`, `comment.updated`).
  - Проверяются только добавленные файлы.
 - **Ограничения:** максимум `Comment.MAX_ATTACHMENTS = 10`, дубли убираются.
 - **Порядок** — по времени загрузки. id файлов — uuid v7, поэтому
  сортировка по строке совпадает с порядком загрузки.
 - **Мягкое удаление** комментария снимает связи, файлы забирает GC. В ответе
  у удалённого комментария `attachments: []`.
 - `CommentAttachmentFileOwnerService` регистрируется в реестре. Файл виден
  тем, кому видна задача неудалённого комментария с этим файлом.
 - `CommentAuthorExpanderService` переименован в `CommentExpanderService`:
  он раскрывает и авторов, и файлы (параллельно).
 ## Прочие изменения
 - **Зависимости:** `@aws-sdk/client-s3`, `file-type`, `@nestjs/schedule`;
  dev — `@types/multer`.
 - **`tsconfig.json`:** `multer` добавлен в `types`, иначе не виден
  `Express.Multer.File`.
 - **`.gitignore` / `.dockerignore`:** добавлен `/storage` — каталог
  локального хранилища.
 ## Переменные окружения
 ```
 FILE_STORAGE=s3                # local (по умолчанию) | s3
 FILE_STORAGE_LOCAL_DIR=./storage
 FILE_MAX_SIZE_MB=25
 FILE_ORPHAN_TTL_HOURS=24
 S3_ENDPOINT=http://rustfs:9000 # для AWS можно не задавать
 S3_REGION=us-east-1
 S3_BUCKET=ulitka
 S3_ACCESS_KEY_ID=...
 S3_SECRET_ACCESS_KEY=...
 S3_FORCE_PATH_STYLE=true       # для RustFS/MinIO
 ```
 В `.env` были закомментированы `RUSTFS_*`. Адаптер использует общие `S3_*`.
 ## Проверено
 - 154 unit-теста проходят. Типы, линтер и сборка чистые.
 - Приложение стартует, DI резолвится, новые маршруты без сессии отвечают 401.
  В `schema.gql` появились `File`, `IssueAttachment`, `IssueDetail.attachments`.
 - **Не проверено:** сценарий целиком с авторизацией, реальной БД и S3
  (upload → attach → download → GC).
 ## TODO / открытые вопросы
 - [ ] Перед деплоем: создать бакет в RustFS (приложение его не создаёт),
      прописать `FILE_STORAGE=s3` и `S3_*` на сервере.
 - [ ] Прогнать e2e: загрузка → прикрепление → скачивание другим участником →
      открепление → GC.
 - [ ] Влить `feature/attachments` в `main`. Push в `main` запускает деплой —
      сначала бакет и переменные окружения.
 - [ ] Лимит числа вложений у задачи (у комментария — 10).
 - [ ] SSE-события для вложений задачи (по образцу `CommentEventsService`).
 - [ ] Комментарий только с файлами, без текста? Сейчас текст обязателен.
 - [ ] Вложения комментариев в GraphQL — когда появятся комментарии в GraphQL.
 - [ ] GC при большом числе файлов: сейчас каждый запуск проходит по всем старым
      файлам. При сотнях тысяч файлов — переписать на `NOT EXISTS`.
 - [ ] Маловероятная гонка: прикрепление файла, загруженного больше 24 ч назад,
      ровно в момент прохода GC может его потерять.
 - [ ] Позже: отдавать скачивание redirect'ом на presigned GET вместо стрима
      через Node.
@@ -11,13 +11,16 @@
      "dependencies": {
        "@apollo/server": "^5.5.1",
        "@as-integrations/express5": "^1.1.2",
        "@aws-sdk/client-s3": "^3.1145.0",
        "@better-auth/prisma-adapter": "^1.7.2",
        "@nestjs/apollo": "^14.0.0",
        "@nestjs/common": "^12.0.1",
        "@nestjs/config": "^12.0.0",
        "@nestjs/core": "^12.0.1",
        "@nestjs/event-emitter": "^12.0.1",
        "@nestjs/graphql": "^14.0.0",
        "@nestjs/platform-express": "^12.0.1",
        "@nestjs/schedule": "^12.0.2",
        "@nestjs/typeorm": "^12.0.1",
        "@prisma/adapter-pg": "^7.10.0",
        "@prisma/client": "^7.10.0",
@@ -25,6 +28,7 @@
        "better-auth": "^1.7.2",
        "class-transformer": "^0.5.1",
        "class-validator": "^0.15.1",
        "file-type": "^22.1.1",
        "graphql": "^16.14.2",
        "nodemailer": "^10.0.0",
        "pg": "^8.23.0",
@@ -39,6 +43,7 @@
        "@nestjs/schematics": "^12.0.0",
        "@nestjs/testing": "^12.0.1",
        "@types/express": "^5.0.0",
        "@types/multer": "^2.3.0",
        "@types/node": "^24.0.0",
        "@types/pg": "^8.23.1",
        "@types/supertest": "^7.0.0",
@@ -370,6 +375,314 @@
        "express": "^5.0.0"
      }
    },
    "node_modules/@aws-sdk/checksums": {
      "version": "3.1001.1",
      "resolved": "https://registry.npmjs.org/@aws-sdk/checksums/-/checksums-3.1001.1.tgz",
      "integrity": "sha512-x12Q17KYlJAd3nKf8LV5LV0vt8sh8/6YfQLGPtrGnQf/tW4jqxPGq5GPpuVitpQYM3eUR4XB7CbxZf751NMbLw==",
      "license": "Apache-2.0",
      "dependencies": {
        "@aws-sdk/core": "^3.978.1",
        "@aws-sdk/types": "^3.974.6",
        "@smithy/core": "^3.35.0",
        "@smithy/types": "^4.19.0",
        "tslib": "^2.6.2"
      },
      "engines": {
        "node": ">=20.0.0"
      }
    },
    "node_modules/@aws-sdk/client-s3": {
      "version": "3.1145.0",
      "resolved": "https://registry.npmjs.org/@aws-sdk/client-s3/-/client-s3-3.1145.0.tgz",
      "integrity": "sha512-MPKAQdx8qCZW1/ChDPILNehtAn/BMP4GNTnaH/xhGCWg3v50ADVq1K2WzxIrFfeANdWUyjwiY0CXDBhclsNWgQ==",
      "license": "Apache-2.0",
      "dependencies": {
        "@aws-sdk/checksums": "^3.1001.1",
        "@aws-sdk/core": "^3.978.1",
        "@aws-sdk/credential-provider-node": "^3.972.84",
        "@aws-sdk/middleware-sdk-s3": "^3.972.77",
        "@aws-sdk/signature-v4-multi-region": "^3.996.47",
        "@aws-sdk/types": "^3.974.6",
        "@smithy/core": "^3.35.0",
        "@smithy/fetch-http-handler": "^5.8.0",
        "@smithy/node-http-handler": "^4.12.1",
        "@smithy/types": "^4.19.0",
        "tslib": "^2.6.2"
      },
      "engines": {
        "node": ">=20.0.0"
      }
    },
    "node_modules/@aws-sdk/core": {
      "version": "3.978.1",
      "resolved": "https://registry.npmjs.org/@aws-sdk/core/-/core-3.978.1.tgz",
      "integrity": "sha512-LbY9aGsEiznDWmUc30Nwv3aIX/+dbwTx8KfS0yOC3NPYMO+O91e6jkT1azf34FwjOndq8/Q+RcVVZz5xnerwdg==",
      "license": "Apache-2.0",
      "dependencies": {
        "@aws-sdk/types": "^3.974.6",
        "@aws-sdk/xml-builder": "^3.972.41",
        "@aws/lambda-invoke-store": "^0.3.0",
        "@smithy/core": "^3.35.0",
        "@smithy/signature-v4": "^5.7.3",
        "@smithy/types": "^4.19.0",
        "bowser": "^2.11.0",
        "tslib": "^2.6.2"
      },
      "engines": {
        "node": ">=20.0.0"
      }
    },
    "node_modules/@aws-sdk/credential-provider-env": {
      "version": "3.972.72",
      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-env/-/credential-provider-env-3.972.72.tgz",
      "integrity": "sha512-xTKO/FWJPozTIXbozVnVGoNBhaGba8TBcx+KyUjRVeOlXE+dUc7GTR1cLvu0uTdIdmemzaFbqqCshXeZA1fZew==",
      "license": "Apache-2.0",
      "dependencies": {
        "@aws-sdk/core": "^3.978.1",
        "@aws-sdk/types": "^3.974.6",
        "@smithy/core": "^3.35.0",
        "@smithy/types": "^4.19.0",
        "tslib": "^2.6.2"
      },
      "engines": {
        "node": ">=20.0.0"
      }
    },
    "node_modules/@aws-sdk/credential-provider-http": {
      "version": "3.972.74",
      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-http/-/credential-provider-http-3.972.74.tgz",
      "integrity": "sha512-u91E/hT8f4d1xy0Jl7VG4nVKJ3lxbrZkoBTeSVoJdWBiSEUMwMS/9+e0H/aJVQV//Lt5wuzP+E69v4aRSsNTmw==",
      "license": "Apache-2.0",
      "dependencies": {
        "@aws-sdk/core": "^3.978.1",
        "@aws-sdk/types": "^3.974.6",
        "@smithy/core": "^3.35.0",
        "@smithy/fetch-http-handler": "^5.8.0",
        "@smithy/node-http-handler": "^4.12.1",
        "@smithy/types": "^4.19.0",
        "tslib": "^2.6.2"
      },
      "engines": {
        "node": ">=20.0.0"
      }
    },
    "node_modules/@aws-sdk/credential-provider-ini": {
      "version": "3.973.17",
      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-ini/-/credential-provider-ini-3.973.17.tgz",
      "integrity": "sha512-ged4KXdBkvIC81bLvNHHuQKdKak/VXhQTR1NWYTTqW0474nlmsxy9O/vlgTIohDDWH3xpBdtVMZRyjb+DnocDA==",
      "license": "Apache-2.0",
      "dependencies": {
        "@aws-sdk/core": "^3.978.1",
        "@aws-sdk/credential-provider-env": "^3.972.72",
        "@aws-sdk/credential-provider-http": "^3.972.74",
        "@aws-sdk/credential-provider-login": "^3.972.79",
        "@aws-sdk/credential-provider-process": "^3.972.72",
        "@aws-sdk/credential-provider-sso": "^3.973.16",
        "@aws-sdk/credential-provider-web-identity": "^3.972.78",
        "@aws-sdk/nested-clients": "^3.997.46",
        "@aws-sdk/types": "^3.974.6",
        "@smithy/core": "^3.35.0",
        "@smithy/credential-provider-imds": "^4.5.2",
        "@smithy/types": "^4.19.0",
        "tslib": "^2.6.2"
      },
      "engines": {
        "node": ">=20.0.0"
      }
    },
    "node_modules/@aws-sdk/credential-provider-login": {
      "version": "3.972.79",
      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-login/-/credential-provider-login-3.972.79.tgz",
      "integrity": "sha512-L+Z85anONJd8MaiuraO4wRxATCdEejBZ3K3eymzWI5JPXa9sOS9CkIm72PBKqXKX+Z9p9NGMX5AIMXm0LEflgw==",
      "license": "Apache-2.0",
      "dependencies": {
        "@aws-sdk/core": "^3.978.1",
        "@aws-sdk/nested-clients": "^3.997.46",
        "@aws-sdk/types": "^3.974.6",
        "@smithy/core": "^3.35.0",
        "@smithy/types": "^4.19.0",
        "tslib": "^2.6.2"
      },
      "engines": {
        "node": ">=20.0.0"
      }
    },
    "node_modules/@aws-sdk/credential-provider-node": {
      "version": "3.972.84",
      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-node/-/credential-provider-node-3.972.84.tgz",
      "integrity": "sha512-oHt854odINVwzwsh+c5x69j0ajm4DbqqqVJ+O1ECsCIZeMDAbzFpXItaqP7UZstJj/ATdTk/KFSH0LaNAgV+kA==",
      "license": "Apache-2.0",
      "dependencies": {
        "@aws-sdk/credential-provider-env": "^3.972.72",
        "@aws-sdk/credential-provider-http": "^3.972.74",
        "@aws-sdk/credential-provider-ini": "^3.973.17",
        "@aws-sdk/credential-provider-process": "^3.972.72",
        "@aws-sdk/credential-provider-sso": "^3.973.16",
        "@aws-sdk/credential-provider-web-identity": "^3.972.78",
        "@aws-sdk/types": "^3.974.6",
        "@smithy/core": "^3.35.0",
        "@smithy/credential-provider-imds": "^4.5.2",
        "@smithy/types": "^4.19.0",
        "tslib": "^2.6.2"
      },
      "engines": {
        "node": ">=20.0.0"
      }
    },
    "node_modules/@aws-sdk/credential-provider-process": {
      "version": "3.972.72",
      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-process/-/credential-provider-process-3.972.72.tgz",
      "integrity": "sha512-rLIp2xbMjX/k9/od7APpqq1ZgXXnV0pOL1Th3ZsL8Wu0TRtBsDTVS8iPqcfRFcHakFxPvR04OSTv2ka2qOb/2A==",
      "license": "Apache-2.0",
      "dependencies": {
        "@aws-sdk/core": "^3.978.1",
        "@aws-sdk/types": "^3.974.6",
        "@smithy/core": "^3.35.0",
        "@smithy/types": "^4.19.0",
        "tslib": "^2.6.2"
      },
      "engines": {
        "node": ">=20.0.0"
      }
    },
    "node_modules/@aws-sdk/credential-provider-sso": {
      "version": "3.973.16",
      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-sso/-/credential-provider-sso-3.973.16.tgz",
      "integrity": "sha512-IGihaJfFZYacJJr/odqILCoK7W/mvrZ7cuK7ECn3sAu4vLC6u0V8bS7mCGbdugJ8Aum2tnvqmx0F2MRFp2rn9g==",
      "license": "Apache-2.0",
      "dependencies": {
        "@aws-sdk/core": "^3.978.1",
        "@aws-sdk/nested-clients": "^3.997.46",
        "@aws-sdk/token-providers": "3.1138.0",
        "@aws-sdk/types": "^3.974.6",
        "@smithy/core": "^3.35.0",
        "@smithy/types": "^4.19.0",
        "tslib": "^2.6.2"
      },
      "engines": {
        "node": ">=20.0.0"
      }
    },
    "node_modules/@aws-sdk/credential-provider-web-identity": {
      "version": "3.972.78",
      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-web-identity/-/credential-provider-web-identity-3.972.78.tgz",
      "integrity": "sha512-/y9WvNtlcPBGLR0qc1a+9J/xtYZfVczvLUOuXaVWylzttH7ewsxwHtjmiJSolNrVSDorIxHGHMU61CbonRkmwA==",
      "license": "Apache-2.0",
      "dependencies": {
        "@aws-sdk/core": "^3.978.1",
        "@aws-sdk/nested-clients": "^3.997.46",
        "@aws-sdk/types": "^3.974.6",
        "@smithy/core": "^3.35.0",
        "@smithy/types": "^4.19.0",
        "tslib": "^2.6.2"
      },
      "engines": {
        "node": ">=20.0.0"
      }
    },
    "node_modules/@aws-sdk/middleware-sdk-s3": {
      "version": "3.972.77",
      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-sdk-s3/-/middleware-sdk-s3-3.972.77.tgz",
      "integrity": "sha512-E7W2UOeUoc+lg3uIfR/dM7ZwusHwhBQrKMnlkRv4EXRR+C0YtV1pg25xC7GdZIhXH+NAMgZPCbE7o5to2cjFiw==",
      "license": "Apache-2.0",
      "dependencies": {
        "@aws-sdk/core": "^3.978.1",
        "@aws-sdk/signature-v4-multi-region": "^3.996.47",
        "@aws-sdk/types": "^3.974.6",
        "@smithy/core": "^3.35.0",
        "@smithy/types": "^4.19.0",
        "tslib": "^2.6.2"
      },
      "engines": {
        "node": ">=20.0.0"
      }
    },
    "node_modules/@aws-sdk/nested-clients": {
      "version": "3.997.46",
      "resolved": "https://registry.npmjs.org/@aws-sdk/nested-clients/-/nested-clients-3.997.46.tgz",
      "integrity": "sha512-oRxtBcka/JGHGs9l9p9IVajGoTP8vTPmoAzdHGy4Qcy9P5vPnDf6nhIeM/COQNY9k/OahImTRaLkHftoXvfcmQ==",
      "license": "Apache-2.0",
      "dependencies": {
        "@aws-sdk/core": "^3.978.1",
        "@aws-sdk/signature-v4-multi-region": "^3.996.47",
        "@aws-sdk/types": "^3.974.6",
        "@smithy/core": "^3.35.0",
        "@smithy/fetch-http-handler": "^5.8.0",
        "@smithy/node-http-handler": "^4.12.1",
        "@smithy/types": "^4.19.0",
        "tslib": "^2.6.2"
      },
      "engines": {
        "node": ">=20.0.0"
      }
    },
    "node_modules/@aws-sdk/signature-v4-multi-region": {
      "version": "3.996.47",
      "resolved": "https://registry.npmjs.org/@aws-sdk/signature-v4-multi-region/-/signature-v4-multi-region-3.996.47.tgz",
      "integrity": "sha512-Zk08macMvQTHzQJCLJVkOlviVoqwYMrpXv4lmLN7b7sAbiMoOK7Go0NYdR5UeF+MW8LIbRmwrNy9u/5VvX1U5g==",
      "license": "Apache-2.0",
      "dependencies": {
        "@aws-sdk/types": "^3.974.6",
        "@smithy/signature-v4": "^5.7.3",
        "@smithy/types": "^4.19.0",
        "tslib": "^2.6.2"
      },
      "engines": {
        "node": ">=20.0.0"
      }
    },
    "node_modules/@aws-sdk/token-providers": {
      "version": "3.1138.0",
      "resolved": "https://registry.npmjs.org/@aws-sdk/token-providers/-/token-providers-3.1138.0.tgz",
      "integrity": "sha512-GpyAr0DD63YOEmYFM6Df+gJuIgC92MMTiBK4FTKfxii5MJ9ge20epR7LyroulscYlG89J+ZB2ivFDPjvfQhzdw==",
      "license": "Apache-2.0",
      "dependencies": {
        "@aws-sdk/core": "^3.978.1",
        "@aws-sdk/nested-clients": "^3.997.46",
        "@aws-sdk/types": "^3.974.6",
        "@smithy/core": "^3.35.0",
        "@smithy/types": "^4.19.0",
        "tslib": "^2.6.2"
      },
      "engines": {
        "node": ">=20.0.0"
      }
    },
    "node_modules/@aws-sdk/types": {
      "version": "3.974.6",
      "resolved": "https://registry.npmjs.org/@aws-sdk/types/-/types-3.974.6.tgz",
      "integrity": "sha512-v/clNZzZnDxGyvpHMOGpJKVXFAExJzUNAAjaWGdcx8QAcXLGwTaOkw33p5SHAi0YAioK32xB3hWwOekRVfmfKg==",
      "license": "Apache-2.0",
      "dependencies": {
        "@smithy/types": "^4.19.0",
        "tslib": "^2.6.2"
      },
      "engines": {
        "node": ">=20.0.0"
      }
    },
    "node_modules/@aws-sdk/xml-builder": {
      "version": "3.972.41",
      "resolved": "https://registry.npmjs.org/@aws-sdk/xml-builder/-/xml-builder-3.972.41.tgz",
      "integrity": "sha512-ctjVSyCMegrWfXlx6VqzSBFI6UqmQ5ZlnfMhdLIiWmhoH8UAQxSCP5N3OpG7X3k4LnS7ou74C4mt20+bfTW2aQ==",
      "license": "Apache-2.0",
      "dependencies": {
        "@smithy/types": "^4.19.0",
        "tslib": "^2.6.2"
      },
      "engines": {
        "node": ">=20.0.0"
      }
    },
    "node_modules/@aws/lambda-invoke-store": {
      "version": "0.3.0",
      "resolved": "https://registry.npmjs.org/@aws/lambda-invoke-store/-/lambda-invoke-store-0.3.0.tgz",
      "integrity": "sha512-sl4Bm6yiMNYrZKkqqDFWN0UfnWhlS8ivKxrYl+6t0gCLrqr8y3B2IqZZbFRkfaVVp7C/baApyh71P+LeE1A2sQ==",
      "license": "Apache-2.0",
      "engines": {
        "node": ">=18.0.0"
      }
    },
    "node_modules/@babel/helper-string-parser": {
      "version": "7.29.7",
      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz",
@@ -1239,6 +1552,22 @@
        }
      }
    },
    "node_modules/@nestjs/event-emitter": {
      "version": "12.0.1",
      "resolved": "https://registry.npmjs.org/@nestjs/event-emitter/-/event-emitter-12.0.1.tgz",
      "integrity": "sha512-7MbpgNcxUcDlqcYY/qgZm1H7MfK3uGcRsd8lEjj9ZYvI9qTl6kdkkykpxZ6YjBRH3wlZK5dFLAei8h5qpsHzOw==",
      "license": "MIT",
      "dependencies": {
        "eventemitter2": "6.4.9"
      },
      "engines": {
        "node": ">=20.19.0"
      },
      "peerDependencies": {
        "@nestjs/common": "^11.0.0 || ^12.0.0",
        "@nestjs/core": "^11.0.0 || ^12.0.0"
      }
    },
    "node_modules/@nestjs/graphql": {
      "version": "14.0.2",
      "resolved": "https://registry.npmjs.org/@nestjs/graphql/-/graphql-14.0.2.tgz",
@@ -1484,6 +1813,22 @@
        "@nestjs/core": "^12.0.0"
      }
    },
    "node_modules/@nestjs/schedule": {
      "version": "12.0.2",
      "resolved": "https://registry.npmjs.org/@nestjs/schedule/-/schedule-12.0.2.tgz",
      "integrity": "sha512-5iAvJEtk0njbfTrG4JQr+SXw8ZrqgDM1wJH9nUs6tVLCX5pWGd1LJ0a8b089UT1FDeDWaThRRfSLixFz9zztcA==",
      "license": "MIT",
      "dependencies": {
        "cron": "4.4.0"
      },
      "engines": {
        "node": ">=20.19.0"
      },
      "peerDependencies": {
        "@nestjs/common": "^11.0.0 || ^12.0.0",
        "@nestjs/core": "^11.0.0 || ^12.0.0"
      }
    },
    "node_modules/@nestjs/schematics": {
      "version": "12.0.5",
      "resolved": "https://registry.npmjs.org/@nestjs/schematics/-/schematics-12.0.5.tgz",
@@ -2789,6 +3134,87 @@
        "url": "https://github.com/sindresorhus/is?sponsor=1"
      }
    },
    "node_modules/@smithy/core": {
      "version": "3.35.1",
      "resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.35.1.tgz",
      "integrity": "sha512-i4YPS4B6ts7bjn7UwLnGjiZdprOvHvgGobFZsYK3GIY3E5hIqtj0rReU69BcTpGp+fvtraSNXeG1l+jtJvF55w==",
      "license": "Apache-2.0",
      "dependencies": {
        "@smithy/types": "^4.19.0",
        "tslib": "^2.6.2"
      },
      "engines": {
        "node": ">=18.0.0"
      }
    },
    "node_modules/@smithy/credential-provider-imds": {
      "version": "4.5.2",
      "resolved": "https://registry.npmjs.org/@smithy/credential-provider-imds/-/credential-provider-imds-4.5.2.tgz",
      "integrity": "sha512-A9uSdn72ozbRUSit0eib0TW7nXuNPlaeM0zcGkJ+nE6tFcSDbnmtwoxbTCFBukVQcszDAyvsd7+rTduPTXpygg==",
      "license": "Apache-2.0",
      "dependencies": {
        "@smithy/core": "^3.33.2",
        "@smithy/types": "^4.17.2",
        "tslib": "^2.6.2"
      },
      "engines": {
        "node": ">=18.0.0"
      }
    },
    "node_modules/@smithy/fetch-http-handler": {
      "version": "5.8.0",
      "resolved": "https://registry.npmjs.org/@smithy/fetch-http-handler/-/fetch-http-handler-5.8.0.tgz",
      "integrity": "sha512-ycSJu3tFAQ4v04CBB0agqFMVsSQ1iG3yw+SpgxRqKfaURpQD4CZ8Wn0zPMmSnOuTpTh65Vz+EA0rMrw089wvkA==",
      "license": "Apache-2.0",
      "dependencies": {
        "@smithy/core": "^3.33.3",
        "@smithy/types": "^4.18.0",
        "tslib": "^2.6.2"
      },
      "engines": {
        "node": ">=18.0.0"
      }
    },
    "node_modules/@smithy/node-http-handler": {
      "version": "4.12.1",
      "resolved": "https://registry.npmjs.org/@smithy/node-http-handler/-/node-http-handler-4.12.1.tgz",
      "integrity": "sha512-ThMkboGeONWXAelq9FvGsuJC4rOi+qyC4/zhUF58xYpxUg5sQKx2VXZYJmtNjr4dSuBJ1HeJXETQILCz3wOHvw==",
      "license": "Apache-2.0",
      "dependencies": {
        "@smithy/core": "^3.33.3",
        "@smithy/types": "^4.18.0",
        "tslib": "^2.6.2"
      },
      "engines": {
        "node": ">=18.0.0"
      }
    },
    "node_modules/@smithy/signature-v4": {
      "version": "5.7.4",
      "resolved": "https://registry.npmjs.org/@smithy/signature-v4/-/signature-v4-5.7.4.tgz",
      "integrity": "sha512-tHy0K0VtqNd5Y7Y41h0a0Lhh0L1GzC08dTWg0F7vRJWFtTENg7IZikf3wQkanYIRdb7ngoIPMTmqgUi401fEeQ==",
      "license": "Apache-2.0",
      "dependencies": {
        "@smithy/core": "^3.35.0",
        "@smithy/types": "^4.19.0",
        "tslib": "^2.6.2"
      },
      "engines": {
        "node": ">=18.0.0"
      }
    },
    "node_modules/@smithy/types": {
      "version": "4.19.0",
      "resolved": "https://registry.npmjs.org/@smithy/types/-/types-4.19.0.tgz",
      "integrity": "sha512-r7jh49VJxGerfAcTQA6gXcKc+98zOp/tqRwzYjgOE+iSQsP6cEU1hq2QzbuipmP68QtYdY9wKEhiCQZIzHgZ4Q==",
      "license": "Apache-2.0",
      "dependencies": {
        "tslib": "^2.6.2"
      },
      "engines": {
        "node": ">=18.0.0"
      }
    },
    "node_modules/@sqltools/formatter": {
      "version": "1.2.5",
      "resolved": "https://registry.npmjs.org/@sqltools/formatter/-/formatter-1.2.5.tgz",
@@ -3055,6 +3481,12 @@
      "integrity": "sha512-MqTGEo5bj5t157U6fA/BiDynNkn0YknVdh48CMPkTSpFTVmvao5UQmm7uEF6xBEo7qIMAlY/JSleYaE6VOdpaA==",
      "license": "MIT"
    },
    "node_modules/@types/luxon": {
      "version": "3.7.6",
      "resolved": "https://registry.npmjs.org/@types/luxon/-/luxon-3.7.6.tgz",
      "integrity": "sha512-6KSjliQAXK8ZLgFQO4B7iE4Rpf/B3rItzCFuXezBY/XIAGxOdLd7vRNK9/StRPwiS/yJsVbB7HKpW46B8tcEuQ==",
      "license": "MIT"
    },
    "node_modules/@types/methods": {
      "version": "1.1.4",
      "resolved": "https://registry.npmjs.org/@types/methods/-/methods-1.1.4.tgz",
@@ -3062,6 +3494,16 @@
      "dev": true,
      "license": "MIT"
    },
    "node_modules/@types/multer": {
      "version": "2.3.0",
      "resolved": "https://registry.npmjs.org/@types/multer/-/multer-2.3.0.tgz",
      "integrity": "sha512-i7STIm9V4K2MPH4ZYMtrZAwNxs3kglk2LgleaTuB9pUXgADBcQYQuYMd7+6xgTIxfoggIkFA/DkkvycdZpIARA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@types/express": "*"
      }
    },
    "node_modules/@types/node": {
      "version": "24.13.6",
      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.6.tgz",
@@ -3883,6 +4325,12 @@
        "url": "https://opencollective.com/express"
      }
    },
    "node_modules/bowser": {
      "version": "2.14.1",
      "resolved": "https://registry.npmjs.org/bowser/-/bowser-2.14.1.tgz",
      "integrity": "sha512-tzPjzCxygAKWFOJP011oxFHs57HzIhOEracIgAePE4pqB3LikALKnSzUyU4MGs9/iCEUuHlAJTjTc5M+u7YEGg==",
      "license": "MIT"
    },
    "node_modules/brace-expansion": {
      "version": "5.0.12",
      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
@@ -4434,6 +4882,23 @@
        "url": "https://opencollective.com/express"
      }
    },
    "node_modules/cron": {
      "version": "4.4.0",
      "resolved": "https://registry.npmjs.org/cron/-/cron-4.4.0.tgz",
      "integrity": "sha512-fkdfq+b+AHI4cKdhZlppHveI/mgz2qpiYxcm+t5E5TsxX7QrLS1VE0+7GENEk9z0EeGPcpSciGv6ez24duWhwQ==",
      "license": "MIT",
      "dependencies": {
        "@types/luxon": "~3.7.0",
        "luxon": "~3.7.0"
      },
      "engines": {
        "node": ">=18.x"
      },
      "funding": {
        "type": "ko-fi",
        "url": "https://ko-fi.com/intcreator"
      }
    },
    "node_modules/cross-inspect": {
      "version": "1.0.1",
      "resolved": "https://registry.npmjs.org/cross-inspect/-/cross-inspect-1.0.1.tgz",
@@ -5005,6 +5470,12 @@
        "node": ">= 0.6"
      }
    },
    "node_modules/eventemitter2": {
      "version": "6.4.9",
      "resolved": "https://registry.npmjs.org/eventemitter2/-/eventemitter2-6.4.9.tgz",
      "integrity": "sha512-JEPTiaOt9f04oa6NOkc4aH+nVp5I3wEjpHbIPqfgCdD5v5bUzy7xQqwcVO2aDQgOWhI28da57HksMrzK9HlRxg==",
      "license": "MIT"
    },
    "node_modules/expect-type": {
      "version": "1.4.0",
      "resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.4.0.tgz",
@@ -6444,6 +6915,15 @@
        "url": "https://github.com/sponsors/wellwelwel"
      }
    },
    "node_modules/luxon": {
      "version": "3.7.2",
      "resolved": "https://registry.npmjs.org/luxon/-/luxon-3.7.2.tgz",
      "integrity": "sha512-vtEhXh/gNjI9Yg1u4jX/0YVPMvxzHuGgCm6tC5kZyb08yjGWGnqAjGJvcXbqQR2P3MyMEFnRbpcdFS6PBcLqew==",
      "license": "MIT",
      "engines": {
        "node": ">=12"
      }
    },
    "node_modules/magic-string": {
      "version": "1.4.1",
      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-1.4.1.tgz",
@@ -24,13 +24,16 @@
  "dependencies": {
    "@apollo/server": "^5.5.1",
    "@as-integrations/express5": "^1.1.2",
    "@aws-sdk/client-s3": "^3.1145.0",
    "@better-auth/prisma-adapter": "^1.7.2",
    "@nestjs/apollo": "^14.0.0",
    "@nestjs/common": "^12.0.1",
    "@nestjs/config": "^12.0.0",
    "@nestjs/core": "^12.0.1",
    "@nestjs/event-emitter": "^12.0.1",
    "@nestjs/graphql": "^14.0.0",
    "@nestjs/platform-express": "^12.0.1",
    "@nestjs/schedule": "^12.0.2",
    "@nestjs/typeorm": "^12.0.1",
    "@prisma/adapter-pg": "^7.10.0",
    "@prisma/client": "^7.10.0",
@@ -38,6 +41,7 @@
    "better-auth": "^1.7.2",
    "class-transformer": "^0.5.1",
    "class-validator": "^0.15.1",
    "file-type": "^22.1.1",
    "graphql": "^16.14.2",
    "nodemailer": "^10.0.0",
    "pg": "^8.23.0",
@@ -52,6 +56,7 @@
    "@nestjs/schematics": "^12.0.0",
    "@nestjs/testing": "^12.0.1",
    "@types/express": "^5.0.0",
    "@types/multer": "^2.3.0",
    "@types/node": "^24.0.0",
    "@types/pg": "^8.23.1",
    "@types/supertest": "^7.0.0",
@@ -0,0 +1,64 @@
 -- CreateTable
 CREATE TABLE "notification_device_token" (
    "id" TEXT NOT NULL,
    "userId" TEXT NOT NULL,
    "token" TEXT NOT NULL,
    "platform" TEXT NOT NULL,
    "createdAt" TIMESTAMPTZ(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
    "updatedAt" TIMESTAMPTZ(3) NOT NULL,
    CONSTRAINT "notification_device_token_pkey" PRIMARY KEY ("id")
 );
 -- CreateTable
 CREATE TABLE "notification_preference" (
    "id" TEXT NOT NULL,
    "userId" TEXT NOT NULL,
    "channel" TEXT NOT NULL,
    "enabled" BOOLEAN NOT NULL DEFAULT true,
    "updatedAt" TIMESTAMPTZ(3) NOT NULL,
    CONSTRAINT "notification_preference_pkey" PRIMARY KEY ("id")
 );
 -- CreateTable
 CREATE TABLE "notification_message" (
    "id" TEXT NOT NULL,
    "userId" TEXT NOT NULL,
    "channel" TEXT NOT NULL,
    "status" TEXT NOT NULL DEFAULT 'PENDING',
    "subject" TEXT,
    "content" TEXT NOT NULL,
    "error" TEXT,
    "sentAt" TIMESTAMPTZ(3),
    "createdAt" TIMESTAMPTZ(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
    CONSTRAINT "notification_message_pkey" PRIMARY KEY ("id")
 );
 -- CreateIndex
 CREATE INDEX "notification_device_token_userId_idx" ON "notification_device_token"("userId");
 -- CreateIndex
 CREATE UNIQUE INDEX "notification_device_token_userId_token_key" ON "notification_device_token"("userId", "token");
 -- CreateIndex
 CREATE UNIQUE INDEX "notification_preference_userId_channel_key" ON "notification_preference"("userId", "channel");
 -- CreateIndex
 CREATE INDEX "notification_message_userId_idx" ON "notification_message"("userId");
 -- CreateIndex
 CREATE INDEX "notification_message_status_idx" ON "notification_message"("status");
 -- CreateIndex
 CREATE INDEX "notification_message_createdAt_idx" ON "notification_message"("createdAt");
 -- AddForeignKey
 ALTER TABLE "notification_device_token" ADD CONSTRAINT "notification_device_token_userId_fkey" FOREIGN KEY ("userId") REFERENCES "user"("id") ON DELETE CASCADE ON UPDATE CASCADE;
 -- AddForeignKey
 ALTER TABLE "notification_preference" ADD CONSTRAINT "notification_preference_userId_fkey" FOREIGN KEY ("userId") REFERENCES "user"("id") ON DELETE CASCADE ON UPDATE CASCADE;
 -- AddForeignKey
 ALTER TABLE "notification_message" ADD CONSTRAINT "notification_message_userId_fkey" FOREIGN KEY ("userId") REFERENCES "user"("id") ON DELETE CASCADE ON UPDATE CASCADE;
@@ -0,0 +1,14 @@
 -- DropForeignKey
 ALTER TABLE "issue" DROP CONSTRAINT "issue_assigneeId_fkey";
 -- DropForeignKey
 ALTER TABLE "issue" DROP CONSTRAINT "issue_reporterId_fkey";
 -- AlterTable
 ALTER TABLE "issue" ALTER COLUMN "reporterId" DROP NOT NULL;
 -- AddForeignKey
 ALTER TABLE "issue" ADD CONSTRAINT "issue_assigneeId_fkey" FOREIGN KEY ("assigneeId") REFERENCES "user"("id") ON DELETE SET NULL ON UPDATE CASCADE;
 -- AddForeignKey
 ALTER TABLE "issue" ADD CONSTRAINT "issue_reporterId_fkey" FOREIGN KEY ("reporterId") REFERENCES "user"("id") ON DELETE SET NULL ON UPDATE CASCADE;
@@ -0,0 +1,25 @@
 -- CreateTable
 CREATE TABLE "comment" (
    "id" TEXT NOT NULL,
    "content" TEXT NOT NULL,
    "issueId" INTEGER NOT NULL,
    "authorId" TEXT,
    "editedAt" TIMESTAMPTZ(3),
    "deletedAt" TIMESTAMPTZ(3),
    "createdAt" TIMESTAMPTZ(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
    "updatedAt" TIMESTAMPTZ(3) NOT NULL,
    CONSTRAINT "comment_pkey" PRIMARY KEY ("id")
 );
 -- CreateIndex
 CREATE INDEX "comment_issueId_createdAt_idx" ON "comment"("issueId", "createdAt");
 -- CreateIndex
 CREATE INDEX "comment_authorId_idx" ON "comment"("authorId");
 -- AddForeignKey
 ALTER TABLE "comment" ADD CONSTRAINT "comment_issueId_fkey" FOREIGN KEY ("issueId") REFERENCES "issue"("id") ON DELETE CASCADE ON UPDATE CASCADE;
 -- AddForeignKey
 ALTER TABLE "comment" ADD CONSTRAINT "comment_authorId_fkey" FOREIGN KEY ("authorId") REFERENCES "user"("id") ON DELETE SET NULL ON UPDATE CASCADE;
@@ -0,0 +1,25 @@
 -- CreateTable
 CREATE TABLE "file" (
    "id" TEXT NOT NULL,
    "storageKey" TEXT NOT NULL,
    "fileName" TEXT NOT NULL,
    "mimeType" TEXT NOT NULL,
    "size" INTEGER NOT NULL,
    "uploaderId" TEXT,
    "createdAt" TIMESTAMPTZ(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
    CONSTRAINT "file_pkey" PRIMARY KEY ("id")
 );
 -- CreateIndex
 CREATE INDEX "file_uploaderId_idx" ON "file"("uploaderId");
 -- CreateIndex
 CREATE INDEX "file_createdAt_idx" ON "file"("createdAt");
 -- CreateIndex
 CREATE UNIQUE INDEX "file_storageKey_key" ON "file"("storageKey");
 -- AddForeignKey
 ALTER TABLE "file" ADD CONSTRAINT "file_uploaderId_fkey" FOREIGN KEY ("uploaderId") REFERENCES "user"("id") ON DELETE SET NULL ON UPDATE CASCADE;
@@ -0,0 +1,18 @@
 -- CreateTable
 CREATE TABLE "issue_attachment" (
    "issueId" INTEGER NOT NULL,
    "fileId" TEXT NOT NULL,
    "createdAt" TIMESTAMPTZ(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
    CONSTRAINT "issue_attachment_pkey" PRIMARY KEY ("issueId","fileId")
 );
 -- CreateIndex
 CREATE INDEX "issue_attachment_fileId_idx" ON "issue_attachment"("fileId");
 -- AddForeignKey
 ALTER TABLE "issue_attachment" ADD CONSTRAINT "issue_attachment_issueId_fkey" FOREIGN KEY ("issueId") REFERENCES "issue"("id") ON DELETE CASCADE ON UPDATE CASCADE;
 -- AddForeignKey
 ALTER TABLE "issue_attachment" ADD CONSTRAINT "issue_attachment_fileId_fkey" FOREIGN KEY ("fileId") REFERENCES "file"("id") ON DELETE CASCADE ON UPDATE CASCADE;
@@ -0,0 +1,18 @@
 -- CreateTable
 CREATE TABLE "comment_attachment" (
    "commentId" TEXT NOT NULL,
    "fileId" TEXT NOT NULL,
    "createdAt" TIMESTAMPTZ(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
    CONSTRAINT "comment_attachment_pkey" PRIMARY KEY ("commentId","fileId")
 );
 -- CreateIndex
 CREATE INDEX "comment_attachment_fileId_idx" ON "comment_attachment"("fileId");
 -- AddForeignKey
 ALTER TABLE "comment_attachment" ADD CONSTRAINT "comment_attachment_commentId_fkey" FOREIGN KEY ("commentId") REFERENCES "comment"("id") ON DELETE CASCADE ON UPDATE CASCADE;
 -- AddForeignKey
 ALTER TABLE "comment_attachment" ADD CONSTRAINT "comment_attachment_fileId_fkey" FOREIGN KEY ("fileId") REFERENCES "file"("id") ON DELETE CASCADE ON UPDATE CASCADE;
@@ -0,0 +1,28 @@
 -- CreateTable
 CREATE TABLE "issue_change" (
    "id" SERIAL NOT NULL,
    "issueId" INTEGER NOT NULL,
    "changeId" TEXT NOT NULL,
    "field" TEXT NOT NULL,
    "oldValue" TEXT,
    "newValue" TEXT,
    "actorId" TEXT,
    "changedAt" TIMESTAMPTZ(3) NOT NULL,
    CONSTRAINT "issue_change_pkey" PRIMARY KEY ("id")
 );
 -- CreateIndex
 CREATE INDEX "issue_change_issueId_changedAt_idx" ON "issue_change"("issueId", "changedAt");
 -- CreateIndex
 CREATE INDEX "issue_change_field_changedAt_idx" ON "issue_change"("field", "changedAt");
 -- CreateIndex
 CREATE INDEX "issue_change_actorId_idx" ON "issue_change"("actorId");
 -- AddForeignKey
 ALTER TABLE "issue_change" ADD CONSTRAINT "issue_change_issueId_fkey" FOREIGN KEY ("issueId") REFERENCES "issue"("id") ON DELETE CASCADE ON UPDATE CASCADE;
 -- AddForeignKey
 ALTER TABLE "issue_change" ADD CONSTRAINT "issue_change_actorId_fkey" FOREIGN KEY ("actorId") REFERENCES "user"("id") ON DELETE SET NULL ON UPDATE CASCADE;
@@ -8,19 +8,25 @@ datasource db {
 }
 model User {
-  id                 String          @id
+  id                       String                    @id
-  name               String
+  name                     String
-  email              String
+  email                    String
-  emailVerified      Boolean         @default(false)
+  emailVerified            Boolean                   @default(false)
-  image              String?
+  image                    String?
-  createdAt          DateTime        @default(now())
+  createdAt                DateTime                  @default(now())
-  updatedAt          DateTime        @updatedAt
+  updatedAt                DateTime                  @updatedAt
-  sessions           Session[]
+  sessions                 Session[]
-  accounts           Account[]
+  accounts                 Account[]
-  assigneeIssues     Issue[]         @relation(name: "assigneeIssues")
+  assigneeIssues           Issue[]                   @relation(name: "assigneeIssues")
-  reporterIssues     Issue[]         @relation(name: "reporterIssues")
+  reporterIssues           Issue[]                   @relation(name: "reporterIssues")
-  projects           Project[]
+  projects                 Project[]
-  projectMemberships ProjectMember[]
+  projectMemberships       ProjectMember[]
  notificationDeviceTokens NotificationDeviceToken[]
  notificationPreferences  NotificationPreference[]
  notificationMessages     NotificationMessage[]
  comments                 Comment[]
  uploadedFiles            File[]
  issueChanges             IssueChange[]
  @@unique([email])
  @@map("user")
@@ -76,21 +82,24 @@ model Verification {
 }
 model Issue {
-  id         Int       @id @default(autoincrement())
+  id          Int               @id @default(autoincrement())
-  key        String
+  key         String
-  title      String
+  title       String
-  content    String?
+  content     String?
-  status     String
+  status      String
-  priority   Int       @default(0)
+  priority    Int               @default(0)
-  assigneeId String?
+  assigneeId  String?
-  assignee   User?     @relation(name: "assigneeIssues", fields: [assigneeId], references: [id], onDelete: Cascade)
+  assignee    User?             @relation(name: "assigneeIssues", fields: [assigneeId], references: [id], onDelete: SetNull)
-  reporterId String
+  reporterId  String?
-  reporter   User      @relation(name: "reporterIssues", fields: [reporterId], references: [id], onDelete: Cascade)
+  reporter    User?             @relation(name: "reporterIssues", fields: [reporterId], references: [id], onDelete: SetNull)
-  projectId  String
+  projectId   String
-  project    Project   @relation(fields: [projectId], references: [id], onDelete: Cascade)
+  project     Project           @relation(fields: [projectId], references: [id], onDelete: Cascade)
-  dueDate    DateTime? @db.Timestamptz(3)
+  dueDate     DateTime?         @db.Timestamptz(3)
-  createdAt  DateTime  @default(now()) @db.Timestamptz(3)
+  comments    Comment[]
-  updatedAt  DateTime  @updatedAt @db.Timestamptz(3)
+  attachments IssueAttachment[]
  changes     IssueChange[]
  createdAt   DateTime          @default(now()) @db.Timestamptz(3)
  updatedAt   DateTime          @updatedAt @db.Timestamptz(3)
  @@index([status])
  @@index([assigneeId])
@@ -132,3 +141,154 @@ model ProjectMember {
  @@index([userId])
  @@map("project_member")
 }
 /// Push-токены устройств пользователя. Регистрируются напрямую клиентом,
 /// без участия остального приложения.
 model NotificationDeviceToken {
  id        String   @id @default(uuid(7))
  userId    String
  user      User     @relation(fields: [userId], references: [id], onDelete: Cascade)
  token     String
  platform  String // ios | android | web
  createdAt DateTime @default(now()) @db.Timestamptz(3)
  updatedAt DateTime @updatedAt @db.Timestamptz(3)
  @@unique([userId, token])
  @@index([userId])
  @@map("notification_device_token")
 }
 /// Включён ли у пользователя конкретный канал доставки уведомлений.
 /// Категорий нет — настройка одна на канал.
 /// Допустимые значения channel валидируются в коде (NotificationChannel VO),
 /// а не типом БД — расширение списка каналов не требует миграции.
 model NotificationPreference {
  id        String   @id @default(uuid(7))
  userId    String
  user      User     @relation(fields: [userId], references: [id], onDelete: Cascade)
  channel   String
  enabled   Boolean  @default(true)
  updatedAt DateTime @updatedAt @db.Timestamptz(3)
  @@unique([userId, channel])
  @@map("notification_preference")
 }
 /// Лог/история отправленных уведомлений — одна запись на попытку доставки
 /// по одному каналу. channel/status — строки, валидируются в коде
 /// (NotificationChannel/NotificationStatus VO), см. комментарий выше.
 model NotificationMessage {
  id        String    @id @default(uuid(7))
  userId    String
  user      User      @relation(fields: [userId], references: [id], onDelete: Cascade)
  channel   String
  status    String    @default("PENDING")
  subject   String?
  content   String
  error     String?
  sentAt    DateTime? @db.Timestamptz(3)
  createdAt DateTime  @default(now()) @db.Timestamptz(3)
  @@index([userId])
  @@index([status])
  @@index([createdAt])
  @@map("notification_message")
 }
 /// Комментарий к задаче. При удалении автора комментарий остаётся (authorId -> NULL).
 /// deletedAt — мягкое удаление, editedAt — время последней правки текста.
 model Comment {
  id          String              @id @default(uuid(7))
  content     String
  issueId     Int
  issue       Issue               @relation(fields: [issueId], references: [id], onDelete: Cascade)
  authorId    String?
  author      User?               @relation(fields: [authorId], references: [id], onDelete: SetNull)
  editedAt    DateTime?           @db.Timestamptz(3)
  deletedAt   DateTime?           @db.Timestamptz(3)
  createdAt   DateTime            @default(now()) @db.Timestamptz(3)
  updatedAt   DateTime            @updatedAt @db.Timestamptz(3)
  attachments CommentAttachment[]
  @@index([issueId, createdAt])
  @@index([authorId])
  @@map("comment")
 }
 /// Загруженный файл. Ничего не знает о владельце: к задачам, комментариям и т.п.
 /// файлы привязываются через таблицы связей в модулях-владельцах.
 /// Файл, на который никто не ссылается, считается сиротой и удаляется GC.
 /// storageKey — ключ объекта в хранилище, имя от пользователя в него не попадает.
 model File {
  id         String   @id @default(uuid(7))
  storageKey String
  fileName   String
  mimeType   String
  size       Int
  uploaderId String?
  uploader   User?    @relation(fields: [uploaderId], references: [id], onDelete: SetNull)
  createdAt  DateTime @default(now()) @db.Timestamptz(3)
  issueAttachments   IssueAttachment[]
  commentAttachments CommentAttachment[]
  @@unique([storageKey])
  @@index([uploaderId])
  @@index([createdAt])
  @@map("file")
 }
 /// Вложение задачи — связь задачи с файлом. Удаление задачи или файла
 /// удаляет связь каскадом; сам файл, оставшийся без связей, удалит GC.
 model IssueAttachment {
  issueId   Int
  issue     Issue    @relation(fields: [issueId], references: [id], onDelete: Cascade)
  fileId    String
  file      File     @relation(fields: [fileId], references: [id], onDelete: Cascade)
  createdAt DateTime @default(now()) @db.Timestamptz(3)
  @@id([issueId, fileId])
  @@index([fileId])
  @@map("issue_attachment")
 }
 /// Вложение комментария — связь комментария с файлом. Управляется вместе
 /// с комментарием (fileIds в create/update); при мягком удалении комментария
 /// связи снимаются, чтобы файлы забрал GC.
 model CommentAttachment {
  commentId String
  comment   Comment  @relation(fields: [commentId], references: [id], onDelete: Cascade)
  fileId    String
  file      File     @relation(fields: [fileId], references: [id], onDelete: Cascade)
  createdAt DateTime @default(now()) @db.Timestamptz(3)
  @@id([commentId, fileId])
  @@index([fileId])
  @@map("comment_attachment")
 }
 /// История изменений задачи — одна строка на изменённое поле.
 /// Строки одного сохранения задачи объединены общим changeId.
 /// field: created | title | content | status | priority | assignee | dueDate
 /// (валидируется в коде, см. ISSUE_CHANGE_FIELDS). Значения — строки:
 /// priority — число, dueDate — ISO-дата, assignee — id пользователя.
 /// При создании задачи пишутся две строки: created и status null -> OPEN,
 /// поэтому статус задачи на любой момент восстанавливается по строкам status.
 /// У задач, созданных до появления истории, строк нет — в статистику они не попадают.
 model IssueChange {
  id        Int      @id @default(autoincrement())
  issueId   Int
  issue     Issue    @relation(fields: [issueId], references: [id], onDelete: Cascade)
  changeId  String
  field     String
  oldValue  String?
  newValue  String?
  actorId   String?
  actor     User?    @relation(fields: [actorId], references: [id], onDelete: SetNull)
  changedAt DateTime @db.Timestamptz(3)
  @@index([issueId, changedAt])
  @@index([field, changedAt])
  @@index([actorId])
  @@map("issue_change")
 }
@@ -5,9 +5,16 @@ import { IssueModule } from './modules/issue/issue.module.js';
 import { ProjectModule } from './modules/project/project.module.js';
 import { UserModule } from './modules/user/user.module.js';
 import { StatusModule } from './modules/status/status.module.js';
 import { NotificationModule } from './modules/notification/notification.module.js';
 import { CommentModule } from './modules/comment/comment.module.js';
 import { FileModule } from './modules/file/file.module.js';
 import { IssueAttachmentModule } from './modules/issue-attachment/issue-attachment.module.js';
 import { HistoryModule } from './modules/history/history.module.js';
 import { AuthModule } from '@thallesp/nestjs-better-auth';
 import { auth } from './lib/auth.js';
 import { ConfigModule } from '@nestjs/config';
 import { EventEmitterModule } from '@nestjs/event-emitter';
 import { ScheduleModule } from '@nestjs/schedule';
 import { GraphQLModule } from '@nestjs/graphql';
 import { ApolloDriver, type ApolloDriverConfig } from '@nestjs/apollo';
 import { join } from 'node:path';
@@ -18,6 +25,11 @@ import { join } from 'node:path';
      isGlobal: true,
      cache: true,
    }),
    // Внутрипроцессная шина доменных событий. Notification-модуль слушает
    // события через неё, не завязываясь на модули, которые их порождают.
    EventEmitterModule.forRoot(),
    // Периодические задачи (@Cron), например сборка файлов-сирот в FileModule
    ScheduleModule.forRoot(),
    GraphQLModule.forRoot<ApolloDriverConfig>({
      driver: ApolloDriver,
      autoSchemaFile: join(process.cwd(), 'src/schema.gql'),
@@ -40,6 +52,11 @@ import { join } from 'node:path';
    ProjectModule,
    UserModule,
    StatusModule,
    NotificationModule,
    CommentModule,
    FileModule,
    IssueAttachmentModule,
    HistoryModule,
  ],
  controllers: [AppController],
  providers: [AppService],
@@ -1,6 +1,7 @@
-import { CallHandler, ExecutionContext, Injectable, NestInterceptor } from '@nestjs/common';
+import { CallHandler, ExecutionContext, Injectable, NestInterceptor, StreamableFile } from '@nestjs/common';
 import { Observable } from 'rxjs';
 import { map } from 'rxjs/operators';
 import { SSE_METADATA } from '@nestjs/common/constants.js';
 import { PaginationMeta } from '../interfaces/pagination-meta.interface.js';
 export interface ResponseEnvelope<T> {
@@ -30,18 +31,26 @@ export class TransformResponseInterceptor<T> implements NestInterceptor<
    context: ExecutionContext,
    next: CallHandler<T>,
  ): Observable<T | ResponseEnvelope<T> | PaginatedResponseEnvelope<T>> {
    // GraphQL уже оборачивает ответ в {data, errors} на уровне транспорта —
    // конверт применяем только к HTTP (REST) контексту, чтобы не задваивать его.
    if (context.getType() !== 'http') {
      return next.handle();
    }
    // SSE-обработчик возвращает поток MessageEvent ({type, data, id}) — его
    // сериализует сам Nest. Обёртка в {data, code} спрятала бы type внутрь data,
    // и клиентский addEventListener('<type>') перестал бы срабатывать.
    if (Reflect.getMetadata(SSE_METADATA, context.getHandler())) {
      return next.handle();
    }
    const response = context.switchToHttp().getResponse();
    return next.handle().pipe(
      map((result) => {
-        // Пагинированные ответы ({data, meta}) разворачиваем на верхний
+        // Файл отдаётся потоком как есть — обёртка {data, code} сломала бы скачивание
-        // уровень конверта, а не оборачиваем повторно как data.data.
+        if (result instanceof StreamableFile) {
          return result;
        }
        if (isPaginatedResult<T>(result)) {
          return {
            data: result.data ?? null,
@@ -0,0 +1,18 @@
 import { UserDto } from '../../../user/application/dto/user.dto.js';
 import { FileDto } from '../../../file/application/dto/file.dto.js';
 export class CommentDto {
  id: string;
  issueId: number;
  authorId: string | null;
  /** null — автор удалил аккаунт */
  author: UserDto | null;
  /** null у удалённого комментария — текст наружу не отдаём */
  content: string | null;
  /** Пусто у удалённого комментария. Скачивание — GET /files/:id/download */
  attachments: FileDto[];
  editedAt: Date | null;
  deletedAt: Date | null;
  createdAt: Date;
  updatedAt: Date;
 }
@@ -0,0 +1,74 @@
 import { describe, expect, it } from 'vitest';
 import { Comment } from '../../domain/entities/comment.entity.js';
 import { CommentApplicationMapper } from './comment-application.mapper.js';
 import { UserDto } from '../../../user/application/dto/user.dto.js';
 const author: UserDto = {
  id: 'user-1',
  name: 'User 1',
  email: 'user-1@example.com',
  emailVerified: true,
  image: null,
  createdAt: new Date('2026-01-01T00:00:00.000Z'),
  updatedAt: new Date('2026-01-01T00:00:00.000Z'),
 };
 const buildComment = (deletedAt: Date | null = null, authorId: string | null = 'user-1', fileIds: string[] = []) =>
  Comment.reconstitute({
    id: 'comment-1',
    content: 'Secret',
    issueId: 1,
    authorId,
    fileIds,
    editedAt: null,
    deletedAt,
    createdAt: new Date('2026-01-01T00:00:00.000Z'),
    updatedAt: new Date('2026-01-01T00:00:00.000Z'),
  });
 describe('CommentApplicationMapper', () => {
  it('expands the author', () => {
    const dto = CommentApplicationMapper.toDto(buildComment(), new Map([[author.id, author]]));
    expect(dto.author).toEqual(author);
    expect(dto.content).toBe('Secret');
  });
  it('hides content of a deleted comment', () => {
    const dto = CommentApplicationMapper.toDto(buildComment(new Date()), new Map([[author.id, author]]));
    expect(dto.content).toBeNull();
    expect(dto.deletedAt).toBeInstanceOf(Date);
  });
  it('returns null author when the author account is deleted', () => {
    const dto = CommentApplicationMapper.toDto(buildComment(null, null), new Map());
    expect(dto.authorId).toBeNull();
    expect(dto.author).toBeNull();
  });
  it('expands attachments and skips files that no longer exist', () => {
    const file = {
      id: 'file-1',
      fileName: 'a.png',
      mimeType: 'image/png',
      size: 1,
      uploaderId: 'user-1',
      createdAt: new Date('2026-01-01T00:00:00.000Z'),
    };
    const dto = CommentApplicationMapper.toDto(
      buildComment(null, 'user-1', ['file-1', 'gone']),
      new Map(),
      new Map([[file.id, file]]),
    );
    expect(dto.attachments).toEqual([file]);
  });
  it('hides attachments of a deleted comment', () => {
    const dto = CommentApplicationMapper.toDto(buildComment(new Date(), 'user-1', ['file-1']), new Map(), new Map());
    expect(dto.attachments).toEqual([]);
  });
 });
@@ -0,0 +1,31 @@
 import { Comment } from '../../domain/entities/comment.entity.js';
 import { CommentDto } from '../dto/comment.dto.js';
 import { UserDto } from '../../../user/application/dto/user.dto.js';
 import { FileDto } from '../../../file/application/dto/file.dto.js';
 export class CommentApplicationMapper {
  static toDto(
    comment: Comment,
    usersById: ReadonlyMap<string, UserDto>,
    filesById: ReadonlyMap<string, FileDto> = new Map(),
  ): CommentDto {
    return {
      id: comment.id as string,
      issueId: comment.issueId,
      authorId: comment.authorId,
      author: comment.authorId ? (usersById.get(comment.authorId) ?? null) : null,
      content: comment.isDeleted ? null : comment.content,
      // Файл могли удалить между запросами — такое вложение просто не показываем
      attachments: comment.isDeleted
        ? []
        : comment.fileIds.flatMap((fileId) => {
            const file = filesById.get(fileId);
            return file ? [file] : [];
          }),
      editedAt: comment.editedAt,
      deletedAt: comment.deletedAt,
      createdAt: comment.createdAt,
      updatedAt: comment.updatedAt,
    };
  }
 }
@@ -0,0 +1,42 @@
 import { Inject, Injectable } from '@nestjs/common';
 import { COMMENT_REPOSITORY, type ICommentRepository } from '../../domain/repositories/comment.repository.interface.js';
 import {
  ISSUE_REPOSITORY,
  type IIssueRepository,
 } from '../../../issue/domain/repositories/issue.repository.interface.js';
 import { Comment } from '../../domain/entities/comment.entity.js';
 import { CommentNotFoundException } from '../../domain/exceptions/comment-not-found.exception.js';
@Injectable()
 export class CommentAccessService {
  constructor(
    @Inject(COMMENT_REPOSITORY)
    private readonly commentRepository: ICommentRepository,
    @Inject(ISSUE_REPOSITORY)
    private readonly issueRepository: IIssueRepository,
  ) {}
  /** Видна ли задача пользователю (то же правило, что в IIssueRepository.findById) */
  async isIssueVisible(issueId: number, userId: string): Promise<boolean> {
    return (await this.issueRepository.findById(issueId, userId)) !== null;
  }
  /**
   * Возвращает неудалённый комментарий, если его задача видна пользователю.
   * Иначе — CommentNotFoundException, чтобы не раскрывать существование
   * комментариев к чужим задачам.
   */
  async getVisibleComment(id: string, userId: string): Promise<Comment> {
    const comment = await this.commentRepository.findById(id);
    if (!comment || comment.isDeleted) {
      throw new CommentNotFoundException(id);
    }
    const issue = await this.issueRepository.findById(comment.issueId, userId);
    if (!issue) {
      throw new CommentNotFoundException(id);
    }
    return comment;
  }
 }
@@ -0,0 +1,40 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import type { ICommentRepository } from '../../domain/repositories/comment.repository.interface.js';
 import type { IIssueRepository } from '../../../issue/domain/repositories/issue.repository.interface.js';
 import { FileOwnerRegistry } from '../../../file/application/services/file-owner.registry.js';
 import { CommentAttachmentFileOwnerService } from './comment-attachment-file-owner.service.js';
 import { buildIssue, mockCommentRepository, mockIssueRepository } from '../use-cases/test-helpers.js';
 describe('CommentAttachmentFileOwnerService', () => {
  let commentRepository: ICommentRepository;
  let issueRepository: IIssueRepository;
  let registry: FileOwnerRegistry;
  beforeEach(() => {
    commentRepository = mockCommentRepository();
    issueRepository = mockIssueRepository();
    registry = new FileOwnerRegistry();
    new CommentAttachmentFileOwnerService(commentRepository, issueRepository, registry).onModuleInit();
  });
  it('registers itself, so GC keeps files attached to comments', async () => {
    vi.mocked(commentRepository.findReferencedFileIds).mockResolvedValue(['a']);
    expect(await registry.findReferenced(['a', 'b'])).toEqual(new Set(['a']));
  });
  it('makes a file visible to users who see the issue of its comment', async () => {
    vi.mocked(commentRepository.findIssueIdsByAttachedFile).mockResolvedValue([1]);
    vi.mocked(issueRepository.findById).mockResolvedValue(buildIssue());
    expect(await registry.isVisibleThroughAnyOwner('file-1', 'user-2')).toBe(true);
    expect(issueRepository.findById).toHaveBeenCalledWith(1, 'user-2');
  });
  it('hides a file when the issue is not visible', async () => {
    vi.mocked(commentRepository.findIssueIdsByAttachedFile).mockResolvedValue([1]);
    vi.mocked(issueRepository.findById).mockResolvedValue(null);
    expect(await registry.isVisibleThroughAnyOwner('file-1', 'user-3')).toBe(false);
  });
 });
@@ -0,0 +1,44 @@
 import { Inject, Injectable, type OnModuleInit } from '@nestjs/common';
 import { COMMENT_REPOSITORY, type ICommentRepository } from '../../domain/repositories/comment.repository.interface.js';
 import {
  ISSUE_REPOSITORY,
  type IIssueRepository,
 } from '../../../issue/domain/repositories/issue.repository.interface.js';
 import { FileOwnerRegistry, type FileOwner } from '../../../file/application/services/file-owner.registry.js';
 /**
 * Регистрирует комментарии как владельца файлов: без этого GC file-модуля
 * считал бы прикреплённые к комментариям файлы сиротами и удалял их.
 */
@Injectable()
 export class CommentAttachmentFileOwnerService implements FileOwner, OnModuleInit {
  readonly name = 'comment';
  constructor(
    @Inject(COMMENT_REPOSITORY)
    private readonly commentRepository: ICommentRepository,
    @Inject(ISSUE_REPOSITORY)
    private readonly issueRepository: IIssueRepository,
    private readonly fileOwners: FileOwnerRegistry,
  ) {}
  onModuleInit(): void {
    this.fileOwners.register(this);
  }
  findReferenced(fileIds: string[]): Promise<string[]> {
    return this.commentRepository.findReferencedFileIds(fileIds);
  }
  /** Файл виден, если видна задача хоть одного неудалённого комментария с ним */
  async isVisibleThrough(fileId: string, userId: string): Promise<boolean> {
    const issueIds = await this.commentRepository.findIssueIdsByAttachedFile(fileId);
    for (const issueId of issueIds) {
      if (await this.issueRepository.findById(issueId, userId)) {
        return true;
      }
    }
    return false;
  }
 }
@@ -0,0 +1,28 @@
 import { Injectable } from '@nestjs/common';
 import { Observable, Subject } from 'rxjs';
 import { CommentDto } from '../dto/comment.dto.js';
 export type CommentEventType = 'comment.created' | 'comment.updated' | 'comment.deleted';
 export interface CommentEvent {
  type: CommentEventType;
  comment: CommentDto;
 }
 /**
 * In-process шина событий comment-модуля для SSE-подписчиков
 * (по аналогии с IssueEventsService). Работает в пределах одного
 * инстанса приложения — для нескольких инстансов понадобится Redis pub/sub.
 */
@Injectable()
 export class CommentEventsService {
  private readonly events$ = new Subject<CommentEvent>();
  emit(type: CommentEventType, comment: CommentDto): void {
    this.events$.next({ type, comment });
  }
  onEvents(): Observable<CommentEvent> {
    return this.events$.asObservable();
  }
 }
@@ -0,0 +1,38 @@
 import { Injectable } from '@nestjs/common';
 import { Comment } from '../../domain/entities/comment.entity.js';
 import { CommentDto } from '../dto/comment.dto.js';
 import { CommentApplicationMapper } from '../mappers/comment-application.mapper.js';
 import { GetUsersUseCase } from '../../../user/application/use-cases/get-users/get-users.use-case.js';
 import { GetUsersQuery } from '../../../user/application/use-cases/get-users/get-users.query.js';
 import { GetFilesUseCase } from '../../../file/application/use-cases/get-files/get-files.use-case.js';
 import { GetFilesQuery } from '../../../file/application/use-cases/get-files/get-files.query.js';
 /** Раскрывает автора и вложения комментария (или списка комментариев) */
@Injectable()
 export class CommentExpanderService {
  constructor(
    private readonly getUsersUseCase: GetUsersUseCase,
    private readonly getFilesUseCase: GetFilesUseCase,
  ) {}
  async expand(comment: Comment): Promise<CommentDto> {
    const [dto] = await this.expandAll([comment]);
    return dto!;
  }
  async expandAll(comments: Comment[]): Promise<CommentDto[]> {
    if (comments.length === 0) return [];
    const userIds = [...new Set(comments.map((comment) => comment.authorId).filter((id): id is string => Boolean(id)))];
    const fileIds = comments.flatMap((comment) => comment.fileIds);
    const [users, files] = await Promise.all([
      userIds.length > 0 ? this.getUsersUseCase.execute(new GetUsersQuery(userIds)) : [],
      fileIds.length > 0 ? this.getFilesUseCase.execute(new GetFilesQuery(fileIds)) : [],
    ]);
    const usersById = new Map(users.map((user) => [user.id, user]));
    const filesById = new Map(files.map((file) => [file.id, file]));
    return comments.map((comment) => CommentApplicationMapper.toDto(comment, usersById, filesById));
  }
 }
@@ -0,0 +1,9 @@
 export class CreateCommentCommand {
  constructor(
    public readonly issueId: number,
    public readonly authorId: string,
    public readonly content: string,
    /** Файлы, заранее загруженные автором через POST /files */
    public readonly fileIds: string[] = [],
  ) {}
 }
@@ -0,0 +1,88 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import type { ICommentRepository } from '../../../domain/repositories/comment.repository.interface.js';
 import type { IIssueRepository } from '../../../../issue/domain/repositories/issue.repository.interface.js';
 import { IssueNotFoundException } from '../../../../issue/domain/exceptions/issue-not-found.exception.js';
 import { Comment } from '../../../domain/entities/comment.entity.js';
 import { CommentEventsService } from '../../services/comment-events.service.js';
 import { CreateCommentUseCase } from './create-comment.use-case.js';
 import { CreateCommentCommand } from './create-comment.command.js';
 import { FileForbiddenException } from '../../../../file/domain/exceptions/file-forbidden.exception.js';
 import {
  buildIssue,
  mockCommentExpander,
  mockCommentRepository,
  mockFileAccess,
  mockIssueRepository,
 } from '../test-helpers.js';
 describe('CreateCommentUseCase', () => {
  let commentRepository: ICommentRepository;
  let issueRepository: IIssueRepository;
  let commentEventsService: CommentEventsService;
  let useCase: CreateCommentUseCase;
  beforeEach(() => {
    commentRepository = mockCommentRepository();
    issueRepository = mockIssueRepository();
    commentEventsService = new CommentEventsService();
    useCase = new CreateCommentUseCase(
      commentRepository,
      issueRepository,
      mockCommentExpander(),
      commentEventsService,
      mockFileAccess({ foreign: new FileForbiddenException('foreign') }),
    );
    vi.mocked(commentRepository.create).mockImplementation(async (comment: Comment) =>
      Comment.reconstitute({
        id: 'comment-1',
        content: comment.content,
        issueId: comment.issueId,
        authorId: comment.authorId,
        fileIds: [...comment.fileIds],
        editedAt: null,
        deletedAt: null,
        createdAt: comment.createdAt,
        updatedAt: comment.updatedAt,
      }),
    );
  });
  it('creates a comment on a visible issue and emits comment.created', async () => {
    vi.mocked(issueRepository.findById).mockResolvedValue(buildIssue());
    const received: unknown[] = [];
    commentEventsService.onEvents().subscribe((event) => received.push(event));
    const dto = await useCase.execute(new CreateCommentCommand(1, 'user-1', 'Hello'));
    expect(issueRepository.findById).toHaveBeenCalledWith(1, 'user-1');
    expect(dto).toMatchObject({ id: 'comment-1', issueId: 1, authorId: 'user-1', content: 'Hello' });
    expect(received).toEqual([{ type: 'comment.created', comment: dto }]);
  });
  it('throws IssueNotFoundException when the issue is not visible to the user', async () => {
    vi.mocked(issueRepository.findById).mockResolvedValue(null);
    await expect(useCase.execute(new CreateCommentCommand(1, 'user-2', 'Hello'))).rejects.toThrow(
      IssueNotFoundException,
    );
    expect(commentRepository.create).not.toHaveBeenCalled();
  });
  it('saves own files as attachments', async () => {
    vi.mocked(issueRepository.findById).mockResolvedValue(buildIssue());
    await useCase.execute(new CreateCommentCommand(1, 'user-1', 'Hello', ['b', 'a', 'b']));
    expect(vi.mocked(commentRepository.create).mock.calls[0]![0].fileIds).toEqual(['a', 'b']);
  });
  it('does not create the comment when a file is not attachable', async () => {
    vi.mocked(issueRepository.findById).mockResolvedValue(buildIssue());
    await expect(useCase.execute(new CreateCommentCommand(1, 'user-1', 'Hello', ['a', 'foreign']))).rejects.toThrow(
      FileForbiddenException,
    );
    expect(commentRepository.create).not.toHaveBeenCalled();
  });
 });
@@ -0,0 +1,56 @@
 import { Inject, Injectable } from '@nestjs/common';
 import {
  COMMENT_REPOSITORY,
  type ICommentRepository,
 } from '../../../domain/repositories/comment.repository.interface.js';
 import {
  ISSUE_REPOSITORY,
  type IIssueRepository,
 } from '../../../../issue/domain/repositories/issue.repository.interface.js';
 import { IssueNotFoundException } from '../../../../issue/domain/exceptions/issue-not-found.exception.js';
 import { Comment } from '../../../domain/entities/comment.entity.js';
 import { CreateCommentCommand } from './create-comment.command.js';
 import { CommentDto } from '../../dto/comment.dto.js';
 import { CommentExpanderService } from '../../services/comment-expander.service.js';
 import { CommentEventsService } from '../../services/comment-events.service.js';
 import { FileAccessService } from '../../../../file/application/services/file-access.service.js';
@Injectable()
 export class CreateCommentUseCase {
  constructor(
    @Inject(COMMENT_REPOSITORY)
    private readonly commentRepository: ICommentRepository,
    @Inject(ISSUE_REPOSITORY)
    private readonly issueRepository: IIssueRepository,
    private readonly commentExpander: CommentExpanderService,
    private readonly commentEventsService: CommentEventsService,
    private readonly fileAccess: FileAccessService,
  ) {}
  async execute(command: CreateCommentCommand): Promise<CommentDto> {
    // Комментировать можно только видимую пользователю задачу
    const issue = await this.issueRepository.findById(command.issueId, command.authorId);
    if (!issue) {
      throw new IssueNotFoundException(command.issueId);
    }
    const comment = Comment.create({
      issueId: command.issueId,
      authorId: command.authorId,
      content: command.content,
      fileIds: command.fileIds,
    });
    // Прикреплять можно только свои файлы (см. FileAccessService.getAttachableFile)
    for (const fileId of comment.fileIds) {
      await this.fileAccess.getAttachableFile(fileId, command.authorId);
    }
    const saved = await this.commentRepository.create(comment);
    const dto = await this.commentExpander.expand(saved);
    this.commentEventsService.emit('comment.created', dto);
    return dto;
  }
 }
@@ -0,0 +1,6 @@
 export class DeleteCommentCommand {
  constructor(
    public readonly id: string,
    public readonly userId: string,
  ) {}
 }
@@ -0,0 +1,78 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import type { ICommentRepository } from '../../../domain/repositories/comment.repository.interface.js';
 import type { IIssueRepository } from '../../../../issue/domain/repositories/issue.repository.interface.js';
 import { Comment } from '../../../domain/entities/comment.entity.js';
 import { CommentNotFoundException } from '../../../domain/exceptions/comment-not-found.exception.js';
 import { CommentForbiddenException } from '../../../domain/exceptions/comment-forbidden.exception.js';
 import { CommentEventsService, type CommentEvent } from '../../services/comment-events.service.js';
 import { CommentAccessService } from '../../services/comment-access.service.js';
 import { DeleteCommentUseCase } from './delete-comment.use-case.js';
 import { DeleteCommentCommand } from './delete-comment.command.js';
 import {
  buildComment,
  buildIssue,
  mockCommentExpander,
  mockCommentRepository,
  mockIssueRepository,
 } from '../test-helpers.js';
 describe('DeleteCommentUseCase', () => {
  let commentRepository: ICommentRepository;
  let issueRepository: IIssueRepository;
  let commentEventsService: CommentEventsService;
  let useCase: DeleteCommentUseCase;
  beforeEach(() => {
    commentRepository = mockCommentRepository();
    issueRepository = mockIssueRepository();
    commentEventsService = new CommentEventsService();
    useCase = new DeleteCommentUseCase(
      commentRepository,
      new CommentAccessService(commentRepository, issueRepository),
      mockCommentExpander(),
      commentEventsService,
    );
    vi.mocked(issueRepository.findById).mockResolvedValue(buildIssue());
  });
  it('soft-deletes the comment and emits comment.deleted without content', async () => {
    vi.mocked(commentRepository.findById).mockResolvedValue(buildComment());
    const received: CommentEvent[] = [];
    commentEventsService.onEvents().subscribe((event) => received.push(event));
    await useCase.execute(new DeleteCommentCommand('comment-1', 'user-1'));
    const saved = vi.mocked(commentRepository.update).mock.calls[0]![0] as Comment;
    expect(saved.isDeleted).toBe(true);
    expect(received).toHaveLength(1);
    expect(received[0]!.type).toBe('comment.deleted');
    expect(received[0]!.comment.content).toBeNull();
  });
  it('drops attachments so GC can collect the files', async () => {
    const comment = buildComment();
    comment.edit('Original', 'user-1', ['file-1']);
    vi.mocked(commentRepository.findById).mockResolvedValue(comment);
    await useCase.execute(new DeleteCommentCommand('comment-1', 'user-1'));
    expect(vi.mocked(commentRepository.update).mock.calls[0]![0].fileIds).toEqual([]);
  });
  it('throws CommentForbiddenException for a non-author', async () => {
    vi.mocked(commentRepository.findById).mockResolvedValue(buildComment());
    await expect(useCase.execute(new DeleteCommentCommand('comment-1', 'user-2'))).rejects.toThrow(
      CommentForbiddenException,
    );
    expect(commentRepository.update).not.toHaveBeenCalled();
  });
  it('throws CommentNotFoundException when the comment does not exist', async () => {
    vi.mocked(commentRepository.findById).mockResolvedValue(null);
    await expect(useCase.execute(new DeleteCommentCommand('missing', 'user-1'))).rejects.toThrow(
      CommentNotFoundException,
    );
  });
 });
@@ -0,0 +1,30 @@
 import { Inject, Injectable } from '@nestjs/common';
 import {
  COMMENT_REPOSITORY,
  type ICommentRepository,
 } from '../../../domain/repositories/comment.repository.interface.js';
 import { DeleteCommentCommand } from './delete-comment.command.js';
 import { CommentExpanderService } from '../../services/comment-expander.service.js';
 import { CommentEventsService } from '../../services/comment-events.service.js';
 import { CommentAccessService } from '../../services/comment-access.service.js';
 /** Мягкое удаление: проставляет deletedAt, запись остаётся в ленте */
@Injectable()
 export class DeleteCommentUseCase {
  constructor(
    @Inject(COMMENT_REPOSITORY)
    private readonly commentRepository: ICommentRepository,
    private readonly commentAccess: CommentAccessService,
    private readonly commentExpander: CommentExpanderService,
    private readonly commentEventsService: CommentEventsService,
  ) {}
  async execute(command: DeleteCommentCommand): Promise<void> {
    const comment = await this.commentAccess.getVisibleComment(command.id, command.userId);
    comment.delete(command.userId);
    await this.commentRepository.update(comment);
    this.commentEventsService.emit('comment.deleted', await this.commentExpander.expand(comment));
  }
 }
@@ -0,0 +1,11 @@
 import type { CommentListDirection } from '../../../domain/repositories/comment.repository.interface.js';
 export class ListCommentsQuery {
  constructor(
    public readonly issueId: number,
    public readonly userId: string,
    public readonly limit: number,
    public readonly cursor?: string,
    public readonly direction: CommentListDirection = 'forward',
  ) {}
 }
@@ -0,0 +1,65 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import type { ICommentRepository } from '../../../domain/repositories/comment.repository.interface.js';
 import type { IIssueRepository } from '../../../../issue/domain/repositories/issue.repository.interface.js';
 import { IssueNotFoundException } from '../../../../issue/domain/exceptions/issue-not-found.exception.js';
 import { ListCommentsUseCase } from './list-comments.use-case.js';
 import { ListCommentsQuery } from './list-comments.query.js';
 import {
  buildComment,
  buildIssue,
  mockCommentExpander,
  mockCommentRepository,
  mockIssueRepository,
 } from '../test-helpers.js';
 describe('ListCommentsUseCase', () => {
  let commentRepository: ICommentRepository;
  let issueRepository: IIssueRepository;
  let useCase: ListCommentsUseCase;
  beforeEach(() => {
    commentRepository = mockCommentRepository();
    issueRepository = mockIssueRepository();
    useCase = new ListCommentsUseCase(commentRepository, issueRepository, mockCommentExpander());
  });
  it('forwards pagination params and returns the next cursor', async () => {
    vi.mocked(issueRepository.findById).mockResolvedValue(buildIssue());
    vi.mocked(commentRepository.findByIssue).mockResolvedValue({
      list: [buildComment({ id: 'comment-2' })],
      nextCursor: 'comment-2',
    });
    const result = await useCase.execute(new ListCommentsQuery(1, 'user-1', 1, 'comment-1'));
    expect(commentRepository.findByIssue).toHaveBeenCalledWith({
      issueId: 1,
      limit: 1,
      cursor: 'comment-1',
      direction: 'forward',
    });
    expect(result.list.map((comment) => comment.id)).toEqual(['comment-2']);
    expect(result.nextCursor).toBe('comment-2');
  });
  it('forwards the backward direction for chat-style paging', async () => {
    vi.mocked(issueRepository.findById).mockResolvedValue(buildIssue());
    vi.mocked(commentRepository.findByIssue).mockResolvedValue({ list: [], nextCursor: null });
    await useCase.execute(new ListCommentsQuery(1, 'user-1', 20, 'comment-5', 'backward'));
    expect(commentRepository.findByIssue).toHaveBeenCalledWith({
      issueId: 1,
      limit: 20,
      cursor: 'comment-5',
      direction: 'backward',
    });
  });
  it('throws IssueNotFoundException when the issue is not visible to the user', async () => {
    vi.mocked(issueRepository.findById).mockResolvedValue(null);
    await expect(useCase.execute(new ListCommentsQuery(1, 'user-2', 50))).rejects.toThrow(IssueNotFoundException);
    expect(commentRepository.findByIssue).not.toHaveBeenCalled();
  });
 });
@@ -0,0 +1,40 @@
 import { Inject, Injectable } from '@nestjs/common';
 import {
  COMMENT_REPOSITORY,
  type ICommentRepository,
 } from '../../../domain/repositories/comment.repository.interface.js';
 import {
  ISSUE_REPOSITORY,
  type IIssueRepository,
 } from '../../../../issue/domain/repositories/issue.repository.interface.js';
 import { IssueNotFoundException } from '../../../../issue/domain/exceptions/issue-not-found.exception.js';
 import { ListCommentsQuery } from './list-comments.query.js';
 import { CommentDto } from '../../dto/comment.dto.js';
 import { CommentExpanderService } from '../../services/comment-expander.service.js';
@Injectable()
 export class ListCommentsUseCase {
  constructor(
    @Inject(COMMENT_REPOSITORY)
    private readonly commentRepository: ICommentRepository,
    @Inject(ISSUE_REPOSITORY)
    private readonly issueRepository: IIssueRepository,
    private readonly commentExpander: CommentExpanderService,
  ) {}
  async execute(query: ListCommentsQuery): Promise<{ list: CommentDto[]; nextCursor: string | null }> {
    const issue = await this.issueRepository.findById(query.issueId, query.userId);
    if (!issue) {
      throw new IssueNotFoundException(query.issueId);
    }
    const { list, nextCursor } = await this.commentRepository.findByIssue({
      issueId: query.issueId,
      limit: query.limit,
      cursor: query.cursor,
      direction: query.direction,
    });
    return { list: await this.commentExpander.expandAll(list), nextCursor };
  }
 }
@@ -0,0 +1,75 @@
 import { vi } from 'vitest';
 import type { ICommentRepository } from '../../domain/repositories/comment.repository.interface.js';
 import type { IIssueRepository } from '../../../issue/domain/repositories/issue.repository.interface.js';
 import { Comment } from '../../domain/entities/comment.entity.js';
 import { Issue } from '../../../issue/domain/entities/issue.entity.js';
 import { CommentExpanderService } from '../services/comment-expander.service.js';
 import { CommentApplicationMapper } from '../mappers/comment-application.mapper.js';
 import type { FileAccessService } from '../../../file/application/services/file-access.service.js';
 export const buildComment = (
  overrides: Partial<{ id: string; issueId: number; authorId: string; deletedAt: Date | null }> = {},
 ) =>
  Comment.reconstitute({
    id: overrides.id ?? 'comment-1',
    content: 'Original',
    issueId: overrides.issueId ?? 1,
    authorId: overrides.authorId ?? 'user-1',
    editedAt: null,
    deletedAt: overrides.deletedAt ?? null,
    createdAt: new Date('2026-01-01T00:00:00.000Z'),
    updatedAt: new Date('2026-01-01T00:00:00.000Z'),
  });
 export const buildIssue = () =>
  Issue.reconstitute({
    id: 1,
    key: 'ISSUE-1',
    title: 'Issue',
    content: null,
    status: 'OPEN',
    priority: 0,
    assignee: null,
    reporter: 'user-1',
    projectId: 'project-1',
    dueDate: null,
    createdAt: new Date('2026-01-01T00:00:00.000Z'),
    updatedAt: new Date('2026-01-01T00:00:00.000Z'),
  });
 export const mockCommentRepository = (): ICommentRepository => ({
  findById: vi.fn(),
  findByIssue: vi.fn(),
  create: vi.fn(),
  update: vi.fn(),
  findIssueIdsByAttachedFile: vi.fn(),
  findReferencedFileIds: vi.fn(),
 });
 export const mockIssueRepository = (): IIssueRepository => ({
  findById: vi.fn(),
  findByCKey: vi.fn(),
  findAll: vi.fn(),
  countByStatus: vi.fn(),
  create: vi.fn(),
  update: vi.fn(),
  delete: vi.fn(),
 });
 /** Все файлы прикрепляемы, кроме перечисленных — для них бросается заданная ошибка */
 export const mockFileAccess = (rejections: Record<string, Error> = {}) =>
  ({
    getAttachableFile: vi.fn(async (fileId: string) => {
      if (rejections[fileId]) throw rejections[fileId];
      return { id: fileId };
    }),
  }) as unknown as FileAccessService;
 /** Экспандер без похода за пользователями и файлами: author всегда null, attachments пустые */
 export const mockCommentExpander = () => {
  const toDto = (comment: Comment) => CommentApplicationMapper.toDto(comment, new Map());
  return {
    expand: vi.fn(async (comment: Comment) => toDto(comment)),
    expandAll: vi.fn(async (comments: Comment[]) => comments.map(toDto)),
  } as unknown as CommentExpanderService;
 };
@@ -0,0 +1,9 @@
 export class UpdateCommentCommand {
  constructor(
    public readonly id: string,
    public readonly userId: string,
    public readonly content: string,
    /** Новый набор вложений целиком; undefined — не менять */
    public readonly fileIds?: string[],
  ) {}
 }
@@ -0,0 +1,112 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import type { ICommentRepository } from '../../../domain/repositories/comment.repository.interface.js';
 import type { IIssueRepository } from '../../../../issue/domain/repositories/issue.repository.interface.js';
 import { CommentNotFoundException } from '../../../domain/exceptions/comment-not-found.exception.js';
 import { CommentForbiddenException } from '../../../domain/exceptions/comment-forbidden.exception.js';
 import { CommentEventsService } from '../../services/comment-events.service.js';
 import { CommentAccessService } from '../../services/comment-access.service.js';
 import { UpdateCommentUseCase } from './update-comment.use-case.js';
 import { UpdateCommentCommand } from './update-comment.command.js';
 import {
  buildComment,
  buildIssue,
  mockCommentExpander,
  mockCommentRepository,
  mockFileAccess,
  mockIssueRepository,
 } from '../test-helpers.js';
 import { FileNotFoundException } from '../../../../file/domain/exceptions/file-not-found.exception.js';
 import type { FileAccessService } from '../../../../file/application/services/file-access.service.js';
 describe('UpdateCommentUseCase', () => {
  let commentRepository: ICommentRepository;
  let issueRepository: IIssueRepository;
  let commentEventsService: CommentEventsService;
  let useCase: UpdateCommentUseCase;
  let received: unknown[];
  let fileAccess: FileAccessService;
  beforeEach(() => {
    commentRepository = mockCommentRepository();
    issueRepository = mockIssueRepository();
    commentEventsService = new CommentEventsService();
    fileAccess = mockFileAccess({ gone: new FileNotFoundException('gone') });
    useCase = new UpdateCommentUseCase(
      commentRepository,
      new CommentAccessService(commentRepository, issueRepository),
      mockCommentExpander(),
      commentEventsService,
      fileAccess,
    );
    received = [];
    commentEventsService.onEvents().subscribe((event) => received.push(event));
    vi.mocked(issueRepository.findById).mockResolvedValue(buildIssue());
  });
  it('updates the content and emits comment.updated', async () => {
    vi.mocked(commentRepository.findById).mockResolvedValue(buildComment());
    const dto = await useCase.execute(new UpdateCommentCommand('comment-1', 'user-1', 'Changed'));
    expect(dto.content).toBe('Changed');
    expect(dto.editedAt).toBeInstanceOf(Date);
    expect(commentRepository.update).toHaveBeenCalledTimes(1);
    expect(received).toEqual([{ type: 'comment.updated', comment: dto }]);
  });
  it('skips saving and events when content did not change', async () => {
    vi.mocked(commentRepository.findById).mockResolvedValue(buildComment());
    await useCase.execute(new UpdateCommentCommand('comment-1', 'user-1', 'Original'));
    expect(commentRepository.update).not.toHaveBeenCalled();
    expect(received).toEqual([]);
  });
  it('throws CommentForbiddenException for a non-author', async () => {
    vi.mocked(commentRepository.findById).mockResolvedValue(buildComment());
    await expect(useCase.execute(new UpdateCommentCommand('comment-1', 'user-2', 'Changed'))).rejects.toThrow(
      CommentForbiddenException,
    );
    expect(commentRepository.update).not.toHaveBeenCalled();
  });
  it('throws CommentNotFoundException for a deleted comment', async () => {
    vi.mocked(commentRepository.findById).mockResolvedValue(buildComment({ deletedAt: new Date() }));
    await expect(useCase.execute(new UpdateCommentCommand('comment-1', 'user-1', 'Changed'))).rejects.toThrow(
      CommentNotFoundException,
    );
  });
  it('throws CommentNotFoundException when the issue is not visible to the user', async () => {
    vi.mocked(commentRepository.findById).mockResolvedValue(buildComment());
    vi.mocked(issueRepository.findById).mockResolvedValue(null);
    await expect(useCase.execute(new UpdateCommentCommand('comment-1', 'user-1', 'Changed'))).rejects.toThrow(
      CommentNotFoundException,
    );
  });
  it('replaces attachments, checking only newly added files', async () => {
    const comment = buildComment();
    comment.edit('Original', 'user-1', ['kept', 'removed']);
    vi.mocked(commentRepository.findById).mockResolvedValue(comment);
    await useCase.execute(new UpdateCommentCommand('comment-1', 'user-1', 'Original', ['kept', 'new']));
    expect(fileAccess.getAttachableFile).toHaveBeenCalledExactlyOnceWith('new', 'user-1');
    expect(vi.mocked(commentRepository.update).mock.calls[0]![0].fileIds).toEqual(['kept', 'new']);
    expect(received).toHaveLength(1);
  });
  it('does not save when an added file is gone', async () => {
    vi.mocked(commentRepository.findById).mockResolvedValue(buildComment());
    await expect(
      useCase.execute(new UpdateCommentCommand('comment-1', 'user-1', 'Original', ['gone'])),
    ).rejects.toThrow(FileNotFoundException);
    expect(commentRepository.update).not.toHaveBeenCalled();
  });
 });
@@ -0,0 +1,49 @@
 import { Inject, Injectable } from '@nestjs/common';
 import {
  COMMENT_REPOSITORY,
  type ICommentRepository,
 } from '../../../domain/repositories/comment.repository.interface.js';
 import { UpdateCommentCommand } from './update-comment.command.js';
 import { CommentDto } from '../../dto/comment.dto.js';
 import { CommentExpanderService } from '../../services/comment-expander.service.js';
 import { CommentEventsService } from '../../services/comment-events.service.js';
 import { CommentAccessService } from '../../services/comment-access.service.js';
 import { FileAccessService } from '../../../../file/application/services/file-access.service.js';
@Injectable()
 export class UpdateCommentUseCase {
  constructor(
    @Inject(COMMENT_REPOSITORY)
    private readonly commentRepository: ICommentRepository,
    private readonly commentAccess: CommentAccessService,
    private readonly commentExpander: CommentExpanderService,
    private readonly commentEventsService: CommentEventsService,
    private readonly fileAccess: FileAccessService,
  ) {}
  async execute(command: UpdateCommentCommand): Promise<CommentDto> {
    const comment = await this.commentAccess.getVisibleComment(command.id, command.userId);
    const attachedBefore = new Set(comment.fileIds);
    const changed = comment.edit(command.content, command.userId, command.fileIds);
    // Проверяем только добавленные файлы: уже прикреплённые проверены при прикреплении
    for (const fileId of comment.fileIds) {
      if (!attachedBefore.has(fileId)) {
        await this.fileAccess.getAttachableFile(fileId, command.userId);
      }
    }
    if (changed) {
      await this.commentRepository.update(comment);
    }
    const dto = await this.commentExpander.expand(comment);
    if (changed) {
      this.commentEventsService.emit('comment.updated', dto);
    }
    return dto;
  }
 }
@@ -0,0 +1,6 @@
 export class WatchIssueCommentsQuery {
  constructor(
    public readonly issueId: number,
    public readonly userId: string,
  ) {}
 }
@@ -0,0 +1,42 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import type { IIssueRepository } from '../../../../issue/domain/repositories/issue.repository.interface.js';
 import { IssueNotFoundException } from '../../../../issue/domain/exceptions/issue-not-found.exception.js';
 import { CommentEventsService, type CommentEvent } from '../../services/comment-events.service.js';
 import { CommentApplicationMapper } from '../../mappers/comment-application.mapper.js';
 import { WatchIssueCommentsUseCase } from './watch-issue-comments.use-case.js';
 import { WatchIssueCommentsQuery } from './watch-issue-comments.query.js';
 import { buildComment, buildIssue, mockIssueRepository } from '../test-helpers.js';
 const dtoForIssue = (issueId: number) =>
  CommentApplicationMapper.toDto(buildComment({ id: `comment-of-${issueId}`, issueId }), new Map());
 describe('WatchIssueCommentsUseCase', () => {
  let issueRepository: IIssueRepository;
  let commentEventsService: CommentEventsService;
  let useCase: WatchIssueCommentsUseCase;
  beforeEach(() => {
    issueRepository = mockIssueRepository();
    commentEventsService = new CommentEventsService();
    useCase = new WatchIssueCommentsUseCase(issueRepository, commentEventsService);
  });
  it('streams only events of the requested issue', async () => {
    vi.mocked(issueRepository.findById).mockResolvedValue(buildIssue());
    const received: CommentEvent[] = [];
    const events$ = await useCase.execute(new WatchIssueCommentsQuery(1, 'user-1'));
    events$.subscribe((event) => received.push(event));
    commentEventsService.emit('comment.created', dtoForIssue(1));
    commentEventsService.emit('comment.created', dtoForIssue(2));
    expect(received.map((event) => event.comment.id)).toEqual(['comment-of-1']);
  });
  it('throws IssueNotFoundException when the issue is not visible to the user', async () => {
    vi.mocked(issueRepository.findById).mockResolvedValue(null);
    await expect(useCase.execute(new WatchIssueCommentsQuery(1, 'user-2'))).rejects.toThrow(IssueNotFoundException);
  });
 });
@@ -0,0 +1,31 @@
 import { Inject, Injectable } from '@nestjs/common';
 import { filter, type Observable } from 'rxjs';
 import {
  ISSUE_REPOSITORY,
  type IIssueRepository,
 } from '../../../../issue/domain/repositories/issue.repository.interface.js';
 import { IssueNotFoundException } from '../../../../issue/domain/exceptions/issue-not-found.exception.js';
 import { WatchIssueCommentsQuery } from './watch-issue-comments.query.js';
 import { type CommentEvent, CommentEventsService } from '../../services/comment-events.service.js';
 /**
 * Поток событий комментариев одной задачи для SSE. Доступ к задаче
 * проверяется один раз — при подключении.
 */
@Injectable()
 export class WatchIssueCommentsUseCase {
  constructor(
    @Inject(ISSUE_REPOSITORY)
    private readonly issueRepository: IIssueRepository,
    private readonly commentEventsService: CommentEventsService,
  ) {}
  async execute(query: WatchIssueCommentsQuery): Promise<Observable<CommentEvent>> {
    const issue = await this.issueRepository.findById(query.issueId, query.userId);
    if (!issue) {
      throw new IssueNotFoundException(query.issueId);
    }
    return this.commentEventsService.onEvents().pipe(filter((event) => event.comment.issueId === query.issueId));
  }
 }
@@ -0,0 +1,40 @@
 import { Module } from '@nestjs/common';
 import { PrismaModule } from '../../common/prisma-adapter/prisma.module.js';
 import { IssueModule } from '../issue/issue.module.js';
 import { UserModule } from '../user/user.module.js';
 import { FileModule } from '../file/file.module.js';
 import { COMMENT_REPOSITORY } from './domain/repositories/comment.repository.interface.js';
 import { CommentPrismaRepository } from './infrastructure/persistence/prisma/repositories/comment.prisma-repository.js';
 import { CommentController } from './presentation/controllers/comment.controller.js';
 import { CreateCommentUseCase } from './application/use-cases/create-comment/create-comment.use-case.js';
 import { ListCommentsUseCase } from './application/use-cases/list-comments/list-comments.use-case.js';
 import { UpdateCommentUseCase } from './application/use-cases/update-comment/update-comment.use-case.js';
 import { DeleteCommentUseCase } from './application/use-cases/delete-comment/delete-comment.use-case.js';
 import { WatchIssueCommentsUseCase } from './application/use-cases/watch-issue-comments/watch-issue-comments.use-case.js';
 import { CommentAccessService } from './application/services/comment-access.service.js';
 import { CommentExpanderService } from './application/services/comment-expander.service.js';
 import { CommentEventsService } from './application/services/comment-events.service.js';
 import { CommentAttachmentFileOwnerService } from './application/services/comment-attachment-file-owner.service.js';
@Module({
  imports: [PrismaModule, IssueModule, UserModule, FileModule],
  controllers: [CommentController],
  providers: [
    CreateCommentUseCase,
    ListCommentsUseCase,
    UpdateCommentUseCase,
    DeleteCommentUseCase,
    WatchIssueCommentsUseCase,
    CommentAccessService,
    CommentExpanderService,
    CommentEventsService,
    CommentAttachmentFileOwnerService,
    {
      // Domain видит только интерфейс ICommentRepository,
      // конкретную реализацию (Prisma) подставляет DI-контейнер здесь
      provide: COMMENT_REPOSITORY,
      useClass: CommentPrismaRepository,
    },
  ],
 })
 export class CommentModule {}
@@ -0,0 +1,122 @@
 import { describe, expect, it } from 'vitest';
 import { Comment } from './comment.entity.js';
 import { CommentForbiddenException } from '../exceptions/comment-forbidden.exception.js';
 const buildComment = (overrides: Partial<{ authorId: string | null; deletedAt: Date | null }> = {}) =>
  Comment.reconstitute({
    id: 'comment-1',
    content: 'Original',
    issueId: 1,
    authorId: overrides.authorId === undefined ? 'user-1' : overrides.authorId,
    editedAt: null,
    deletedAt: overrides.deletedAt ?? null,
    createdAt: new Date('2026-01-01T00:00:00.000Z'),
    updatedAt: new Date('2026-01-01T00:00:00.000Z'),
  });
 describe('Comment', () => {
  describe('create', () => {
    it('creates a new comment without id and edit/delete marks', () => {
      const comment = Comment.create({ issueId: 1, authorId: 'user-1', content: ' Hello ' });
      expect(comment.id).toBeNull();
      expect(comment.content).toBe('Hello');
      expect(comment.editedAt).toBeNull();
      expect(comment.isDeleted).toBe(false);
    });
    it('rejects empty content', () => {
      expect(() => Comment.create({ issueId: 1, authorId: 'user-1', content: '' })).toThrow();
    });
  });
  describe('edit', () => {
    it('changes content and sets editedAt', () => {
      const comment = buildComment();
      expect(comment.edit('Changed', 'user-1')).toBe(true);
      expect(comment.content).toBe('Changed');
      expect(comment.editedAt).toBeInstanceOf(Date);
    });
    it('is a no-op when content is the same', () => {
      const comment = buildComment();
      expect(comment.edit(' Original ', 'user-1')).toBe(false);
      expect(comment.editedAt).toBeNull();
    });
    it('forbids editing by someone other than the author', () => {
      expect(() => buildComment().edit('Changed', 'user-2')).toThrow(CommentForbiddenException);
    });
    it('forbids editing when the author account is deleted', () => {
      expect(() => buildComment({ authorId: null }).edit('Changed', 'user-1')).toThrow(CommentForbiddenException);
    });
    it('forbids editing a deleted comment', () => {
      expect(() => buildComment({ deletedAt: new Date() }).edit('Changed', 'user-1')).toThrow();
    });
  });
  describe('delete', () => {
    it('soft-deletes the comment', () => {
      const comment = buildComment();
      comment.delete('user-1');
      expect(comment.isDeleted).toBe(true);
      expect(comment.deletedAt).toBeInstanceOf(Date);
    });
    it('forbids deletion by someone other than the author', () => {
      expect(() => buildComment().delete('user-2')).toThrow(CommentForbiddenException);
    });
  });
  describe('attachments', () => {
    it('creates a comment with deduplicated files', () => {
      const comment = Comment.create({ issueId: 1, authorId: 'user-1', content: 'Hi', fileIds: ['a', 'b', 'a'] });
      expect(comment.fileIds).toEqual(['a', 'b']);
    });
    it('limits the number of files', () => {
      const fileIds = Array.from({ length: Comment.MAX_ATTACHMENTS + 1 }, (_, i) => `f${i}`);
      expect(() => Comment.create({ issueId: 1, authorId: 'user-1', content: 'Hi', fileIds })).toThrow();
    });
    it('treats a changed file set as an edit, even with the same text', () => {
      const comment = buildComment();
      expect(comment.edit('Original', 'user-1', ['a'])).toBe(true);
      expect(comment.fileIds).toEqual(['a']);
      expect(comment.editedAt).toBeInstanceOf(Date);
    });
    it('keeps files when fileIds is not passed', () => {
      const comment = buildComment();
      comment.edit('Original', 'user-1', ['a']);
      expect(comment.edit('Changed', 'user-1')).toBe(true);
      expect(comment.fileIds).toEqual(['a']);
    });
    it('reports no change for the same text and files', () => {
      const comment = buildComment();
      comment.edit('Original', 'user-1', ['a', 'b']);
      expect(comment.edit('Original', 'user-1', ['a', 'b'])).toBe(false);
    });
    it('drops files on delete so GC can collect them', () => {
      const comment = buildComment();
      comment.edit('Original', 'user-1', ['a']);
      comment.delete('user-1');
      expect(comment.fileIds).toEqual([]);
    });
  });
 });
@@ -0,0 +1,167 @@
 import { CommentContent } from '../value-objects/comment-content.vo.js';
 import { CommentForbiddenException } from '../exceptions/comment-forbidden.exception.js';
 interface CommentProps {
  id: string | null;
  content: CommentContent;
  issueId: number;
  /** null — автор удалил аккаунт */
  authorId: string | null;
  /** Прикреплённые файлы (file-модуль), по времени загрузки */
  fileIds: string[];
  editedAt: Date | null;
  deletedAt: Date | null;
  createdAt: Date;
  updatedAt: Date;
 }
 /**
 * Комментарий к задаче. Удаление мягкое: запись остаётся (deletedAt),
 * чтобы в ленте можно было показать «комментарий удалён».
 *
 * Вложения — часть комментария: задаются при создании и правке,
 * снимаются при удалении (тогда осиротевшие файлы удалит GC file-модуля).
 *
 * `id` (uuid v7) генерируется базой, поэтому у нового комментария
 * он равен null до сохранения в репозитории.
 */
 export class Comment {
  static readonly MAX_ATTACHMENTS = 10;
  private constructor(private readonly props: CommentProps) {}
  /** Фабричный метод для создания НОВОГО комментария */
  static create(params: { issueId: number; authorId: string; content: string; fileIds?: string[] }): Comment {
    const now = new Date();
    return new Comment({
      id: null,
      content: CommentContent.create(params.content),
      issueId: params.issueId,
      authorId: params.authorId,
      fileIds: Comment.normalizeFileIds(params.fileIds ?? []),
      editedAt: null,
      deletedAt: null,
      createdAt: now,
      updatedAt: now,
    });
  }
  /** Восстановление сущности из персистентного слоя */
  static reconstitute(props: {
    id: string;
    content: string;
    issueId: number;
    authorId: string | null;
    fileIds?: string[];
    editedAt: Date | null;
    deletedAt: Date | null;
    createdAt: Date;
    updatedAt: Date;
  }): Comment {
    return new Comment({
      ...props,
      content: CommentContent.create(props.content),
      fileIds: [...(props.fileIds ?? [])],
    });
  }
  get id(): string | null {
    return this.props.id;
  }
  get content(): string {
    return this.props.content.value;
  }
  get issueId(): number {
    return this.props.issueId;
  }
  get authorId(): string | null {
    return this.props.authorId;
  }
  get fileIds(): readonly string[] {
    return this.props.fileIds;
  }
  get editedAt(): Date | null {
    return this.props.editedAt;
  }
  get deletedAt(): Date | null {
    return this.props.deletedAt;
  }
  get isDeleted(): boolean {
    return this.props.deletedAt !== null;
  }
  get createdAt(): Date {
    return this.props.createdAt;
  }
  get updatedAt(): Date {
    return this.props.updatedAt;
  }
  /**
   * Меняет текст и, если передан fileIds, — набор вложений (целиком).
   * Возвращает false, если ничего не изменилось.
   */
  edit(content: string, userId: string, fileIds?: string[]): boolean {
    this.assertCanModify(userId);
    const nextContent = CommentContent.create(content);
    const nextFileIds = fileIds === undefined ? this.props.fileIds : Comment.normalizeFileIds(fileIds);
    const contentChanged = !nextContent.equals(this.props.content);
    const filesChanged =
      nextFileIds.length !== this.props.fileIds.length || nextFileIds.some((id, i) => id !== this.props.fileIds[i]);
    if (!contentChanged && !filesChanged) {
      return false;
    }
    const now = new Date();
    this.props.content = nextContent;
    this.props.fileIds = nextFileIds;
    this.props.editedAt = now;
    this.props.updatedAt = now;
    return true;
  }
  delete(userId: string): void {
    this.assertCanModify(userId);
    const now = new Date();
    this.props.fileIds = [];
    this.props.deletedAt = now;
    this.props.updatedAt = now;
  }
  /**
   * Без дублей и в порядке загрузки: id файлов — uuid v7, их строковый порядок
   * совпадает с временем создания. Так порядок одинаков в ответе на create
   * и при чтении из БД, а сравнение наборов в edit не зависит от порядка у клиента.
   */
  private static normalizeFileIds(fileIds: string[]): string[] {
    const unique = [...new Set(fileIds)].sort();
    if (unique.length > Comment.MAX_ATTACHMENTS) {
      throw new Error(`К комментарию можно прикрепить не больше ${Comment.MAX_ATTACHMENTS} файлов`);
    }
    return unique;
  }
  /** Править и удалять комментарий может только его автор, и только пока он не удалён */
  private assertCanModify(userId: string): void {
    if (this.isDeleted) {
      throw new Error('Комментарий уже удалён');
    }
    if (this.props.authorId !== userId) {
      throw new CommentForbiddenException(this.props.id ?? 'new');
    }
  }
 }
@@ -0,0 +1,6 @@
 export class CommentForbiddenException extends Error {
  constructor(id: string) {
    super(`Нет прав на изменение комментария id=${id}`);
    this.name = 'CommentForbiddenException';
  }
 }
@@ -0,0 +1,6 @@
 export class CommentNotFoundException extends Error {
  constructor(id: string) {
    super(`Комментарий с id=${id} не найден`);
    this.name = 'CommentNotFoundException';
  }
 }
@@ -0,0 +1,36 @@
 import { Comment } from '../entities/comment.entity.js';
 /** Направление пагинации комментариев: forward — от старых к новым, backward — от новых к старым */
 export const COMMENT_LIST_DIRECTIONS = ['forward', 'backward'] as const;
 export type CommentListDirection = (typeof COMMENT_LIST_DIRECTIONS)[number];
 /** DI-токен, т.к. интерфейсы стираются при компиляции TS */
 export const COMMENT_REPOSITORY = Symbol('COMMENT_REPOSITORY');
 export interface ICommentRepository {
  /** Возвращает и мягко удалённые комментарии — решение принимает вызывающий */
  findById(id: string): Promise<Comment | null>;
  /**
   * Комментарии задачи от старых к новым, включая удалённые.
   * Курсорная пагинация. forward: cursor — id последнего полученного комментария,
   * отдаются более новые. backward: cursor — id самого старого полученного,
   * отдаются более старые (без cursor — последняя страница). Список всегда
   * отсортирован от старых к новым.
   */
  findByIssue(params: {
    issueId: number;
    limit: number;
    cursor?: string;
    direction?: CommentListDirection;
  }): Promise<{ list: Comment[]; nextCursor: string | null }>;
  /**
   * Создание и обновление сохраняют и вложения (fileIds) — атомарно с комментарием.
   * FileNotFoundException, если файл удалили между проверкой и записью.
   */
  create(comment: Comment): Promise<Comment>;
  update(comment: Comment): Promise<void>;
  /** Задачи неудалённых комментариев, к которым прикреплён файл */
  findIssueIdsByAttachedFile(fileId: string): Promise<number[]>;
  /** Подмножество fileIds, прикреплённых хотя бы к одному комментарию */
  findReferencedFileIds(fileIds: string[]): Promise<string[]>;
 }
@@ -0,0 +1,18 @@
 import { describe, expect, it } from 'vitest';
 import { CommentContent } from './comment-content.vo.js';
 describe('CommentContent', () => {
  it('trims the value', () => {
    expect(CommentContent.create('  hello  ').value).toBe('hello');
  });
  it('rejects empty content', () => {
    expect(() => CommentContent.create('   ')).toThrow('Комментарий не может быть пустым');
  });
  it('rejects content longer than the limit', () => {
    expect(() => CommentContent.create('a'.repeat(CommentContent.MAX_LENGTH + 1))).toThrow(
      `Комментарий не может превышать ${CommentContent.MAX_LENGTH} символов`,
    );
  });
 });
@@ -0,0 +1,27 @@
 export class CommentContent {
  static readonly MAX_LENGTH = 10000;
  private constructor(private readonly _value: string) {}
  static create(value: string): CommentContent {
    const trimmed = value?.trim();
    if (!trimmed) {
      throw new Error('Комментарий не может быть пустым');
    }
    if (trimmed.length > CommentContent.MAX_LENGTH) {
      throw new Error(`Комментарий не может превышать ${CommentContent.MAX_LENGTH} символов`);
    }
    return new CommentContent(trimmed);
  }
  get value(): string {
    return this._value;
  }
  equals(other: CommentContent): boolean {
    return this._value === other.value;
  }
 }
@@ -0,0 +1,41 @@
 import type { Comment as PrismaComment, Prisma } from '../../../../../../generated/prisma/client.js';
 import { Comment } from '../../../../domain/entities/comment.entity.js';
 /** Комментарий вместе с id прикреплённых файлов (см. COMMENT_INCLUDE в репозитории) */
 export type PrismaCommentWithAttachments = PrismaComment & { attachments: { fileId: string }[] };
 export class CommentPrismaMapper {
  static toDomain(record: PrismaCommentWithAttachments): Comment {
    return Comment.reconstitute({
      id: record.id,
      content: record.content,
      issueId: record.issueId,
      authorId: record.authorId,
      fileIds: record.attachments.map((attachment) => attachment.fileId),
      editedAt: record.editedAt,
      deletedAt: record.deletedAt,
      createdAt: record.createdAt,
      updatedAt: record.updatedAt,
    });
  }
  static toCreateInput(comment: Comment): Prisma.CommentUncheckedCreateInput {
    return {
      content: comment.content,
      issueId: comment.issueId,
      authorId: comment.authorId,
      createdAt: comment.createdAt,
      updatedAt: comment.updatedAt,
      attachments: { create: comment.fileIds.map((fileId) => ({ fileId })) },
    };
  }
  static toUpdateInput(comment: Comment): Prisma.CommentUncheckedUpdateInput {
    return {
      content: comment.content,
      editedAt: comment.editedAt,
      deletedAt: comment.deletedAt,
      updatedAt: comment.updatedAt,
    };
  }
 }
@@ -0,0 +1,129 @@
 import { Injectable } from '@nestjs/common';
 import { PrismaAdapter } from '../../../../../../common/prisma-adapter/prisma.adapter.js';
 import { Prisma } from '../../../../../../generated/prisma/client.js';
 import { Comment } from '../../../../domain/entities/comment.entity.js';
 import type {
  CommentListDirection,
  ICommentRepository,
 } from '../../../../domain/repositories/comment.repository.interface.js';
 import { CommentPrismaMapper } from '../mappers/comment.mapper.js';
 import { IssueNotFoundException } from '../../../../../issue/domain/exceptions/issue-not-found.exception.js';
 import { FileNotFoundException } from '../../../../../file/domain/exceptions/file-not-found.exception.js';
 const FOREIGN_KEY_VIOLATION = 'P2003';
 /** Вложения подгружаются вместе с комментарием, по времени загрузки файла (uuid v7) */
 const COMMENT_INCLUDE = {
  attachments: { select: { fileId: true }, orderBy: { fileId: 'asc' } },
 } satisfies Prisma.CommentInclude;
@Injectable()
 export class CommentPrismaRepository implements ICommentRepository {
  constructor(private readonly prisma: PrismaAdapter) {}
  async findById(id: string): Promise<Comment | null> {
    const record = await this.prisma.comment.findUnique({ where: { id }, include: COMMENT_INCLUDE });
    return record ? CommentPrismaMapper.toDomain(record) : null;
  }
  async findByIssue(params: {
    issueId: number;
    limit: number;
    cursor?: string;
    direction?: CommentListDirection;
  }): Promise<{ list: Comment[]; nextCursor: string | null }> {
    const limit = Math.max(1, params.limit);
    const order = params.direction === 'backward' ? 'desc' : 'asc';
    // Берём на одну запись больше, чтобы понять, есть ли следующая страница.
    // id (uuid v7) — тай-брейкер для комментариев с одинаковым createdAt.
    const records = await this.prisma.comment.findMany({
      where: { issueId: params.issueId },
      include: COMMENT_INCLUDE,
      orderBy: [{ createdAt: order }, { id: order }],
      take: limit + 1,
      ...(params.cursor ? { cursor: { id: params.cursor }, skip: 1 } : {}),
    });
    const hasMore = records.length > limit;
    const page = hasMore ? records.slice(0, limit) : records;
    // Курсор — последняя запись страницы в порядке выборки: для backward это самая старая
    const nextCursor = hasMore ? page[page.length - 1]!.id : null;
    if (order === 'desc') page.reverse();
    return { list: page.map(CommentPrismaMapper.toDomain), nextCursor };
  }
  async create(comment: Comment): Promise<Comment> {
    try {
      // Вложения создаются вложенной записью — одним атомарным запросом
      const record = await this.prisma.comment.create({
        data: CommentPrismaMapper.toCreateInput(comment),
        include: COMMENT_INCLUDE,
      });
      return CommentPrismaMapper.toDomain(record);
    } catch (error) {
      // Задачу или файл удалили между проверкой доступа и вставкой
      throw this.mapForeignKeyError(error, comment) ?? error;
    }
  }
  async update(comment: Comment): Promise<void> {
    const id = comment.id as string;
    const fileIds = [...comment.fileIds];
    try {
      await this.prisma.$transaction(async (tx) => {
        await tx.comment.update({
          where: { id },
          data: CommentPrismaMapper.toUpdateInput(comment),
        });
        // Синхронизируем набор вложений: лишние снимаем, новые добавляем
        await tx.commentAttachment.deleteMany({ where: { commentId: id, fileId: { notIn: fileIds } } });
        if (fileIds.length > 0) {
          await tx.commentAttachment.createMany({
            data: fileIds.map((fileId) => ({ commentId: id, fileId })),
            skipDuplicates: true,
          });
        }
      });
    } catch (error) {
      throw this.mapForeignKeyError(error, comment) ?? error;
    }
  }
  async findIssueIdsByAttachedFile(fileId: string): Promise<number[]> {
    const records = await this.prisma.comment.findMany({
      where: { deletedAt: null, attachments: { some: { fileId } } },
      select: { issueId: true },
      distinct: ['issueId'],
    });
    return records.map((record) => record.issueId);
  }
  async findReferencedFileIds(fileIds: string[]): Promise<string[]> {
    if (fileIds.length === 0) return [];
    const records = await this.prisma.commentAttachment.findMany({
      where: { fileId: { in: fileIds } },
      select: { fileId: true },
      distinct: ['fileId'],
    });
    return records.map((record) => record.fileId);
  }
  /** Какой FK нарушен — по имени ограничения в meta (comment_attachment_fileId_fkey и т.п.) */
  private mapForeignKeyError(error: unknown, comment: Comment): Error | null {
    if (!(error instanceof Prisma.PrismaClientKnownRequestError) || error.code !== FOREIGN_KEY_VIOLATION) {
      return null;
    }
    if (JSON.stringify(error.meta ?? {}).includes('fileId')) {
      return new FileNotFoundException(comment.fileIds.join(', '));
    }
    return new IssueNotFoundException(comment.issueId);
  }
 }
@@ -0,0 +1,126 @@
 import {
  Body,
  Controller,
  Delete,
  ForbiddenException,
  Get,
  HttpCode,
  HttpStatus,
  type MessageEvent,
  NotFoundException,
  Param,
  ParseIntPipe,
  Patch,
  Post,
  Query,
  Sse,
  UseGuards,
 } from '@nestjs/common';
 import { Session, type UserSession } from '@thallesp/nestjs-better-auth';
 import { map, type Observable } from 'rxjs';
 import { CreateCommentUseCase } from '../../application/use-cases/create-comment/create-comment.use-case.js';
 import { ListCommentsUseCase } from '../../application/use-cases/list-comments/list-comments.use-case.js';
 import { UpdateCommentUseCase } from '../../application/use-cases/update-comment/update-comment.use-case.js';
 import { DeleteCommentUseCase } from '../../application/use-cases/delete-comment/delete-comment.use-case.js';
 import { WatchIssueCommentsUseCase } from '../../application/use-cases/watch-issue-comments/watch-issue-comments.use-case.js';
 import { CreateCommentCommand } from '../../application/use-cases/create-comment/create-comment.command.js';
 import { ListCommentsQuery } from '../../application/use-cases/list-comments/list-comments.query.js';
 import { UpdateCommentCommand } from '../../application/use-cases/update-comment/update-comment.command.js';
 import { DeleteCommentCommand } from '../../application/use-cases/delete-comment/delete-comment.command.js';
 import { WatchIssueCommentsQuery } from '../../application/use-cases/watch-issue-comments/watch-issue-comments.query.js';
 import { CreateCommentRequestDto } from '../dto/create-comment.dto.js';
 import { UpdateCommentRequestDto } from '../dto/update-comment.dto.js';
 import { ListCommentsDto } from '../dto/list-comments.dto.js';
 import { CommentNotFoundException } from '../../domain/exceptions/comment-not-found.exception.js';
 import { CommentForbiddenException } from '../../domain/exceptions/comment-forbidden.exception.js';
 import { IssueNotFoundException } from '../../../issue/domain/exceptions/issue-not-found.exception.js';
 import { IssueVisibleGuard } from '../guards/issue-visible.guard.js';
 import { FileNotFoundException } from '../../../file/domain/exceptions/file-not-found.exception.js';
 import { FileForbiddenException } from '../../../file/domain/exceptions/file-forbidden.exception.js';
@Controller()
 export class CommentController {
  constructor(
    private readonly createCommentUseCase: CreateCommentUseCase,
    private readonly listCommentsUseCase: ListCommentsUseCase,
    private readonly updateCommentUseCase: UpdateCommentUseCase,
    private readonly deleteCommentUseCase: DeleteCommentUseCase,
    private readonly watchIssueCommentsUseCase: WatchIssueCommentsUseCase,
  ) {}
  @Get('issues/:issueId/comments')
  list(
    @Param('issueId', ParseIntPipe) issueId: number,
    @Query() query: ListCommentsDto,
    @Session() session: UserSession,
  ) {
    return this.handleErrors(() =>
      this.listCommentsUseCase.execute(
        new ListCommentsQuery(issueId, session.user.id, Number(query.limit), query.cursor, query.direction),
      ),
    );
  }
  @Post('issues/:issueId/comments')
  create(
    @Param('issueId', ParseIntPipe) issueId: number,
    @Body() dto: CreateCommentRequestDto,
    @Session() session: UserSession,
  ) {
    return this.handleErrors(() =>
      this.createCommentUseCase.execute(new CreateCommentCommand(issueId, session.user.id, dto.content, dto.fileIds)),
    );
  }
  /**
   * SSE-поток комментариев одной задачи: клиент открывает его на странице
   * задачи и закрывает при уходе. После переподключения клиенту стоит
   * перезапросить список — события, пришедшие во время обрыва, не повторяются.
   * Доступ проверяет IssueVisibleGuard — так клиент без доступа получает 404.
   */
  @Sse('issues/:issueId/comments/events')
  @UseGuards(IssueVisibleGuard)
  events(
    @Param('issueId', ParseIntPipe) issueId: number,
    @Session() session: UserSession,
  ): Promise<Observable<MessageEvent>> {
    return this.handleErrors(async () => {
      const events$ = await this.watchIssueCommentsUseCase.execute(
        new WatchIssueCommentsQuery(issueId, session.user.id),
      );
      return events$.pipe(map((event) => ({ type: event.type, data: event.comment })));
    });
  }
  @Patch('comments/:id')
  update(@Param('id') id: string, @Body() dto: UpdateCommentRequestDto, @Session() session: UserSession) {
    return this.handleErrors(() =>
      this.updateCommentUseCase.execute(new UpdateCommentCommand(id, session.user.id, dto.content, dto.fileIds)),
    );
  }
  @Delete('comments/:id')
  @HttpCode(HttpStatus.NO_CONTENT)
  async delete(@Param('id') id: string, @Session() session: UserSession) {
    await this.handleErrors(() => this.deleteCommentUseCase.execute(new DeleteCommentCommand(id, session.user.id)));
  }
  /** Транслирует доменные исключения в HTTP-ответ — это забота presentation-слоя */
  private async handleErrors<T>(fn: () => Promise<T>): Promise<T> {
    try {
      return await fn();
    } catch (error) {
      if (
        error instanceof CommentNotFoundException ||
        error instanceof IssueNotFoundException ||
        error instanceof FileNotFoundException
      ) {
        throw new NotFoundException(error.message);
      }
      if (error instanceof CommentForbiddenException || error instanceof FileForbiddenException) {
        throw new ForbiddenException(error.message);
      }
      throw error;
    }
  }
 }
@@ -0,0 +1,18 @@
 import { ArrayMaxSize, IsArray, IsNotEmpty, IsOptional, IsString, MaxLength } from 'class-validator';
 import { CommentContent } from '../../domain/value-objects/comment-content.vo.js';
 import { Comment } from '../../domain/entities/comment.entity.js';
 export class CreateCommentRequestDto {
  @IsString()
  @IsNotEmpty()
  @MaxLength(CommentContent.MAX_LENGTH)
  content: string;
  /** id файлов, загруженных через POST /files */
  @IsOptional()
  @IsArray()
  @ArrayMaxSize(Comment.MAX_ATTACHMENTS)
  @IsString({ each: true })
  @MaxLength(64, { each: true })
  fileIds?: string[];
 }
@@ -0,0 +1,24 @@
 import { IsIn, IsOptional } from 'class-validator';
 import { IntDecorator, StringDecorator } from '../../../../common/decorators/validators.js';
 import {
  COMMENT_LIST_DIRECTIONS,
  type CommentListDirection,
 } from '../../domain/repositories/comment.repository.interface.js';
 export class ListCommentsDto {
  @IntDecorator({ isOptional: true, min: 1, max: 100 })
  limit: number = 50;
  /** id последнего полученного комментария (nextCursor из предыдущего ответа) */
  @StringDecorator({ isOptional: true })
  cursor?: string;
  /**
   * forward — от старых к новым, cursor — последний полученный (новые после него).
   * backward — страницы от новых к старым (для чата), cursor — самый старый полученный.
   * В обоих случаях список в ответе отсортирован от старых к новым.
   */
  @IsOptional()
  @IsIn(COMMENT_LIST_DIRECTIONS)
  direction: CommentListDirection = 'forward';
 }
@@ -0,0 +1,18 @@
 import { ArrayMaxSize, IsArray, IsNotEmpty, IsOptional, IsString, MaxLength } from 'class-validator';
 import { CommentContent } from '../../domain/value-objects/comment-content.vo.js';
 import { Comment } from '../../domain/entities/comment.entity.js';
 export class UpdateCommentRequestDto {
  @IsString()
  @IsNotEmpty()
  @MaxLength(CommentContent.MAX_LENGTH)
  content: string;
  /** id файлов, загруженных через POST /files — набор целиком; не передан — не менять */
  @IsOptional()
  @IsArray()
  @ArrayMaxSize(Comment.MAX_ATTACHMENTS)
  @IsString({ each: true })
  @MaxLength(64, { each: true })
  fileIds?: string[];
 }
@@ -0,0 +1,44 @@
 import { describe, expect, it, vi } from 'vitest';
 import { BadRequestException, type ExecutionContext, NotFoundException, UnauthorizedException } from '@nestjs/common';
 import { CommentAccessService } from '../../application/services/comment-access.service.js';
 import { IssueVisibleGuard } from './issue-visible.guard.js';
 const buildContext = (params: Record<string, string>, userId?: string) =>
  ({
    switchToHttp: () => ({
      getRequest: () => ({ params, session: userId ? { user: { id: userId } } : undefined }),
    }),
  }) as unknown as ExecutionContext;
 const buildGuard = (visible: boolean) => {
  const commentAccess = { isIssueVisible: vi.fn().mockResolvedValue(visible) } as unknown as CommentAccessService;
  return { guard: new IssueVisibleGuard(commentAccess), commentAccess };
 };
 describe('IssueVisibleGuard', () => {
  it('allows access to a visible issue', async () => {
    const { guard, commentAccess } = buildGuard(true);
    await expect(guard.canActivate(buildContext({ issueId: '1' }, 'user-1'))).resolves.toBe(true);
    expect(commentAccess.isIssueVisible).toHaveBeenCalledWith(1, 'user-1');
  });
  it('throws NotFoundException when the issue is not visible', async () => {
    const { guard } = buildGuard(false);
    await expect(guard.canActivate(buildContext({ issueId: '1' }, 'user-2'))).rejects.toThrow(NotFoundException);
  });
  it('throws BadRequestException for a non-numeric issueId', async () => {
    const { guard, commentAccess } = buildGuard(true);
    await expect(guard.canActivate(buildContext({ issueId: 'abc' }, 'user-1'))).rejects.toThrow(BadRequestException);
    expect(commentAccess.isIssueVisible).not.toHaveBeenCalled();
  });
  it('throws UnauthorizedException without a session', async () => {
    const { guard } = buildGuard(true);
    await expect(guard.canActivate(buildContext({ issueId: '1' }))).rejects.toThrow(UnauthorizedException);
  });
 });
@@ -0,0 +1,48 @@
 import {
  BadRequestException,
  type CanActivate,
  type ExecutionContext,
  Injectable,
  NotFoundException,
  UnauthorizedException,
 } from '@nestjs/common';
 import type { UserSession } from '@thallesp/nestjs-better-auth';
 import { CommentAccessService } from '../../application/services/comment-access.service.js';
 import { IssueNotFoundException } from '../../../issue/domain/exceptions/issue-not-found.exception.js';
 /**
 * Проверяет доступ к задаче из `:issueId` ДО вызова обработчика.
 *
 * Нужен SSE-эндпоинтам: при наличии глобального interceptor'а Nest вызывает
 * @Sse-обработчик уже после отправки заголовков 200, и ошибка из него доходит
 * до клиента только как `event: error`. Guard же отвечает честным 404.
 *
 * Сессию в request кладёт глобальный AuthGuard, который выполняется раньше.
 */
@Injectable()
 export class IssueVisibleGuard implements CanActivate {
  constructor(private readonly commentAccess: CommentAccessService) {}
  async canActivate(context: ExecutionContext): Promise<boolean> {
    const request = context
      .switchToHttp()
      .getRequest<{ params: Record<string, string | undefined>; session?: UserSession }>();
    const userId = request.session?.user.id;
    if (!userId) {
      throw new UnauthorizedException();
    }
    // Пайпы (ParseIntPipe) выполняются после guard'ов — парсим сами
    const issueId = Number(request.params.issueId);
    if (!Number.isInteger(issueId)) {
      throw new BadRequestException('Validation failed (numeric string is expected)');
    }
    if (!(await this.commentAccess.isIssueVisible(issueId, userId))) {
      throw new NotFoundException(new IssueNotFoundException(issueId).message);
    }
    return true;
  }
 }
@@ -0,0 +1,9 @@
 export class FileDto {
  id: string;
  fileName: string;
  mimeType: string;
  size: number;
  /** null — загрузивший удалил аккаунт */
  uploaderId: string | null;
  createdAt: Date;
 }
@@ -0,0 +1,16 @@
 import { StoredFile } from '../../domain/entities/stored-file.entity.js';
 import { FileDto } from '../dto/file.dto.js';
 export class FileApplicationMapper {
  /** storageKey — деталь хранилища, наружу не отдаём */
  static toDto(file: StoredFile): FileDto {
    return {
      id: file.id as string,
      fileName: file.fileName,
      mimeType: file.mimeType,
      size: file.size,
      uploaderId: file.uploaderId,
      createdAt: file.createdAt,
    };
  }
 }
@@ -0,0 +1,29 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import type { IFileRepository } from '../../domain/repositories/file.repository.interface.js';
 import { FileForbiddenException } from '../../domain/exceptions/file-forbidden.exception.js';
 import { FileNotFoundException } from '../../domain/exceptions/file-not-found.exception.js';
 import { FileAccessService } from './file-access.service.js';
 import { buildFile, mockFileRepository, registryWithOwner } from '../use-cases/test-helpers.js';
 describe('FileAccessService.getAttachableFile', () => {
  let fileRepository: IFileRepository;
  let service: FileAccessService;
  beforeEach(() => {
    fileRepository = mockFileRepository();
    service = new FileAccessService(fileRepository, registryWithOwner({ visibleTo: { 'user-2': ['file-1'] } }));
    vi.mocked(fileRepository.findById).mockResolvedValue(buildFile());
  });
  it('returns an own file', async () => {
    await expect(service.getAttachableFile('file-1', 'user-1')).resolves.toMatchObject({ id: 'file-1' });
  });
  it('forbids attaching a visible file uploaded by someone else', async () => {
    await expect(service.getAttachableFile('file-1', 'user-2')).rejects.toThrow(FileForbiddenException);
  });
  it('hides an invisible file', async () => {
    await expect(service.getAttachableFile('file-1', 'user-3')).rejects.toThrow(FileNotFoundException);
  });
 });
@@ -0,0 +1,44 @@
 import { Inject, Injectable } from '@nestjs/common';
 import { FILE_REPOSITORY, type IFileRepository } from '../../domain/repositories/file.repository.interface.js';
 import { StoredFile } from '../../domain/entities/stored-file.entity.js';
 import { FileNotFoundException } from '../../domain/exceptions/file-not-found.exception.js';
 import { FileOwnerRegistry } from './file-owner.registry.js';
 import { FileDto } from '../dto/file.dto.js';
 import { FileApplicationMapper } from '../mappers/file-application.mapper.js';
@Injectable()
 export class FileAccessService {
  constructor(
    @Inject(FILE_REPOSITORY)
    private readonly fileRepository: IFileRepository,
    private readonly fileOwners: FileOwnerRegistry,
  ) {}
  /**
   * Файл виден загрузившему и всем, кому виден хоть один его владелец
   * (например, задача, к которой он прикреплён). Иначе — FileNotFoundException,
   * чтобы не раскрывать существование чужих файлов.
   */
  async getVisibleFile(id: string, userId: string): Promise<StoredFile> {
    const file = await this.fileRepository.findById(id);
    if (!file) {
      throw new FileNotFoundException(id);
    }
    if (file.isUploadedBy(userId) || (await this.fileOwners.isVisibleThroughAnyOwner(id, userId))) {
      return file;
    }
    throw new FileNotFoundException(id);
  }
  /**
   * Файл, который пользователь может прикрепить к задаче/комментарию:
   * невидимый — FileNotFoundException, видимый, но чужой — FileForbiddenException.
   */
  async getAttachableFile(id: string, userId: string): Promise<FileDto> {
    const file = await this.getVisibleFile(id, userId);
    file.assertOwnedBy(userId);
    return FileApplicationMapper.toDto(file);
  }
 }
@@ -0,0 +1,61 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import { ConfigService } from '@nestjs/config';
 import type { IFileRepository } from '../../domain/repositories/file.repository.interface.js';
 import type { IFileStorage } from '../../domain/ports/file-storage.port.js';
 import { FileGcService } from './file-gc.service.js';
 import { buildFile, mockFileRepository, mockFileStorage, registryWithOwner } from '../use-cases/test-helpers.js';
 describe('FileGcService', () => {
  let fileRepository: IFileRepository;
  let fileStorage: IFileStorage;
  const config = new ConfigService({ FILE_ORPHAN_TTL_HOURS: '24' });
  const now = new Date('2026-01-10T00:00:00.000Z');
  beforeEach(() => {
    fileRepository = mockFileRepository();
    fileStorage = mockFileStorage();
  });
  it('removes only unreferenced files older than the TTL', async () => {
    const gc = new FileGcService(fileRepository, fileStorage, registryWithOwner({ referenced: ['kept'] }), config);
    vi.mocked(fileRepository.findCreatedBefore).mockResolvedValueOnce([
      buildFile({ id: 'kept' }),
      buildFile({ id: 'orphan' }),
    ]);
    const removed = await gc.collect(now);
    expect(fileRepository.findCreatedBefore).toHaveBeenCalledWith({
      before: new Date('2026-01-09T00:00:00.000Z'),
      limit: 500,
      cursor: undefined,
    });
    expect(removed).toBe(1);
    expect(fileStorage.delete).toHaveBeenCalledExactlyOnceWith('files/orphan');
    expect(fileRepository.delete).toHaveBeenCalledExactlyOnceWith('orphan');
  });
  it('keeps the row when the object cannot be deleted and goes on', async () => {
    const gc = new FileGcService(fileRepository, fileStorage, registryWithOwner(), config);
    vi.mocked(fileRepository.findCreatedBefore).mockResolvedValueOnce([buildFile({ id: 'a' }), buildFile({ id: 'b' })]);
    vi.mocked(fileStorage.delete).mockRejectedValueOnce(new Error('s3 down'));
    const removed = await gc.collect(now);
    expect(removed).toBe(1);
    expect(fileRepository.delete).toHaveBeenCalledExactlyOnceWith('b');
  });
  it('pages through files by cursor', async () => {
    const gc = new FileGcService(fileRepository, fileStorage, registryWithOwner(), config);
    const fullBatch = Array.from({ length: 500 }, (_, i) => buildFile({ id: `f${i}` }));
    vi.mocked(fileRepository.findCreatedBefore)
      .mockResolvedValueOnce(fullBatch)
      .mockResolvedValueOnce([buildFile({ id: 'last' })]);
    const removed = await gc.collect(now);
    expect(removed).toBe(501);
    expect(vi.mocked(fileRepository.findCreatedBefore).mock.calls[1]![0]).toMatchObject({ cursor: 'f499' });
  });
 });
@@ -0,0 +1,90 @@
 import { Inject, Injectable, Logger } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
 import { Cron, CronExpression } from '@nestjs/schedule';
 import { FILE_REPOSITORY, type IFileRepository } from '../../domain/repositories/file.repository.interface.js';
 import { FILE_STORAGE, type IFileStorage } from '../../domain/ports/file-storage.port.js';
 import { FileOwnerRegistry } from './file-owner.registry.js';
 const BATCH_SIZE = 500;
 /**
 * Удаляет файлы-сироты — на которые не ссылается ни один владелец:
 * загруженные, но так и не прикреплённые, и те, чьи задачи/комментарии
 * удалены (каскад в БД убирает связь, но не сам файл).
 *
 * TTL нужен, чтобы не удалить файл, который пользователь только что загрузил
 * и вот-вот прикрепит (например, пока пишет комментарий).
 *
 * Сначала удаляется объект, потом строка: если упадёт удаление строки,
 * файл останется сиротой и будет подобран следующим запуском
 * (удаление объекта идемпотентно). Обратный порядок терял бы объекты навсегда.
 *
 * Несколько инстансов приложения могут запустить GC одновременно — это
 * безопасно, все операции идемпотентны.
 */
@Injectable()
 export class FileGcService {
  private readonly logger = new Logger(FileGcService.name);
  private readonly orphanTtlMs: number;
  private running = false;
  constructor(
    @Inject(FILE_REPOSITORY)
    private readonly fileRepository: IFileRepository,
    @Inject(FILE_STORAGE)
    private readonly fileStorage: IFileStorage,
    private readonly fileOwners: FileOwnerRegistry,
    config: ConfigService,
  ) {
    this.orphanTtlMs = Number(config.get('FILE_ORPHAN_TTL_HOURS', 24)) * 60 * 60 * 1000;
  }
  @Cron(CronExpression.EVERY_HOUR)
  async handleCron(): Promise<void> {
    if (this.running) return;
    this.running = true;
    try {
      const removed = await this.collect();
      if (removed > 0) {
        this.logger.log(`Удалено файлов-сирот: ${removed}`);
      }
    } catch (error) {
      this.logger.error('Сборка файлов-сирот упала', error instanceof Error ? error.stack : error);
    } finally {
      this.running = false;
    }
  }
  /** Возвращает количество удалённых файлов */
  async collect(now = new Date()): Promise<number> {
    const before = new Date(now.getTime() - this.orphanTtlMs);
    let cursor: string | undefined;
    let removed = 0;
    for (;;) {
      const batch = await this.fileRepository.findCreatedBefore({ before, limit: BATCH_SIZE, cursor });
      if (batch.length === 0) break;
      const ids = batch.map((file) => file.id as string);
      const referenced = await this.fileOwners.findReferenced(ids);
      for (const file of batch) {
        if (referenced.has(file.id as string)) continue;
        try {
          await this.fileStorage.delete(file.storageKey);
          await this.fileRepository.delete(file.id as string);
          removed++;
        } catch (error) {
          this.logger.warn(`Не удалось удалить файл id=${file.id}: ${error instanceof Error ? error.message : error}`);
        }
      }
      if (batch.length < BATCH_SIZE) break;
      cursor = ids[ids.length - 1];
    }
    return removed;
  }
 }
@@ -0,0 +1,49 @@
 import { Injectable } from '@nestjs/common';
 /**
 * Модуль, к сущностям которого привязываются файлы (задачи, комментарии...).
 * Связи хранятся в его таблицах (issue_attachment и т.п.), file-модуль
 * о них не знает и спрашивает через этот интерфейс.
 */
 export interface FileOwner {
  /** Для логов */
  readonly name: string;
  /** Подмножество fileIds, на которые ссылаются сущности этого владельца (для GC) */
  findReferenced(fileIds: string[]): Promise<string[]>;
  /** Виден ли файл пользователю через сущность этого владельца */
  isVisibleThrough(fileId: string, userId: string): Promise<boolean>;
 }
 /**
 * Реестр владельцев файлов. Модуль-владелец регистрируется в onModuleInit:
 *
 *   constructor(private readonly fileOwners: FileOwnerRegistry) {}
 *   onModuleInit() { this.fileOwners.register(this); }
 *
 * Важно: файл, на который не ссылается ни один зарегистрированный владелец,
 * GC считает сиротой. Новый владелец ОБЯЗАН зарегистрироваться.
 */
@Injectable()
 export class FileOwnerRegistry {
  private readonly owners: FileOwner[] = [];
  register(owner: FileOwner): void {
    this.owners.push(owner);
  }
  async findReferenced(fileIds: string[]): Promise<Set<string>> {
    if (fileIds.length === 0) return new Set();
    const results = await Promise.all(this.owners.map((owner) => owner.findReferenced(fileIds)));
    return new Set(results.flat());
  }
  async isVisibleThroughAnyOwner(fileId: string, userId: string): Promise<boolean> {
    for (const owner of this.owners) {
      if (await owner.isVisibleThrough(fileId, userId)) {
        return true;
      }
    }
    return false;
  }
 }
@@ -0,0 +1,6 @@
 export class DeleteFileCommand {
  constructor(
    public readonly id: string,
    public readonly userId: string,
  ) {}
 }
@@ -0,0 +1,52 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import type { IFileRepository } from '../../../domain/repositories/file.repository.interface.js';
 import type { IFileStorage } from '../../../domain/ports/file-storage.port.js';
 import { FileForbiddenException } from '../../../domain/exceptions/file-forbidden.exception.js';
 import { FileNotFoundException } from '../../../domain/exceptions/file-not-found.exception.js';
 import { FileAccessService } from '../../services/file-access.service.js';
 import { DeleteFileUseCase } from './delete-file.use-case.js';
 import { DeleteFileCommand } from './delete-file.command.js';
 import { buildFile, mockFileRepository, mockFileStorage, registryWithOwner } from '../test-helpers.js';
 describe('DeleteFileUseCase', () => {
  let fileRepository: IFileRepository;
  let fileStorage: IFileStorage;
  let useCase: DeleteFileUseCase;
  beforeEach(() => {
    fileRepository = mockFileRepository();
    fileStorage = mockFileStorage();
    const registry = registryWithOwner({ visibleTo: { 'user-2': ['file-1'] } });
    useCase = new DeleteFileUseCase(fileRepository, fileStorage, new FileAccessService(fileRepository, registry));
    vi.mocked(fileRepository.findById).mockResolvedValue(buildFile());
  });
  it('deletes the object first, then the row', async () => {
    const order: string[] = [];
    vi.mocked(fileStorage.delete).mockImplementation(async () => void order.push('storage'));
    vi.mocked(fileRepository.delete).mockImplementation(async () => void order.push('row'));
    await useCase.execute(new DeleteFileCommand('file-1', 'user-1'));
    expect(fileStorage.delete).toHaveBeenCalledWith('files/file-1');
    expect(fileRepository.delete).toHaveBeenCalledWith('file-1');
    expect(order).toEqual(['storage', 'row']);
  });
  it('keeps the row when deleting the object fails, so a retry can finish', async () => {
    vi.mocked(fileStorage.delete).mockRejectedValue(new Error('s3 down'));
    await expect(useCase.execute(new DeleteFileCommand('file-1', 'user-1'))).rejects.toThrow('s3 down');
    expect(fileRepository.delete).not.toHaveBeenCalled();
  });
  it('forbids deleting a visible file uploaded by someone else', async () => {
    await expect(useCase.execute(new DeleteFileCommand('file-1', 'user-2'))).rejects.toThrow(FileForbiddenException);
    expect(fileStorage.delete).not.toHaveBeenCalled();
  });
  it('returns not found for an invisible file', async () => {
    await expect(useCase.execute(new DeleteFileCommand('file-1', 'user-3'))).rejects.toThrow(FileNotFoundException);
  });
 });
@@ -0,0 +1,29 @@
 import { Inject, Injectable } from '@nestjs/common';
 import { FILE_REPOSITORY, type IFileRepository } from '../../../domain/repositories/file.repository.interface.js';
 import { FILE_STORAGE, type IFileStorage } from '../../../domain/ports/file-storage.port.js';
 import { DeleteFileCommand } from './delete-file.command.js';
 import { FileAccessService } from '../../services/file-access.service.js';
 /**
 * Удаляет файл целиком; связи с владельцами уходят каскадом в БД.
 * Порядок как в FileGcService: сначала объект, потом строка — при сбое
 * повторный DELETE доведёт дело до конца, объект не потеряется.
 */
@Injectable()
 export class DeleteFileUseCase {
  constructor(
    @Inject(FILE_REPOSITORY)
    private readonly fileRepository: IFileRepository,
    @Inject(FILE_STORAGE)
    private readonly fileStorage: IFileStorage,
    private readonly fileAccess: FileAccessService,
  ) {}
  async execute(command: DeleteFileCommand): Promise<void> {
    const file = await this.fileAccess.getVisibleFile(command.id, command.userId);
    file.assertOwnedBy(command.userId);
    await this.fileStorage.delete(file.storageKey);
    await this.fileRepository.delete(command.id);
  }
 }
@@ -0,0 +1,6 @@
 export class DownloadFileQuery {
  constructor(
    public readonly id: string,
    public readonly userId: string,
  ) {}
 }
@@ -0,0 +1,63 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import type { Readable } from 'node:stream';
 import type { IFileRepository } from '../../../domain/repositories/file.repository.interface.js';
 import type { IFileStorage } from '../../../domain/ports/file-storage.port.js';
 import { FileNotFoundException } from '../../../domain/exceptions/file-not-found.exception.js';
 import { FileAccessService } from '../../services/file-access.service.js';
 import { DownloadFileUseCase } from './download-file.use-case.js';
 import { DownloadFileQuery } from './download-file.query.js';
 import { buildFile, mockFileRepository, mockFileStorage, registryWithOwner } from '../test-helpers.js';
 describe('DownloadFileUseCase', () => {
  let fileRepository: IFileRepository;
  let fileStorage: IFileStorage;
  let useCase: DownloadFileUseCase;
  const stream = {} as Readable;
  beforeEach(() => {
    fileRepository = mockFileRepository();
    fileStorage = mockFileStorage();
    const registry = registryWithOwner({ visibleTo: { 'user-2': ['file-1'] } });
    useCase = new DownloadFileUseCase(fileStorage, new FileAccessService(fileRepository, registry));
    vi.mocked(fileStorage.get).mockResolvedValue(stream);
  });
  it('lets the uploader download the file', async () => {
    vi.mocked(fileRepository.findById).mockResolvedValue(buildFile());
    const result = await useCase.execute(new DownloadFileQuery('file-1', 'user-1'));
    expect(fileStorage.get).toHaveBeenCalledWith('files/file-1');
    expect(result).toMatchObject({ file: { id: 'file-1' }, inline: true, stream });
  });
  it('lets a user who sees an owner of the file download it', async () => {
    vi.mocked(fileRepository.findById).mockResolvedValue(buildFile());
    await expect(useCase.execute(new DownloadFileQuery('file-1', 'user-2'))).resolves.toMatchObject({
      file: { id: 'file-1' },
    });
  });
  it('marks non-image files as attachment-only', async () => {
    vi.mocked(fileRepository.findById).mockResolvedValue(buildFile({ mimeType: 'application/octet-stream' }));
    const result = await useCase.execute(new DownloadFileQuery('file-1', 'user-1'));
    expect(result.inline).toBe(false);
  });
  it('hides the file from everyone else', async () => {
    vi.mocked(fileRepository.findById).mockResolvedValue(buildFile());
    await expect(useCase.execute(new DownloadFileQuery('file-1', 'user-3'))).rejects.toThrow(FileNotFoundException);
    expect(fileStorage.get).not.toHaveBeenCalled();
  });
  it('throws FileNotFoundException for a missing file', async () => {
    vi.mocked(fileRepository.findById).mockResolvedValue(null);
    await expect(useCase.execute(new DownloadFileQuery('file-1', 'user-1'))).rejects.toThrow(FileNotFoundException);
  });
 });
@@ -0,0 +1,34 @@
 import type { Readable } from 'node:stream';
 import { Inject, Injectable } from '@nestjs/common';
 import { FILE_STORAGE, type IFileStorage } from '../../../domain/ports/file-storage.port.js';
 import { DownloadFileQuery } from './download-file.query.js';
 import { FileDto } from '../../dto/file.dto.js';
 import { FileApplicationMapper } from '../../mappers/file-application.mapper.js';
 import { FileAccessService } from '../../services/file-access.service.js';
 export interface DownloadFileResult {
  file: FileDto;
  /** Можно ли показывать в браузере inline, иначе — только скачивание */
  inline: boolean;
  stream: Readable;
 }
@Injectable()
 export class DownloadFileUseCase {
  constructor(
    @Inject(FILE_STORAGE)
    private readonly fileStorage: IFileStorage,
    private readonly fileAccess: FileAccessService,
  ) {}
  async execute(query: DownloadFileQuery): Promise<DownloadFileResult> {
    const file = await this.fileAccess.getVisibleFile(query.id, query.userId);
    const stream = await this.fileStorage.get(file.storageKey);
    return {
      file: FileApplicationMapper.toDto(file),
      inline: file.isInlineViewable,
      stream,
    };
  }
 }
@@ -0,0 +1,3 @@
 export class GetFilesQuery {
  constructor(public readonly ids: string[]) {}
 }
@@ -0,0 +1,24 @@
 import { Inject, Injectable } from '@nestjs/common';
 import { FILE_REPOSITORY, type IFileRepository } from '../../../domain/repositories/file.repository.interface.js';
 import { GetFilesQuery } from './get-files.query.js';
 import { FileDto } from '../../dto/file.dto.js';
 import { FileApplicationMapper } from '../../mappers/file-application.mapper.js';
 /**
 * Метаданные файлов по id — для модулей-владельцев, раскрывающих свои связи
 * в FileDto (по аналогии с GetUsersUseCase). Доступ проверяет вызывающий:
 * он отдаёт только файлы своих сущностей, видимых пользователю.
 */
@Injectable()
 export class GetFilesUseCase {
  constructor(
    @Inject(FILE_REPOSITORY)
    private readonly fileRepository: IFileRepository,
  ) {}
  async execute(query: GetFilesQuery): Promise<FileDto[]> {
    const ids = [...new Set(query.ids)];
    const files = await this.fileRepository.findByIds(ids);
    return files.map(FileApplicationMapper.toDto);
  }
 }
@@ -0,0 +1,46 @@
 import { vi } from 'vitest';
 import type { IFileRepository } from '../../domain/repositories/file.repository.interface.js';
 import type { IFileStorage } from '../../domain/ports/file-storage.port.js';
 import { StoredFile } from '../../domain/entities/stored-file.entity.js';
 import { FileOwnerRegistry, type FileOwner } from '../services/file-owner.registry.js';
 export const buildFile = (
  overrides: Partial<{ id: string; uploaderId: string | null; mimeType: string; createdAt: Date }> = {},
 ) =>
  StoredFile.reconstitute({
    id: overrides.id ?? 'file-1',
    storageKey: `files/${overrides.id ?? 'file-1'}`,
    fileName: 'photo.png',
    mimeType: overrides.mimeType ?? 'image/png',
    size: 10,
    uploaderId: overrides.uploaderId === undefined ? 'user-1' : overrides.uploaderId,
    createdAt: overrides.createdAt ?? new Date('2026-01-01T00:00:00.000Z'),
  });
 export const mockFileRepository = (): IFileRepository => ({
  findById: vi.fn(),
  findByIds: vi.fn(),
  findCreatedBefore: vi.fn(),
  create: vi.fn(),
  delete: vi.fn(),
 });
 export const mockFileStorage = (): IFileStorage => ({
  put: vi.fn(),
  get: vi.fn(),
  delete: vi.fn(),
 });
 /** Реестр с одним владельцем, которому видны/принадлежат перечисленные файлы */
 export const registryWithOwner = (params: { referenced?: string[]; visibleTo?: Record<string, string[]> } = {}) => {
  const owner: FileOwner = {
    name: 'test',
    findReferenced: vi.fn(async (ids: string[]) => ids.filter((id) => params.referenced?.includes(id))),
    isVisibleThrough: vi.fn(async (fileId: string, userId: string) =>
      Boolean(params.visibleTo?.[userId]?.includes(fileId)),
    ),
  };
  const registry = new FileOwnerRegistry();
  registry.register(owner);
  return registry;
 };
@@ -0,0 +1,9 @@
 export class UploadFileCommand {
  constructor(
    public readonly uploaderId: string,
    /** Временный файл, куда multer сохранил загрузку. Удаляет его вызывающий */
    public readonly tempPath: string,
    public readonly originalName: string,
    public readonly size: number,
  ) {}
 }
@@ -0,0 +1,75 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import type { IFileRepository } from '../../../domain/repositories/file.repository.interface.js';
 import type { IFileStorage } from '../../../domain/ports/file-storage.port.js';
 import type { IFileTypeDetector } from '../../../domain/ports/file-type-detector.port.js';
 import { StoredFile } from '../../../domain/entities/stored-file.entity.js';
 import { UploadFileUseCase } from './upload-file.use-case.js';
 import { UploadFileCommand } from './upload-file.command.js';
 import { mockFileRepository, mockFileStorage } from '../test-helpers.js';
 vi.mock('node:fs', () => ({ createReadStream: vi.fn(() => 'stream') }));
 describe('UploadFileUseCase', () => {
  let fileRepository: IFileRepository;
  let fileStorage: IFileStorage;
  let detector: IFileTypeDetector;
  let useCase: UploadFileUseCase;
  beforeEach(() => {
    fileRepository = mockFileRepository();
    fileStorage = mockFileStorage();
    detector = { detect: vi.fn() };
    useCase = new UploadFileUseCase(fileRepository, fileStorage, detector);
    vi.mocked(fileRepository.create).mockImplementation(async (file: StoredFile) =>
      StoredFile.reconstitute({
        id: 'file-1',
        storageKey: file.storageKey,
        fileName: file.fileName,
        mimeType: file.mimeType,
        size: file.size,
        uploaderId: file.uploaderId,
        createdAt: file.createdAt,
      }),
    );
  });
  it('stores the file under a generated key with the sniffed MIME type', async () => {
    vi.mocked(detector.detect).mockResolvedValue('image/png');
    const dto = await useCase.execute(new UploadFileCommand('user-1', '/tmp/upload', 'photo.png', 10));
    const [key, , meta] = vi.mocked(fileStorage.put).mock.calls[0]!;
    expect(key).toMatch(/^files\/[0-9a-f-]{36}$/);
    expect(meta).toEqual({ contentType: 'image/png', size: 10 });
    expect(dto).toEqual({
      id: 'file-1',
      fileName: 'photo.png',
      mimeType: 'image/png',
      size: 10,
      uploaderId: 'user-1',
      createdAt: expect.any(Date),
    });
    expect(dto).not.toHaveProperty('storageKey');
  });
  it('falls back to octet-stream for unrecognized content, ignoring the name', async () => {
    vi.mocked(detector.detect).mockResolvedValue(null);
    const dto = await useCase.execute(new UploadFileCommand('user-1', '/tmp/upload', 'evil.html', 10));
    expect(dto.mimeType).toBe('application/octet-stream');
  });
  it('removes the stored object when saving the row fails', async () => {
    vi.mocked(detector.detect).mockResolvedValue('image/png');
    vi.mocked(fileRepository.create).mockRejectedValue(new Error('db down'));
    await expect(useCase.execute(new UploadFileCommand('user-1', '/tmp/upload', 'photo.png', 10))).rejects.toThrow(
      'db down',
    );
    const [key] = vi.mocked(fileStorage.put).mock.calls[0]!;
    expect(fileStorage.delete).toHaveBeenCalledWith(key);
  });
 });
@@ -0,0 +1,64 @@
 import { randomUUID } from 'node:crypto';
 import { createReadStream } from 'node:fs';
 import { Inject, Injectable, Logger } from '@nestjs/common';
 import { FILE_REPOSITORY, type IFileRepository } from '../../../domain/repositories/file.repository.interface.js';
 import { FILE_STORAGE, type IFileStorage } from '../../../domain/ports/file-storage.port.js';
 import { FILE_TYPE_DETECTOR, type IFileTypeDetector } from '../../../domain/ports/file-type-detector.port.js';
 import { StoredFile } from '../../../domain/entities/stored-file.entity.js';
 import { UploadFileCommand } from './upload-file.command.js';
 import { FileDto } from '../../dto/file.dto.js';
 import { FileApplicationMapper } from '../../mappers/file-application.mapper.js';
 const UNKNOWN_MIME_TYPE = 'application/octet-stream';
 /**
 * Загружает файл без привязки к владельцу. Прикрепление к задаче/комментарию —
 * отдельный шаг в модуле-владельце; не прикреплённый файл удалит GC.
 */
@Injectable()
 export class UploadFileUseCase {
  private readonly logger = new Logger(UploadFileUseCase.name);
  constructor(
    @Inject(FILE_REPOSITORY)
    private readonly fileRepository: IFileRepository,
    @Inject(FILE_STORAGE)
    private readonly fileStorage: IFileStorage,
    @Inject(FILE_TYPE_DETECTOR)
    private readonly fileTypeDetector: IFileTypeDetector,
  ) {}
  async execute(command: UploadFileCommand): Promise<FileDto> {
    // Заголовку Content-Type от клиента не доверяем. Нераспознанное
    // (в т.ч. HTML/SVG) хранится как octet-stream и отдаётся только на скачивание.
    const mimeType = (await this.fileTypeDetector.detect(command.tempPath)) ?? UNKNOWN_MIME_TYPE;
    const storageKey = `files/${randomUUID()}`;
    await this.fileStorage.put(storageKey, createReadStream(command.tempPath), {
      contentType: mimeType,
      size: command.size,
    });
    try {
      const file = await this.fileRepository.create(
        StoredFile.create({
          storageKey,
          fileName: command.originalName,
          mimeType,
          size: command.size,
          uploaderId: command.uploaderId,
        }),
      );
      return FileApplicationMapper.toDto(file);
    } catch (error) {
      // Строки нет — GC этот объект никогда не найдёт, убираем сразу
      try {
        await this.fileStorage.delete(storageKey);
      } catch (cleanupError) {
        this.logger.warn(`Не удалось удалить объект ${storageKey}: ${String(cleanupError)}`);
      }
      throw error;
    }
  }
 }
@@ -0,0 +1,43 @@
 import { describe, expect, it } from 'vitest';
 import { StoredFile } from './stored-file.entity.js';
 import { FileForbiddenException } from '../exceptions/file-forbidden.exception.js';
 const build = (mimeType = 'image/png', uploaderId: string | null = 'user-1') =>
  StoredFile.reconstitute({
    id: 'file-1',
    storageKey: 'files/key',
    fileName: 'photo.png',
    mimeType,
    size: 10,
    uploaderId,
    createdAt: new Date('2026-01-01T00:00:00.000Z'),
  });
 describe('StoredFile', () => {
  it('creates a new file with sanitized name and no id', () => {
    const file = StoredFile.create({
      storageKey: 'files/key',
      fileName: '../secret/report.pdf',
      mimeType: 'application/pdf',
      size: 100,
      uploaderId: 'user-1',
    });
    expect(file.id).toBeNull();
    expect(file.fileName).toBe('report.pdf');
    expect(file.uploaderId).toBe('user-1');
  });
  it('allows inline view only for safe image types', () => {
    expect(build('image/png').isInlineViewable).toBe(true);
    expect(build('image/svg+xml').isInlineViewable).toBe(false);
    expect(build('text/html').isInlineViewable).toBe(false);
    expect(build('application/octet-stream').isInlineViewable).toBe(false);
  });
  it('treats only the uploader as the owner', () => {
    expect(() => build().assertOwnedBy('user-1')).not.toThrow();
    expect(() => build().assertOwnedBy('user-2')).toThrow(FileForbiddenException);
    expect(() => build('image/png', null).assertOwnedBy('user-1')).toThrow(FileForbiddenException);
  });
 });
@@ -0,0 +1,112 @@
 import { FileName } from '../value-objects/file-name.vo.js';
 import { FileForbiddenException } from '../exceptions/file-forbidden.exception.js';
 interface StoredFileProps {
  id: string | null;
  storageKey: string;
  fileName: FileName;
  mimeType: string;
  size: number;
  /** null — загрузивший удалил аккаунт */
  uploaderId: string | null;
  createdAt: Date;
 }
 /**
 * Типы, которые безопасно показывать в браузере inline. Всё остальное
 * (в т.ч. HTML и SVG — источник stored XSS) отдаётся только на скачивание.
 */
 const INLINE_MIME_TYPES = new Set(['image/png', 'image/jpeg', 'image/gif', 'image/webp']);
 /**
 * Загруженный файл (не путать с глобальным `File` из Web API).
 * О владельцах (задача, комментарий...) ничего не знает — связи живут
 * в модулях-владельцах, см. FileOwnerRegistry.
 *
 * `id` (uuid v7) генерирует Prisma, поэтому у нового файла он null до сохранения.
 */
 export class StoredFile {
  private constructor(private readonly props: StoredFileProps) {}
  /** Фабричный метод для НОВОГО файла, уже положенного в хранилище */
  static create(params: {
    storageKey: string;
    fileName: string;
    mimeType: string;
    size: number;
    uploaderId: string;
  }): StoredFile {
    return new StoredFile({
      id: null,
      storageKey: params.storageKey,
      fileName: FileName.create(params.fileName),
      mimeType: params.mimeType,
      size: params.size,
      uploaderId: params.uploaderId,
      createdAt: new Date(),
    });
  }
  /** Восстановление сущности из персистентного слоя */
  static reconstitute(props: {
    id: string;
    storageKey: string;
    fileName: string;
    mimeType: string;
    size: number;
    uploaderId: string | null;
    createdAt: Date;
  }): StoredFile {
    return new StoredFile({
      ...props,
      fileName: FileName.create(props.fileName),
    });
  }
  get id(): string | null {
    return this.props.id;
  }
  get storageKey(): string {
    return this.props.storageKey;
  }
  get fileName(): string {
    return this.props.fileName.value;
  }
  get mimeType(): string {
    return this.props.mimeType;
  }
  get size(): number {
    return this.props.size;
  }
  get uploaderId(): string | null {
    return this.props.uploaderId;
  }
  get createdAt(): Date {
    return this.props.createdAt;
  }
  get isInlineViewable(): boolean {
    return INLINE_MIME_TYPES.has(this.props.mimeType);
  }
  isUploadedBy(userId: string): boolean {
    return this.props.uploaderId === userId;
  }
  /**
   * Удалить файл или прикрепить его к сущности может только тот, кто его загрузил.
   * Иначе, увидев файл через одну задачу, можно было бы «перенести» его
   * в другую и раскрыть людям, которым он не предназначался.
   */
  assertOwnedBy(userId: string): void {
    if (!this.isUploadedBy(userId)) {
      throw new FileForbiddenException(this.props.id ?? 'new');
    }
  }
 }
@@ -0,0 +1,6 @@
 export class FileForbiddenException extends Error {
  constructor(id: string) {
    super(`Нет прав на это действие с файлом id=${id}`);
    this.name = 'FileForbiddenException';
  }
 }
@@ -0,0 +1,6 @@
 export class FileNotFoundException extends Error {
  constructor(id: string) {
    super(`Файл с id=${id} не найден`);
    this.name = 'FileNotFoundException';
  }
 }
@@ -0,0 +1,13 @@
 import type { Readable } from 'node:stream';
 /** DI-токен, т.к. интерфейсы стираются при компиляции TS */
 export const FILE_STORAGE = Symbol('FILE_STORAGE');
 /** Объектное хранилище содержимого файлов (S3-совместимое или локальный диск) */
 export interface IFileStorage {
  put(key: string, body: Readable, meta: { contentType: string; size: number }): Promise<void>;
  /** Бросает ошибку сразу, если объекта нет, — до того как ответ начнёт отправляться */
  get(key: string): Promise<Readable>;
  /** Идемпотентно: отсутствие объекта не ошибка */
  delete(key: string): Promise<void>;
 }
@@ -0,0 +1,8 @@
 /** DI-токен, т.к. интерфейсы стираются при компиляции TS */
 export const FILE_TYPE_DETECTOR = Symbol('FILE_TYPE_DETECTOR');
 /** Определяет MIME-тип по содержимому файла, а не по заголовку от клиента */
 export interface IFileTypeDetector {
  /** null — тип не распознан (в т.ч. все текстовые форматы: HTML, SVG, CSV...) */
  detect(path: string): Promise<string | null>;
 }
@@ -0,0 +1,16 @@
 import { StoredFile } from '../entities/stored-file.entity.js';
 /** DI-токен, т.к. интерфейсы стираются при компиляции TS */
 export const FILE_REPOSITORY = Symbol('FILE_REPOSITORY');
 export interface IFileRepository {
  findById(id: string): Promise<StoredFile | null>;
  findByIds(ids: string[]): Promise<StoredFile[]>;
  /**
   * Файлы, созданные раньше `before`, по возрастанию id (uuid v7 ≈ время создания).
   * Курсорная пагинация для GC: cursor — id последнего полученного файла.
   */
  findCreatedBefore(params: { before: Date; limit: number; cursor?: string }): Promise<StoredFile[]>;
  create(file: StoredFile): Promise<StoredFile>;
  delete(id: string): Promise<void>;
 }
@@ -0,0 +1,30 @@
 import { describe, expect, it } from 'vitest';
 import { FileName } from './file-name.vo.js';
 describe('FileName', () => {
  it('keeps a regular name, including cyrillic', () => {
    expect(FileName.create('Отчёт за май.pdf').value).toBe('Отчёт за май.pdf');
  });
  it('strips directories from the client-supplied path', () => {
    expect(FileName.create('C:\\Users\\me\\photo.png').value).toBe('photo.png');
    expect(FileName.create('../../etc/passwd').value).toBe('passwd');
  });
  it('removes control characters', () => {
    expect(FileName.create('evil\r\nname\u0000.txt').value).toBe('evilname.txt');
  });
  it('falls back when nothing is left', () => {
    expect(FileName.create('').value).toBe(FileName.FALLBACK);
    expect(FileName.create('  ').value).toBe(FileName.FALLBACK);
    expect(FileName.create('dir/..').value).toBe(FileName.FALLBACK);
  });
  it('truncates long names keeping the extension', () => {
    const name = FileName.create(`${'a'.repeat(300)}.docx`).value;
    expect([...name]).toHaveLength(FileName.MAX_LENGTH);
    expect(name.endsWith('.docx')).toBe(true);
  });
 });
@@ -0,0 +1,52 @@
 /**
 * Оригинальное имя файла — только для отображения и Content-Disposition.
 * В ключ хранилища не попадает, поэтому достаточно убрать путь и
 * управляющие символы, а не экранировать всё подряд.
 */
 export class FileName {
  static readonly MAX_LENGTH = 255;
  static readonly FALLBACK = 'file';
  private constructor(private readonly _value: string) {}
  static create(value: string): FileName {
    const baseName = (value ?? '').split(/[/\\]/).pop() ?? '';
    const cleaned = Array.from(baseName.normalize('NFC'))
      .filter((char) => !FileName.isControl(char))
      .join('')
      .trim();
    if (!cleaned || cleaned === '.' || cleaned === '..') {
      return new FileName(FileName.FALLBACK);
    }
    return new FileName(FileName.truncate(cleaned));
  }
  /** C0-управляющие символы и DEL: переводы строк ломают заголовки, \0 — пути */
  private static isControl(char: string): boolean {
    const code = char.codePointAt(0)!;
    return code <= 0x1f || code === 0x7f;
  }
  /** Обрезает длинное имя, сохраняя расширение */
  private static truncate(name: string): string {
    const chars = Array.from(name);
    if (chars.length <= FileName.MAX_LENGTH) {
      return name;
    }
    const dot = name.lastIndexOf('.');
    // Array.from, а не split(''): длина в code points, суррогатные пары не рвём
    const ext = dot > 0 ? Array.from(name.slice(dot)) : [];
    if (ext.length === 0 || ext.length > 16) {
      return chars.slice(0, FileName.MAX_LENGTH).join('');
    }
    return chars.slice(0, FileName.MAX_LENGTH - ext.length).join('') + ext.join('');
  }
  get value(): string {
    return this._value;
  }
 }
@@ -0,0 +1,67 @@
 import { tmpdir } from 'node:os';
 import { Module } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
 import { MulterModule } from '@nestjs/platform-express';
 import { PrismaModule } from '../../common/prisma-adapter/prisma.module.js';
 import { FILE_REPOSITORY } from './domain/repositories/file.repository.interface.js';
 import { FILE_STORAGE } from './domain/ports/file-storage.port.js';
 import { FILE_TYPE_DETECTOR } from './domain/ports/file-type-detector.port.js';
 import { FilePrismaRepository } from './infrastructure/persistence/prisma/repositories/file.prisma-repository.js';
 import { createFileStorage } from './infrastructure/storage/file-storage.factory.js';
 import { FileTypeDetector } from './infrastructure/storage/file-type.detector.js';
 import { FileController } from './presentation/controllers/file.controller.js';
 import { UploadFileUseCase } from './application/use-cases/upload-file/upload-file.use-case.js';
 import { DownloadFileUseCase } from './application/use-cases/download-file/download-file.use-case.js';
 import { DeleteFileUseCase } from './application/use-cases/delete-file/delete-file.use-case.js';
 import { GetFilesUseCase } from './application/use-cases/get-files/get-files.use-case.js';
 import { FileAccessService } from './application/services/file-access.service.js';
 import { FileGcService } from './application/services/file-gc.service.js';
 import { FileOwnerRegistry } from './application/services/file-owner.registry.js';
@Module({
  imports: [
    PrismaModule,
    MulterModule.registerAsync({
      inject: [ConfigService],
      useFactory: (config: ConfigService) => ({
        // Загрузка пишется во временный файл, а не в память: тип определяем
        // по содержимому, размер известен заранее, память не зависит от размера файла
        dest: tmpdir(),
        // Без этого multer декодирует имя файла как latin1 и ломает кириллицу
        defParamCharset: 'utf8',
        limits: {
          fileSize: Number(config.get('FILE_MAX_SIZE_MB', 25)) * 1024 * 1024,
          files: 1,
        },
      }),
    }),
  ],
  controllers: [FileController],
  providers: [
    UploadFileUseCase,
    DownloadFileUseCase,
    DeleteFileUseCase,
    GetFilesUseCase,
    FileAccessService,
    FileGcService,
    FileOwnerRegistry,
    {
      // Domain видит только интерфейсы, конкретные реализации подставляет DI-контейнер здесь
      provide: FILE_REPOSITORY,
      useClass: FilePrismaRepository,
    },
    {
      provide: FILE_STORAGE,
      inject: [ConfigService],
      useFactory: createFileStorage,
    },
    {
      provide: FILE_TYPE_DETECTOR,
      useClass: FileTypeDetector,
    },
  ],
  // Модули-владельцы (issue, comment) регистрируются в реестре,
  // проверяют прикрепляемые файлы и раскрывают связи в FileDto
  exports: [FileOwnerRegistry, FileAccessService, GetFilesUseCase],
 })
 export class FileModule {}
@@ -0,0 +1,27 @@
 import type { File as PrismaFile, Prisma } from '../../../../../../generated/prisma/client.js';
 import { StoredFile } from '../../../../domain/entities/stored-file.entity.js';
 export class FilePrismaMapper {
  static toDomain(record: PrismaFile): StoredFile {
    return StoredFile.reconstitute({
      id: record.id,
      storageKey: record.storageKey,
      fileName: record.fileName,
      mimeType: record.mimeType,
      size: record.size,
      uploaderId: record.uploaderId,
      createdAt: record.createdAt,
    });
  }
  static toCreateInput(file: StoredFile): Prisma.FileUncheckedCreateInput {
    return {
      storageKey: file.storageKey,
      fileName: file.fileName,
      mimeType: file.mimeType,
      size: file.size,
      uploaderId: file.uploaderId,
      createdAt: file.createdAt,
    };
  }
 }
@@ -0,0 +1,46 @@
 import { Injectable } from '@nestjs/common';
 import { PrismaAdapter } from '../../../../../../common/prisma-adapter/prisma.adapter.js';
 import { StoredFile } from '../../../../domain/entities/stored-file.entity.js';
 import { IFileRepository } from '../../../../domain/repositories/file.repository.interface.js';
 import { FilePrismaMapper } from '../mappers/file.mapper.js';
@Injectable()
 export class FilePrismaRepository implements IFileRepository {
  constructor(private readonly prisma: PrismaAdapter) {}
  async findById(id: string): Promise<StoredFile | null> {
    const record = await this.prisma.file.findUnique({ where: { id } });
    return record ? FilePrismaMapper.toDomain(record) : null;
  }
  async findByIds(ids: string[]): Promise<StoredFile[]> {
    if (ids.length === 0) return [];
    const records = await this.prisma.file.findMany({ where: { id: { in: ids } } });
    return records.map(FilePrismaMapper.toDomain);
  }
  async findCreatedBefore(params: { before: Date; limit: number; cursor?: string }): Promise<StoredFile[]> {
    const records = await this.prisma.file.findMany({
      where: { createdAt: { lt: params.before } },
      orderBy: { id: 'asc' },
      take: Math.max(1, params.limit),
      ...(params.cursor ? { cursor: { id: params.cursor }, skip: 1 } : {}),
    });
    return records.map(FilePrismaMapper.toDomain);
  }
  async create(file: StoredFile): Promise<StoredFile> {
    const record = await this.prisma.file.create({
      data: FilePrismaMapper.toCreateInput(file),
    });
    return FilePrismaMapper.toDomain(record);
  }
  async delete(id: string): Promise<void> {
    // deleteMany не падает, если строку уже удалил параллельный запрос/GC
    await this.prisma.file.deleteMany({ where: { id } });
  }
 }
@@ -0,0 +1,26 @@
 import { ConfigService } from '@nestjs/config';
 import type { IFileStorage } from '../../domain/ports/file-storage.port.js';
 import { LocalFileStorage } from './local-file-storage.js';
 import { S3FileStorage } from './s3-file-storage.js';
 /** FILE_STORAGE=s3 — S3-совместимое хранилище, иначе локальный диск */
 export function createFileStorage(config: ConfigService): IFileStorage {
  const driver = config.get<string>('FILE_STORAGE', 'local');
  if (driver === 's3') {
    return new S3FileStorage({
      endpoint: config.get<string>('S3_ENDPOINT') || undefined,
      region: config.get<string>('S3_REGION', 'us-east-1'),
      bucket: config.getOrThrow<string>('S3_BUCKET'),
      accessKeyId: config.getOrThrow<string>('S3_ACCESS_KEY_ID'),
      secretAccessKey: config.getOrThrow<string>('S3_SECRET_ACCESS_KEY'),
      forcePathStyle: config.get<string>('S3_FORCE_PATH_STYLE', 'true') !== 'false',
    });
  }
  if (driver !== 'local') {
    throw new Error(`Неизвестный FILE_STORAGE=${driver}, ожидается local | s3`);
  }
  return new LocalFileStorage(config.get<string>('FILE_STORAGE_LOCAL_DIR', './storage'));
 }
@@ -0,0 +1,11 @@
 import { Injectable } from '@nestjs/common';
 import { fileTypeFromFile } from 'file-type';
 import type { IFileTypeDetector } from '../../domain/ports/file-type-detector.port.js';
 /** Определение типа по сигнатуре (magic bytes) через file-type */
@Injectable()
 export class FileTypeDetector implements IFileTypeDetector {
  async detect(path: string): Promise<string | null> {
    return (await fileTypeFromFile(path))?.mime ?? null;
  }
 }
@@ -0,0 +1,38 @@
 import { mkdtemp, rm } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { Readable } from 'node:stream';
 import { text } from 'node:stream/consumers';
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
 import { LocalFileStorage } from './local-file-storage.js';
 describe('LocalFileStorage', () => {
  let root: string;
  let storage: LocalFileStorage;
  beforeEach(async () => {
    root = await mkdtemp(join(tmpdir(), 'ulitka-files-'));
    storage = new LocalFileStorage(root);
  });
  afterEach(async () => {
    await rm(root, { recursive: true, force: true });
  });
  it('puts, gets and deletes an object', async () => {
    await storage.put('files/a', Readable.from(['hello']));
    expect(await text(await storage.get('files/a'))).toBe('hello');
    await storage.delete('files/a');
    await expect(storage.get('files/a')).rejects.toThrow();
  });
  it('treats deleting a missing object as success', async () => {
    await expect(storage.delete('files/missing')).resolves.toBeUndefined();
  });
  it('rejects keys escaping the root', async () => {
    await expect(storage.put('../escape', Readable.from(['x']))).rejects.toThrow('Недопустимый ключ');
  });
 });
@@ -0,0 +1,40 @@
 import { createReadStream, createWriteStream } from 'node:fs';
 import { mkdir, rm, stat } from 'node:fs/promises';
 import { dirname, resolve, sep } from 'node:path';
 import type { Readable } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
 import type { IFileStorage } from '../../domain/ports/file-storage.port.js';
 /** Хранилище на локальном диске — для разработки и тестов */
 export class LocalFileStorage implements IFileStorage {
  private readonly root: string;
  constructor(root: string) {
    this.root = resolve(root);
  }
  async put(key: string, body: Readable): Promise<void> {
    const path = this.resolveKey(key);
    await mkdir(dirname(path), { recursive: true });
    await pipeline(body, createWriteStream(path));
  }
  async get(key: string): Promise<Readable> {
    const path = this.resolveKey(key);
    await stat(path);
    return createReadStream(path);
  }
  async delete(key: string): Promise<void> {
    await rm(this.resolveKey(key), { force: true });
  }
  /** Ключи генерирует приложение, но выход за пределы root всё равно запрещаем */
  private resolveKey(key: string): string {
    const path = resolve(this.root, key);
    if (!path.startsWith(this.root + sep)) {
      throw new Error(`Недопустимый ключ хранилища: ${key}`);
    }
    return path;
  }
 }
@@ -0,0 +1,60 @@
 import type { Readable } from 'node:stream';
 import { DeleteObjectCommand, GetObjectCommand, PutObjectCommand, S3Client } from '@aws-sdk/client-s3';
 import type { IFileStorage } from '../../domain/ports/file-storage.port.js';
 export interface S3FileStorageOptions {
  /** Для MinIO/RustFS — адрес сервера, для AWS можно не задавать */
  endpoint?: string;
  region: string;
  bucket: string;
  accessKeyId: string;
  secretAccessKey: string;
  /** MinIO/RustFS обычно требуют path-style (http://host/bucket/key) */
  forcePathStyle: boolean;
 }
 /**
 * S3-совместимое хранилище (AWS S3, MinIO, RustFS...).
 * Бакет должен существовать заранее — приложение его не создаёт.
 */
 export class S3FileStorage implements IFileStorage {
  private readonly client: S3Client;
  private readonly bucket: string;
  constructor(options: S3FileStorageOptions) {
    this.bucket = options.bucket;
    this.client = new S3Client({
      endpoint: options.endpoint,
      region: options.region,
      forcePathStyle: options.forcePathStyle,
      credentials: {
        accessKeyId: options.accessKeyId,
        secretAccessKey: options.secretAccessKey,
      },
    });
  }
  async put(key: string, body: Readable, meta: { contentType: string; size: number }): Promise<void> {
    await this.client.send(
      new PutObjectCommand({
        Bucket: this.bucket,
        Key: key,
        Body: body,
        ContentType: meta.contentType,
        // Без длины SDK не может отправить поток одним PUT
        ContentLength: meta.size,
      }),
    );
  }
  async get(key: string): Promise<Readable> {
    const response = await this.client.send(new GetObjectCommand({ Bucket: this.bucket, Key: key }));
    // В Node.js Body — это Readable (IncomingMessage с примесями SDK)
    return response.Body as Readable;
  }
  async delete(key: string): Promise<void> {
    // DeleteObject в S3 идемпотентен — отсутствие объекта не ошибка
    await this.client.send(new DeleteObjectCommand({ Bucket: this.bucket, Key: key }));
  }
 }
@@ -0,0 +1,101 @@
 import { rm } from 'node:fs/promises';
 import {
  BadRequestException,
  Controller,
  Delete,
  ForbiddenException,
  Get,
  HttpCode,
  HttpStatus,
  NotFoundException,
  Param,
  Post,
  Res,
  StreamableFile,
  UploadedFile,
  UseInterceptors,
 } from '@nestjs/common';
 import { FileInterceptor } from '@nestjs/platform-express';
 import { Session, type UserSession } from '@thallesp/nestjs-better-auth';
 import type { Response } from 'express';
 import { UploadFileUseCase } from '../../application/use-cases/upload-file/upload-file.use-case.js';
 import { DownloadFileUseCase } from '../../application/use-cases/download-file/download-file.use-case.js';
 import { DeleteFileUseCase } from '../../application/use-cases/delete-file/delete-file.use-case.js';
 import { UploadFileCommand } from '../../application/use-cases/upload-file/upload-file.command.js';
 import { DownloadFileQuery } from '../../application/use-cases/download-file/download-file.query.js';
 import { DeleteFileCommand } from '../../application/use-cases/delete-file/delete-file.command.js';
 import { FileNotFoundException } from '../../domain/exceptions/file-not-found.exception.js';
 import { FileForbiddenException } from '../../domain/exceptions/file-forbidden.exception.js';
 import { contentDisposition } from '../helpers/content-disposition.js';
@Controller('files')
 export class FileController {
  constructor(
    private readonly uploadFileUseCase: UploadFileUseCase,
    private readonly downloadFileUseCase: DownloadFileUseCase,
    private readonly deleteFileUseCase: DeleteFileUseCase,
  ) {}
  /**
   * multipart/form-data с полем `file`. Лимиты и временный каталог задаёт
   * MulterModule в FileModule; превышение размера — 413 от Nest.
   */
  @Post()
  @UseInterceptors(FileInterceptor('file'))
  async upload(@UploadedFile() file: Express.Multer.File | undefined, @Session() session: UserSession) {
    if (!file) {
      throw new BadRequestException('Поле file обязательно');
    }
    try {
      return await this.uploadFileUseCase.execute(
        new UploadFileCommand(session.user.id, file.path, file.originalname, file.size),
      );
    } finally {
      await rm(file.path, { force: true });
    }
  }
  @Get(':id/download')
  async download(
    @Param('id') id: string,
    @Session() session: UserSession,
    @Res({ passthrough: true }) res: Response,
  ): Promise<StreamableFile> {
    const { file, inline, stream } = await this.handleErrors(() =>
      this.downloadFileUseCase.execute(new DownloadFileQuery(id, session.user.id)),
    );
    // Браузер не должен «угадывать» тип: иначе octet-stream с HTML внутри
    // может исполниться как страница на нашем домене
    res.setHeader('X-Content-Type-Options', 'nosniff');
    res.setHeader('Cache-Control', 'private, max-age=0, must-revalidate');
    return new StreamableFile(stream, {
      type: file.mimeType,
      length: file.size,
      disposition: contentDisposition(inline ? 'inline' : 'attachment', file.fileName),
    });
  }
  @Delete(':id')
  @HttpCode(HttpStatus.NO_CONTENT)
  async delete(@Param('id') id: string, @Session() session: UserSession) {
    await this.handleErrors(() => this.deleteFileUseCase.execute(new DeleteFileCommand(id, session.user.id)));
  }
  /** Транслирует доменные исключения в HTTP-ответ — это забота presentation-слоя */
  private async handleErrors<T>(fn: () => Promise<T>): Promise<T> {
    try {
      return await fn();
    } catch (error) {
      if (error instanceof FileNotFoundException) {
        throw new NotFoundException(error.message);
      }
      if (error instanceof FileForbiddenException) {
        throw new ForbiddenException(error.message);
      }
      throw error;
    }
  }
 }
@@ -0,0 +1,23 @@
 import { Field, Int, ObjectType } from '@nestjs/graphql';
 /** Метаданные файла. Содержимое — REST: GET /api/files/:id/download */
@ObjectType('File')
 export class FileType {
  @Field()
  id: string;
  @Field()
  fileName: string;
  @Field()
  mimeType: string;
  @Field(() => Int)
  size: number;
  @Field(() => String, { nullable: true })
  uploaderId: string | null;
  @Field(() => Date)
  createdAt: Date;
 }
@@ -0,0 +1,22 @@
 import { describe, expect, it } from 'vitest';
 import { contentDisposition } from './content-disposition.js';
 describe('contentDisposition', () => {
  it('encodes a plain ASCII name', () => {
    expect(contentDisposition('attachment', 'report.pdf')).toBe(
      `attachment; filename="report.pdf"; filename*=UTF-8''report.pdf`,
    );
  });
  it('encodes cyrillic with an ASCII fallback', () => {
    expect(contentDisposition('inline', 'Отчёт.png')).toBe(
      `inline; filename="_____.png"; filename*=UTF-8''%D0%9E%D1%82%D1%87%D1%91%D1%82.png`,
    );
  });
  it('escapes quotes and RFC 5987 special characters', () => {
    expect(contentDisposition('attachment', `a"b'(c).txt`)).toBe(
      `attachment; filename="a_b'(c).txt"; filename*=UTF-8''a%22b%27%28c%29.txt`,
    );
  });
 });
@@ -0,0 +1,13 @@
 /**
 * Заголовок Content-Disposition с именем файла по RFC 6266/5987:
 * `filename` — ASCII-фолбэк для старых клиентов, `filename*` — полное UTF-8 имя.
 */
 export function contentDisposition(type: 'inline' | 'attachment', fileName: string): string {
  const fallback = fileName.replace(/[^\x20-\x7e]|["\\%]/g, '_');
  const encoded = encodeURIComponent(fileName).replace(
    /['()*]/g,
    (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`,
  );
  return `${type}; filename="${fallback}"; filename*=UTF-8''${encoded}`;
 }
@@ -0,0 +1,22 @@
 import type { IssueStatusValue } from '../../../issue/domain/value-objects/issue-status.vo.js';
 /** Счётчик по каждому статусу; статусы без задач — 0 */
 export type IssueStatusCounts = Record<IssueStatusValue, number>;
 export class DailyIssueStatsDayDto {
  /** YYYY-MM-DD в часовом поясе запроса */
  date: string;
  /** Создано задач за день */
  created: number;
  /** Переходов в статус за день (создание задачи в OPEN сюда не входит). transitions.DONE — выполнено за день */
  transitions: IssueStatusCounts;
  /** Задач в каждом статусе на конец дня */
  byStatus: IssueStatusCounts;
 }
 export class DailyIssueStatsDto {
  from: string;
  to: string;
  timeZone: string;
  days: DailyIssueStatsDayDto[];
 }
@@ -0,0 +1,21 @@
 import type { IssueChangeField } from '../../../issue/domain/entities/issue-change.js';
 import { UserDto } from '../../../user/application/dto/user.dto.js';
 export class IssueFieldChangeDto {
  field: IssueChangeField;
  oldValue: string | null;
  newValue: string | null;
  /** Только для field = assignee: пользователи из oldValue/newValue (null — не назначен или удалён) */
  oldUser?: UserDto | null;
  newUser?: UserDto | null;
 }
 /** Одно сохранение задачи: кто, когда и какие поля изменил */
 export class IssueHistoryEntryDto {
  /** changeId */
  id: string;
  changedAt: Date;
  actorId: string | null;
  actor: UserDto | null;
  changes: IssueFieldChangeDto[];
 }
@@ -0,0 +1,12 @@
 export class GetDailyIssueStatsQuery {
  constructor(
    public readonly userId: string,
    public readonly projectId?: string,
    /** YYYY-MM-DD */
    public readonly from?: string,
    /** YYYY-MM-DD */
    public readonly to?: string,
    /** IANA, например Europe/Moscow */
    public readonly timeZone?: string,
  ) {}
 }
@@ -0,0 +1,77 @@
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import type { IIssueHistoryRepository } from '../../../domain/repositories/issue-history.repository.interface.js';
 import { InvalidStatsPeriodException } from '../../../domain/exceptions/invalid-stats-period.exception.js';
 import { GetDailyIssueStatsUseCase } from './get-daily-issue-stats.use-case.js';
 import { GetDailyIssueStatsQuery } from './get-daily-issue-stats.query.js';
 const zero = { OPEN: 0, IN_PROGRESS: 0, DONE: 0, CANCELLED: 0 };
 describe('GetDailyIssueStatsUseCase', () => {
  let repository: IIssueHistoryRepository;
  let useCase: GetDailyIssueStatsUseCase;
  beforeEach(() => {
    repository = {
      findByIssue: vi.fn(),
      countDailyEvents: vi.fn().mockResolvedValue([]),
      countDailyStatuses: vi.fn().mockResolvedValue([]),
    };
    useCase = new GetDailyIssueStatsUseCase(repository);
  });
  it('passes the validated period and visibility params to the repository', async () => {
    await useCase.execute(
      new GetDailyIssueStatsQuery('user-1', 'project-1', '2026-10-01', '2026-10-03', 'Europe/Moscow'),
    );
    const range = {
      userId: 'user-1',
      projectId: 'project-1',
      from: '2026-10-01',
      to: '2026-10-03',
      timeZone: 'Europe/Moscow',
    };
    expect(repository.countDailyEvents).toHaveBeenCalledWith(range);
    expect(repository.countDailyStatuses).toHaveBeenCalledWith(range);
  });
  it('fills every day and every status, including the empty ones', async () => {
    vi.mocked(repository.countDailyEvents).mockResolvedValue([
      { date: '2026-10-01', kind: 'created', count: 2 },
      { date: '2026-10-03', kind: 'status', status: 'DONE', count: 1 },
    ]);
    vi.mocked(repository.countDailyStatuses).mockResolvedValue([
      { date: '2026-10-01', status: 'OPEN', count: 2 },
      { date: '2026-10-03', status: 'OPEN', count: 1 },
      { date: '2026-10-03', status: 'DONE', count: 1 },
    ]);
    const result = await useCase.execute(new GetDailyIssueStatsQuery('user-1', undefined, '2026-10-01', '2026-10-03'));
    expect(result).toEqual({
      from: '2026-10-01',
      to: '2026-10-03',
      timeZone: 'UTC',
      days: [
        { date: '2026-10-01', created: 2, transitions: zero, byStatus: { ...zero, OPEN: 2 } },
        { date: '2026-10-02', created: 0, transitions: zero, byStatus: zero },
        { date: '2026-10-03', created: 0, transitions: { ...zero, DONE: 1 }, byStatus: { ...zero, OPEN: 1, DONE: 1 } },
      ],
    });
  });
  it('ignores statuses that are no longer known', async () => {
    vi.mocked(repository.countDailyStatuses).mockResolvedValue([{ date: '2026-10-01', status: 'LEGACY', count: 5 }]);
    const result = await useCase.execute(new GetDailyIssueStatsQuery('user-1', undefined, '2026-10-01', '2026-10-01'));
    expect(result.days[0]!.byStatus).toEqual(zero);
  });
  it('rejects an invalid period without querying the database', async () => {
    await expect(
      useCase.execute(new GetDailyIssueStatsQuery('user-1', undefined, '2026-10-05', '2026-10-01')),
    ).rejects.toThrow(InvalidStatsPeriodException);
    expect(repository.countDailyEvents).not.toHaveBeenCalled();
  });
 });
@@ -0,0 +1,73 @@
 import { Inject, Injectable } from '@nestjs/common';
 import { ISSUE_STATUSES, type IssueStatusValue } from '../../../../issue/domain/value-objects/issue-status.vo.js';
 import {
  ISSUE_HISTORY_REPOSITORY,
  type IIssueHistoryRepository,
 } from '../../../domain/repositories/issue-history.repository.interface.js';
 import { StatsPeriod } from '../../../domain/value-objects/stats-period.vo.js';
 import { DailyIssueStatsDayDto, DailyIssueStatsDto, IssueStatusCounts } from '../../dto/daily-issue-stats.dto.js';
 import { GetDailyIssueStatsQuery } from './get-daily-issue-stats.query.js';
 /**
 * Статистика задач по дням, считается по истории изменений (issue_change).
 * Видимость — как у списка задач: только задачи, где пользователь reporter/assignee.
 */
@Injectable()
 export class GetDailyIssueStatsUseCase {
  constructor(
    @Inject(ISSUE_HISTORY_REPOSITORY)
    private readonly historyRepository: IIssueHistoryRepository,
  ) {}
  async execute(query: GetDailyIssueStatsQuery): Promise<DailyIssueStatsDto> {
    const period = StatsPeriod.create({ from: query.from, to: query.to, timeZone: query.timeZone });
    const range = {
      userId: query.userId,
      projectId: query.projectId,
      from: period.from,
      to: period.to,
      timeZone: period.timeZone,
    };
    const [events, statuses] = await Promise.all([
      this.historyRepository.countDailyEvents(range),
      this.historyRepository.countDailyStatuses(range),
    ]);
    // Каждый день периода попадает в ответ, даже если в нём ничего не было
    const days = new Map<string, DailyIssueStatsDayDto>(
      period.days.map((date) => [
        date,
        { date, created: 0, transitions: emptyStatusCounts(), byStatus: emptyStatusCounts() },
      ]),
    );
    for (const event of events) {
      const day = days.get(event.date);
      if (!day) continue;
      if (event.kind === 'created') {
        day.created += event.count;
      } else if (isKnownStatus(event.status)) {
        day.transitions[event.status] += event.count;
      }
    }
    for (const entry of statuses) {
      const day = days.get(entry.date);
      if (day && isKnownStatus(entry.status)) {
        day.byStatus[entry.status] += entry.count;
      }
    }
    return { from: period.from, to: period.to, timeZone: period.timeZone, days: [...days.values()] };
  }
 }
 function emptyStatusCounts(): IssueStatusCounts {
  return Object.fromEntries(ISSUE_STATUSES.map((status) => [status.alias, 0])) as IssueStatusCounts;
 }
 function isKnownStatus(status: string): status is IssueStatusValue {
  return ISSUE_STATUSES.some((known) => known.alias === status);
 }
Author	SHA1	Message	Date
vadim	cb29c7d2c4	Add issue change history and daily issue stats Gitea Actions Demo / Deploy (push) Successful in 32s Details Issue changes are recorded per field in the issue_change table, in the same transaction as the issue itself. The new history module exposes: - GET /api/issues/:issueId/history — change timeline grouped by save - GET /api/issues/stats/daily — created, status transitions and status snapshot per day, with time zone support The migration backfills history for existing issues. Setting a field to its current value no longer bumps updatedAt or emits issue.updated.	2026-10-08 09:55:21 +03:00
vadim	f44590b8ca	update issue filter Gitea Actions Demo / Deploy (push) Successful in 31s Details	2026-10-06 23:18:00 +03:00
vadim	5607e97533	sort comments Gitea Actions Demo / Deploy (push) Successful in 1m50s Details	2026-10-02 21:43:37 +03:00
vadimandClaude Opus 5.5	d0fcc93a8d	Add WIP notes on attachments work Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-02 09:18:15 +03:00
vadimandClaude Opus 5.5	60fb39f98f	Add attachments to comments - CommentAttachment link table (comment <-> file) + migration - fileIds in create/update comment; update replaces the whole set, synced in one transaction with the comment - CommentDto.attachments; empty for deleted comments - Soft delete drops attachments so GC can collect the files - Max 10 files per comment, ordered by upload time (uuid v7) - Registers comments as a file owner - Rename CommentAuthorExpanderService -> CommentExpanderService (expands authors and files) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-02 09:18:08 +03:00
vadimandClaude Opus 5.5	423afa658d	Add issue attachments - IssueAttachment link table (issue <-> file) + migration - GET/POST /issues/:issueId/attachments, DELETE .../attachments/:fileId - Only own uploaded files can be attached; attach is idempotent - Registers issues as a file owner: attached files stay visible to issue participants and are not collected by GC - IssueDetail.attachments GraphQL field via @ResolveField, issue module untouched Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-02 09:18:02 +03:00
vadimandClaude Opus 5.5	f32c6e348d	Add file module for uploads and storage - File model + migration: file metadata, content lives in object storage - IFileStorage port with local disk and S3-compatible (RustFS/MinIO) adapters - POST /files, GET /files/:id/download, DELETE /files/:id - MIME sniffed from content; only safe images served inline, nosniff header - FileOwnerRegistry: owner modules register to grant visibility and keep their files from GC; FileGcService removes orphaned files hourly - TransformResponseInterceptor passes StreamableFile through Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-02 09:17:55 +03:00
vadim	5cfc8986d7	prettier Gitea Actions Demo / Deploy (push) Successful in 1m34s Details	2026-10-01 12:04:21 +03:00
vadim	4b6ecfbf5d	comments implement	2026-10-01 12:02:03 +03:00
vadim	9e0bef2527	update git ignore	2026-10-01 11:25:31 +03:00
vadimandClaude Opus 5.5	3272c75512	Add Comment model for issue comments Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-01 11:23:51 +03:00
vadimandClaude Opus 5.5	2696f33a7e	Keep issues when assignee or reporter is deleted Switch issue.assigneeId/reporterId FKs from CASCADE to SET NULL and make reporter nullable through the entity, DTOs and GraphQL types. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-01 11:23:51 +03:00
vadimandClaude Opus 5.5	4b8c855855	Add missing migration for notification tables Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-01 11:23:46 +03:00
vadim	60391ee123	notification	2026-09-29 18:42:29 +03:00