feat(home): add SaaS readiness checklist + admin route

- GET /api/admin/readiness (admin-only) returns startup checklist as JSON
- validateSaaSReadiness() prints status table at boot (skipped in test)
- 7 categories: Config, Security, Auth, Mail, Billing, Analytics, Monitoring
- Smart dependencies: Resend configured → skip Nodemailer warning
- Non-blocking: warnings only, never prevents startup

Author: PierreBrisorgueil

lib/app.js

@@ -89,7 +89,7 @@ const bootstrap = async () => {
 /**
  * log server configuration
  */
-const logConfiguration = () => {
+const logConfiguration = async () => {
   // Create server URL
   const server = `${(config.secure && config.secure.credentials ? 'https://' : 'http://') + config.api.host}:${config.api.port}`;
   // Logging initialization
@@ -99,6 +99,22 @@ const logConfiguration = () => {
   console.log(chalk.green(`Server:          ${server}`));
   console.log(chalk.green(`Database:        ${config.db.uri}`));
   if (config.cors.origin.length > 0) console.log(chalk.green(`Cors:            ${config.cors.origin}`));
+
+  // SaaS readiness summary (skip in test to keep output clean)
+  if (process.env.NODE_ENV !== 'test') {
+    try {
+      const { default: HomeService } = await import('../modules/home/services/home.service.js');
+      const checks = HomeService.getReadinessStatus();
+      console.log();
+      console.log(chalk.green('SaaS Readiness:'));
+      checks.forEach((c) => {
+        const icon = c.status === 'ok' ? chalk.green('OK') : chalk.yellow('WARN');
+        console.log(`  ${icon}  ${c.category.padEnd(12)} ${c.message}`);
+      });
+    } catch (_err) {
+      // Non-blocking — readiness check failure should not prevent boot
+    }
+  }
 };
 
 // Boot up the server
@@ -118,7 +134,7 @@ const start = async () => {
     if (config.secure && config.secure.credentials)
       http = await nodeHttps.createServer(config.secure.credentials, app).setTimeout(config.api.timeout).listen(config.api.port, config.api.host);
     else http = await nodeHttp.createServer(app).setTimeout(config.api.timeout).listen(config.api.port, config.api.host);
-    logConfiguration();
+    await logConfiguration();
     return {
       db,
       orm,

lib/middlewares/policy.js

@@ -201,6 +201,7 @@ const deriveSubjectType = (routePath) => {
   if (routePath.startsWith('/api/tasks')) return 'Task';
   if (routePath.startsWith('/api/uploads')) return 'Upload';
   if (routePath.startsWith('/api/home')) return 'Home';
+  if (routePath === '/api/admin/readiness') return 'Readiness';
   if (routePath.startsWith('/api/admin/organizations')) return 'Organization';
   if (routePath.includes('/requests')) return 'Membership';
   if (routePath.includes('/members')) return 'Membership';

modules/home/controllers/home.controller.js

@@ -96,11 +96,26 @@ const health = (req, res) => {
   responses.success(res, 'health check')(payload);
 };
 
+/**
+ * @desc Endpoint to return SaaS readiness checks (admin only)
+ * @param {Object} req - Express request object
+ * @param {Object} res - Express response object
+ */
+const readiness = (req, res) => {
+  try {
+    const data = HomeService.getReadinessStatus();
+    responses.success(res, 'readiness check')(data);
+  } catch (err) {
+    responses.error(res, 422, 'Unprocessable Entity', errors.getMessage(err))(err);
+  }
+};
+
 export default {
   releases,
   changelogs,
   team,
   page,
   pageByName,
   health,
+  readiness,
 };

modules/home/policies/home.policy.js

@@ -12,6 +12,9 @@
  */
 export function homeAbilities(user, membership, { can }) {
   can('read', 'Home');
+  if (Array.isArray(user?.roles) && user.roles.includes('admin')) {
+    can('read', 'Readiness');
+  }
 }
 
 /**

modules/home/routes/home.route.js

@@ -35,6 +35,8 @@ export default (app) => {
   app.route('/api/home/team').all(policy.isAllowed).get(home.team);
   // markdown files
   app.route('/api/home/pages/:name').all(policy.isAllowed).get(home.page);
+  // readiness check — admin only (JWT + CASL)
+  app.route('/api/admin/readiness').all(passport.authenticate('jwt', { session: false }), policy.isAllowed).get(home.readiness);
 
   // Finish by binding the task middleware
   app.param('name', home.pageByName);

modules/home/services/home.service.js

@@ -10,8 +10,16 @@ import mongoose from 'mongoose';
 
 import AuthService from '../../auth/services/auth.service.js';
 import config from '../../../config/index.js';
+import mailer from '../../../lib/helpers/mailer/index.js';
 import HomeRepository from '../repositories/home.repository.js';
 
+/**
+ * @desc Check whether a config value is meaningfully set (truthy, non-empty, not a DEVKIT placeholder).
+ * @param {*} value - Config value to check
+ * @returns {boolean} true if set and not a placeholder
+ */
+const isSet = (value) => !!(value && typeof value === 'string' && value.trim() !== '' && !value.startsWith('DEVKIT_NODE_'));
+
 /**
  * @desc Function to get all admin users in db
  * @return {Promise} All users
@@ -102,10 +110,80 @@ const getHealthStatus = () => {
   };
 };
 
+/**
+ * @desc Run SaaS readiness checks against current configuration.
+ * Each check returns { category, status, message }.
+ * @returns {Array<{category: string, status: string, message: string}>}
+ */
+const getReadinessStatus = () => {
+  const checks = [];
+
+  // config — domain
+  checks.push({
+    category: 'config',
+    status: isSet(config.domain) ? 'ok' : 'warning',
+    message: isSet(config.domain) ? 'Domain configured' : 'Domain not configured',
+  });
+
+  // security — JWT secret
+  const jwtDefault = config.jwt?.secret === 'WaosSecretKeyExampleToChnageAbsolutely';
+  checks.push({
+    category: 'security',
+    status: jwtDefault ? 'warning' : 'ok',
+    message: jwtDefault ? 'JWT secret is default — change it before production' : 'JWT secret is custom',
+  });
+
+  // auth — OAuth providers
+  const oAuthProviders = [];
+  if (isSet(config.oAuth?.google?.clientID)) oAuthProviders.push('Google');
+  if (isSet(config.oAuth?.apple?.clientID)) oAuthProviders.push('Apple');
+  checks.push({
+    category: 'auth',
+    status: oAuthProviders.length > 0 ? 'ok' : 'warning',
+    message: oAuthProviders.length > 0 ? `OAuth configured (${oAuthProviders.join(', ')})` : 'No OAuth provider configured',
+  });
+
+  // mail — mailer from
+  const mailConfigured = mailer.isConfigured();
+  const mailProvider = config.mailer?.provider || 'nodemailer';
+  checks.push({
+    category: 'mail',
+    status: mailConfigured ? 'ok' : 'warning',
+    message: mailConfigured ? `Mail configured (${mailProvider})` : 'No mail provider configured',
+  });
+
+  // billing — Stripe
+  const stripeConfigured = isSet(config.stripe?.secretKey);
+  checks.push({
+    category: 'billing',
+    status: stripeConfigured ? 'ok' : 'warning',
+    message: stripeConfigured ? 'Stripe configured' : 'Stripe not configured',
+  });
+
+  // analytics — PostHog
+  const posthogConfigured = isSet(config.posthog?.apiKey);
+  checks.push({
+    category: 'analytics',
+    status: posthogConfigured ? 'ok' : 'warning',
+    message: posthogConfigured ? 'PostHog configured' : 'PostHog not configured',
+  });
+
+  // monitoring — Sentry
+  const sentryConfigured = isSet(config.sentry?.dsn);
+  checks.push({
+    category: 'monitoring',
+    status: sentryConfigured ? 'ok' : 'warning',
+    message: sentryConfigured ? 'Sentry configured' : 'Sentry not configured',
+  });
+
+  return checks;
+};
+
 export default {
   page,
   releases,
   changelogs,
   team,
   getHealthStatus,
+  getReadinessStatus,
 };

modules/home/tests/home.integration.tests.js

@@ -18,6 +18,7 @@ describe('Home integration tests:', () => {
   let agent;
   let HomeService;
   let adminToken;
+  let userToken;
   let originalOrganizationsEnabled;
 
   //  init
@@ -50,6 +51,17 @@ describe('Home integration tests:', () => {
         roles: ['admin'],
       });
       adminToken = jwt.sign({ userId: admin.id }, config.jwt.secret, { expiresIn: config.jwt.expiresIn });
+
+      // Create regular user and sign JWT for readiness auth tests
+      const regularUser = await User.create({
+        firstName: 'Regular',
+        lastName: 'User',
+        email: 'regular-readiness@test.com',
+        password: 'W@os.jsI$Aw3$0m3',
+        provider: 'local',
+        roles: ['user'],
+      });
+      userToken = jwt.sign({ userId: regularUser.id }, config.jwt.secret, { expiresIn: config.jwt.expiresIn });
     } catch (err) {
       console.log(err);
       expect(err).toBeFalsy();
@@ -186,6 +198,40 @@ describe('Home integration tests:', () => {
     });
   });
 
+  describe('Readiness', () => {
+    test('should return 401 for unauthenticated user', async () => {
+      const result = await agent.get('/api/admin/readiness').expect(401);
+      expect(result.body).toBeDefined();
+    });
+
+    test('should return 403 for regular user', async () => {
+      const result = await agent.get('/api/admin/readiness').set('Cookie', `TOKEN=${userToken}`).expect(403);
+      expect(result.body.type).toBe('error');
+    });
+
+    test('should return 200 with readiness checks for admin', async () => {
+      const result = await agent.get('/api/admin/readiness').set('Cookie', `TOKEN=${adminToken}`).expect(200);
+      expect(result.body.type).toBe('success');
+      expect(result.body.message).toBe('readiness check');
+      expect(result.body.data).toBeInstanceOf(Array);
+      expect(result.body.data.length).toBeGreaterThan(0);
+    });
+
+    test('should return correct shape for each readiness check', async () => {
+      const result = await agent.get('/api/admin/readiness').set('Cookie', `TOKEN=${adminToken}`).expect(200);
+      const expectedCategories = ['config', 'security', 'auth', 'mail', 'billing', 'analytics', 'monitoring'];
+      const categories = result.body.data.map((c) => c.category);
+      expect(categories).toEqual(expectedCategories);
+      result.body.data.forEach((item) => {
+        expect(item).toHaveProperty('category');
+        expect(item).toHaveProperty('status');
+        expect(item).toHaveProperty('message');
+        expect(['ok', 'warning']).toContain(item.status);
+        expect(typeof item.message).toBe('string');
+      });
+    });
+  });
+
   describe('Errors', () => {
     test('should return 422 when team service fails', async () => {
       jest.spyOn(HomeService, 'team').mockRejectedValueOnce(new Error('DB error'));