@ahksolution/permissions-sdk 1.0.0

package/dist/client/permissions-grpc.client.js

@@ -0,0 +1,182 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var PermissionsGrpcClient_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PermissionsGrpcClient = void 0;
+const common_1 = require("@nestjs/common");
+const rxjs_1 = require("rxjs");
+const constants_1 = require("../constants");
+/**
+ * Maps gRPC evaluation source enum to TypeScript type
+ */
+function mapEvaluationSource(source) {
+    const sourceMap = {
+        0: 'denied',
+        1: 'rbac',
+        2: 'abac',
+        3: 'break-glass',
+        4: 'denied',
+    };
+    return sourceMap[source];
+}
+/**
+ * Converts gRPC response to domain EvaluationResult
+ */
+function toEvaluationResult(response) {
+    return {
+        allowed: response.allowed,
+        source: mapEvaluationSource(response.source),
+        matchedRoles: response.matchedRoles,
+        matchedPolicies: response.matchedPolicies,
+        reason: response.reason,
+        evaluationTimeMs: response.evaluationTimeMs,
+    };
+}
+/**
+ * Converts resource context to gRPC format
+ */
+function toGrpcResourceContext(context) {
+    if (context === undefined) {
+        return undefined;
+    }
+    const { id, type, ownerId, department, ...rest } = context;
+    const attributes = {};
+    for (const [key, value] of Object.entries(rest)) {
+        if (value !== undefined && value !== null) {
+            attributes[key] = typeof value === 'string' ? value : JSON.stringify(value);
+        }
+    }
+    return {
+        id,
+        type,
+        ownerId,
+        department,
+        attributes: Object.keys(attributes).length > 0 ? attributes : undefined,
+    };
+}
+/**
+ * Converts request context to gRPC format
+ */
+function toGrpcRequestContext(context) {
+    if (context === undefined) {
+        return undefined;
+    }
+    const { ip, userAgent, method, path, ...rest } = context;
+    const attributes = {};
+    for (const [key, value] of Object.entries(rest)) {
+        if (value !== undefined && value !== null) {
+            attributes[key] = typeof value === 'string' ? value : JSON.stringify(value);
+        }
+    }
+    return {
+        ip,
+        userAgent,
+        method,
+        path,
+        attributes: Object.keys(attributes).length > 0 ? attributes : undefined,
+    };
+}
+/**
+ * gRPC client for the Permissions Service
+ * Provides methods to check permissions via gRPC calls to the permissions microservice
+ */
+let PermissionsGrpcClient = PermissionsGrpcClient_1 = class PermissionsGrpcClient {
+    client;
+    logger = new common_1.Logger(PermissionsGrpcClient_1.name);
+    permissionsService;
+    constructor(client) {
+        this.client = client;
+    }
+    onModuleInit() {
+        this.permissionsService =
+            this.client.getService(constants_1.PERMISSIONS_SERVICE_NAME);
+        this.logger.log('Permissions gRPC client initialized');
+    }
+    /**
+     * Check if a user has a specific permission
+     */
+    async checkPermission(userId, permissionCode, options) {
+        const response = await (0, rxjs_1.firstValueFrom)(this.permissionsService.checkPermission({
+            userId,
+            permissionCode,
+            resourceContext: toGrpcResourceContext(options?.resource),
+            requestContext: toGrpcRequestContext(options?.request),
+        }));
+        return toEvaluationResult(response);
+    }
+    /**
+     * Check multiple permissions at once
+     */
+    async checkBulkPermissions(userId, permissionCodes, options) {
+        const response = await (0, rxjs_1.firstValueFrom)(this.permissionsService.checkBulkPermissions({
+            userId,
+            permissionCodes,
+            resourceContext: toGrpcResourceContext(options?.resource),
+            requestContext: toGrpcRequestContext(options?.request),
+        }));
+        const results = {};
+        for (const [key, value] of Object.entries(response.results)) {
+            results[key] = toEvaluationResult(value);
+        }
+        return {
+            results,
+            totalTimeMs: response.totalTimeMs,
+        };
+    }
+    /**
+     * Get all effective permissions for a user
+     */
+    async getEffectivePermissions(userId) {
+        const response = await (0, rxjs_1.firstValueFrom)(this.permissionsService.getEffectivePermissions({ userId }));
+        return {
+            permissions: response.permissions,
+            roles: response.roles.map((r) => ({
+                id: r.id,
+                code: r.code,
+                name: r.name,
+                isSystem: r.isSystem,
+            })),
+            version: response.version,
+            computedAt: new Date(response.computedAt),
+        };
+    }
+    /**
+     * Simple boolean check - does user have this permission?
+     */
+    async hasPermission(userId, permissionCode) {
+        const response = await (0, rxjs_1.firstValueFrom)(this.permissionsService.hasPermission({ userId, permissionCode }));
+        return response.hasPermission;
+    }
+    /**
+     * Check if user has ALL of the specified permissions
+     */
+    async hasAllPermissions(userId, permissionCodes) {
+        const response = await (0, rxjs_1.firstValueFrom)(this.permissionsService.hasAllPermissions({ userId, permissionCodes }));
+        return response.hasPermission;
+    }
+    /**
+     * Check if user has ANY of the specified permissions
+     */
+    async hasAnyPermission(userId, permissionCodes) {
+        const response = await (0, rxjs_1.firstValueFrom)(this.permissionsService.hasAnyPermission({ userId, permissionCodes }));
+        return response.hasPermission;
+    }
+};
+exports.PermissionsGrpcClient = PermissionsGrpcClient;
+exports.PermissionsGrpcClient = PermissionsGrpcClient = PermissionsGrpcClient_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_1.PERMISSIONS_GRPC_CLIENT)),
+    __metadata("design:paramtypes", [Object])
+], PermissionsGrpcClient);
+//# sourceMappingURL=permissions-grpc.client.js.map

package/dist/client/permissions-grpc.client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions-grpc.client.js","sourceRoot":"","sources":["../../src/client/permissions-grpc.client.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAA0E;AAE1E,+BAAsC;AAEtC,4CAAiF;AAgBjF;;GAEG;AACH,SAAS,mBAAmB,CAAC,MAA4B;IACvD,MAAM,SAAS,GAAmD;QAChE,CAAC,EAAE,QAAQ;QACX,CAAC,EAAE,MAAM;QACT,CAAC,EAAE,MAAM;QACT,CAAC,EAAE,aAAa;QAChB,CAAC,EAAE,QAAQ;KACZ,CAAC;IACF,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,QAAiC;IAC3D,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,MAAM,EAAE,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC5C,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;KAC5C,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAAC,OAAyB;IAStD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAC3D,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1C,UAAU,CAAC,GAAG,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,OAAO;QACL,EAAE;QACF,IAAI;QACJ,OAAO;QACP,UAAU;QACV,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;KACxE,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,OAAwB;IASpD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IACzD,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1C,UAAU,CAAC,GAAG,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,OAAO;QACL,EAAE;QACF,SAAS;QACT,MAAM;QACN,IAAI;QACJ,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;KACxE,CAAC;AACJ,CAAC;AAED;;;GAGG;AAEI,IAAM,qBAAqB,6BAA3B,MAAM,qBAAqB;IAMb;IALF,MAAM,GAAG,IAAI,eAAM,CAAC,uBAAqB,CAAC,IAAI,CAAC,CAAC;IACzD,kBAAkB,CAA0B;IAEpD,YAEmB,MAAkB;QAAlB,WAAM,GAAN,MAAM,CAAY;IAClC,CAAC;IAEJ,YAAY;QACV,IAAI,CAAC,kBAAkB;YACrB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAyB,oCAAwB,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,MAAc,EACd,cAAsB,EACtB,OAGC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAc,EACnC,IAAI,CAAC,kBAAkB,CAAC,eAAe,CAAC;YACtC,MAAM;YACN,cAAc;YACd,eAAe,EAAE,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC;YACzD,cAAc,EAAE,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC;SACvD,CAAC,CACH,CAAC;QACF,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,MAAc,EACd,eAAyB,EACzB,OAGC;QAED,MAAM,QAAQ,GAAiC,MAAM,IAAA,qBAAc,EACjE,IAAI,CAAC,kBAAkB,CAAC,oBAAoB,CAAC;YAC3C,MAAM;YACN,eAAe;YACf,eAAe,EAAE,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC;YACzD,cAAc,EAAE,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC;SACvD,CAAC,CACH,CAAC;QACF,MAAM,OAAO,GAAqC,EAAE,CAAC;QACrD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO;YACL,OAAO;YACP,WAAW,EAAE,QAAQ,CAAC,WAAW;SAClC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,uBAAuB,CAAC,MAAc;QAC1C,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAc,EACnC,IAAI,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC,CAC5D,CAAC;QACF,OAAO;YACL,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChC,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;aACrB,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,UAAU,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;SAC1C,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,cAAsB;QACxD,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAc,EACnC,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAClE,CAAC;QACF,OAAO,QAAQ,CAAC,aAAa,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,eAAyB;QAC/D,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAc,EACnC,IAAI,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CACvE,CAAC;QACF,OAAO,QAAQ,CAAC,aAAa,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,MAAc,EAAE,eAAyB;QAC9D,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAc,EACnC,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CACtE,CAAC;QACF,OAAO,QAAQ,CAAC,aAAa,CAAC;IAChC,CAAC;CACF,CAAA;AAnHY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,eAAM,EAAC,mCAAuB,CAAC,CAAA;;GALvB,qBAAqB,CAmHjC"}

package/dist/constants.d.ts

@@ -0,0 +1,44 @@
+/**
+ * gRPC package name as defined in the proto file
+ */
+export declare const PERMISSIONS_PACKAGE_NAME = "permissions";
+/**
+ * gRPC service name as defined in the proto file
+ */
+export declare const PERMISSIONS_SERVICE_NAME = "PermissionsService";
+/**
+ * Injection token for the gRPC client
+ */
+export declare const PERMISSIONS_GRPC_CLIENT = "PERMISSIONS_GRPC_CLIENT";
+/**
+ * Injection token for the permissions service instance
+ */
+export declare const PERMISSIONS_SERVICE = "PERMISSIONS_SERVICE";
+/**
+ * Path to the proto file (relative to package root)
+ */
+export declare const PROTO_PATH: string;
+/**
+ * Default gRPC server options
+ */
+export declare const DEFAULT_GRPC_OPTIONS: {
+    readonly url: "localhost:50051";
+    readonly package: "permissions";
+    readonly protoPath: string;
+};
+/**
+ * Redis channel for permission change events
+ */
+export declare const PERMISSION_EVENTS_CHANNEL = "permissions:events";
+/**
+ * Event types for permission changes
+ */
+export declare const PERMISSION_EVENT_TYPES: {
+    readonly ROLE_UPDATED: "role:updated";
+    readonly ROLE_DELETED: "role:deleted";
+    readonly PERMISSION_ASSIGNED: "permission:assigned";
+    readonly PERMISSION_REVOKED: "permission:revoked";
+    readonly USER_ROLES_CHANGED: "user:roles:changed";
+    readonly CACHE_INVALIDATED: "cache:invalidated";
+};
+//# sourceMappingURL=constants.d.ts.map

package/dist/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,eAAO,MAAM,wBAAwB,gBAAgB,CAAC;AAEtD;;GAEG;AACH,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAE7D;;GAEG;AACH,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE;;GAEG;AACH,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAEzD;;GAEG;AACH,eAAO,MAAM,UAAU,QAAgD,CAAC;AAExE;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;CAIvB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,yBAAyB,uBAAuB,CAAC;AAE9D;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;CAOzB,CAAC"}

package/dist/constants.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PERMISSION_EVENT_TYPES = exports.PERMISSION_EVENTS_CHANNEL = exports.DEFAULT_GRPC_OPTIONS = exports.PROTO_PATH = exports.PERMISSIONS_SERVICE = exports.PERMISSIONS_GRPC_CLIENT = exports.PERMISSIONS_SERVICE_NAME = exports.PERMISSIONS_PACKAGE_NAME = void 0;
+const path_1 = require("path");
+/**
+ * gRPC package name as defined in the proto file
+ */
+exports.PERMISSIONS_PACKAGE_NAME = 'permissions';
+/**
+ * gRPC service name as defined in the proto file
+ */
+exports.PERMISSIONS_SERVICE_NAME = 'PermissionsService';
+/**
+ * Injection token for the gRPC client
+ */
+exports.PERMISSIONS_GRPC_CLIENT = 'PERMISSIONS_GRPC_CLIENT';
+/**
+ * Injection token for the permissions service instance
+ */
+exports.PERMISSIONS_SERVICE = 'PERMISSIONS_SERVICE';
+/**
+ * Path to the proto file (relative to package root)
+ */
+exports.PROTO_PATH = (0, path_1.join)(__dirname, 'proto', 'permissions.proto');
+/**
+ * Default gRPC server options
+ */
+exports.DEFAULT_GRPC_OPTIONS = {
+    url: 'localhost:50051',
+    package: exports.PERMISSIONS_PACKAGE_NAME,
+    protoPath: exports.PROTO_PATH,
+};
+/**
+ * Redis channel for permission change events
+ */
+exports.PERMISSION_EVENTS_CHANNEL = 'permissions:events';
+/**
+ * Event types for permission changes
+ */
+exports.PERMISSION_EVENT_TYPES = {
+    ROLE_UPDATED: 'role:updated',
+    ROLE_DELETED: 'role:deleted',
+    PERMISSION_ASSIGNED: 'permission:assigned',
+    PERMISSION_REVOKED: 'permission:revoked',
+    USER_ROLES_CHANGED: 'user:roles:changed',
+    CACHE_INVALIDATED: 'cache:invalidated',
+};
+//# sourceMappingURL=constants.js.map

package/dist/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":";;;AAAA,+BAA4B;AAE5B;;GAEG;AACU,QAAA,wBAAwB,GAAG,aAAa,CAAC;AAEtD;;GAEG;AACU,QAAA,wBAAwB,GAAG,oBAAoB,CAAC;AAE7D;;GAEG;AACU,QAAA,uBAAuB,GAAG,yBAAyB,CAAC;AAEjE;;GAEG;AACU,QAAA,mBAAmB,GAAG,qBAAqB,CAAC;AAEzD;;GAEG;AACU,QAAA,UAAU,GAAG,IAAA,WAAI,EAAC,SAAS,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC;AAExE;;GAEG;AACU,QAAA,oBAAoB,GAAG;IAClC,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,gCAAwB;IACjC,SAAS,EAAE,kBAAU;CACb,CAAC;AAEX;;GAEG;AACU,QAAA,yBAAyB,GAAG,oBAAoB,CAAC;AAE9D;;GAEG;AACU,QAAA,sBAAsB,GAAG;IACpC,YAAY,EAAE,cAAc;IAC5B,YAAY,EAAE,cAAc;IAC5B,mBAAmB,EAAE,qBAAqB;IAC1C,kBAAkB,EAAE,oBAAoB;IACxC,kBAAkB,EAAE,oBAAoB;IACxC,iBAAiB,EAAE,mBAAmB;CAC9B,CAAC"}

package/dist/decorators/index.d.ts

@@ -0,0 +1,2 @@
+export * from './require-permissions.decorator';
+//# sourceMappingURL=index.d.ts.map

package/dist/decorators/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/decorators/index.ts"],"names":[],"mappings":"AAAA,cAAc,iCAAiC,CAAC"}

package/dist/decorators/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./require-permissions.decorator"), exports);
+//# sourceMappingURL=index.js.map

package/dist/decorators/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/decorators/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,kEAAgD"}

package/dist/decorators/require-permissions.decorator.d.ts

@@ -0,0 +1,51 @@
+import type { RequirePermissionsOptions } from '../types';
+/**
+ * Decorator to require specific permissions on a controller or method
+ *
+ * @param permissions - Single permission code or array of permission codes
+ * @param options - Options for permission evaluation
+ *
+ * @example
+ * ```typescript
+ * // Require a single permission
+ * @RequirePermissions('users:read')
+ * async getUsers() { ... }
+ *
+ * // Require ALL permissions (AND logic - default)
+ * @RequirePermissions(['users:read', 'users:list'])
+ * async getUsers() { ... }
+ *
+ * // Require ANY of the permissions (OR logic)
+ * @RequirePermissions(['users:delete', 'admin:full'], { mode: 'any' })
+ * async deleteUser() { ... }
+ *
+ * // With custom error message
+ * @RequirePermissions('admin:full', { errorMessage: 'Admin access required' })
+ * async adminAction() { ... }
+ * ```
+ */
+export declare function RequirePermissions(permissions: string | readonly string[], options?: RequirePermissionsOptions): MethodDecorator & ClassDecorator;
+/**
+ * Alias for RequirePermissions with mode: 'any'
+ *
+ * @example
+ * ```typescript
+ * // User needs at least one of these permissions
+ * @RequireAnyPermission(['orders:create', 'orders:manage'])
+ * async createOrder() { ... }
+ * ```
+ */
+export declare function RequireAnyPermission(permissions: string[], options?: Omit<RequirePermissionsOptions, 'mode'>): MethodDecorator & ClassDecorator;
+/**
+ * Alias for RequirePermissions with mode: 'all'
+ * This is the default behavior, but can be used for clarity
+ *
+ * @example
+ * ```typescript
+ * // User needs ALL of these permissions
+ * @RequireAllPermissions(['orders:read', 'orders:export'])
+ * async exportOrders() { ... }
+ * ```
+ */
+export declare function RequireAllPermissions(permissions: string[], options?: Omit<RequirePermissionsOptions, 'mode'>): MethodDecorator & ClassDecorator;
+//# sourceMappingURL=require-permissions.decorator.d.ts.map

package/dist/decorators/require-permissions.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-permissions.decorator.d.ts","sourceRoot":"","sources":["../../src/decorators/require-permissions.decorator.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAuB,yBAAyB,EAAE,MAAM,UAAU,CAAC;AAG/E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EACvC,OAAO,CAAC,EAAE,yBAAyB,GAClC,eAAe,GAAG,cAAc,CAOlC;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,EAAE,EACrB,OAAO,CAAC,EAAE,IAAI,CAAC,yBAAyB,EAAE,MAAM,CAAC,GAChD,eAAe,GAAG,cAAc,CAElC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,EAAE,EACrB,OAAO,CAAC,EAAE,IAAI,CAAC,yBAAyB,EAAE,MAAM,CAAC,GAChD,eAAe,GAAG,cAAc,CAElC"}

package/dist/decorators/require-permissions.decorator.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RequirePermissions = RequirePermissions;
+exports.RequireAnyPermission = RequireAnyPermission;
+exports.RequireAllPermissions = RequireAllPermissions;
+/* eslint-disable @typescript-eslint/naming-convention */
+const common_1 = require("@nestjs/common");
+const types_1 = require("../types");
+/**
+ * Decorator to require specific permissions on a controller or method
+ *
+ * @param permissions - Single permission code or array of permission codes
+ * @param options - Options for permission evaluation
+ *
+ * @example
+ * ```typescript
+ * // Require a single permission
+ * @RequirePermissions('users:read')
+ * async getUsers() { ... }
+ *
+ * // Require ALL permissions (AND logic - default)
+ * @RequirePermissions(['users:read', 'users:list'])
+ * async getUsers() { ... }
+ *
+ * // Require ANY of the permissions (OR logic)
+ * @RequirePermissions(['users:delete', 'admin:full'], { mode: 'any' })
+ * async deleteUser() { ... }
+ *
+ * // With custom error message
+ * @RequirePermissions('admin:full', { errorMessage: 'Admin access required' })
+ * async adminAction() { ... }
+ * ```
+ */
+function RequirePermissions(permissions, options) {
+    const permissionArray = Array.isArray(permissions) ? permissions : [permissions];
+    const metadata = {
+        permissions: permissionArray,
+        options: options ?? {},
+    };
+    return (0, common_1.SetMetadata)(types_1.PERMISSIONS_METADATA_KEY, metadata);
+}
+/**
+ * Alias for RequirePermissions with mode: 'any'
+ *
+ * @example
+ * ```typescript
+ * // User needs at least one of these permissions
+ * @RequireAnyPermission(['orders:create', 'orders:manage'])
+ * async createOrder() { ... }
+ * ```
+ */
+function RequireAnyPermission(permissions, options) {
+    return RequirePermissions(permissions, { ...options, mode: 'any' });
+}
+/**
+ * Alias for RequirePermissions with mode: 'all'
+ * This is the default behavior, but can be used for clarity
+ *
+ * @example
+ * ```typescript
+ * // User needs ALL of these permissions
+ * @RequireAllPermissions(['orders:read', 'orders:export'])
+ * async exportOrders() { ... }
+ * ```
+ */
+function RequireAllPermissions(permissions, options) {
+    return RequirePermissions(permissions, { ...options, mode: 'all' });
+}
+//# sourceMappingURL=require-permissions.decorator.js.map

package/dist/decorators/require-permissions.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-permissions.decorator.js","sourceRoot":"","sources":["../../src/decorators/require-permissions.decorator.ts"],"names":[],"mappings":";;AA+BA,gDAUC;AAYD,oDAKC;AAaD,sDAKC;AA5ED,yDAAyD;AACzD,2CAA6C;AAG7C,oCAAoD;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAgB,kBAAkB,CAChC,WAAuC,EACvC,OAAmC;IAEnC,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAwB;QACpC,WAAW,EAAE,eAAe;QAC5B,OAAO,EAAE,OAAO,IAAI,EAAE;KACvB,CAAC;IACF,OAAO,IAAA,oBAAW,EAAC,gCAAwB,EAAE,QAAQ,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,oBAAoB,CAClC,WAAqB,EACrB,OAAiD;IAEjD,OAAO,kBAAkB,CAAC,WAAW,EAAE,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,qBAAqB,CACnC,WAAqB,EACrB,OAAiD;IAEjD,OAAO,kBAAkB,CAAC,WAAW,EAAE,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACtE,CAAC"}

package/dist/guards/index.d.ts

@@ -0,0 +1,2 @@
+export * from './permissions.guard';
+//# sourceMappingURL=index.d.ts.map

package/dist/guards/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/guards/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAC"}

package/dist/guards/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./permissions.guard"), exports);
+//# sourceMappingURL=index.js.map

package/dist/guards/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/guards/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sDAAoC"}

package/dist/guards/permissions.guard.d.ts

@@ -0,0 +1,55 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { PermissionsGrpcClient } from '../client/permissions-grpc.client';
+/**
+ * NestJS Guard that checks permissions via the Permissions gRPC Service
+ *
+ * This guard:
+ * 1. Extracts permission requirements from the @RequirePermissions decorator
+ * 2. Gets the user ID from the request (expects JWT auth to have run first)
+ * 3. Calls the permissions microservice via gRPC to verify access
+ * 4. Throws ForbiddenException if permission is denied
+ *
+ * @example
+ * ```typescript
+ * // Use globally
+ * @Module({
+ *   providers: [
+ *     {
+ *       provide: APP_GUARD,
+ *       useClass: PermissionsGuard,
+ *     },
+ *   ],
+ * })
+ * export class AppModule {}
+ *
+ * // Or use on specific controllers/routes
+ * @Controller('orders')
+ * @UseGuards(JwtAuthGuard, PermissionsGuard)
+ * export class OrdersController { ... }
+ * ```
+ */
+export declare class PermissionsGuard implements CanActivate {
+    private readonly reflector;
+    private readonly permissionsClient;
+    private readonly logger;
+    constructor(reflector: Reflector, permissionsClient: PermissionsGrpcClient);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+    /**
+     * Get permission metadata from the handler or class
+     */
+    private getPermissionsMetadata;
+    /**
+     * Evaluate permissions based on mode
+     */
+    private evaluatePermissions;
+    /**
+     * Build request context from the HTTP request
+     */
+    private buildRequestContext;
+    /**
+     * Build resource context from request params/query
+     */
+    private buildResourceContext;
+}
+//# sourceMappingURL=permissions.guard.d.ts.map

package/dist/guards/permissions.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.guard.d.ts","sourceRoot":"","sources":["../../src/guards/permissions.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAIjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AA0B1E;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBACa,gBAAiB,YAAW,WAAW;IAIhD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAJpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqC;gBAGzC,SAAS,EAAE,SAAS,EACpB,iBAAiB,EAAE,qBAAqB;IAGrD,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IA2C9D;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAO9B;;OAEG;YACW,mBAAmB;IAuBjC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAU3B;;OAEG;IACH,OAAO,CAAC,oBAAoB;CAO7B"}