@application-kit/authorization 0.0.0-stage → 0.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 application-kit
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,71 @@
-# Temporary Holding Version
+# @application-kit/authorization
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Авторизация на CASL для NestJS-приложений с браузерным клиентом. Пакет не знает ни одной роли, subject'а и
+правила: словарь и гранты объявляют модули приложения, механизм собирает из них ability и проверяет политики.
+Одна и та же карта грантов строит ability и на сервере (проверка доступа), и в браузере (скрытие недоступного UI).
+
+## Установка
+
+```sh
+yarn add @application-kit/authorization
+```
+
+Peer-зависимости: `@casl/ability`, `@nestjs/common`, `@nestjs/core`, `nestjs-pino`. Все обязательные.
+`@nestjs/graphql` пакету не нужен: guard узнаёт GraphQL-запрос по типу контекста и работает и в приложении без GraphQL.
+
+## Входы
+
+| Вход | Для чего | Тянет |
+|------|----------|-------|
+| `@application-kit/authorization` | сервер и браузер: реестры, `buildAbilityFor`, `composeAbilityGrants` | только `@casl/ability` |
+| `@application-kit/authorization/nest` | сервер: guard, декораторы, фабрика, логгер | `@nestjs/*`, `nestjs-pino` |
+
+Корневой вход не импортирует Nest — его можно собирать в браузерный бандл.
+
+## Словарь приложения
+
+Роли, subject'ы и их action'ы объявляются расширением реестров пакета (module augmentation):
+
+```ts
+declare module '@application-kit/authorization' {
+  interface RoleRegistryInterface { EDITOR: true, VIEWER: true }
+  interface SubjectRegistryInterface { Article: 'publish' | 'read' }
+}
+```
+
+Пока реестр ролей пуст, тип роли — `never`: грант нельзя выдать роли, которой приложение не объявило.
+
+## Гранты
+
+Модуль объявляет фрагмент карты «роль → грант» рядом со своим subject'ом; фрагменты складываются в одну карту.
+Гранты одной роли из разных модулей складываются, а не перезаписывают друг друга. Роль без гранта не получает
+ни одного правила (deny-by-default).
+
+```ts
+const grants = composeAbilityGrants(['EDITOR', 'VIEWER'], articleGrants, commentGrants)
+const ability = buildAbilityFor({ role: 'EDITOR' }, grants)
+```
+
+## Nest
+
+- `PoliciesGuard` — глобальный guard (`APP_GUARD`): обработчик с `@Public()` пропускается, с `@CheckPolicies(...)` —
+  проверяется конъюнкцией политик над ability актора из `request.user`. GraphQL-резолвер без обоих декораторов
+  запрещён (fail-closed) с предупреждением в лог, REST-обработчик — пропускается: его авторизация на маршруте.
+- `CheckPolicies(...handlers)`, `PolicyHandler`, `permitAuthenticated` — политики обработчика.
+- `Public()`, `IS_PUBLIC_KEY` — открытый обработчик; ключ читает и guard аутентификации приложения.
+- `AbilityFactory` — ability актора по карте грантов.
+
+Провайдеры токенов приносит приложение:
+
+```ts
+providers: [
+  AbilityFactory,
+  { provide: ABILITY_FACTORY, useExisting: AbilityFactory },
+  { provide: ABILITY_GRANTS, useValue: grants },
+  { provide: AUTHORIZATION_LOGGER, useClass: AuthorizationLogger },
+  { provide: APP_GUARD, useClass: PoliciesGuard },
+]
+```
+
+`AuthorizationLogger` — pino-логгер пакета с контекстом `AuthorizationLogger`; собирается из глобального
+`LoggerModule` `nestjs-pino`.

package/dist/cjs/build-ability.d.ts

@@ -0,0 +1,7 @@
+import type { AbilityGrantMap } from './types/ability-grant.js';
+import type { AppAbility } from './types/ability.js';
+import type { Role } from './types/roles.js';
+export interface AbilityActorInterface {
+    role: Role;
+}
+export declare const buildAbilityFor: (actor: AbilityActorInterface | null, grants: AbilityGrantMap) => AppAbility;

package/dist/cjs/build-ability.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildAbilityFor = void 0;
+const ability_1 = require("@casl/ability");
+const grantOf = (grants, role) => grants[role];
+const buildAbilityFor = (actor, grants) => {
+    const builder = new ability_1.AbilityBuilder(ability_1.createMongoAbility);
+    if (actor !== null) {
+        grantOf(grants, actor.role)?.(builder);
+    }
+    return builder.build();
+};
+exports.buildAbilityFor = buildAbilityFor;

package/dist/cjs/compose-ability-grants.d.ts

@@ -0,0 +1,3 @@
+import type { AbilityGrantMap } from './types/ability-grant.js';
+import type { Role } from './types/roles.js';
+export declare const composeAbilityGrants: (roles: readonly Role[], ...fragments: AbilityGrantMap[]) => AbilityGrantMap;

package/dist/cjs/compose-ability-grants.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.composeAbilityGrants = void 0;
+const grantsForRole = (fragments, role) => {
+    const grants = [];
+    for (const fragment of fragments) {
+        const grant = fragment[role];
+        if (grant !== undefined) {
+            grants.push(grant);
+        }
+    }
+    return grants;
+};
+const composeAbilityGrants = (roles, ...fragments) => {
+    const composed = new Map();
+    for (const role of roles) {
+        const grants = grantsForRole(fragments, role);
+        if (grants.length > 0) {
+            composed.set(role, (builder) => {
+                for (const grant of grants) {
+                    grant(builder);
+                }
+            });
+        }
+    }
+    return Object.fromEntries(composed);
+};
+exports.composeAbilityGrants = composeAbilityGrants;

package/dist/cjs/index.d.ts

@@ -0,0 +1,3 @@
+export * from './types/index.js';
+export * from './build-ability.js';
+export * from './compose-ability-grants.js';

package/dist/cjs/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./types/index.js"), exports);
+__exportStar(require("./build-ability.js"), exports);
+__exportStar(require("./compose-ability-grants.js"), exports);

package/dist/cjs/nest/ability.factory.d.ts

@@ -0,0 +1,8 @@
+import type { AbilityActorInterface } from '../build-ability.js';
+import type { AbilityGrantMap } from '../types/ability-grant.js';
+import type { AppAbility } from '../types/ability.js';
+export declare class AbilityFactory {
+    private readonly grants;
+    constructor(grants: AbilityGrantMap);
+    createForActor(actor: AbilityActorInterface): AppAbility;
+}

package/dist/cjs/nest/ability.factory.js

@@ -0,0 +1,33 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AbilityFactory = void 0;
+const common_1 = require("@nestjs/common");
+const build_ability_js_1 = require("../build-ability.js");
+const constants_js_1 = require("./constants.js");
+let AbilityFactory = class AbilityFactory {
+    grants;
+    constructor(grants) {
+        this.grants = grants;
+    }
+    createForActor(actor) {
+        return (0, build_ability_js_1.buildAbilityFor)(actor, this.grants);
+    }
+};
+exports.AbilityFactory = AbilityFactory;
+exports.AbilityFactory = AbilityFactory = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(constants_js_1.ABILITY_GRANTS)),
+    __metadata("design:paramtypes", [Object])
+], AbilityFactory);

package/dist/cjs/nest/authorization-logger.d.ts

@@ -0,0 +1,5 @@
+import * as nestjsPino from 'nestjs-pino';
+import type { AuthorizationLoggerInterface } from './authorization-logger.interface.js';
+export declare class AuthorizationLogger extends nestjsPino.PinoLogger implements AuthorizationLoggerInterface {
+    constructor(options: nestjsPino.Params);
+}

package/dist/cjs/nest/authorization-logger.interface.d.ts

@@ -0,0 +1,3 @@
+export interface AuthorizationLoggerInterface {
+    warn(context: unknown, message: string): void;
+}

package/dist/cjs/nest/authorization-logger.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/nest/authorization-logger.js

@@ -0,0 +1,59 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var AuthorizationLogger_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizationLogger = void 0;
+const common_1 = require("@nestjs/common");
+const nestjsPino = __importStar(require("nestjs-pino"));
+let AuthorizationLogger = AuthorizationLogger_1 = class AuthorizationLogger extends nestjsPino.PinoLogger {
+    constructor(options) {
+        super(options);
+        this.setContext(AuthorizationLogger_1.name);
+    }
+};
+exports.AuthorizationLogger = AuthorizationLogger;
+exports.AuthorizationLogger = AuthorizationLogger = AuthorizationLogger_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [Object])
+], AuthorizationLogger);

package/dist/cjs/nest/check-policies.decorator.d.ts

@@ -0,0 +1,5 @@
+import type { CustomDecorator } from '@nestjs/common';
+import type { AppAbility } from '../types/ability.js';
+export declare const CHECK_POLICIES_KEY = "checkPolicies";
+export type PolicyHandler = (ability: AppAbility) => boolean;
+export declare const CheckPolicies: (...handlers: PolicyHandler[]) => CustomDecorator;

package/dist/cjs/nest/check-policies.decorator.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CheckPolicies = exports.CHECK_POLICIES_KEY = void 0;
+const common_1 = require("@nestjs/common");
+exports.CHECK_POLICIES_KEY = 'checkPolicies';
+const CheckPolicies = (...handlers) => (0, common_1.SetMetadata)(exports.CHECK_POLICIES_KEY, handlers);
+exports.CheckPolicies = CheckPolicies;

package/dist/cjs/nest/constants.d.ts

@@ -0,0 +1,3 @@
+export declare const ABILITY_FACTORY: unique symbol;
+export declare const ABILITY_GRANTS: unique symbol;
+export declare const AUTHORIZATION_LOGGER: unique symbol;

package/dist/cjs/nest/constants.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTHORIZATION_LOGGER = exports.ABILITY_GRANTS = exports.ABILITY_FACTORY = void 0;
+exports.ABILITY_FACTORY = Symbol('ABILITY_FACTORY');
+exports.ABILITY_GRANTS = Symbol('ABILITY_GRANTS');
+exports.AUTHORIZATION_LOGGER = Symbol('AUTHORIZATION_LOGGER');

package/dist/cjs/nest/index.d.ts

@@ -0,0 +1,8 @@
+export * from './ability.factory.js';
+export * from './authorization-logger.js';
+export * from './authorization-logger.interface.js';
+export * from './check-policies.decorator.js';
+export * from './constants.js';
+export * from './policies.guard.js';
+export * from './policy-handlers.js';
+export * from './public.decorator.js';

package/dist/cjs/nest/index.js

@@ -0,0 +1,24 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./ability.factory.js"), exports);
+__exportStar(require("./authorization-logger.js"), exports);
+__exportStar(require("./authorization-logger.interface.js"), exports);
+__exportStar(require("./check-policies.decorator.js"), exports);
+__exportStar(require("./constants.js"), exports);
+__exportStar(require("./policies.guard.js"), exports);
+__exportStar(require("./policy-handlers.js"), exports);
+__exportStar(require("./public.decorator.js"), exports);

package/dist/cjs/nest/policies.guard.d.ts

@@ -0,0 +1,14 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import type { AbilityFactory } from './ability.factory.js';
+import type { AuthorizationLoggerInterface } from './authorization-logger.interface.js';
+export declare class PoliciesGuard implements CanActivate {
+    private readonly reflector;
+    private readonly abilityFactory;
+    private readonly logger;
+    constructor(reflector: Reflector, abilityFactory: AbilityFactory, logger: AuthorizationLoggerInterface);
+    canActivate(context: ExecutionContext): boolean;
+    private allowWithoutPolicies;
+    private enforcePolicies;
+    private extractActor;
+}

package/dist/cjs/nest/policies.guard.js

@@ -0,0 +1,78 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PoliciesGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const check_policies_decorator_js_1 = require("./check-policies.decorator.js");
+const constants_js_1 = require("./constants.js");
+const public_decorator_js_1 = require("./public.decorator.js");
+const GRAPHQL_CONTEXT_TYPE = 'graphql';
+const GRAPHQL_CONTEXT_ARGUMENT_INDEX = 2;
+const isGraphql = (context) => context.getType() === GRAPHQL_CONTEXT_TYPE;
+let PoliciesGuard = class PoliciesGuard {
+    reflector;
+    abilityFactory;
+    logger;
+    constructor(reflector, abilityFactory, logger) {
+        this.reflector = reflector;
+        this.abilityFactory = abilityFactory;
+        this.logger = logger;
+    }
+    canActivate(context) {
+        const isPublic = this.reflector.getAllAndOverride(public_decorator_js_1.IS_PUBLIC_KEY, [
+            context.getHandler(),
+            context.getClass(),
+        ]);
+        if (isPublic === true) {
+            return true;
+        }
+        const handlers = this.reflector.getAllAndOverride(check_policies_decorator_js_1.CHECK_POLICIES_KEY, [context.getHandler(), context.getClass()]) ?? [];
+        return handlers.length === 0 ? this.allowWithoutPolicies(context) : this.enforcePolicies({ context, handlers });
+    }
+    allowWithoutPolicies(context) {
+        if (isGraphql(context)) {
+            this.logger.warn({ class: context.getClass().name, handler: context.getHandler().name }, 'PoliciesGuard deny-by-default — GraphQL resolver missing @Public/@CheckPolicies');
+            throw new common_1.ForbiddenException('Forbidden by policy');
+        }
+        return true;
+    }
+    enforcePolicies(parameters) {
+        const actor = this.extractActor(parameters.context);
+        if (actor === null) {
+            throw new common_1.ForbiddenException('No authenticated user');
+        }
+        const ability = this.abilityFactory.createForActor({
+            role: actor.role,
+        });
+        const isAllowed = parameters.handlers.every((handler) => handler(ability));
+        if (!isAllowed) {
+            throw new common_1.ForbiddenException('Forbidden by policy');
+        }
+        return true;
+    }
+    extractActor(context) {
+        const request = isGraphql(context)
+            ? context.getArgByIndex(GRAPHQL_CONTEXT_ARGUMENT_INDEX).req
+            : context.switchToHttp().getRequest();
+        return request?.user ?? null;
+    }
+};
+exports.PoliciesGuard = PoliciesGuard;
+exports.PoliciesGuard = PoliciesGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __param(1, (0, common_1.Inject)(constants_js_1.ABILITY_FACTORY)),
+    __param(2, (0, common_1.Inject)(constants_js_1.AUTHORIZATION_LOGGER)),
+    __metadata("design:paramtypes", [core_1.Reflector, Function, Object])
+], PoliciesGuard);

package/dist/cjs/nest/policy-handlers.d.ts

@@ -0,0 +1,2 @@
+import type { PolicyHandler } from './check-policies.decorator.js';
+export declare const permitAuthenticated: PolicyHandler;

package/dist/cjs/nest/policy-handlers.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.permitAuthenticated = void 0;
+const permitAuthenticated = () => true;
+exports.permitAuthenticated = permitAuthenticated;

package/dist/cjs/nest/public.decorator.d.ts

@@ -0,0 +1,3 @@
+import type { CustomDecorator } from '@nestjs/common';
+export declare const IS_PUBLIC_KEY = "isPublic";
+export declare const Public: () => CustomDecorator;

package/dist/cjs/nest/public.decorator.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Public = exports.IS_PUBLIC_KEY = void 0;
+const common_1 = require("@nestjs/common");
+exports.IS_PUBLIC_KEY = 'isPublic';
+const Public = () => (0, common_1.SetMetadata)(exports.IS_PUBLIC_KEY, true);
+exports.Public = Public;

package/dist/cjs/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}

package/dist/cjs/types/ability-grant.d.ts

@@ -0,0 +1,5 @@
+import type { AbilityBuilder } from '@casl/ability';
+import type { AppAbility } from './ability.js';
+import type { Role } from './roles.js';
+export type AbilityGrant = (builder: AbilityBuilder<AppAbility>) => void;
+export type AbilityGrantMap = Partial<Record<Role, AbilityGrant>>;

package/dist/cjs/types/ability-grant.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/types/ability.d.ts

@@ -0,0 +1,4 @@
+import type { MongoAbility } from '@casl/ability';
+import type { Action } from './actions.js';
+import type { Subject } from './subjects.js';
+export type AppAbility = MongoAbility<[Action, Subject]>;

package/dist/cjs/types/ability.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/types/actions.d.ts

@@ -0,0 +1,2 @@
+import type { Subject, SubjectRegistryInterface } from './subjects.js';
+export type Action = SubjectRegistryInterface[Subject];

package/dist/cjs/types/actions.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/types/index.d.ts

@@ -0,0 +1,5 @@
+export * from './ability.js';
+export * from './ability-grant.js';
+export * from './actions.js';
+export * from './roles.js';
+export * from './subjects.js';

package/dist/cjs/types/index.js

@@ -0,0 +1,21 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./ability.js"), exports);
+__exportStar(require("./ability-grant.js"), exports);
+__exportStar(require("./actions.js"), exports);
+__exportStar(require("./roles.js"), exports);
+__exportStar(require("./subjects.js"), exports);

package/dist/cjs/types/roles.d.ts

@@ -0,0 +1,3 @@
+export type Role = keyof RoleRegistryInterface;
+export interface RoleRegistryInterface {
+}

package/dist/cjs/types/roles.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/types/subjects.d.ts

@@ -0,0 +1,4 @@
+export type Subject = keyof SubjectRegistryInterface;
+export interface SubjectRegistryInterface {
+    all: never;
+}

package/dist/cjs/types/subjects.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/esm/build-ability.d.ts

@@ -0,0 +1,7 @@
+import type { AbilityGrantMap } from './types/ability-grant.js';
+import type { AppAbility } from './types/ability.js';
+import type { Role } from './types/roles.js';
+export interface AbilityActorInterface {
+    role: Role;
+}
+export declare const buildAbilityFor: (actor: AbilityActorInterface | null, grants: AbilityGrantMap) => AppAbility;

package/dist/esm/build-ability.js

@@ -0,0 +1,9 @@
+import { AbilityBuilder, createMongoAbility } from '@casl/ability';
+const grantOf = (grants, role) => grants[role];
+export const buildAbilityFor = (actor, grants) => {
+    const builder = new AbilityBuilder(createMongoAbility);
+    if (actor !== null) {
+        grantOf(grants, actor.role)?.(builder);
+    }
+    return builder.build();
+};

package/dist/esm/compose-ability-grants.d.ts

@@ -0,0 +1,3 @@
+import type { AbilityGrantMap } from './types/ability-grant.js';
+import type { Role } from './types/roles.js';
+export declare const composeAbilityGrants: (roles: readonly Role[], ...fragments: AbilityGrantMap[]) => AbilityGrantMap;

package/dist/esm/compose-ability-grants.js

@@ -0,0 +1,24 @@
+const grantsForRole = (fragments, role) => {
+    const grants = [];
+    for (const fragment of fragments) {
+        const grant = fragment[role];
+        if (grant !== undefined) {
+            grants.push(grant);
+        }
+    }
+    return grants;
+};
+export const composeAbilityGrants = (roles, ...fragments) => {
+    const composed = new Map();
+    for (const role of roles) {
+        const grants = grantsForRole(fragments, role);
+        if (grants.length > 0) {
+            composed.set(role, (builder) => {
+                for (const grant of grants) {
+                    grant(builder);
+                }
+            });
+        }
+    }
+    return Object.fromEntries(composed);
+};

package/dist/esm/index.d.ts

@@ -0,0 +1,3 @@
+export * from './types/index.js';
+export * from './build-ability.js';
+export * from './compose-ability-grants.js';

package/dist/esm/index.js

@@ -0,0 +1,3 @@
+export * from './types/index.js';
+export * from './build-ability.js';
+export * from './compose-ability-grants.js';

package/dist/esm/nest/ability.factory.d.ts

@@ -0,0 +1,8 @@
+import type { AbilityActorInterface } from '../build-ability.js';
+import type { AbilityGrantMap } from '../types/ability-grant.js';
+import type { AppAbility } from '../types/ability.js';
+export declare class AbilityFactory {
+    private readonly grants;
+    constructor(grants: AbilityGrantMap);
+    createForActor(actor: AbilityActorInterface): AppAbility;
+}

package/dist/esm/nest/ability.factory.js

@@ -0,0 +1,30 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from '@nestjs/common';
+import { buildAbilityFor } from '../build-ability.js';
+import { ABILITY_GRANTS } from './constants.js';
+let AbilityFactory = class AbilityFactory {
+    grants;
+    constructor(grants) {
+        this.grants = grants;
+    }
+    createForActor(actor) {
+        return buildAbilityFor(actor, this.grants);
+    }
+};
+AbilityFactory = __decorate([
+    Injectable(),
+    __param(0, Inject(ABILITY_GRANTS)),
+    __metadata("design:paramtypes", [Object])
+], AbilityFactory);
+export { AbilityFactory };

package/dist/esm/nest/authorization-logger.d.ts

@@ -0,0 +1,5 @@
+import * as nestjsPino from 'nestjs-pino';
+import type { AuthorizationLoggerInterface } from './authorization-logger.interface.js';
+export declare class AuthorizationLogger extends nestjsPino.PinoLogger implements AuthorizationLoggerInterface {
+    constructor(options: nestjsPino.Params);
+}

package/dist/esm/nest/authorization-logger.interface.d.ts

@@ -0,0 +1,3 @@
+export interface AuthorizationLoggerInterface {
+    warn(context: unknown, message: string): void;
+}

package/dist/esm/nest/authorization-logger.interface.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/nest/authorization-logger.js

@@ -0,0 +1,23 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var AuthorizationLogger_1;
+import { Injectable } from '@nestjs/common';
+import * as nestjsPino from 'nestjs-pino';
+let AuthorizationLogger = AuthorizationLogger_1 = class AuthorizationLogger extends nestjsPino.PinoLogger {
+    constructor(options) {
+        super(options);
+        this.setContext(AuthorizationLogger_1.name);
+    }
+};
+AuthorizationLogger = AuthorizationLogger_1 = __decorate([
+    Injectable(),
+    __metadata("design:paramtypes", [Object])
+], AuthorizationLogger);
+export { AuthorizationLogger };

package/dist/esm/nest/check-policies.decorator.d.ts

@@ -0,0 +1,5 @@
+import type { CustomDecorator } from '@nestjs/common';
+import type { AppAbility } from '../types/ability.js';
+export declare const CHECK_POLICIES_KEY = "checkPolicies";
+export type PolicyHandler = (ability: AppAbility) => boolean;
+export declare const CheckPolicies: (...handlers: PolicyHandler[]) => CustomDecorator;

package/dist/esm/nest/check-policies.decorator.js

@@ -0,0 +1,3 @@
+import { SetMetadata } from '@nestjs/common';
+export const CHECK_POLICIES_KEY = 'checkPolicies';
+export const CheckPolicies = (...handlers) => SetMetadata(CHECK_POLICIES_KEY, handlers);

package/dist/esm/nest/constants.d.ts

@@ -0,0 +1,3 @@
+export declare const ABILITY_FACTORY: unique symbol;
+export declare const ABILITY_GRANTS: unique symbol;
+export declare const AUTHORIZATION_LOGGER: unique symbol;

package/dist/esm/nest/constants.js

@@ -0,0 +1,3 @@
+export const ABILITY_FACTORY = Symbol('ABILITY_FACTORY');
+export const ABILITY_GRANTS = Symbol('ABILITY_GRANTS');
+export const AUTHORIZATION_LOGGER = Symbol('AUTHORIZATION_LOGGER');

package/dist/esm/nest/index.d.ts

@@ -0,0 +1,8 @@
+export * from './ability.factory.js';
+export * from './authorization-logger.js';
+export * from './authorization-logger.interface.js';
+export * from './check-policies.decorator.js';
+export * from './constants.js';
+export * from './policies.guard.js';
+export * from './policy-handlers.js';
+export * from './public.decorator.js';

package/dist/esm/nest/index.js

@@ -0,0 +1,8 @@
+export * from './ability.factory.js';
+export * from './authorization-logger.js';
+export * from './authorization-logger.interface.js';
+export * from './check-policies.decorator.js';
+export * from './constants.js';
+export * from './policies.guard.js';
+export * from './policy-handlers.js';
+export * from './public.decorator.js';

package/dist/esm/nest/policies.guard.d.ts

@@ -0,0 +1,14 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import type { AbilityFactory } from './ability.factory.js';
+import type { AuthorizationLoggerInterface } from './authorization-logger.interface.js';
+export declare class PoliciesGuard implements CanActivate {
+    private readonly reflector;
+    private readonly abilityFactory;
+    private readonly logger;
+    constructor(reflector: Reflector, abilityFactory: AbilityFactory, logger: AuthorizationLoggerInterface);
+    canActivate(context: ExecutionContext): boolean;
+    private allowWithoutPolicies;
+    private enforcePolicies;
+    private extractActor;
+}

package/dist/esm/nest/policies.guard.js

@@ -0,0 +1,75 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { ForbiddenException, Inject, Injectable, } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { CHECK_POLICIES_KEY } from './check-policies.decorator.js';
+import { ABILITY_FACTORY, AUTHORIZATION_LOGGER } from './constants.js';
+import { IS_PUBLIC_KEY } from './public.decorator.js';
+const GRAPHQL_CONTEXT_TYPE = 'graphql';
+const GRAPHQL_CONTEXT_ARGUMENT_INDEX = 2;
+const isGraphql = (context) => context.getType() === GRAPHQL_CONTEXT_TYPE;
+let PoliciesGuard = class PoliciesGuard {
+    reflector;
+    abilityFactory;
+    logger;
+    constructor(reflector, abilityFactory, logger) {
+        this.reflector = reflector;
+        this.abilityFactory = abilityFactory;
+        this.logger = logger;
+    }
+    canActivate(context) {
+        const isPublic = this.reflector.getAllAndOverride(IS_PUBLIC_KEY, [
+            context.getHandler(),
+            context.getClass(),
+        ]);
+        if (isPublic === true) {
+            return true;
+        }
+        const handlers = this.reflector.getAllAndOverride(CHECK_POLICIES_KEY, [context.getHandler(), context.getClass()]) ?? [];
+        return handlers.length === 0 ? this.allowWithoutPolicies(context) : this.enforcePolicies({ context, handlers });
+    }
+    allowWithoutPolicies(context) {
+        if (isGraphql(context)) {
+            this.logger.warn({ class: context.getClass().name, handler: context.getHandler().name }, 'PoliciesGuard deny-by-default — GraphQL resolver missing @Public/@CheckPolicies');
+            throw new ForbiddenException('Forbidden by policy');
+        }
+        return true;
+    }
+    enforcePolicies(parameters) {
+        const actor = this.extractActor(parameters.context);
+        if (actor === null) {
+            throw new ForbiddenException('No authenticated user');
+        }
+        const ability = this.abilityFactory.createForActor({
+            role: actor.role,
+        });
+        const isAllowed = parameters.handlers.every((handler) => handler(ability));
+        if (!isAllowed) {
+            throw new ForbiddenException('Forbidden by policy');
+        }
+        return true;
+    }
+    extractActor(context) {
+        const request = isGraphql(context)
+            ? context.getArgByIndex(GRAPHQL_CONTEXT_ARGUMENT_INDEX).req
+            : context.switchToHttp().getRequest();
+        return request?.user ?? null;
+    }
+};
+PoliciesGuard = __decorate([
+    Injectable(),
+    __param(1, Inject(ABILITY_FACTORY)),
+    __param(2, Inject(AUTHORIZATION_LOGGER)),
+    __metadata("design:paramtypes", [Reflector, Function, Object])
+], PoliciesGuard);
+export { PoliciesGuard };

package/dist/esm/nest/policy-handlers.d.ts

@@ -0,0 +1,2 @@
+import type { PolicyHandler } from './check-policies.decorator.js';
+export declare const permitAuthenticated: PolicyHandler;

package/dist/esm/nest/policy-handlers.js

@@ -0,0 +1 @@
+export const permitAuthenticated = () => true;

package/dist/esm/nest/public.decorator.d.ts

@@ -0,0 +1,3 @@
+import type { CustomDecorator } from '@nestjs/common';
+export declare const IS_PUBLIC_KEY = "isPublic";
+export declare const Public: () => CustomDecorator;

package/dist/esm/nest/public.decorator.js

@@ -0,0 +1,3 @@
+import { SetMetadata } from '@nestjs/common';
+export const IS_PUBLIC_KEY = 'isPublic';
+export const Public = () => SetMetadata(IS_PUBLIC_KEY, true);

package/dist/esm/types/ability-grant.d.ts

@@ -0,0 +1,5 @@
+import type { AbilityBuilder } from '@casl/ability';
+import type { AppAbility } from './ability.js';
+import type { Role } from './roles.js';
+export type AbilityGrant = (builder: AbilityBuilder<AppAbility>) => void;
+export type AbilityGrantMap = Partial<Record<Role, AbilityGrant>>;

package/dist/esm/types/ability-grant.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/types/ability.d.ts

@@ -0,0 +1,4 @@
+import type { MongoAbility } from '@casl/ability';
+import type { Action } from './actions.js';
+import type { Subject } from './subjects.js';
+export type AppAbility = MongoAbility<[Action, Subject]>;

package/dist/esm/types/ability.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/types/actions.d.ts

@@ -0,0 +1,2 @@
+import type { Subject, SubjectRegistryInterface } from './subjects.js';
+export type Action = SubjectRegistryInterface[Subject];

package/dist/esm/types/actions.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/types/index.d.ts

@@ -0,0 +1,5 @@
+export * from './ability.js';
+export * from './ability-grant.js';
+export * from './actions.js';
+export * from './roles.js';
+export * from './subjects.js';

package/dist/esm/types/index.js

@@ -0,0 +1,5 @@
+export * from './ability.js';
+export * from './ability-grant.js';
+export * from './actions.js';
+export * from './roles.js';
+export * from './subjects.js';

package/dist/esm/types/roles.d.ts

@@ -0,0 +1,3 @@
+export type Role = keyof RoleRegistryInterface;
+export interface RoleRegistryInterface {
+}

package/dist/esm/types/roles.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/types/subjects.d.ts

@@ -0,0 +1,4 @@
+export type Subject = keyof SubjectRegistryInterface;
+export interface SubjectRegistryInterface {
+    all: never;
+}

package/dist/esm/types/subjects.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,87 @@
 {
   "name": "@application-kit/authorization",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.0.0",
+  "description": "Авторизация на CASL для NestJS и браузера: реестры subject'ов и ролей, ability из грантов модулей, глобальный guard политик",
+  "keywords": [
+    "authorization",
+    "casl",
+    "nestjs",
+    "policies"
+  ],
+  "homepage": "https://gitlab.com/application-kit/application-kit/-/tree/main/packages/authorization",
+  "bugs": "https://gitlab.com/application-kit/application-kit/-/issues",
+  "repository": {
+    "type": "git",
+    "url": "https://gitlab.com/application-kit/application-kit.git",
+    "directory": "packages/authorization"
+  },
+  "license": "MIT",
+  "author": {
+    "name": "application-kit"
+  },
+  "sideEffects": false,
+  "type": "module",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/esm/index.d.ts",
+        "default": "./dist/esm/index.js"
+      },
+      "require": {
+        "types": "./dist/cjs/index.d.ts",
+        "default": "./dist/cjs/index.js"
+      }
+    },
+    "./nest": {
+      "import": {
+        "types": "./dist/esm/nest/index.d.ts",
+        "default": "./dist/esm/nest/index.js"
+      },
+      "require": {
+        "types": "./dist/cjs/nest/index.d.ts",
+        "default": "./dist/cjs/nest/index.js"
+      }
+    },
+    "./package.json": "./package.json"
+  },
+  "main": "./dist/cjs/index.js",
+  "module": "./dist/esm/index.js",
+  "types": "./dist/cjs/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "rm -rf ./dist && node ../../scripts/barrels.mjs create ./src --entry-only=nest && tsc --project tsconfig.build.json && tsc --project tsconfig.build.cjs.json && node ../../scripts/barrels.mjs clean ./src && node ../../scripts/mark-cjs.mjs ./dist/cjs",
+    "lint:tsc": "tsc --noEmit --pretty --project .",
+    "test:mutation": "stryker run",
+    "test:unit": "vitest run"
+  },
+  "devDependencies": {
+    "@casl/ability": "^7.0.1",
+    "@nestjs/common": "^11.2.7",
+    "@nestjs/core": "^11.2.7",
+    "@nestjs/testing": "^11.2.7",
+    "@stryker-mutator/core": "^10.0.0",
+    "@stryker-mutator/vitest-runner": "^10.0.0",
+    "@types/node": "^26.2.0",
+    "nestjs-pino": "^4.6.1",
+    "pino": "^10.3.1",
+    "pino-http": "^11.0.0",
+    "reflect-metadata": "^0.2.2",
+    "rxjs": "^7.8.2",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.11"
+  },
+  "peerDependencies": {
+    "@casl/ability": "^7.0.0",
+    "@nestjs/common": "^11.0.0",
+    "@nestjs/core": "^11.0.0",
+    "nestjs-pino": "^4.6.1"
+  },
+  "engines": {
+    "node": ">=24"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
 }