@application-kit/authorization 0.1.0 → 0.3.0

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @application-kit/authorization
 
+## 0.3.0
+
+### Minor Changes
+
+- ef902ec: Вход `/nest`: `CurrentActor()` — актор параметром обработчика, `withPublicRoutes(AuthGuard('jwt'))` — guard аутентификации с учётом `@Public()`, `resolveExecutionRequest` — чтение запроса без развилки HTTP/GraphQL. Новых зависимостей нет: `@nestjs/graphql` и `@nestjs/passport` пакету не нужны.
+
+## 0.2.0
+
+### Minor Changes
+
+- 4bcfbde: Вход `/nest`: `AuthorizationModule.forRoot({ grants })` — динамический модуль с `AbilityFactory` (токен `ABILITY_FACTORY`),
+  картой грантов `ABILITY_GRANTS`, pino-логгером `AUTHORIZATION_LOGGER` и глобальным `PoliciesGuard` (`APP_GUARD`);
+  экспортирует `ABILITY_FACTORY`, `ABILITY_GRANTS`, `AbilityFactory`. Ручная проводка провайдеров в приложении больше не нужна.
+  `PoliciesGuard` получает `Reflector` по явному токену — модуль собирается и без `emitDecoratorMetadata`.
+
 ## 0.1.0
 
 ### Minor Changes

package/README.md

@@ -52,19 +52,22 @@ const ability = buildAbilityFor({ role: 'EDITOR' }, grants)
   проверяется конъюнкцией политик над ability актора из `request.user`. GraphQL-резолвер без обоих декораторов
   запрещён (fail-closed) с предупреждением в лог, REST-обработчик — пропускается: его авторизация на маршруте.
 - `CheckPolicies(...handlers)`, `PolicyHandler`, `permitAuthenticated` — политики обработчика.
-- `Public()`, `IS_PUBLIC_KEY` — открытый обработчик; ключ читает и guard аутентификации приложения.
+- `Public()`, `IS_PUBLIC_KEY` — открытый обработчик.
+- `withPublicRoutes(AuthGuard('jwt'))` — guard аутентификации приложения поверх его базы: открытый обработчик пропускает
+  мимо базы, а запрос ей отдаёт и на HTTP, и в GraphQL. `@nestjs/passport` пакету не нужен.
+- `CurrentActor()` — параметр обработчика с `request.user`; на открытом обработчике актора может не быть.
+- `resolveExecutionRequest(context)` — запрос без развилки транспорта. `@nestjs/graphql` пакету не нужен.
 - `AbilityFactory` — ability актора по карте грантов.
 
-Провайдеры токенов приносит приложение:
+Собирает механизм `AuthorizationModule.forRoot({ grants })`: фабрика ability, логгер и глобальный guard (`APP_GUARD`)
+провайдятся пакетом, приложение приносит только карту грантов. Наружу модуль отдаёт `ABILITY_FACTORY`, `ABILITY_GRANTS`
+и `AbilityFactory` — для кода, который строит ability актора сам (например, резолвер, отдающий её клиенту).
 
 ```ts
-providers: [
-  AbilityFactory,
-  { provide: ABILITY_FACTORY, useExisting: AbilityFactory },
-  { provide: ABILITY_GRANTS, useValue: grants },
-  { provide: AUTHORIZATION_LOGGER, useClass: AuthorizationLogger },
-  { provide: APP_GUARD, useClass: PoliciesGuard },
-]
+@Module({
+  imports: [AuthorizationModule.forRoot({ grants })],
+})
+export class AppModule {}
 ```
 
 `AuthorizationLogger` — pino-логгер пакета с контекстом `AuthorizationLogger`; собирается из глобального

package/dist/cjs/nest/authorization.module.d.ts

@@ -0,0 +1,8 @@
+import type { DynamicModule } from '@nestjs/common';
+import type { AbilityGrantMap } from '../types/ability-grant.js';
+export interface AuthorizationModuleOptionsInterface {
+    readonly grants: AbilityGrantMap;
+}
+export declare class AuthorizationModule {
+    static forRoot(options: AuthorizationModuleOptionsInterface): DynamicModule;
+}

package/dist/cjs/nest/authorization.module.js

@@ -0,0 +1,35 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizationModule = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const ability_factory_js_1 = require("./ability.factory.js");
+const authorization_logger_js_1 = require("./authorization-logger.js");
+const constants_js_1 = require("./constants.js");
+const policies_guard_js_1 = require("./policies.guard.js");
+let AuthorizationModule = class AuthorizationModule {
+    static forRoot(options) {
+        return {
+            exports: [constants_js_1.ABILITY_FACTORY, constants_js_1.ABILITY_GRANTS, ability_factory_js_1.AbilityFactory],
+            module: this,
+            providers: [
+                ability_factory_js_1.AbilityFactory,
+                { provide: constants_js_1.ABILITY_FACTORY, useExisting: ability_factory_js_1.AbilityFactory },
+                { provide: constants_js_1.ABILITY_GRANTS, useValue: options.grants },
+                { provide: constants_js_1.AUTHORIZATION_LOGGER, useClass: authorization_logger_js_1.AuthorizationLogger },
+                policies_guard_js_1.PoliciesGuard,
+                { provide: core_1.APP_GUARD, useExisting: policies_guard_js_1.PoliciesGuard },
+            ],
+        };
+    }
+};
+exports.AuthorizationModule = AuthorizationModule;
+exports.AuthorizationModule = AuthorizationModule = __decorate([
+    (0, common_1.Module)({})
+], AuthorizationModule);

package/dist/cjs/nest/current-actor.decorator.d.ts

@@ -0,0 +1 @@
+export declare const CurrentActor: (...dataOrPipes: unknown[]) => ParameterDecorator;

package/dist/cjs/nest/current-actor.decorator.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CurrentActor = void 0;
+const common_1 = require("@nestjs/common");
+const resolve_execution_actor_js_1 = require("./internal/resolve-execution-actor.js");
+const currentActorFactory = (_, context) => (0, resolve_execution_actor_js_1.resolveExecutionActor)(context);
+exports.CurrentActor = (0, common_1.createParamDecorator)(currentActorFactory);

package/dist/cjs/nest/index.d.ts

@@ -1,8 +1,12 @@
 export * from './ability.factory.js';
 export * from './authorization-logger.js';
 export * from './authorization-logger.interface.js';
+export * from './authorization.module.js';
 export * from './check-policies.decorator.js';
 export * from './constants.js';
+export * from './current-actor.decorator.js';
 export * from './policies.guard.js';
 export * from './policy-handlers.js';
 export * from './public.decorator.js';
+export * from './resolve-execution-request.js';
+export * from './with-public-routes.js';

package/dist/cjs/nest/index.js

@@ -17,8 +17,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./ability.factory.js"), exports);
 __exportStar(require("./authorization-logger.js"), exports);
 __exportStar(require("./authorization-logger.interface.js"), exports);
+__exportStar(require("./authorization.module.js"), exports);
 __exportStar(require("./check-policies.decorator.js"), exports);
 __exportStar(require("./constants.js"), exports);
+__exportStar(require("./current-actor.decorator.js"), exports);
 __exportStar(require("./policies.guard.js"), exports);
 __exportStar(require("./policy-handlers.js"), exports);
 __exportStar(require("./public.decorator.js"), exports);
+__exportStar(require("./resolve-execution-request.js"), exports);
+__exportStar(require("./with-public-routes.js"), exports);

package/dist/cjs/nest/internal/index.d.ts

@@ -0,0 +1,3 @@
+export * from './is-graphql-context.js';
+export * from './is-public-handler.js';
+export * from './resolve-execution-actor.js';

package/dist/cjs/nest/internal/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./is-graphql-context.js"), exports);
+__exportStar(require("./is-public-handler.js"), exports);
+__exportStar(require("./resolve-execution-actor.js"), exports);

package/dist/cjs/nest/internal/is-graphql-context.d.ts

@@ -0,0 +1,2 @@
+import type { ExecutionContext } from '@nestjs/common';
+export declare const isGraphqlContext: (context: ExecutionContext) => boolean;

package/dist/cjs/nest/internal/is-graphql-context.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isGraphqlContext = void 0;
+const GRAPHQL_CONTEXT_TYPE = 'graphql';
+const isGraphqlContext = (context) => {
+    const transport = context.getType();
+    return transport === GRAPHQL_CONTEXT_TYPE;
+};
+exports.isGraphqlContext = isGraphqlContext;

package/dist/cjs/nest/internal/is-public-handler.d.ts

@@ -0,0 +1,3 @@
+import type { ExecutionContext } from '@nestjs/common';
+import type { Reflector } from '@nestjs/core';
+export declare const isPublicHandler: (reflector: Reflector, context: ExecutionContext) => boolean;

package/dist/cjs/nest/internal/is-public-handler.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isPublicHandler = void 0;
+const public_decorator_js_1 = require("../public.decorator.js");
+const isPublicHandler = (reflector, context) => {
+    const targets = [context.getHandler(), context.getClass()];
+    return reflector.getAllAndOverride(public_decorator_js_1.IS_PUBLIC_KEY, targets) === true;
+};
+exports.isPublicHandler = isPublicHandler;

package/dist/cjs/nest/internal/resolve-execution-actor.d.ts

@@ -0,0 +1,3 @@
+import type { ExecutionContext } from '@nestjs/common';
+import type { AbilityActorInterface } from '../../build-ability.js';
+export declare const resolveExecutionActor: (context: ExecutionContext) => AbilityActorInterface | undefined;

package/dist/cjs/nest/internal/resolve-execution-actor.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveExecutionActor = void 0;
+const resolve_execution_request_js_1 = require("../resolve-execution-request.js");
+const resolveExecutionActor = (context) => {
+    const request = (0, resolve_execution_request_js_1.resolveExecutionRequest)(context);
+    return request?.user;
+};
+exports.resolveExecutionActor = resolveExecutionActor;

package/dist/cjs/nest/policies.guard.d.ts

@@ -10,5 +10,4 @@ export declare class PoliciesGuard implements CanActivate {
     canActivate(context: ExecutionContext): boolean;
     private allowWithoutPolicies;
     private enforcePolicies;
-    private extractActor;
 }

package/dist/cjs/nest/policies.guard.js

@@ -17,10 +17,9 @@ const common_1 = require("@nestjs/common");
 const core_1 = require("@nestjs/core");
 const check_policies_decorator_js_1 = require("./check-policies.decorator.js");
 const constants_js_1 = require("./constants.js");
-const public_decorator_js_1 = require("./public.decorator.js");
-const GRAPHQL_CONTEXT_TYPE = 'graphql';
-const GRAPHQL_CONTEXT_ARGUMENT_INDEX = 2;
-const isGraphql = (context) => context.getType() === GRAPHQL_CONTEXT_TYPE;
+const is_graphql_context_js_1 = require("./internal/is-graphql-context.js");
+const is_public_handler_js_1 = require("./internal/is-public-handler.js");
+const resolve_execution_actor_js_1 = require("./internal/resolve-execution-actor.js");
 let PoliciesGuard = class PoliciesGuard {
     reflector;
     abilityFactory;
@@ -31,26 +30,22 @@ let PoliciesGuard = class PoliciesGuard {
         this.logger = logger;
     }
     canActivate(context) {
-        const isPublic = this.reflector.getAllAndOverride(public_decorator_js_1.IS_PUBLIC_KEY, [
-            context.getHandler(),
-            context.getClass(),
-        ]);
-        if (isPublic === true) {
+        if ((0, is_public_handler_js_1.isPublicHandler)(this.reflector, context)) {
             return true;
         }
         const handlers = this.reflector.getAllAndOverride(check_policies_decorator_js_1.CHECK_POLICIES_KEY, [context.getHandler(), context.getClass()]) ?? [];
         return handlers.length === 0 ? this.allowWithoutPolicies(context) : this.enforcePolicies({ context, handlers });
     }
     allowWithoutPolicies(context) {
-        if (isGraphql(context)) {
+        if ((0, is_graphql_context_js_1.isGraphqlContext)(context)) {
             this.logger.warn({ class: context.getClass().name, handler: context.getHandler().name }, 'PoliciesGuard deny-by-default — GraphQL resolver missing @Public/@CheckPolicies');
             throw new common_1.ForbiddenException('Forbidden by policy');
         }
         return true;
     }
     enforcePolicies(parameters) {
-        const actor = this.extractActor(parameters.context);
-        if (actor === null) {
+        const actor = (0, resolve_execution_actor_js_1.resolveExecutionActor)(parameters.context);
+        if (actor === undefined) {
             throw new common_1.ForbiddenException('No authenticated user');
         }
         const ability = this.abilityFactory.createForActor({
@@ -62,16 +57,11 @@ let PoliciesGuard = class PoliciesGuard {
         }
         return true;
     }
-    extractActor(context) {
-        const request = isGraphql(context)
-            ? context.getArgByIndex(GRAPHQL_CONTEXT_ARGUMENT_INDEX).req
-            : context.switchToHttp().getRequest();
-        return request?.user ?? null;
-    }
 };
 exports.PoliciesGuard = PoliciesGuard;
 exports.PoliciesGuard = PoliciesGuard = __decorate([
     (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(core_1.Reflector)),
     __param(1, (0, common_1.Inject)(constants_js_1.ABILITY_FACTORY)),
     __param(2, (0, common_1.Inject)(constants_js_1.AUTHORIZATION_LOGGER)),
     __metadata("design:paramtypes", [core_1.Reflector, Function, Object])

package/dist/cjs/nest/resolve-execution-request.d.ts

@@ -0,0 +1,2 @@
+import type { ExecutionContext } from '@nestjs/common';
+export declare const resolveExecutionRequest: <TRequest>(context: ExecutionContext) => TRequest | undefined;

package/dist/cjs/nest/resolve-execution-request.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveExecutionRequest = void 0;
+const is_graphql_context_js_1 = require("./internal/is-graphql-context.js");
+const GRAPHQL_CONTEXT_ARGUMENT_INDEX = 2;
+const resolveExecutionRequest = (context) => ((0, is_graphql_context_js_1.isGraphqlContext)(context)
+    ? context.getArgByIndex(GRAPHQL_CONTEXT_ARGUMENT_INDEX).req
+    : context.switchToHttp().getRequest());
+exports.resolveExecutionRequest = resolveExecutionRequest;

package/dist/cjs/nest/with-public-routes.d.ts

@@ -0,0 +1,2 @@
+import type { CanActivate, Type } from '@nestjs/common';
+export declare const withPublicRoutes: <TGuard extends Type<CanActivate>>(base: TGuard) => TGuard;

package/dist/cjs/nest/with-public-routes.js

@@ -0,0 +1,36 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withPublicRoutes = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const is_public_handler_js_1 = require("./internal/is-public-handler.js");
+const resolve_execution_request_js_1 = require("./resolve-execution-request.js");
+const withPublicRoutes = (base) => {
+    let PublicRoutesGuard = class PublicRoutesGuard extends base {
+        reflector;
+        canActivate(context) {
+            return (0, is_public_handler_js_1.isPublicHandler)(this.reflector, context) || super.canActivate(context);
+        }
+        getRequest(context) {
+            return (0, resolve_execution_request_js_1.resolveExecutionRequest)(context);
+        }
+    };
+    __decorate([
+        (0, common_1.Inject)(core_1.Reflector),
+        __metadata("design:type", core_1.Reflector)
+    ], PublicRoutesGuard.prototype, "reflector", void 0);
+    PublicRoutesGuard = __decorate([
+        (0, common_1.Injectable)()
+    ], PublicRoutesGuard);
+    return PublicRoutesGuard;
+};
+exports.withPublicRoutes = withPublicRoutes;

package/dist/esm/nest/authorization.module.d.ts

@@ -0,0 +1,8 @@
+import type { DynamicModule } from '@nestjs/common';
+import type { AbilityGrantMap } from '../types/ability-grant.js';
+export interface AuthorizationModuleOptionsInterface {
+    readonly grants: AbilityGrantMap;
+}
+export declare class AuthorizationModule {
+    static forRoot(options: AuthorizationModuleOptionsInterface): DynamicModule;
+}

package/dist/esm/nest/authorization.module.js

@@ -0,0 +1,32 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Module } from '@nestjs/common';
+import { APP_GUARD } from '@nestjs/core';
+import { AbilityFactory } from './ability.factory.js';
+import { AuthorizationLogger } from './authorization-logger.js';
+import { ABILITY_FACTORY, ABILITY_GRANTS, AUTHORIZATION_LOGGER } from './constants.js';
+import { PoliciesGuard } from './policies.guard.js';
+let AuthorizationModule = class AuthorizationModule {
+    static forRoot(options) {
+        return {
+            exports: [ABILITY_FACTORY, ABILITY_GRANTS, AbilityFactory],
+            module: this,
+            providers: [
+                AbilityFactory,
+                { provide: ABILITY_FACTORY, useExisting: AbilityFactory },
+                { provide: ABILITY_GRANTS, useValue: options.grants },
+                { provide: AUTHORIZATION_LOGGER, useClass: AuthorizationLogger },
+                PoliciesGuard,
+                { provide: APP_GUARD, useExisting: PoliciesGuard },
+            ],
+        };
+    }
+};
+AuthorizationModule = __decorate([
+    Module({})
+], AuthorizationModule);
+export { AuthorizationModule };

package/dist/esm/nest/current-actor.decorator.d.ts

@@ -0,0 +1 @@
+export declare const CurrentActor: (...dataOrPipes: unknown[]) => ParameterDecorator;

package/dist/esm/nest/current-actor.decorator.js

@@ -0,0 +1,4 @@
+import { createParamDecorator } from '@nestjs/common';
+import { resolveExecutionActor } from './internal/resolve-execution-actor.js';
+const currentActorFactory = (_, context) => resolveExecutionActor(context);
+export const CurrentActor = createParamDecorator(currentActorFactory);

package/dist/esm/nest/index.d.ts

@@ -1,8 +1,12 @@
 export * from './ability.factory.js';
 export * from './authorization-logger.js';
 export * from './authorization-logger.interface.js';
+export * from './authorization.module.js';
 export * from './check-policies.decorator.js';
 export * from './constants.js';
+export * from './current-actor.decorator.js';
 export * from './policies.guard.js';
 export * from './policy-handlers.js';
 export * from './public.decorator.js';
+export * from './resolve-execution-request.js';
+export * from './with-public-routes.js';

package/dist/esm/nest/index.js

@@ -1,8 +1,12 @@
 export * from './ability.factory.js';
 export * from './authorization-logger.js';
 export * from './authorization-logger.interface.js';
+export * from './authorization.module.js';
 export * from './check-policies.decorator.js';
 export * from './constants.js';
+export * from './current-actor.decorator.js';
 export * from './policies.guard.js';
 export * from './policy-handlers.js';
 export * from './public.decorator.js';
+export * from './resolve-execution-request.js';
+export * from './with-public-routes.js';

package/dist/esm/nest/internal/index.d.ts

@@ -0,0 +1,3 @@
+export * from './is-graphql-context.js';
+export * from './is-public-handler.js';
+export * from './resolve-execution-actor.js';

package/dist/esm/nest/internal/index.js

@@ -0,0 +1,3 @@
+export * from './is-graphql-context.js';
+export * from './is-public-handler.js';
+export * from './resolve-execution-actor.js';

package/dist/esm/nest/internal/is-graphql-context.d.ts

@@ -0,0 +1,2 @@
+import type { ExecutionContext } from '@nestjs/common';
+export declare const isGraphqlContext: (context: ExecutionContext) => boolean;

package/dist/esm/nest/internal/is-graphql-context.js

@@ -0,0 +1,5 @@
+const GRAPHQL_CONTEXT_TYPE = 'graphql';
+export const isGraphqlContext = (context) => {
+    const transport = context.getType();
+    return transport === GRAPHQL_CONTEXT_TYPE;
+};

package/dist/esm/nest/internal/is-public-handler.d.ts

@@ -0,0 +1,3 @@
+import type { ExecutionContext } from '@nestjs/common';
+import type { Reflector } from '@nestjs/core';
+export declare const isPublicHandler: (reflector: Reflector, context: ExecutionContext) => boolean;

package/dist/esm/nest/internal/is-public-handler.js

@@ -0,0 +1,5 @@
+import { IS_PUBLIC_KEY } from '../public.decorator.js';
+export const isPublicHandler = (reflector, context) => {
+    const targets = [context.getHandler(), context.getClass()];
+    return reflector.getAllAndOverride(IS_PUBLIC_KEY, targets) === true;
+};

package/dist/esm/nest/internal/resolve-execution-actor.d.ts

@@ -0,0 +1,3 @@
+import type { ExecutionContext } from '@nestjs/common';
+import type { AbilityActorInterface } from '../../build-ability.js';
+export declare const resolveExecutionActor: (context: ExecutionContext) => AbilityActorInterface | undefined;

package/dist/esm/nest/internal/resolve-execution-actor.js

@@ -0,0 +1,5 @@
+import { resolveExecutionRequest } from '../resolve-execution-request.js';
+export const resolveExecutionActor = (context) => {
+    const request = resolveExecutionRequest(context);
+    return request?.user;
+};

package/dist/esm/nest/policies.guard.d.ts

@@ -10,5 +10,4 @@ export declare class PoliciesGuard implements CanActivate {
     canActivate(context: ExecutionContext): boolean;
     private allowWithoutPolicies;
     private enforcePolicies;
-    private extractActor;
 }

package/dist/esm/nest/policies.guard.js

@@ -14,10 +14,9 @@ import { ForbiddenException, Inject, Injectable, } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
 import { CHECK_POLICIES_KEY } from './check-policies.decorator.js';
 import { ABILITY_FACTORY, AUTHORIZATION_LOGGER } from './constants.js';
-import { IS_PUBLIC_KEY } from './public.decorator.js';
-const GRAPHQL_CONTEXT_TYPE = 'graphql';
-const GRAPHQL_CONTEXT_ARGUMENT_INDEX = 2;
-const isGraphql = (context) => context.getType() === GRAPHQL_CONTEXT_TYPE;
+import { isGraphqlContext } from './internal/is-graphql-context.js';
+import { isPublicHandler } from './internal/is-public-handler.js';
+import { resolveExecutionActor } from './internal/resolve-execution-actor.js';
 let PoliciesGuard = class PoliciesGuard {
     reflector;
     abilityFactory;
@@ -28,26 +27,22 @@ let PoliciesGuard = class PoliciesGuard {
         this.logger = logger;
     }
     canActivate(context) {
-        const isPublic = this.reflector.getAllAndOverride(IS_PUBLIC_KEY, [
-            context.getHandler(),
-            context.getClass(),
-        ]);
-        if (isPublic === true) {
+        if (isPublicHandler(this.reflector, context)) {
             return true;
         }
         const handlers = this.reflector.getAllAndOverride(CHECK_POLICIES_KEY, [context.getHandler(), context.getClass()]) ?? [];
         return handlers.length === 0 ? this.allowWithoutPolicies(context) : this.enforcePolicies({ context, handlers });
     }
     allowWithoutPolicies(context) {
-        if (isGraphql(context)) {
+        if (isGraphqlContext(context)) {
             this.logger.warn({ class: context.getClass().name, handler: context.getHandler().name }, 'PoliciesGuard deny-by-default — GraphQL resolver missing @Public/@CheckPolicies');
             throw new ForbiddenException('Forbidden by policy');
         }
         return true;
     }
     enforcePolicies(parameters) {
-        const actor = this.extractActor(parameters.context);
-        if (actor === null) {
+        const actor = resolveExecutionActor(parameters.context);
+        if (actor === undefined) {
             throw new ForbiddenException('No authenticated user');
         }
         const ability = this.abilityFactory.createForActor({
@@ -59,15 +54,10 @@ let PoliciesGuard = class PoliciesGuard {
         }
         return true;
     }
-    extractActor(context) {
-        const request = isGraphql(context)
-            ? context.getArgByIndex(GRAPHQL_CONTEXT_ARGUMENT_INDEX).req
-            : context.switchToHttp().getRequest();
-        return request?.user ?? null;
-    }
 };
 PoliciesGuard = __decorate([
     Injectable(),
+    __param(0, Inject(Reflector)),
     __param(1, Inject(ABILITY_FACTORY)),
     __param(2, Inject(AUTHORIZATION_LOGGER)),
     __metadata("design:paramtypes", [Reflector, Function, Object])

package/dist/esm/nest/resolve-execution-request.d.ts

@@ -0,0 +1,2 @@
+import type { ExecutionContext } from '@nestjs/common';
+export declare const resolveExecutionRequest: <TRequest>(context: ExecutionContext) => TRequest | undefined;

package/dist/esm/nest/resolve-execution-request.js

@@ -0,0 +1,5 @@
+import { isGraphqlContext } from './internal/is-graphql-context.js';
+const GRAPHQL_CONTEXT_ARGUMENT_INDEX = 2;
+export const resolveExecutionRequest = (context) => (isGraphqlContext(context)
+    ? context.getArgByIndex(GRAPHQL_CONTEXT_ARGUMENT_INDEX).req
+    : context.switchToHttp().getRequest());

package/dist/esm/nest/with-public-routes.d.ts

@@ -0,0 +1,2 @@
+import type { CanActivate, Type } from '@nestjs/common';
+export declare const withPublicRoutes: <TGuard extends Type<CanActivate>>(base: TGuard) => TGuard;

package/dist/esm/nest/with-public-routes.js

@@ -0,0 +1,32 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Inject, Injectable } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { isPublicHandler } from './internal/is-public-handler.js';
+import { resolveExecutionRequest } from './resolve-execution-request.js';
+export const withPublicRoutes = (base) => {
+    let PublicRoutesGuard = class PublicRoutesGuard extends base {
+        reflector;
+        canActivate(context) {
+            return isPublicHandler(this.reflector, context) || super.canActivate(context);
+        }
+        getRequest(context) {
+            return resolveExecutionRequest(context);
+        }
+    };
+    __decorate([
+        Inject(Reflector),
+        __metadata("design:type", Reflector)
+    ], PublicRoutesGuard.prototype, "reflector", void 0);
+    PublicRoutesGuard = __decorate([
+        Injectable()
+    ], PublicRoutesGuard);
+    return PublicRoutesGuard;
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@application-kit/authorization",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Авторизация на CASL для NestJS и браузера: реестры subject'ов и ролей, ability из грантов модулей, глобальный guard политик",
   "keywords": [
     "authorization",
@@ -51,7 +51,7 @@
     "dist"
   ],
   "scripts": {
-    "build": "rm -rf ./dist && node ../../scripts/barrels.mjs create ./src --entry-only=nest && tsc --project tsconfig.build.json && tsc --project tsconfig.build.cjs.json && node ../../scripts/barrels.mjs clean ./src && node ../../scripts/mark-cjs.mjs ./dist/cjs",
+    "build": "rm -rf ./dist && node ../../scripts/barrels.mjs create ./src --entry-only=nest,internal && tsc --project tsconfig.build.json && tsc --project tsconfig.build.cjs.json && node ../../scripts/barrels.mjs clean ./src && node ../../scripts/mark-cjs.mjs ./dist/cjs",
     "lint:tsc": "tsc --noEmit --pretty --project .",
     "test:mutation": "stryker run",
     "test:unit": "vitest run"