@application-kit/authorization 0.2.0 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @application-kit/authorization
 
+## 0.4.0
+
+### Minor Changes
+
+- 92d5b04: Вход `/vue`: `installAuthorization(app, { accessDenied, grants, resolveActor, router })` — ability на приложение, `<Can>`,
+  `useAbility()` и гвард маршрутов по `meta.can`; `canAccessRoute` и расширение `RouteMeta.can`. Гранты, источник актора и маршрут
+  отказа приходят параметрами. `@casl/vue`, `vue`, `vue-router` — опциональные peer, корневой вход их не тянет.
+
+## 0.3.0
+
+### Minor Changes
+
+- ef902ec: Вход `/nest`: `CurrentActor()` — актор параметром обработчика, `withPublicRoutes(AuthGuard('jwt'))` — guard аутентификации с учётом `@Public()`, `resolveExecutionRequest` — чтение запроса без развилки HTTP/GraphQL. Новых зависимостей нет: `@nestjs/graphql` и `@nestjs/passport` пакету не нужны.
+
 ## 0.2.0
 
 ### Minor Changes

package/README.md

@@ -10,7 +10,8 @@
 yarn add @application-kit/authorization
 ```
 
-Peer-зависимости: `@casl/ability`, `@nestjs/common`, `@nestjs/core`, `nestjs-pino`. Все обязательные.
+Peer-зависимости: `@casl/ability`, `@nestjs/common`, `@nestjs/core`, `nestjs-pino` — обязательные; `@casl/vue`, `vue`,
+`vue-router` — опциональные, нужны только входу `/vue`.
 `@nestjs/graphql` пакету не нужен: guard узнаёт GraphQL-запрос по типу контекста и работает и в приложении без GraphQL.
 
 ## Входы
@@ -19,6 +20,7 @@ Peer-зависимости: `@casl/ability`, `@nestjs/common`, `@nestjs/core`,
 |------|----------|-------|
 | `@application-kit/authorization` | сервер и браузер: реестры, `buildAbilityFor`, `composeAbilityGrants` | только `@casl/ability` |
 | `@application-kit/authorization/nest` | сервер: guard, декораторы, фабрика, логгер | `@nestjs/*`, `nestjs-pino` |
+| `@application-kit/authorization/vue` | клиент и SSR: ability на приложение, `<Can>`, гвард маршрутов по `meta.can` | `vue`, `vue-router`, `@casl/vue` |
 
 Корневой вход не импортирует Nest — его можно собирать в браузерный бандл.
 
@@ -46,13 +48,39 @@ const grants = composeAbilityGrants(['EDITOR', 'VIEWER'], articleGrants, comment
 const ability = buildAbilityFor({ role: 'EDITOR' }, grants)
 ```
 
+## Vue
+
+`installAuthorization(app, options)` ставит ability (свой экземпляр на приложение, поэтому и на запрос SSR), `<Can>`,
+`useAbility()` и гвард: маршрут с `meta.can` без нужного права уводит на `accessDenied`. Решение только о показе
+интерфейса: источник истины — бэкенд. `RouteMeta.can` объявляет сам вход.
+
+```ts
+installAuthorization(app, {
+  accessDenied: { name: 'ACCESS_DENIED' }, // сам не несёт meta.can: отказ на нём зациклился бы
+  grants,
+  resolveActor: async () => meRepository.loadMe(), // null — гость; исполняется в контексте приложения
+  router,
+})
+
+const routes = [{ path: '/console', component: Console, meta: { can: { action: 'read', subject: 'Console' } } }]
+```
+
+Актор запрашивается лениво, на первом маршруте с `meta.can`: маршруты без него запроса не ждут. Ошибка `resolveActor`
+читается как гость, и следующий такой переход спросит снова — это и покрывает вход без перезагрузки страницы. Актор,
+приехавший снапшотом SSR, `resolveActor` возвращает сам, без запроса. `canAccessRoute(ability, route)` — то же решение
+отдельно от гварда.
+
 ## Nest
 
 - `PoliciesGuard` — глобальный guard (`APP_GUARD`): обработчик с `@Public()` пропускается, с `@CheckPolicies(...)` —
   проверяется конъюнкцией политик над ability актора из `request.user`. GraphQL-резолвер без обоих декораторов
   запрещён (fail-closed) с предупреждением в лог, REST-обработчик — пропускается: его авторизация на маршруте.
 - `CheckPolicies(...handlers)`, `PolicyHandler`, `permitAuthenticated` — политики обработчика.
-- `Public()`, `IS_PUBLIC_KEY` — открытый обработчик; ключ читает и guard аутентификации приложения.
+- `Public()`, `IS_PUBLIC_KEY` — открытый обработчик.
+- `withPublicRoutes(AuthGuard('jwt'))` — guard аутентификации приложения поверх его базы: открытый обработчик пропускает
+  мимо базы, а запрос ей отдаёт и на HTTP, и в GraphQL. `@nestjs/passport` пакету не нужен.
+- `CurrentActor()` — параметр обработчика с `request.user`; на открытом обработчике актора может не быть.
+- `resolveExecutionRequest(context)` — запрос без развилки транспорта. `@nestjs/graphql` пакету не нужен.
 - `AbilityFactory` — ability актора по карте грантов.
 
 Собирает механизм `AuthorizationModule.forRoot({ grants })`: фабрика ability, логгер и глобальный guard (`APP_GUARD`)

package/dist/cjs/nest/current-actor.decorator.d.ts

@@ -0,0 +1 @@
+export declare const CurrentActor: (...dataOrPipes: unknown[]) => ParameterDecorator;

package/dist/cjs/nest/current-actor.decorator.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CurrentActor = void 0;
+const common_1 = require("@nestjs/common");
+const resolve_execution_actor_js_1 = require("./internal/resolve-execution-actor.js");
+const currentActorFactory = (_, context) => (0, resolve_execution_actor_js_1.resolveExecutionActor)(context);
+exports.CurrentActor = (0, common_1.createParamDecorator)(currentActorFactory);

package/dist/cjs/nest/index.d.ts

@@ -4,6 +4,9 @@ export * from './authorization-logger.interface.js';
 export * from './authorization.module.js';
 export * from './check-policies.decorator.js';
 export * from './constants.js';
+export * from './current-actor.decorator.js';
 export * from './policies.guard.js';
 export * from './policy-handlers.js';
 export * from './public.decorator.js';
+export * from './resolve-execution-request.js';
+export * from './with-public-routes.js';

package/dist/cjs/nest/index.js

@@ -20,6 +20,9 @@ __exportStar(require("./authorization-logger.interface.js"), exports);
 __exportStar(require("./authorization.module.js"), exports);
 __exportStar(require("./check-policies.decorator.js"), exports);
 __exportStar(require("./constants.js"), exports);
+__exportStar(require("./current-actor.decorator.js"), exports);
 __exportStar(require("./policies.guard.js"), exports);
 __exportStar(require("./policy-handlers.js"), exports);
 __exportStar(require("./public.decorator.js"), exports);
+__exportStar(require("./resolve-execution-request.js"), exports);
+__exportStar(require("./with-public-routes.js"), exports);

package/dist/cjs/nest/internal/index.d.ts

@@ -0,0 +1,3 @@
+export * from './is-graphql-context.js';
+export * from './is-public-handler.js';
+export * from './resolve-execution-actor.js';

package/dist/cjs/nest/internal/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./is-graphql-context.js"), exports);
+__exportStar(require("./is-public-handler.js"), exports);
+__exportStar(require("./resolve-execution-actor.js"), exports);

package/dist/cjs/nest/internal/is-graphql-context.d.ts

@@ -0,0 +1,2 @@
+import type { ExecutionContext } from '@nestjs/common';
+export declare const isGraphqlContext: (context: ExecutionContext) => boolean;

package/dist/cjs/nest/internal/is-graphql-context.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isGraphqlContext = void 0;
+const GRAPHQL_CONTEXT_TYPE = 'graphql';
+const isGraphqlContext = (context) => {
+    const transport = context.getType();
+    return transport === GRAPHQL_CONTEXT_TYPE;
+};
+exports.isGraphqlContext = isGraphqlContext;

package/dist/cjs/nest/internal/is-public-handler.d.ts

@@ -0,0 +1,3 @@
+import type { ExecutionContext } from '@nestjs/common';
+import type { Reflector } from '@nestjs/core';
+export declare const isPublicHandler: (reflector: Reflector, context: ExecutionContext) => boolean;

package/dist/cjs/nest/internal/is-public-handler.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isPublicHandler = void 0;
+const public_decorator_js_1 = require("../public.decorator.js");
+const isPublicHandler = (reflector, context) => {
+    const targets = [context.getHandler(), context.getClass()];
+    return reflector.getAllAndOverride(public_decorator_js_1.IS_PUBLIC_KEY, targets) === true;
+};
+exports.isPublicHandler = isPublicHandler;

package/dist/cjs/nest/internal/resolve-execution-actor.d.ts

@@ -0,0 +1,3 @@
+import type { ExecutionContext } from '@nestjs/common';
+import type { AbilityActorInterface } from '../../build-ability.js';
+export declare const resolveExecutionActor: (context: ExecutionContext) => AbilityActorInterface | undefined;

package/dist/cjs/nest/internal/resolve-execution-actor.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveExecutionActor = void 0;
+const resolve_execution_request_js_1 = require("../resolve-execution-request.js");
+const resolveExecutionActor = (context) => {
+    const request = (0, resolve_execution_request_js_1.resolveExecutionRequest)(context);
+    return request?.user;
+};
+exports.resolveExecutionActor = resolveExecutionActor;

package/dist/cjs/nest/policies.guard.d.ts

@@ -10,5 +10,4 @@ export declare class PoliciesGuard implements CanActivate {
     canActivate(context: ExecutionContext): boolean;
     private allowWithoutPolicies;
     private enforcePolicies;
-    private extractActor;
 }

package/dist/cjs/nest/policies.guard.js

@@ -17,10 +17,9 @@ const common_1 = require("@nestjs/common");
 const core_1 = require("@nestjs/core");
 const check_policies_decorator_js_1 = require("./check-policies.decorator.js");
 const constants_js_1 = require("./constants.js");
-const public_decorator_js_1 = require("./public.decorator.js");
-const GRAPHQL_CONTEXT_TYPE = 'graphql';
-const GRAPHQL_CONTEXT_ARGUMENT_INDEX = 2;
-const isGraphql = (context) => context.getType() === GRAPHQL_CONTEXT_TYPE;
+const is_graphql_context_js_1 = require("./internal/is-graphql-context.js");
+const is_public_handler_js_1 = require("./internal/is-public-handler.js");
+const resolve_execution_actor_js_1 = require("./internal/resolve-execution-actor.js");
 let PoliciesGuard = class PoliciesGuard {
     reflector;
     abilityFactory;
@@ -31,26 +30,22 @@ let PoliciesGuard = class PoliciesGuard {
         this.logger = logger;
     }
     canActivate(context) {
-        const isPublic = this.reflector.getAllAndOverride(public_decorator_js_1.IS_PUBLIC_KEY, [
-            context.getHandler(),
-            context.getClass(),
-        ]);
-        if (isPublic === true) {
+        if ((0, is_public_handler_js_1.isPublicHandler)(this.reflector, context)) {
             return true;
         }
         const handlers = this.reflector.getAllAndOverride(check_policies_decorator_js_1.CHECK_POLICIES_KEY, [context.getHandler(), context.getClass()]) ?? [];
         return handlers.length === 0 ? this.allowWithoutPolicies(context) : this.enforcePolicies({ context, handlers });
     }
     allowWithoutPolicies(context) {
-        if (isGraphql(context)) {
+        if ((0, is_graphql_context_js_1.isGraphqlContext)(context)) {
             this.logger.warn({ class: context.getClass().name, handler: context.getHandler().name }, 'PoliciesGuard deny-by-default — GraphQL resolver missing @Public/@CheckPolicies');
             throw new common_1.ForbiddenException('Forbidden by policy');
         }
         return true;
     }
     enforcePolicies(parameters) {
-        const actor = this.extractActor(parameters.context);
-        if (actor === null) {
+        const actor = (0, resolve_execution_actor_js_1.resolveExecutionActor)(parameters.context);
+        if (actor === undefined) {
             throw new common_1.ForbiddenException('No authenticated user');
         }
         const ability = this.abilityFactory.createForActor({
@@ -62,12 +57,6 @@ let PoliciesGuard = class PoliciesGuard {
         }
         return true;
     }
-    extractActor(context) {
-        const request = isGraphql(context)
-            ? context.getArgByIndex(GRAPHQL_CONTEXT_ARGUMENT_INDEX).req
-            : context.switchToHttp().getRequest();
-        return request?.user ?? null;
-    }
 };
 exports.PoliciesGuard = PoliciesGuard;
 exports.PoliciesGuard = PoliciesGuard = __decorate([

package/dist/cjs/nest/resolve-execution-request.d.ts

@@ -0,0 +1,2 @@
+import type { ExecutionContext } from '@nestjs/common';
+export declare const resolveExecutionRequest: <TRequest>(context: ExecutionContext) => TRequest | undefined;

package/dist/cjs/nest/resolve-execution-request.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveExecutionRequest = void 0;
+const is_graphql_context_js_1 = require("./internal/is-graphql-context.js");
+const GRAPHQL_CONTEXT_ARGUMENT_INDEX = 2;
+const resolveExecutionRequest = (context) => ((0, is_graphql_context_js_1.isGraphqlContext)(context)
+    ? context.getArgByIndex(GRAPHQL_CONTEXT_ARGUMENT_INDEX).req
+    : context.switchToHttp().getRequest());
+exports.resolveExecutionRequest = resolveExecutionRequest;

package/dist/cjs/nest/with-public-routes.d.ts

@@ -0,0 +1,2 @@
+import type { CanActivate, Type } from '@nestjs/common';
+export declare const withPublicRoutes: <TGuard extends Type<CanActivate>>(base: TGuard) => TGuard;

package/dist/cjs/nest/with-public-routes.js

@@ -0,0 +1,36 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withPublicRoutes = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const is_public_handler_js_1 = require("./internal/is-public-handler.js");
+const resolve_execution_request_js_1 = require("./resolve-execution-request.js");
+const withPublicRoutes = (base) => {
+    let PublicRoutesGuard = class PublicRoutesGuard extends base {
+        reflector;
+        canActivate(context) {
+            return (0, is_public_handler_js_1.isPublicHandler)(this.reflector, context) || super.canActivate(context);
+        }
+        getRequest(context) {
+            return (0, resolve_execution_request_js_1.resolveExecutionRequest)(context);
+        }
+    };
+    __decorate([
+        (0, common_1.Inject)(core_1.Reflector),
+        __metadata("design:type", core_1.Reflector)
+    ], PublicRoutesGuard.prototype, "reflector", void 0);
+    PublicRoutesGuard = __decorate([
+        (0, common_1.Injectable)()
+    ], PublicRoutesGuard);
+    return PublicRoutesGuard;
+};
+exports.withPublicRoutes = withPublicRoutes;

package/dist/cjs/vue/index.d.ts

@@ -0,0 +1,2 @@
+export * from './install-authorization.js';
+export * from './route-ability.js';

package/dist/cjs/vue/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./install-authorization.js"), exports);
+__exportStar(require("./route-ability.js"), exports);

package/dist/cjs/vue/install-authorization.d.ts

@@ -0,0 +1,11 @@
+import type { App } from 'vue';
+import type { RouteLocationRaw, Router } from 'vue-router';
+import type { AbilityActorInterface } from '../build-ability.js';
+import type { AbilityGrantMap } from '../types/ability-grant.js';
+export interface InstallAuthorizationOptionsInterface {
+    accessDenied: RouteLocationRaw;
+    grants: AbilityGrantMap;
+    resolveActor(): Promise<AbilityActorInterface | null>;
+    router: Router;
+}
+export declare const installAuthorization: (app: App, options: InstallAuthorizationOptionsInterface) => void;

package/dist/cjs/vue/install-authorization.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.installAuthorization = void 0;
+const ability_1 = require("@casl/ability");
+const vue_1 = require("@casl/vue");
+const build_ability_js_1 = require("../build-ability.js");
+const route_ability_js_1 = require("./route-ability.js");
+const installAuthorization = (app, options) => {
+    const ability = (0, ability_1.createMongoAbility)();
+    app.use(vue_1.abilitiesPlugin, ability);
+    app.component('Can', vue_1.Can);
+    const hydrateAbility = async () => {
+        try {
+            const actor = await app.runWithContext(async () => options.resolveActor());
+            ability.update((0, build_ability_js_1.buildAbilityFor)(actor, options.grants).rules);
+        }
+        catch {
+        }
+    };
+    options.router.beforeEach(async (to) => {
+        if (to.meta.can !== undefined && ability.rules.length === 0) {
+            await hydrateAbility();
+        }
+        return (0, route_ability_js_1.canAccessRoute)(ability, to) || options.accessDenied;
+    });
+};
+exports.installAuthorization = installAuthorization;

package/dist/cjs/vue/route-ability.d.ts

@@ -0,0 +1,14 @@
+import type { AnyAbility } from '@casl/ability';
+import type { RouteLocationNormalized } from 'vue-router';
+import type { Action } from '../types/actions.js';
+import type { Subject } from '../types/subjects.js';
+export interface RouteAbilityRequirementInterface {
+    action: Action;
+    subject: Subject;
+}
+declare module 'vue-router' {
+    interface RouteMeta {
+        can?: RouteAbilityRequirementInterface;
+    }
+}
+export declare const canAccessRoute: (ability: AnyAbility, route: Pick<RouteLocationNormalized, "meta">) => boolean;

package/dist/cjs/vue/route-ability.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canAccessRoute = void 0;
+const canAccessRoute = (ability, route) => {
+    const requirement = route.meta.can;
+    return requirement === undefined || ability.can(requirement.action, requirement.subject);
+};
+exports.canAccessRoute = canAccessRoute;

package/dist/esm/nest/current-actor.decorator.d.ts

@@ -0,0 +1 @@
+export declare const CurrentActor: (...dataOrPipes: unknown[]) => ParameterDecorator;

package/dist/esm/nest/current-actor.decorator.js

@@ -0,0 +1,4 @@
+import { createParamDecorator } from '@nestjs/common';
+import { resolveExecutionActor } from './internal/resolve-execution-actor.js';
+const currentActorFactory = (_, context) => resolveExecutionActor(context);
+export const CurrentActor = createParamDecorator(currentActorFactory);

package/dist/esm/nest/index.d.ts

@@ -4,6 +4,9 @@ export * from './authorization-logger.interface.js';
 export * from './authorization.module.js';
 export * from './check-policies.decorator.js';
 export * from './constants.js';
+export * from './current-actor.decorator.js';
 export * from './policies.guard.js';
 export * from './policy-handlers.js';
 export * from './public.decorator.js';
+export * from './resolve-execution-request.js';
+export * from './with-public-routes.js';

package/dist/esm/nest/index.js

@@ -4,6 +4,9 @@ export * from './authorization-logger.interface.js';
 export * from './authorization.module.js';
 export * from './check-policies.decorator.js';
 export * from './constants.js';
+export * from './current-actor.decorator.js';
 export * from './policies.guard.js';
 export * from './policy-handlers.js';
 export * from './public.decorator.js';
+export * from './resolve-execution-request.js';
+export * from './with-public-routes.js';

package/dist/esm/nest/internal/index.d.ts

@@ -0,0 +1,3 @@
+export * from './is-graphql-context.js';
+export * from './is-public-handler.js';
+export * from './resolve-execution-actor.js';

package/dist/esm/nest/internal/index.js

@@ -0,0 +1,3 @@
+export * from './is-graphql-context.js';
+export * from './is-public-handler.js';
+export * from './resolve-execution-actor.js';

package/dist/esm/nest/internal/is-graphql-context.d.ts

@@ -0,0 +1,2 @@
+import type { ExecutionContext } from '@nestjs/common';
+export declare const isGraphqlContext: (context: ExecutionContext) => boolean;

package/dist/esm/nest/internal/is-graphql-context.js

@@ -0,0 +1,5 @@
+const GRAPHQL_CONTEXT_TYPE = 'graphql';
+export const isGraphqlContext = (context) => {
+    const transport = context.getType();
+    return transport === GRAPHQL_CONTEXT_TYPE;
+};

package/dist/esm/nest/internal/is-public-handler.d.ts

@@ -0,0 +1,3 @@
+import type { ExecutionContext } from '@nestjs/common';
+import type { Reflector } from '@nestjs/core';
+export declare const isPublicHandler: (reflector: Reflector, context: ExecutionContext) => boolean;

package/dist/esm/nest/internal/is-public-handler.js

@@ -0,0 +1,5 @@
+import { IS_PUBLIC_KEY } from '../public.decorator.js';
+export const isPublicHandler = (reflector, context) => {
+    const targets = [context.getHandler(), context.getClass()];
+    return reflector.getAllAndOverride(IS_PUBLIC_KEY, targets) === true;
+};

package/dist/esm/nest/internal/resolve-execution-actor.d.ts

@@ -0,0 +1,3 @@
+import type { ExecutionContext } from '@nestjs/common';
+import type { AbilityActorInterface } from '../../build-ability.js';
+export declare const resolveExecutionActor: (context: ExecutionContext) => AbilityActorInterface | undefined;

package/dist/esm/nest/internal/resolve-execution-actor.js

@@ -0,0 +1,5 @@
+import { resolveExecutionRequest } from '../resolve-execution-request.js';
+export const resolveExecutionActor = (context) => {
+    const request = resolveExecutionRequest(context);
+    return request?.user;
+};

package/dist/esm/nest/policies.guard.d.ts

@@ -10,5 +10,4 @@ export declare class PoliciesGuard implements CanActivate {
     canActivate(context: ExecutionContext): boolean;
     private allowWithoutPolicies;
     private enforcePolicies;
-    private extractActor;
 }

package/dist/esm/nest/policies.guard.js

@@ -14,10 +14,9 @@ import { ForbiddenException, Inject, Injectable, } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
 import { CHECK_POLICIES_KEY } from './check-policies.decorator.js';
 import { ABILITY_FACTORY, AUTHORIZATION_LOGGER } from './constants.js';
-import { IS_PUBLIC_KEY } from './public.decorator.js';
-const GRAPHQL_CONTEXT_TYPE = 'graphql';
-const GRAPHQL_CONTEXT_ARGUMENT_INDEX = 2;
-const isGraphql = (context) => context.getType() === GRAPHQL_CONTEXT_TYPE;
+import { isGraphqlContext } from './internal/is-graphql-context.js';
+import { isPublicHandler } from './internal/is-public-handler.js';
+import { resolveExecutionActor } from './internal/resolve-execution-actor.js';
 let PoliciesGuard = class PoliciesGuard {
     reflector;
     abilityFactory;
@@ -28,26 +27,22 @@ let PoliciesGuard = class PoliciesGuard {
         this.logger = logger;
     }
     canActivate(context) {
-        const isPublic = this.reflector.getAllAndOverride(IS_PUBLIC_KEY, [
-            context.getHandler(),
-            context.getClass(),
-        ]);
-        if (isPublic === true) {
+        if (isPublicHandler(this.reflector, context)) {
             return true;
         }
         const handlers = this.reflector.getAllAndOverride(CHECK_POLICIES_KEY, [context.getHandler(), context.getClass()]) ?? [];
         return handlers.length === 0 ? this.allowWithoutPolicies(context) : this.enforcePolicies({ context, handlers });
     }
     allowWithoutPolicies(context) {
-        if (isGraphql(context)) {
+        if (isGraphqlContext(context)) {
             this.logger.warn({ class: context.getClass().name, handler: context.getHandler().name }, 'PoliciesGuard deny-by-default — GraphQL resolver missing @Public/@CheckPolicies');
             throw new ForbiddenException('Forbidden by policy');
         }
         return true;
     }
     enforcePolicies(parameters) {
-        const actor = this.extractActor(parameters.context);
-        if (actor === null) {
+        const actor = resolveExecutionActor(parameters.context);
+        if (actor === undefined) {
             throw new ForbiddenException('No authenticated user');
         }
         const ability = this.abilityFactory.createForActor({
@@ -59,12 +54,6 @@ let PoliciesGuard = class PoliciesGuard {
         }
         return true;
     }
-    extractActor(context) {
-        const request = isGraphql(context)
-            ? context.getArgByIndex(GRAPHQL_CONTEXT_ARGUMENT_INDEX).req
-            : context.switchToHttp().getRequest();
-        return request?.user ?? null;
-    }
 };
 PoliciesGuard = __decorate([
     Injectable(),

package/dist/esm/nest/resolve-execution-request.d.ts

@@ -0,0 +1,2 @@
+import type { ExecutionContext } from '@nestjs/common';
+export declare const resolveExecutionRequest: <TRequest>(context: ExecutionContext) => TRequest | undefined;

package/dist/esm/nest/resolve-execution-request.js

@@ -0,0 +1,5 @@
+import { isGraphqlContext } from './internal/is-graphql-context.js';
+const GRAPHQL_CONTEXT_ARGUMENT_INDEX = 2;
+export const resolveExecutionRequest = (context) => (isGraphqlContext(context)
+    ? context.getArgByIndex(GRAPHQL_CONTEXT_ARGUMENT_INDEX).req
+    : context.switchToHttp().getRequest());

package/dist/esm/nest/with-public-routes.d.ts

@@ -0,0 +1,2 @@
+import type { CanActivate, Type } from '@nestjs/common';
+export declare const withPublicRoutes: <TGuard extends Type<CanActivate>>(base: TGuard) => TGuard;

package/dist/esm/nest/with-public-routes.js

@@ -0,0 +1,32 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Inject, Injectable } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { isPublicHandler } from './internal/is-public-handler.js';
+import { resolveExecutionRequest } from './resolve-execution-request.js';
+export const withPublicRoutes = (base) => {
+    let PublicRoutesGuard = class PublicRoutesGuard extends base {
+        reflector;
+        canActivate(context) {
+            return isPublicHandler(this.reflector, context) || super.canActivate(context);
+        }
+        getRequest(context) {
+            return resolveExecutionRequest(context);
+        }
+    };
+    __decorate([
+        Inject(Reflector),
+        __metadata("design:type", Reflector)
+    ], PublicRoutesGuard.prototype, "reflector", void 0);
+    PublicRoutesGuard = __decorate([
+        Injectable()
+    ], PublicRoutesGuard);
+    return PublicRoutesGuard;
+};

package/dist/esm/vue/index.d.ts

@@ -0,0 +1,2 @@
+export * from './install-authorization.js';
+export * from './route-ability.js';

package/dist/esm/vue/index.js

@@ -0,0 +1,2 @@
+export * from './install-authorization.js';
+export * from './route-ability.js';

package/dist/esm/vue/install-authorization.d.ts

@@ -0,0 +1,11 @@
+import type { App } from 'vue';
+import type { RouteLocationRaw, Router } from 'vue-router';
+import type { AbilityActorInterface } from '../build-ability.js';
+import type { AbilityGrantMap } from '../types/ability-grant.js';
+export interface InstallAuthorizationOptionsInterface {
+    accessDenied: RouteLocationRaw;
+    grants: AbilityGrantMap;
+    resolveActor(): Promise<AbilityActorInterface | null>;
+    router: Router;
+}
+export declare const installAuthorization: (app: App, options: InstallAuthorizationOptionsInterface) => void;

package/dist/esm/vue/install-authorization.js

@@ -0,0 +1,23 @@
+import { createMongoAbility } from '@casl/ability';
+import { abilitiesPlugin, Can } from '@casl/vue';
+import { buildAbilityFor } from '../build-ability.js';
+import { canAccessRoute } from './route-ability.js';
+export const installAuthorization = (app, options) => {
+    const ability = createMongoAbility();
+    app.use(abilitiesPlugin, ability);
+    app.component('Can', Can);
+    const hydrateAbility = async () => {
+        try {
+            const actor = await app.runWithContext(async () => options.resolveActor());
+            ability.update(buildAbilityFor(actor, options.grants).rules);
+        }
+        catch {
+        }
+    };
+    options.router.beforeEach(async (to) => {
+        if (to.meta.can !== undefined && ability.rules.length === 0) {
+            await hydrateAbility();
+        }
+        return canAccessRoute(ability, to) || options.accessDenied;
+    });
+};

package/dist/esm/vue/route-ability.d.ts

@@ -0,0 +1,14 @@
+import type { AnyAbility } from '@casl/ability';
+import type { RouteLocationNormalized } from 'vue-router';
+import type { Action } from '../types/actions.js';
+import type { Subject } from '../types/subjects.js';
+export interface RouteAbilityRequirementInterface {
+    action: Action;
+    subject: Subject;
+}
+declare module 'vue-router' {
+    interface RouteMeta {
+        can?: RouteAbilityRequirementInterface;
+    }
+}
+export declare const canAccessRoute: (ability: AnyAbility, route: Pick<RouteLocationNormalized, "meta">) => boolean;

package/dist/esm/vue/route-ability.js

@@ -0,0 +1,4 @@
+export const canAccessRoute = (ability, route) => {
+    const requirement = route.meta.can;
+    return requirement === undefined || ability.can(requirement.action, requirement.subject);
+};

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "@application-kit/authorization",
-  "version": "0.2.0",
-  "description": "Авторизация на CASL для NestJS и браузера: реестры subject'ов и ролей, ability из грантов модулей, глобальный guard политик",
+  "version": "0.4.0",
+  "description": "Авторизация на CASL для NestJS и браузера: реестры subject'ов и ролей, ability из грантов модулей, глобальный guard политик, гвард маршрутов Vue",
   "keywords": [
     "authorization",
     "casl",
     "nestjs",
-    "policies"
+    "policies",
+    "vue"
   ],
   "homepage": "https://gitlab.com/application-kit/application-kit/-/tree/main/packages/authorization",
   "bugs": "https://gitlab.com/application-kit/application-kit/-/issues",
@@ -42,7 +43,17 @@
         "default": "./dist/cjs/nest/index.js"
       }
     },
-    "./package.json": "./package.json"
+    "./package.json": "./package.json",
+    "./vue": {
+      "import": {
+        "types": "./dist/esm/vue/index.d.ts",
+        "default": "./dist/esm/vue/index.js"
+      },
+      "require": {
+        "types": "./dist/cjs/vue/index.d.ts",
+        "default": "./dist/cjs/vue/index.js"
+      }
+    }
   },
   "main": "./dist/cjs/index.js",
   "module": "./dist/esm/index.js",
@@ -51,13 +62,14 @@
     "dist"
   ],
   "scripts": {
-    "build": "rm -rf ./dist && node ../../scripts/barrels.mjs create ./src --entry-only=nest && tsc --project tsconfig.build.json && tsc --project tsconfig.build.cjs.json && node ../../scripts/barrels.mjs clean ./src && node ../../scripts/mark-cjs.mjs ./dist/cjs",
+    "build": "rm -rf ./dist && node ../../scripts/barrels.mjs create ./src --entry-only=nest,internal,vue && tsc --project tsconfig.build.json && tsc --project tsconfig.build.cjs.json && node ../../scripts/barrels.mjs clean ./src && node ../../scripts/mark-cjs.mjs ./dist/cjs",
     "lint:tsc": "tsc --noEmit --pretty --project .",
     "test:mutation": "stryker run",
     "test:unit": "vitest run"
   },
   "devDependencies": {
     "@casl/ability": "^7.0.1",
+    "@casl/vue": "^3.0.1",
     "@nestjs/common": "^11.2.7",
     "@nestjs/core": "^11.2.7",
     "@nestjs/testing": "^11.2.7",
@@ -70,13 +82,29 @@
     "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.2",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.11"
+    "vitest": "^4.1.11",
+    "vue": "^3.5.41",
+    "vue-router": "^5.2.0"
   },
   "peerDependencies": {
     "@casl/ability": "^7.0.0",
+    "@casl/vue": "^3.0.0",
     "@nestjs/common": "^11.0.0",
     "@nestjs/core": "^11.0.0",
-    "nestjs-pino": "^4.6.1"
+    "nestjs-pino": "^4.6.1",
+    "vue": "^3.5.0",
+    "vue-router": "^5.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@casl/vue": {
+      "optional": true
+    },
+    "vue": {
+      "optional": true
+    },
+    "vue-router": {
+      "optional": true
+    }
   },
   "engines": {
     "node": ">=24"