@application-kit/authorization 0.3.0 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @application-kit/authorization
 
+## 0.5.0
+
+### Minor Changes
+
+- e9411eb: Спеки-гейты продукта переехали в пакеты: спека теперь — вызов помощника с параметрами продукта, а нарушение приходит ошибкой со списком.
+
+  `ui/testing`: `assertTokensDeclared`. `kafka/testing` (новый вход): `assertConsumerTopicsConsistent`. `authorization/testing` (новый вход): `assertAbilityRegistryConsistent`. `nestjs-vite/static-assets-gate` (новый вход, отдельно от `/testing`, чтобы спеки с фейком рендерера не грузили `vite`): `assertStaticAssetsLayout`. `lint-config` разрешает импорт нового входа `nestjs-vite/static-assets-gate`.
+
+## 0.4.0
+
+### Minor Changes
+
+- 92d5b04: Вход `/vue`: `installAuthorization(app, { accessDenied, grants, resolveActor, router })` — ability на приложение, `<Can>`,
+  `useAbility()` и гвард маршрутов по `meta.can`; `canAccessRoute` и расширение `RouteMeta.can`. Гранты, источник актора и маршрут
+  отказа приходят параметрами. `@casl/vue`, `vue`, `vue-router` — опциональные peer, корневой вход их не тянет.
+
 ## 0.3.0
 
 ### Minor Changes

package/README.md

@@ -10,7 +10,8 @@
 yarn add @application-kit/authorization
 ```
 
-Peer-зависимости: `@casl/ability`, `@nestjs/common`, `@nestjs/core`, `nestjs-pino`. Все обязательные.
+Peer-зависимости: `@casl/ability`, `@nestjs/common`, `@nestjs/core`, `nestjs-pino` — обязательные; `@casl/vue`, `vue`,
+`vue-router` — опциональные, нужны только входу `/vue`.
 `@nestjs/graphql` пакету не нужен: guard узнаёт GraphQL-запрос по типу контекста и работает и в приложении без GraphQL.
 
 ## Входы
@@ -19,6 +20,8 @@ Peer-зависимости: `@casl/ability`, `@nestjs/common`, `@nestjs/core`,
 |------|----------|-------|
 | `@application-kit/authorization` | сервер и браузер: реестры, `buildAbilityFor`, `composeAbilityGrants` | только `@casl/ability` |
 | `@application-kit/authorization/nest` | сервер: guard, декораторы, фабрика, логгер | `@nestjs/*`, `nestjs-pino` |
+| `@application-kit/authorization/vue` | клиент и SSR: ability на приложение, `<Can>`, гвард маршрутов по `meta.can` | `vue`, `vue-router`, `@casl/vue` |
+| `@application-kit/authorization/testing` | спека продукта: гейт реестра abilities | `node:fs`, `@casl/ability` |
 
 Корневой вход не импортирует Nest — его можно собирать в браузерный бандл.
 
@@ -46,6 +49,28 @@ const grants = composeAbilityGrants(['EDITOR', 'VIEWER'], articleGrants, comment
 const ability = buildAbilityFor({ role: 'EDITOR' }, grants)
 ```
 
+## Vue
+
+`installAuthorization(app, options)` ставит ability (свой экземпляр на приложение, поэтому и на запрос SSR), `<Can>`,
+`useAbility()` и гвард: маршрут с `meta.can` без нужного права уводит на `accessDenied`. Решение только о показе
+интерфейса: источник истины — бэкенд. `RouteMeta.can` объявляет сам вход.
+
+```ts
+installAuthorization(app, {
+  accessDenied: { name: 'ACCESS_DENIED' }, // сам не несёт meta.can: отказ на нём зациклился бы
+  grants,
+  resolveActor: async () => meRepository.loadMe(), // null — гость; исполняется в контексте приложения
+  router,
+})
+
+const routes = [{ path: '/console', component: Console, meta: { can: { action: 'read', subject: 'Console' } } }]
+```
+
+Актор запрашивается лениво, на первом маршруте с `meta.can`: маршруты без него запроса не ждут. Ошибка `resolveActor`
+читается как гость, и следующий такой переход спросит снова — это и покрывает вход без перезагрузки страницы. Актор,
+приехавший снапшотом SSR, `resolveActor` возвращает сам, без запроса. `canAccessRoute(ability, route)` — то же решение
+отдельно от гварда.
+
 ## Nest
 
 - `PoliciesGuard` — глобальный guard (`APP_GUARD`): обработчик с `@Public()` пропускается, с `@CheckPolicies(...)` —
@@ -72,3 +97,18 @@ export class AppModule {}
 
 `AuthorizationLogger` — pino-логгер пакета с контекстом `AuthorizationLogger`; собирается из глобального
 `LoggerModule` `nestjs-pino`.
+
+## Гейт реестра
+
+Реестр subject'ов живёт только в типах: забытая регистрация не падает в рантайме. `assertAbilityRegistryConsistent` из
+входа `@application-kit/authorization/testing` читает блоки `declare module` файлов грантов и падает, если запись не
+выдана грантом продукта или её subject не проверяется в prod-коде:
+
+```ts
+await assertAbilityRegistryConsistent({
+  grants: abilityGrants,
+  grantsFiles: 'modules/*/module.grants.ts',
+  roles: Object.values(ROLE_VALUE),
+  sourceRoot: path.resolve(import.meta.dirname, '..'),
+})
+```

package/dist/cjs/testing/assert-ability-registry-consistent.d.ts

@@ -0,0 +1,9 @@
+import type { AbilityGrantMap } from '../types/ability-grant.js';
+import type { Role } from '../types/roles.js';
+export interface AbilityRegistryOptionsInterface {
+    readonly grants: AbilityGrantMap;
+    readonly grantsFiles: string;
+    readonly roles: readonly Role[];
+    readonly sourceRoot: string;
+}
+export declare const assertAbilityRegistryConsistent: (options: AbilityRegistryOptionsInterface) => Promise<void>;

package/dist/cjs/testing/assert-ability-registry-consistent.js

@@ -0,0 +1,64 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertAbilityRegistryConsistent = void 0;
+const promises_1 = require("node:fs/promises");
+const node_path_1 = __importDefault(require("node:path"));
+const build_ability_js_1 = require("../build-ability.js");
+const REGISTRY_MARKER = 'interface SubjectRegistryInterface {';
+const PRODUCTION_EXTENSIONS = new Set(['.ts', '.vue']);
+const actionsOf = (declaration) => declaration
+    .split('|')
+    .map((action) => action.replaceAll(/[^\w-]/gu, ''))
+    .filter((action) => action.length > 0 && action !== 'never');
+const withoutComments = (source) => source
+    .split('\n')
+    .filter((line) => !(/^\s*(?:\/\/|\*|\/\*)/u).test(line))
+    .join('\n');
+const registryEntries = (code) => {
+    const start = code.indexOf(REGISTRY_MARKER) + REGISTRY_MARKER.length;
+    return code.slice(start, code.indexOf('}', start))
+        .split('\n')
+        .map((line) => line.trim())
+        .filter((line) => line.includes(':'))
+        .map((line) => [line.slice(0, line.indexOf(':')).trim(), actionsOf(line.slice(line.indexOf(':') + 1))]);
+};
+const grantedPairs = (roles, grants) => {
+    const rules = roles.flatMap((role) => (0, build_ability_js_1.buildAbilityFor)({ role }, grants).rules);
+    return new Set(rules.flatMap((rule) => [rule.action].flat().flatMap((action) => [rule.subject].flat().map((subject) => `${action} ${subject}`))));
+};
+const productionSources = async (sourceRoot, producers) => {
+    const files = await (0, promises_1.readdir)(sourceRoot, { recursive: true });
+    const sources = files.filter((file) => PRODUCTION_EXTENSIONS.has(node_path_1.default.extname(file))
+        && !file.endsWith('.spec.ts')
+        && !file.split(node_path_1.default.sep).includes('tests')
+        && !producers.includes(file));
+    return Promise.all(sources.map(async (file) => (0, promises_1.readFile)(node_path_1.default.join(sourceRoot, file), 'utf8')));
+};
+const assertAbilityRegistryConsistent = async (options) => {
+    const { grants, grantsFiles, roles, sourceRoot } = options;
+    const producers = await Array.fromAsync((0, promises_1.glob)(grantsFiles, { cwd: sourceRoot }));
+    const [codes, sources] = await Promise.all([
+        Promise.all(producers.map(async (file) => withoutComments(await (0, promises_1.readFile)(node_path_1.default.join(sourceRoot, file), 'utf8')))),
+        productionSources(sourceRoot, producers),
+    ]);
+    const entries = codes.filter((code) => code.includes(REGISTRY_MARKER)).flatMap((code) => registryEntries(code));
+    const granted = grantedPairs(roles, grants);
+    const violations = [
+        ...entries.length === 0 ? [`шаблон ${grantsFiles} не нашёл записей реестра`] : [],
+        ...entries.flatMap(([subject, actions]) => actions
+            .map((action) => `${action} ${subject}`)
+            .filter((pair) => !granted.has(pair))
+            .map((pair) => `запись реестра «${pair}» не выдана ни одним грантом`)),
+        ...entries
+            .map(([subject]) => subject)
+            .filter((subject) => sources.every((source) => !source.includes(`'${subject}'`)))
+            .map((subject) => `subject ${subject} не проверяется в prod-коде`),
+    ];
+    if (violations.length > 0) {
+        throw new Error(`Гейт реестра abilities:\n${violations.join('\n')}`);
+    }
+};
+exports.assertAbilityRegistryConsistent = assertAbilityRegistryConsistent;

package/dist/cjs/testing/index.d.ts

@@ -0,0 +1 @@
+export * from './assert-ability-registry-consistent.js';

package/dist/cjs/testing/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./assert-ability-registry-consistent.js"), exports);

package/dist/cjs/vue/index.d.ts

@@ -0,0 +1,2 @@
+export * from './install-authorization.js';
+export * from './route-ability.js';

package/dist/cjs/vue/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./install-authorization.js"), exports);
+__exportStar(require("./route-ability.js"), exports);

package/dist/cjs/vue/install-authorization.d.ts

@@ -0,0 +1,11 @@
+import type { App } from 'vue';
+import type { RouteLocationRaw, Router } from 'vue-router';
+import type { AbilityActorInterface } from '../build-ability.js';
+import type { AbilityGrantMap } from '../types/ability-grant.js';
+export interface InstallAuthorizationOptionsInterface {
+    accessDenied: RouteLocationRaw;
+    grants: AbilityGrantMap;
+    resolveActor(): Promise<AbilityActorInterface | null>;
+    router: Router;
+}
+export declare const installAuthorization: (app: App, options: InstallAuthorizationOptionsInterface) => void;

package/dist/cjs/vue/install-authorization.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.installAuthorization = void 0;
+const ability_1 = require("@casl/ability");
+const vue_1 = require("@casl/vue");
+const build_ability_js_1 = require("../build-ability.js");
+const route_ability_js_1 = require("./route-ability.js");
+const installAuthorization = (app, options) => {
+    const ability = (0, ability_1.createMongoAbility)();
+    app.use(vue_1.abilitiesPlugin, ability);
+    app.component('Can', vue_1.Can);
+    const hydrateAbility = async () => {
+        try {
+            const actor = await app.runWithContext(async () => options.resolveActor());
+            ability.update((0, build_ability_js_1.buildAbilityFor)(actor, options.grants).rules);
+        }
+        catch {
+        }
+    };
+    options.router.beforeEach(async (to) => {
+        if (to.meta.can !== undefined && ability.rules.length === 0) {
+            await hydrateAbility();
+        }
+        return (0, route_ability_js_1.canAccessRoute)(ability, to) || options.accessDenied;
+    });
+};
+exports.installAuthorization = installAuthorization;

package/dist/cjs/vue/route-ability.d.ts

@@ -0,0 +1,14 @@
+import type { AnyAbility } from '@casl/ability';
+import type { RouteLocationNormalized } from 'vue-router';
+import type { Action } from '../types/actions.js';
+import type { Subject } from '../types/subjects.js';
+export interface RouteAbilityRequirementInterface {
+    action: Action;
+    subject: Subject;
+}
+declare module 'vue-router' {
+    interface RouteMeta {
+        can?: RouteAbilityRequirementInterface;
+    }
+}
+export declare const canAccessRoute: (ability: AnyAbility, route: Pick<RouteLocationNormalized, "meta">) => boolean;

package/dist/cjs/vue/route-ability.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canAccessRoute = void 0;
+const canAccessRoute = (ability, route) => {
+    const requirement = route.meta.can;
+    return requirement === undefined || ability.can(requirement.action, requirement.subject);
+};
+exports.canAccessRoute = canAccessRoute;

package/dist/esm/testing/assert-ability-registry-consistent.d.ts

@@ -0,0 +1,9 @@
+import type { AbilityGrantMap } from '../types/ability-grant.js';
+import type { Role } from '../types/roles.js';
+export interface AbilityRegistryOptionsInterface {
+    readonly grants: AbilityGrantMap;
+    readonly grantsFiles: string;
+    readonly roles: readonly Role[];
+    readonly sourceRoot: string;
+}
+export declare const assertAbilityRegistryConsistent: (options: AbilityRegistryOptionsInterface) => Promise<void>;

package/dist/esm/testing/assert-ability-registry-consistent.js

@@ -0,0 +1,57 @@
+import { glob, readdir, readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { buildAbilityFor } from '../build-ability.js';
+const REGISTRY_MARKER = 'interface SubjectRegistryInterface {';
+const PRODUCTION_EXTENSIONS = new Set(['.ts', '.vue']);
+const actionsOf = (declaration) => declaration
+    .split('|')
+    .map((action) => action.replaceAll(/[^\w-]/gu, ''))
+    .filter((action) => action.length > 0 && action !== 'never');
+const withoutComments = (source) => source
+    .split('\n')
+    .filter((line) => !(/^\s*(?:\/\/|\*|\/\*)/u).test(line))
+    .join('\n');
+const registryEntries = (code) => {
+    const start = code.indexOf(REGISTRY_MARKER) + REGISTRY_MARKER.length;
+    return code.slice(start, code.indexOf('}', start))
+        .split('\n')
+        .map((line) => line.trim())
+        .filter((line) => line.includes(':'))
+        .map((line) => [line.slice(0, line.indexOf(':')).trim(), actionsOf(line.slice(line.indexOf(':') + 1))]);
+};
+const grantedPairs = (roles, grants) => {
+    const rules = roles.flatMap((role) => buildAbilityFor({ role }, grants).rules);
+    return new Set(rules.flatMap((rule) => [rule.action].flat().flatMap((action) => [rule.subject].flat().map((subject) => `${action} ${subject}`))));
+};
+const productionSources = async (sourceRoot, producers) => {
+    const files = await readdir(sourceRoot, { recursive: true });
+    const sources = files.filter((file) => PRODUCTION_EXTENSIONS.has(path.extname(file))
+        && !file.endsWith('.spec.ts')
+        && !file.split(path.sep).includes('tests')
+        && !producers.includes(file));
+    return Promise.all(sources.map(async (file) => readFile(path.join(sourceRoot, file), 'utf8')));
+};
+export const assertAbilityRegistryConsistent = async (options) => {
+    const { grants, grantsFiles, roles, sourceRoot } = options;
+    const producers = await Array.fromAsync(glob(grantsFiles, { cwd: sourceRoot }));
+    const [codes, sources] = await Promise.all([
+        Promise.all(producers.map(async (file) => withoutComments(await readFile(path.join(sourceRoot, file), 'utf8')))),
+        productionSources(sourceRoot, producers),
+    ]);
+    const entries = codes.filter((code) => code.includes(REGISTRY_MARKER)).flatMap((code) => registryEntries(code));
+    const granted = grantedPairs(roles, grants);
+    const violations = [
+        ...entries.length === 0 ? [`шаблон ${grantsFiles} не нашёл записей реестра`] : [],
+        ...entries.flatMap(([subject, actions]) => actions
+            .map((action) => `${action} ${subject}`)
+            .filter((pair) => !granted.has(pair))
+            .map((pair) => `запись реестра «${pair}» не выдана ни одним грантом`)),
+        ...entries
+            .map(([subject]) => subject)
+            .filter((subject) => sources.every((source) => !source.includes(`'${subject}'`)))
+            .map((subject) => `subject ${subject} не проверяется в prod-коде`),
+    ];
+    if (violations.length > 0) {
+        throw new Error(`Гейт реестра abilities:\n${violations.join('\n')}`);
+    }
+};

package/dist/esm/testing/index.d.ts

@@ -0,0 +1 @@
+export * from './assert-ability-registry-consistent.js';

package/dist/esm/testing/index.js

@@ -0,0 +1 @@
+export * from './assert-ability-registry-consistent.js';

package/dist/esm/vue/index.d.ts

@@ -0,0 +1,2 @@
+export * from './install-authorization.js';
+export * from './route-ability.js';

package/dist/esm/vue/index.js

@@ -0,0 +1,2 @@
+export * from './install-authorization.js';
+export * from './route-ability.js';

package/dist/esm/vue/install-authorization.d.ts

@@ -0,0 +1,11 @@
+import type { App } from 'vue';
+import type { RouteLocationRaw, Router } from 'vue-router';
+import type { AbilityActorInterface } from '../build-ability.js';
+import type { AbilityGrantMap } from '../types/ability-grant.js';
+export interface InstallAuthorizationOptionsInterface {
+    accessDenied: RouteLocationRaw;
+    grants: AbilityGrantMap;
+    resolveActor(): Promise<AbilityActorInterface | null>;
+    router: Router;
+}
+export declare const installAuthorization: (app: App, options: InstallAuthorizationOptionsInterface) => void;

package/dist/esm/vue/install-authorization.js

@@ -0,0 +1,23 @@
+import { createMongoAbility } from '@casl/ability';
+import { abilitiesPlugin, Can } from '@casl/vue';
+import { buildAbilityFor } from '../build-ability.js';
+import { canAccessRoute } from './route-ability.js';
+export const installAuthorization = (app, options) => {
+    const ability = createMongoAbility();
+    app.use(abilitiesPlugin, ability);
+    app.component('Can', Can);
+    const hydrateAbility = async () => {
+        try {
+            const actor = await app.runWithContext(async () => options.resolveActor());
+            ability.update(buildAbilityFor(actor, options.grants).rules);
+        }
+        catch {
+        }
+    };
+    options.router.beforeEach(async (to) => {
+        if (to.meta.can !== undefined && ability.rules.length === 0) {
+            await hydrateAbility();
+        }
+        return canAccessRoute(ability, to) || options.accessDenied;
+    });
+};

package/dist/esm/vue/route-ability.d.ts

@@ -0,0 +1,14 @@
+import type { AnyAbility } from '@casl/ability';
+import type { RouteLocationNormalized } from 'vue-router';
+import type { Action } from '../types/actions.js';
+import type { Subject } from '../types/subjects.js';
+export interface RouteAbilityRequirementInterface {
+    action: Action;
+    subject: Subject;
+}
+declare module 'vue-router' {
+    interface RouteMeta {
+        can?: RouteAbilityRequirementInterface;
+    }
+}
+export declare const canAccessRoute: (ability: AnyAbility, route: Pick<RouteLocationNormalized, "meta">) => boolean;

package/dist/esm/vue/route-ability.js

@@ -0,0 +1,4 @@
+export const canAccessRoute = (ability, route) => {
+    const requirement = route.meta.can;
+    return requirement === undefined || ability.can(requirement.action, requirement.subject);
+};

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "@application-kit/authorization",
-  "version": "0.3.0",
-  "description": "Авторизация на CASL для NestJS и браузера: реестры subject'ов и ролей, ability из грантов модулей, глобальный guard политик",
+  "version": "0.5.0",
+  "description": "Авторизация на CASL для NestJS и браузера: реестры subject'ов и ролей, ability из грантов модулей, глобальный guard политик, гвард маршрутов Vue",
   "keywords": [
     "authorization",
     "casl",
     "nestjs",
-    "policies"
+    "policies",
+    "vue"
   ],
   "homepage": "https://gitlab.com/application-kit/application-kit/-/tree/main/packages/authorization",
   "bugs": "https://gitlab.com/application-kit/application-kit/-/issues",
@@ -42,7 +43,27 @@
         "default": "./dist/cjs/nest/index.js"
       }
     },
-    "./package.json": "./package.json"
+    "./package.json": "./package.json",
+    "./testing": {
+      "import": {
+        "types": "./dist/esm/testing/index.d.ts",
+        "default": "./dist/esm/testing/index.js"
+      },
+      "require": {
+        "types": "./dist/cjs/testing/index.d.ts",
+        "default": "./dist/cjs/testing/index.js"
+      }
+    },
+    "./vue": {
+      "import": {
+        "types": "./dist/esm/vue/index.d.ts",
+        "default": "./dist/esm/vue/index.js"
+      },
+      "require": {
+        "types": "./dist/cjs/vue/index.d.ts",
+        "default": "./dist/cjs/vue/index.js"
+      }
+    }
   },
   "main": "./dist/cjs/index.js",
   "module": "./dist/esm/index.js",
@@ -51,13 +72,14 @@
     "dist"
   ],
   "scripts": {
-    "build": "rm -rf ./dist && node ../../scripts/barrels.mjs create ./src --entry-only=nest,internal && tsc --project tsconfig.build.json && tsc --project tsconfig.build.cjs.json && node ../../scripts/barrels.mjs clean ./src && node ../../scripts/mark-cjs.mjs ./dist/cjs",
+    "build": "rm -rf ./dist && node ../../scripts/barrels.mjs create ./src --entry-only=nest,internal,testing,vue && tsc --project tsconfig.build.json && tsc --project tsconfig.build.cjs.json && node ../../scripts/barrels.mjs clean ./src && node ../../scripts/mark-cjs.mjs ./dist/cjs",
     "lint:tsc": "tsc --noEmit --pretty --project .",
     "test:mutation": "stryker run",
     "test:unit": "vitest run"
   },
   "devDependencies": {
     "@casl/ability": "^7.0.1",
+    "@casl/vue": "^3.0.1",
     "@nestjs/common": "^11.2.7",
     "@nestjs/core": "^11.2.7",
     "@nestjs/testing": "^11.2.7",
@@ -70,13 +92,29 @@
     "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.2",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.11"
+    "vitest": "^4.1.11",
+    "vue": "^3.5.41",
+    "vue-router": "^5.2.0"
   },
   "peerDependencies": {
     "@casl/ability": "^7.0.0",
+    "@casl/vue": "^3.0.0",
     "@nestjs/common": "^11.0.0",
     "@nestjs/core": "^11.0.0",
-    "nestjs-pino": "^4.6.1"
+    "nestjs-pino": "^4.6.1",
+    "vue": "^3.5.0",
+    "vue-router": "^5.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@casl/vue": {
+      "optional": true
+    },
+    "vue": {
+      "optional": true
+    },
+    "vue-router": {
+      "optional": true
+    }
   },
   "engines": {
     "node": ">=24"