@arikajs/authorization 0.0.4 → 0.0.6

package/dist/AuthorizationManager.js

@@ -1,29 +1,63 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthorizationManager = void 0;
+const AuthorizationContext_1 = require("./AuthorizationContext");
 class AuthorizationManager {
     constructor(user) {
         this.user = user;
+        this.context = new AuthorizationContext_1.AuthorizationContext(user);
     }
     /**
-     * Determine if the user can perform the given ability.
+     * Create a request-scoped authorization context and bind it to the request.
      */
+    static createContext(request) {
+        const user = request.user || (request.auth ? null : null);
+        const context = new AuthorizationContext_1.AuthorizationContext(user);
+        request.can = context.can.bind(context);
+        request.cannot = context.cannot.bind(context);
+        request.authorize = context.authorize.bind(context);
+        return context;
+    }
+    // ── Delegated checks ────────────────────────────────────────────
     async can(ability, ...args) {
-        const { Gate } = require('./Gate');
-        return await Gate.forUser(this.user).allows(ability, ...args);
+        return await this.context.can(ability, ...args);
     }
-    /**
-     * Determine if the user cannot perform the given ability.
-     */
     async cannot(ability, ...args) {
-        return !(await this.can(ability, ...args));
+        return await this.context.cannot(ability, ...args);
     }
-    /**
-     * Authorize or throw exception.
-     */
     async authorize(ability, ...args) {
-        const { Gate } = require('./Gate');
-        await Gate.forUser(this.user).authorize(ability, ...args);
+        return await this.context.authorize(ability, ...args);
+    }
+    async inspect(ability, ...args) {
+        return await this.context.inspect(ability, ...args);
+    }
+    async any(abilities, ...args) {
+        return await this.context.any(abilities, ...args);
+    }
+    async every(abilities, ...args) {
+        return await this.context.every(abilities, ...args);
+    }
+    async none(abilities, ...args) {
+        return await this.context.none(abilities, ...args);
+    }
+    // ── Role & Permission ───────────────────────────────────────────
+    hasRole(role) {
+        return this.context.hasRole(role);
+    }
+    hasAnyRole(roles) {
+        return this.context.hasAnyRole(roles);
+    }
+    hasAllRoles(roles) {
+        return this.context.hasAllRoles(roles);
+    }
+    hasPermission(permission) {
+        return this.context.hasPermission(permission);
+    }
+    hasAnyPermission(permissions) {
+        return this.context.hasAnyPermission(permissions);
+    }
+    hasAllPermissions(permissions) {
+        return this.context.hasAllPermissions(permissions);
     }
 }
 exports.AuthorizationManager = AuthorizationManager;

package/dist/AuthorizationManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthorizationManager.js","sourceRoot":"","sources":["../src/AuthorizationManager.ts"],"names":[],"mappings":";;;AAAA,MAAa,oBAAoB;IAG7B,YAAY,IAAS;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACrB,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,GAAG,CAAC,OAAe,EAAE,GAAG,IAAW;QAC5C,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAClE,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,GAAG,IAAW;QAC/C,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,GAAG,IAAW;QAClD,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAC9D,CAAC;CACJ;AA7BD,oDA6BC"}
+{"version":3,"file":"AuthorizationManager.js","sourceRoot":"","sources":["../src/AuthorizationManager.ts"],"names":[],"mappings":";;;AAAA,iEAA8D;AAG9D,MAAa,oBAAoB;IAI7B,YAAY,IAAS;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,IAAI,2CAAoB,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,aAAa,CAAC,OAAY;QACpC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,IAAI,2CAAoB,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9C,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,mEAAmE;IAE5D,KAAK,CAAC,GAAG,CAAC,OAAe,EAAE,GAAG,IAAW;QAC5C,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACpD,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,GAAG,IAAW;QAC/C,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACvD,CAAC;IAEM,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,GAAG,IAAW;QAClD,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1D,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,OAAe,EAAE,GAAG,IAAW;QAChD,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACxD,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,SAAmB,EAAE,GAAG,IAAW;QAChD,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,CAAC;IACtD,CAAC;IAEM,KAAK,CAAC,KAAK,CAAC,SAAmB,EAAE,GAAG,IAAW;QAClD,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,CAAC;IACxD,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,SAAmB,EAAE,GAAG,IAAW;QACjD,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,mEAAmE;IAE5D,OAAO,CAAC,IAAuB;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAEM,UAAU,CAAC,KAAe;QAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAEM,WAAW,CAAC,KAAe;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAEM,aAAa,CAAC,UAAkB;QACnC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IAClD,CAAC;IAEM,gBAAgB,CAAC,WAAqB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC;IAEM,iBAAiB,CAAC,WAAqB;QAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;IACvD,CAAC;CACJ;AA5ED,oDA4EC"}

package/dist/Exceptions/AuthorizationException.d.ts

@@ -1,5 +1,6 @@
 export declare class AuthorizationException extends Error {
     statusCode: number;
-    constructor(message?: string);
+    code: string | null;
+    constructor(message?: string, code?: string | null);
 }
 //# sourceMappingURL=AuthorizationException.d.ts.map

package/dist/Exceptions/AuthorizationException.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthorizationException.d.ts","sourceRoot":"","sources":["../../src/Exceptions/AuthorizationException.ts"],"names":[],"mappings":"AAAA,qBAAa,sBAAuB,SAAQ,KAAK;IACtC,UAAU,EAAE,MAAM,CAAO;gBAEpB,OAAO,GAAE,MAAuC;CAI/D"}
+{"version":3,"file":"AuthorizationException.d.ts","sourceRoot":"","sources":["../../src/Exceptions/AuthorizationException.ts"],"names":[],"mappings":"AAAA,qBAAa,sBAAuB,SAAQ,KAAK;IACtC,UAAU,EAAE,MAAM,CAAO;IACzB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;gBAEf,OAAO,GAAE,MAAuC,EAAE,IAAI,GAAE,MAAM,GAAG,IAAW;CAK3F"}

package/dist/Exceptions/AuthorizationException.js

@@ -2,10 +2,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthorizationException = void 0;
 class AuthorizationException extends Error {
-    constructor(message = 'This action is unauthorized.') {
+    constructor(message = 'This action is unauthorized.', code = null) {
         super(message);
         this.statusCode = 403;
         this.name = 'AuthorizationException';
+        this.code = code;
     }
 }
 exports.AuthorizationException = AuthorizationException;

package/dist/Exceptions/AuthorizationException.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthorizationException.js","sourceRoot":"","sources":["../../src/Exceptions/AuthorizationException.ts"],"names":[],"mappings":";;;AAAA,MAAa,sBAAuB,SAAQ,KAAK;IAG7C,YAAY,UAAkB,8BAA8B;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QAHZ,eAAU,GAAW,GAAG,CAAC;QAI5B,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACzC,CAAC;CACJ;AAPD,wDAOC"}
+{"version":3,"file":"AuthorizationException.js","sourceRoot":"","sources":["../../src/Exceptions/AuthorizationException.ts"],"names":[],"mappings":";;;AAAA,MAAa,sBAAuB,SAAQ,KAAK;IAI7C,YAAY,UAAkB,8BAA8B,EAAE,OAAsB,IAAI;QACpF,KAAK,CAAC,OAAO,CAAC,CAAC;QAJZ,eAAU,GAAW,GAAG,CAAC;QAK5B,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACrB,CAAC;CACJ;AATD,wDASC"}

package/dist/Gate.d.ts

@@ -1,7 +1,12 @@
-type GateCallback = (user: any, ...args: any[]) => boolean | Promise<boolean>;
+import { AuthResponse } from './AuthResponse';
+type GateCallback = (user: any, ...args: any[]) => boolean | AuthResponse | Promise<boolean | AuthResponse>;
+type BeforeCallback = (user: any, ability: string, ...args: any[]) => boolean | null | undefined | Promise<boolean | null | undefined>;
+type AfterCallback = (user: any, ability: string, result: boolean, ...args: any[]) => void | Promise<void>;
 export declare class Gate {
     private static abilities;
     private static policyResolver;
+    private static beforeCallbacks;
+    private static afterCallbacks;
     private static currentUser;
     /**
      * Define a new ability.
@@ -11,10 +16,27 @@ export declare class Gate {
      * Register a policy for a model.
      */
     static policy(model: any, policy: any): void;
+    /**
+     * Register a callback to run before all gate checks.
+     * Return `true` to allow immediately (super admin bypass).
+     * Return `false` to deny immediately.
+     * Return `null`/`undefined` to continue to the actual gate check.
+     */
+    static before(callback: BeforeCallback): void;
+    /**
+     * Register a callback to run after all gate checks.
+     * Useful for logging, auditing decisions, etc.
+     */
+    static after(callback: AfterCallback): void;
     /**
      * Set the current user for authorization checks.
      */
     static forUser(user: any): typeof Gate;
+    /**
+     * Determine if the user is authorized for an ability.
+     * Returns the AuthResponse for rich deny messages.
+     */
+    static inspect(ability: string, ...args: any[]): Promise<AuthResponse>;
     /**
      * Determine if the user is authorized to perform an ability.
      */
@@ -24,7 +46,7 @@ export declare class Gate {
      */
     static denies(ability: string, ...args: any[]): Promise<boolean>;
     /**
-     * Authorize or throw exception.
+     * Authorize or throw exception with optional custom message.
      */
     static authorize(ability: string, ...args: any[]): Promise<void>;
     /**
@@ -32,7 +54,21 @@ export declare class Gate {
      */
     static check(ability: string, ...args: any[]): Promise<boolean>;
     /**
-     * Reset all gates and policies (useful for testing).
+     * Check if the user can perform ANY of the given abilities.
+     */
+    static any(abilities: string[], ...args: any[]): Promise<boolean>;
+    /**
+     * Check if the user can perform ALL of the given abilities.
+     */
+    static every(abilities: string[], ...args: any[]): Promise<boolean>;
+    /**
+     * Check if the user can perform NONE of the given abilities.
+     */
+    static none(abilities: string[], ...args: any[]): Promise<boolean>;
+    private static normalizeResult;
+    private static runAfterCallbacks;
+    /**
+     * Reset all gates, policies, and hooks (useful for testing).
      */
     static reset(): void;
 }

package/dist/Gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Gate.d.ts","sourceRoot":"","sources":["../src/Gate.ts"],"names":[],"mappings":"AAGA,KAAK,YAAY,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAE9E,qBAAa,IAAI;IACb,OAAO,CAAC,MAAM,CAAC,SAAS,CAAwC;IAChE,OAAO,CAAC,MAAM,CAAC,cAAc,CAAwC;IACrE,OAAO,CAAC,MAAM,CAAC,WAAW,CAAa;IAEvC;;OAEG;WACW,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,IAAI;IAInE;;OAEG;WACW,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,GAAG,IAAI;IAInD;;OAEG;WACW,OAAO,CAAC,IAAI,EAAE,GAAG,GAAG,OAAO,IAAI;IAK7C;;OAEG;WACiB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAwB7E;;OAEG;WACiB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAI7E;;OAEG;WACiB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAM7E;;OAEG;WACiB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAI5E;;OAEG;WACW,KAAK,IAAI,IAAI;CAK9B"}
+{"version":3,"file":"Gate.d.ts","sourceRoot":"","sources":["../src/Gate.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,KAAK,YAAY,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,GAAG,YAAY,GAAG,OAAO,CAAC,OAAO,GAAG,YAAY,CAAC,CAAC;AAC5G,KAAK,cAAc,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;AACvI,KAAK,aAAa,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE3G,qBAAa,IAAI;IACb,OAAO,CAAC,MAAM,CAAC,SAAS,CAAwC;IAChE,OAAO,CAAC,MAAM,CAAC,cAAc,CAAwC;IACrE,OAAO,CAAC,MAAM,CAAC,eAAe,CAAwB;IACtD,OAAO,CAAC,MAAM,CAAC,cAAc,CAAuB;IACpD,OAAO,CAAC,MAAM,CAAC,WAAW,CAAa;IAIvC;;OAEG;WACW,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,IAAI;IAInE;;OAEG;WACW,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,GAAG,IAAI;IAMnD;;;;;OAKG;WACW,MAAM,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI;IAIpD;;;OAGG;WACW,KAAK,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI;IAMlD;;OAEG;WACW,OAAO,CAAC,IAAI,EAAE,GAAG,GAAG,OAAO,IAAI;IAO7C;;;OAGG;WACiB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAkDnF;;OAEG;WACiB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAK7E;;OAEG;WACiB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAI7E;;OAEG;WACiB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAO7E;;OAEG;WACiB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAM5E;;OAEG;WACiB,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAS9E;;OAEG;WACiB,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAShF;;OAEG;WACiB,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAW/E,OAAO,CAAC,MAAM,CAAC,eAAe;mBAOT,iBAAiB;IAMtC;;OAEG;WACW,KAAK,IAAI,IAAI;CAO9B"}

package/dist/Gate.js

@@ -3,7 +3,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.Gate = void 0;
 const PolicyResolver_1 = require("./PolicyResolver");
 const AuthorizationException_1 = require("./Exceptions/AuthorizationException");
+const AuthResponse_1 = require("./AuthResponse");
 class Gate {
+    // ── Gate Definitions ────────────────────────────────────────────
     /**
      * Define a new ability.
      */
@@ -16,6 +18,24 @@ class Gate {
     static policy(model, policy) {
         this.policyResolver.register(model, policy);
     }
+    // ── Before / After Hooks ────────────────────────────────────────
+    /**
+     * Register a callback to run before all gate checks.
+     * Return `true` to allow immediately (super admin bypass).
+     * Return `false` to deny immediately.
+     * Return `null`/`undefined` to continue to the actual gate check.
+     */
+    static before(callback) {
+        this.beforeCallbacks.push(callback);
+    }
+    /**
+     * Register a callback to run after all gate checks.
+     * Useful for logging, auditing decisions, etc.
+     */
+    static after(callback) {
+        this.afterCallbacks.push(callback);
+    }
+    // ── User Binding ────────────────────────────────────────────────
     /**
      * Set the current user for authorization checks.
      */
@@ -23,28 +43,64 @@ class Gate {
         this.currentUser = user;
         return this;
     }
+    // ── Single Ability Checks ───────────────────────────────────────
     /**
-     * Determine if the user is authorized to perform an ability.
+     * Determine if the user is authorized for an ability.
+     * Returns the AuthResponse for rich deny messages.
      */
-    static async allows(ability, ...args) {
-        // 1. Check if it's a direct gate definition
-        if (this.abilities.has(ability)) {
-            const callback = this.abilities.get(ability);
-            return await callback(this.currentUser, ...args);
+    static async inspect(ability, ...args) {
+        // 1. Run before hooks
+        for (const cb of this.beforeCallbacks) {
+            const beforeResult = await cb(this.currentUser, ability, ...args);
+            if (beforeResult === true) {
+                return AuthResponse_1.AuthResponse.allow();
+            }
+            if (beforeResult === false) {
+                return AuthResponse_1.AuthResponse.deny();
+            }
+            // null/undefined = continue
         }
-        // 2. Check if it's a policy method
+        // 2. Check policy before() method
         if (args.length > 0) {
             const resource = args[0];
             const policy = this.policyResolver.resolvePolicy(resource);
             if (policy) {
+                const instance = this.policyResolver.getInstance(policy);
+                if (typeof instance.before === 'function') {
+                    const policyBefore = await instance.before(this.currentUser, ability, ...args);
+                    if (policyBefore === true)
+                        return AuthResponse_1.AuthResponse.allow();
+                    if (policyBefore === false)
+                        return AuthResponse_1.AuthResponse.deny();
+                }
                 const method = this.policyResolver.getPolicyMethod(policy, ability);
                 if (method) {
-                    return await method(this.currentUser, ...args);
+                    const result = await method(this.currentUser, ...args);
+                    const response = this.normalizeResult(result);
+                    await this.runAfterCallbacks(ability, response.allowed(), ...args);
+                    return response;
                 }
             }
         }
-        // 3. Default deny
-        return false;
+        // 3. Check direct gate definition
+        if (this.abilities.has(ability)) {
+            const callback = this.abilities.get(ability);
+            const result = await callback(this.currentUser, ...args);
+            const response = this.normalizeResult(result);
+            await this.runAfterCallbacks(ability, response.allowed(), ...args);
+            return response;
+        }
+        // 4. Default deny
+        const response = AuthResponse_1.AuthResponse.deny();
+        await this.runAfterCallbacks(ability, false, ...args);
+        return response;
+    }
+    /**
+     * Determine if the user is authorized to perform an ability.
+     */
+    static async allows(ability, ...args) {
+        const response = await this.inspect(ability, ...args);
+        return response.allowed();
     }
     /**
      * Determine if the user is NOT authorized.
@@ -53,11 +109,12 @@ class Gate {
         return !(await this.allows(ability, ...args));
     }
     /**
-     * Authorize or throw exception.
+     * Authorize or throw exception with optional custom message.
      */
     static async authorize(ability, ...args) {
-        if (!(await this.allows(ability, ...args))) {
-            throw new AuthorizationException_1.AuthorizationException();
+        const response = await this.inspect(ability, ...args);
+        if (response.denied()) {
+            throw new AuthorizationException_1.AuthorizationException(response.message() || 'This action is unauthorized.', response.code());
         }
     }
     /**
@@ -66,17 +123,67 @@ class Gate {
     static async check(ability, ...args) {
         return await this.allows(ability, ...args);
     }
+    // ── Bulk Ability Checks ─────────────────────────────────────────
+    /**
+     * Check if the user can perform ANY of the given abilities.
+     */
+    static async any(abilities, ...args) {
+        for (const ability of abilities) {
+            if (await this.allows(ability, ...args)) {
+                return true;
+            }
+        }
+        return false;
+    }
+    /**
+     * Check if the user can perform ALL of the given abilities.
+     */
+    static async every(abilities, ...args) {
+        for (const ability of abilities) {
+            if (!(await this.allows(ability, ...args))) {
+                return false;
+            }
+        }
+        return true;
+    }
+    /**
+     * Check if the user can perform NONE of the given abilities.
+     */
+    static async none(abilities, ...args) {
+        for (const ability of abilities) {
+            if (await this.allows(ability, ...args)) {
+                return false;
+            }
+        }
+        return true;
+    }
+    // ── Internals ───────────────────────────────────────────────────
+    static normalizeResult(result) {
+        if (result instanceof AuthResponse_1.AuthResponse) {
+            return result;
+        }
+        return result ? AuthResponse_1.AuthResponse.allow() : AuthResponse_1.AuthResponse.deny();
+    }
+    static async runAfterCallbacks(ability, result, ...args) {
+        for (const cb of this.afterCallbacks) {
+            await cb(this.currentUser, ability, result, ...args);
+        }
+    }
     /**
-     * Reset all gates and policies (useful for testing).
+     * Reset all gates, policies, and hooks (useful for testing).
      */
     static reset() {
         this.abilities.clear();
         this.policyResolver = new PolicyResolver_1.PolicyResolver();
+        this.beforeCallbacks = [];
+        this.afterCallbacks = [];
         this.currentUser = null;
     }
 }
 exports.Gate = Gate;
 Gate.abilities = new Map();
 Gate.policyResolver = new PolicyResolver_1.PolicyResolver();
+Gate.beforeCallbacks = [];
+Gate.afterCallbacks = [];
 Gate.currentUser = null;
 //# sourceMappingURL=Gate.js.map

package/dist/Gate.js.map

@@ -1 +1 @@
-{"version":3,"file":"Gate.js","sourceRoot":"","sources":["../src/Gate.ts"],"names":[],"mappings":";;;AAAA,qDAAkD;AAClD,gFAA6E;AAI7E,MAAa,IAAI;IAKb;;OAEG;IACI,MAAM,CAAC,MAAM,CAAC,OAAe,EAAE,QAAsB;QACxD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,MAAM,CAAC,KAAU,EAAE,MAAW;QACxC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,OAAO,CAAC,IAAS;QAC3B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,GAAG,IAAW;QACtD,4CAA4C;QAC5C,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;YAC9C,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,CAAC;QACrD,CAAC;QAED,mCAAmC;QACnC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YAE3D,IAAI,MAAM,EAAE,CAAC;gBACT,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBACpE,IAAI,MAAM,EAAE,CAAC;oBACT,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,CAAC;gBACnD,CAAC;YACL,CAAC;QACL,CAAC;QAED,kBAAkB;QAClB,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,GAAG,IAAW;QACtD,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,GAAG,IAAW;QACzD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,+CAAsB,EAAE,CAAC;QACvC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAe,EAAE,GAAG,IAAW;QACrD,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,KAAK;QACf,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,cAAc,GAAG,IAAI,+BAAc,EAAE,CAAC;QAC3C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC5B,CAAC;;AApFL,oBAqFC;AApFkB,cAAS,GAA8B,IAAI,GAAG,EAAE,CAAC;AACjD,mBAAc,GAAmB,IAAI,+BAAc,EAAE,CAAC;AACtD,gBAAW,GAAQ,IAAI,CAAC"}
+{"version":3,"file":"Gate.js","sourceRoot":"","sources":["../src/Gate.ts"],"names":[],"mappings":";;;AAAA,qDAAkD;AAClD,gFAA6E;AAC7E,iDAA8C;AAM9C,MAAa,IAAI;IAOb,mEAAmE;IAEnE;;OAEG;IACI,MAAM,CAAC,MAAM,CAAC,OAAe,EAAE,QAAsB;QACxD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,MAAM,CAAC,KAAU,EAAE,MAAW;QACxC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,mEAAmE;IAEnE;;;;;OAKG;IACI,MAAM,CAAC,MAAM,CAAC,QAAwB;QACzC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,KAAK,CAAC,QAAuB;QACvC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED,mEAAmE;IAEnE;;OAEG;IACI,MAAM,CAAC,OAAO,CAAC,IAAS;QAC3B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,mEAAmE;IAEnE;;;OAGG;IACI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAe,EAAE,GAAG,IAAW;QACvD,sBAAsB;QACtB,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACpC,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;YAClE,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;gBACxB,OAAO,2BAAY,CAAC,KAAK,EAAE,CAAC;YAChC,CAAC;YACD,IAAI,YAAY,KAAK,KAAK,EAAE,CAAC;gBACzB,OAAO,2BAAY,CAAC,IAAI,EAAE,CAAC;YAC/B,CAAC;YACD,4BAA4B;QAChC,CAAC;QAED,kCAAkC;QAClC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC3D,IAAI,MAAM,EAAE,CAAC;gBACT,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;gBACzD,IAAI,OAAO,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;oBACxC,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;oBAC/E,IAAI,YAAY,KAAK,IAAI;wBAAE,OAAO,2BAAY,CAAC,KAAK,EAAE,CAAC;oBACvD,IAAI,YAAY,KAAK,KAAK;wBAAE,OAAO,2BAAY,CAAC,IAAI,EAAE,CAAC;gBAC3D,CAAC;gBAED,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBACpE,IAAI,MAAM,EAAE,CAAC;oBACT,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,CAAC;oBACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;oBAC9C,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;oBACnE,OAAO,QAAQ,CAAC;gBACpB,CAAC;YACL,CAAC;QACL,CAAC;QAED,kCAAkC;QAClC,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;YAC9C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,CAAC;YACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;YACnE,OAAO,QAAQ,CAAC;QACpB,CAAC;QAED,kBAAkB;QAClB,MAAM,QAAQ,GAAG,2BAAY,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;QACtD,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,GAAG,IAAW;QACtD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;QACtD,OAAO,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC9B,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,GAAG,IAAW;QACtD,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAe,EAAE,GAAG,IAAW;QACzD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;QACtD,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,+CAAsB,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,8BAA8B,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5G,CAAC;IACL,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAe,EAAE,GAAG,IAAW;QACrD,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED,mEAAmE;IAEnE;;OAEG;IACI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,SAAmB,EAAE,GAAG,IAAW;QACvD,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;YAC9B,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;gBACtC,OAAO,IAAI,CAAC;YAChB,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,SAAmB,EAAE,GAAG,IAAW;QACzD,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;gBACzC,OAAO,KAAK,CAAC;YACjB,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAmB,EAAE,GAAG,IAAW;QACxD,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;YAC9B,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;gBACtC,OAAO,KAAK,CAAC;YACjB,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,mEAAmE;IAE3D,MAAM,CAAC,eAAe,CAAC,MAA8B;QACzD,IAAI,MAAM,YAAY,2BAAY,EAAE,CAAC;YACjC,OAAO,MAAM,CAAC;QAClB,CAAC;QACD,OAAO,MAAM,CAAC,CAAC,CAAC,2BAAY,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,2BAAY,CAAC,IAAI,EAAE,CAAC;IAC/D,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,OAAe,EAAE,MAAe,EAAE,GAAG,IAAW;QACnF,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACnC,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;QACzD,CAAC;IACL,CAAC;IAED;;OAEG;IACI,MAAM,CAAC,KAAK;QACf,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,cAAc,GAAG,IAAI,+BAAc,EAAE,CAAC;QAC3C,IAAI,CAAC,eAAe,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC,cAAc,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;IAC5B,CAAC;;AA3ML,oBA4MC;AA3MkB,cAAS,GAA8B,IAAI,GAAG,EAAE,CAAC;AACjD,mBAAc,GAAmB,IAAI,+BAAc,EAAE,CAAC;AACtD,oBAAe,GAAqB,EAAE,CAAC;AACvC,mBAAc,GAAoB,EAAE,CAAC;AACrC,gBAAW,GAAQ,IAAI,CAAC"}

package/dist/Middleware/Authorize.d.ts

@@ -2,10 +2,11 @@ export declare class Authorize {
     /**
      * Handle authorization middleware.
      *
-     * @param request - The request object (should have user attached)
-     * @param next - The next middleware function
-     * @param ability - The ability to check (e.g., 'edit-post' or 'update')
-     * @param resourceKey - Optional resource key from request (e.g., 'post')
+     * Usage:
+     *   .middleware('can:edit-post')           → Gate check
+     *   .middleware('can:update,post')         → Policy check using req[resourceKey]
+     *   .middleware('role:admin')              → Role check
+     *   .middleware('permission:edit-posts')   → Permission check
      */
     handle(request: any, next: () => Promise<any>, ability: string, resourceKey?: string): Promise<any>;
 }

package/dist/Middleware/Authorize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Authorize.d.ts","sourceRoot":"","sources":["../../src/Middleware/Authorize.ts"],"names":[],"mappings":"AAGA,qBAAa,SAAS;IAClB;;;;;;;OAOG;IACU,MAAM,CACf,OAAO,EAAE,GAAG,EACZ,IAAI,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,EACxB,OAAO,EAAE,MAAM,EACf,WAAW,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,GAAG,CAAC;CAoBlB"}
+{"version":3,"file":"Authorize.d.ts","sourceRoot":"","sources":["../../src/Middleware/Authorize.ts"],"names":[],"mappings":"AAIA,qBAAa,SAAS;IAClB;;;;;;;;OAQG;IACU,MAAM,CACf,OAAO,EAAE,GAAG,EACZ,IAAI,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,EACxB,OAAO,EAAE,MAAM,EACf,WAAW,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,GAAG,CAAC;CAsClB"}

package/dist/Middleware/Authorize.js

@@ -3,22 +3,40 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.Authorize = void 0;
 const Gate_1 = require("../Gate");
 const AuthorizationException_1 = require("../Exceptions/AuthorizationException");
+const RolePermission_1 = require("../RolePermission");
 class Authorize {
     /**
      * Handle authorization middleware.
      *
-     * @param request - The request object (should have user attached)
-     * @param next - The next middleware function
-     * @param ability - The ability to check (e.g., 'edit-post' or 'update')
-     * @param resourceKey - Optional resource key from request (e.g., 'post')
+     * Usage:
+     *   .middleware('can:edit-post')           → Gate check
+     *   .middleware('can:update,post')         → Policy check using req[resourceKey]
+     *   .middleware('role:admin')              → Role check
+     *   .middleware('permission:edit-posts')   → Permission check
      */
     async handle(request, next, ability, resourceKey) {
-        const user = request.user;
+        const user = request.user || (request.auth && await request.auth.user());
         if (!user) {
             throw new AuthorizationException_1.AuthorizationException('User not authenticated.');
         }
+        // Role-based check: 'role:admin' or 'role:admin,editor'
+        if (ability.startsWith('role:')) {
+            const roles = ability.substring(5).split(',');
+            if (!RolePermission_1.RolePermissionMixin.hasAnyRole(user, roles)) {
+                throw new AuthorizationException_1.AuthorizationException(`User does not have the required role.`);
+            }
+            return next();
+        }
+        // Permission-based check: 'permission:edit-posts'
+        if (ability.startsWith('permission:')) {
+            const permissions = ability.substring(11).split(',');
+            if (!RolePermission_1.RolePermissionMixin.hasAnyPermission(user, permissions)) {
+                throw new AuthorizationException_1.AuthorizationException(`User does not have the required permission.`);
+            }
+            return next();
+        }
+        // Standard gate/policy check
         Gate_1.Gate.forUser(user);
-        // If resourceKey is provided, get resource from request
         const resource = resourceKey ? request[resourceKey] : null;
         if (resource) {
             await Gate_1.Gate.authorize(ability, resource);

package/dist/Middleware/Authorize.js.map

@@ -1 +1 @@
-{"version":3,"file":"Authorize.js","sourceRoot":"","sources":["../../src/Middleware/Authorize.ts"],"names":[],"mappings":";;;AAAA,kCAA+B;AAC/B,iFAA8E;AAE9E,MAAa,SAAS;IAClB;;;;;;;OAOG;IACI,KAAK,CAAC,MAAM,CACf,OAAY,EACZ,IAAwB,EACxB,OAAe,EACf,WAAoB;QAEpB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAE1B,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,MAAM,IAAI,+CAAsB,CAAC,yBAAyB,CAAC,CAAC;QAChE,CAAC;QAED,WAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEnB,wDAAwD;QACxD,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAE3D,IAAI,QAAQ,EAAE,CAAC;YACX,MAAM,WAAI,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACJ,MAAM,WAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAClB,CAAC;CACJ;AAlCD,8BAkCC"}
+{"version":3,"file":"Authorize.js","sourceRoot":"","sources":["../../src/Middleware/Authorize.ts"],"names":[],"mappings":";;;AAAA,kCAA+B;AAC/B,iFAA8E;AAC9E,sDAAwD;AAExD,MAAa,SAAS;IAClB;;;;;;;;OAQG;IACI,KAAK,CAAC,MAAM,CACf,OAAY,EACZ,IAAwB,EACxB,OAAe,EACf,WAAoB;QAEpB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAEzE,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,MAAM,IAAI,+CAAsB,CAAC,yBAAyB,CAAC,CAAC;QAChE,CAAC;QAED,wDAAwD;QACxD,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9C,IAAI,CAAC,oCAAmB,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,+CAAsB,CAAC,uCAAuC,CAAC,CAAC;YAC9E,CAAC;YACD,OAAO,IAAI,EAAE,CAAC;QAClB,CAAC;QAED,kDAAkD;QAClD,IAAI,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACpC,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACrD,IAAI,CAAC,oCAAmB,CAAC,gBAAgB,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC3D,MAAM,IAAI,+CAAsB,CAAC,6CAA6C,CAAC,CAAC;YACpF,CAAC;YACD,OAAO,IAAI,EAAE,CAAC;QAClB,CAAC;QAED,6BAA6B;QAC7B,WAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEnB,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAE3D,IAAI,QAAQ,EAAE,CAAC;YACX,MAAM,WAAI,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACJ,MAAM,WAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAClB,CAAC;CACJ;AArDD,8BAqDC"}

package/dist/PolicyResolver.d.ts

@@ -1,15 +1,20 @@
 export declare class PolicyResolver {
     private policies;
+    private instances;
     /**
      * Register a policy for a given model/class.
      */
     register(model: any, policy: any): void;
     /**
-     * Resolve the policy for a given resource.
+     * Resolve the policy class/constructor for a given resource.
      */
     resolvePolicy(resource: any): any | null;
     /**
-     * Get policy method for ability.
+     * Get or create a cached instance for a policy class.
+     */
+    getInstance(policy: any): any;
+    /**
+     * Get bound policy method for ability.
      */
     getPolicyMethod(policy: any, ability: string): Function | null;
 }

package/dist/PolicyResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PolicyResolver.d.ts","sourceRoot":"","sources":["../src/PolicyResolver.ts"],"names":[],"mappings":"AAEA,qBAAa,cAAc;IACvB,OAAO,CAAC,QAAQ,CAA4B;IAE5C;;OAEG;IACI,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,GAAG,IAAI;IAI9C;;OAEG;IACI,aAAa,CAAC,QAAQ,EAAE,GAAG,GAAG,GAAG,GAAG,IAAI;IAiB/C;;OAEG;IACI,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI;CAWxE"}
+{"version":3,"file":"PolicyResolver.d.ts","sourceRoot":"","sources":["../src/PolicyResolver.ts"],"names":[],"mappings":"AAEA,qBAAa,cAAc;IACvB,OAAO,CAAC,QAAQ,CAA4B;IAC5C,OAAO,CAAC,SAAS,CAA4B;IAE7C;;OAEG;IACI,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,GAAG,IAAI;IAI9C;;OAEG;IACI,aAAa,CAAC,QAAQ,EAAE,GAAG,GAAG,GAAG,GAAG,IAAI;IA4B/C;;OAEG;IACI,WAAW,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG;IASpC;;OAEG;IACI,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI;CAWxE"}

package/dist/PolicyResolver.js

@@ -4,6 +4,7 @@ exports.PolicyResolver = void 0;
 class PolicyResolver {
     constructor() {
         this.policies = new Map();
+        this.instances = new Map();
     }
     /**
      * Register a policy for a given model/class.
@@ -12,12 +13,12 @@ class PolicyResolver {
         this.policies.set(model, policy);
     }
     /**
-     * Resolve the policy for a given resource.
+     * Resolve the policy class/constructor for a given resource.
      */
     resolvePolicy(resource) {
         if (!resource)
             return null;
-        // Check if resource has a constructor
+        // Check by constructor
         const constructor = resource.constructor;
         if (constructor && this.policies.has(constructor)) {
             return this.policies.get(constructor);
@@ -26,15 +27,36 @@ class PolicyResolver {
         if (this.policies.has(resource)) {
             return this.policies.get(resource);
         }
+        // Auto-discovery by naming convention
+        if (constructor && constructor.name) {
+            const policyName = `${constructor.name}Policy`;
+            for (const [, policy] of this.policies) {
+                const pName = typeof policy === 'function' ? policy.name : policy.constructor?.name;
+                if (pName === policyName) {
+                    return policy;
+                }
+            }
+        }
         return null;
     }
     /**
-     * Get policy method for ability.
+     * Get or create a cached instance for a policy class.
+     */
+    getInstance(policy) {
+        if (typeof policy !== 'function')
+            return policy;
+        if (!this.instances.has(policy)) {
+            this.instances.set(policy, new policy());
+        }
+        return this.instances.get(policy);
+    }
+    /**
+     * Get bound policy method for ability.
      */
     getPolicyMethod(policy, ability) {
         if (!policy)
             return null;
-        const instance = typeof policy === 'function' ? new policy() : policy;
+        const instance = this.getInstance(policy);
         if (typeof instance[ability] === 'function') {
             return instance[ability].bind(instance);
         }

package/dist/PolicyResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"PolicyResolver.js","sourceRoot":"","sources":["../src/PolicyResolver.ts"],"names":[],"mappings":";;;AAEA,MAAa,cAAc;IAA3B;QACY,aAAQ,GAAkB,IAAI,GAAG,EAAE,CAAC;IA2ChD,CAAC;IAzCG;;OAEG;IACI,QAAQ,CAAC,KAAU,EAAE,MAAW;QACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACI,aAAa,CAAC,QAAa;QAC9B,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,sCAAsC;QACtC,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;QACzC,IAAI,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC1C,CAAC;QAED,gBAAgB;QAChB,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QAED,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;OAEG;IACI,eAAe,CAAC,MAAW,EAAE,OAAe;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,MAAM,QAAQ,GAAG,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QAEtE,IAAI,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,UAAU,EAAE,CAAC;YAC1C,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,IAAI,CAAC;IAChB,CAAC;CACJ;AA5CD,wCA4CC"}
+{"version":3,"file":"PolicyResolver.js","sourceRoot":"","sources":["../src/PolicyResolver.ts"],"names":[],"mappings":";;;AAEA,MAAa,cAAc;IAA3B;QACY,aAAQ,GAAkB,IAAI,GAAG,EAAE,CAAC;QACpC,cAAS,GAAkB,IAAI,GAAG,EAAE,CAAC;IAkEjD,CAAC;IAhEG;;OAEG;IACI,QAAQ,CAAC,KAAU,EAAE,MAAW;QACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACI,aAAa,CAAC,QAAa;QAC9B,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,uBAAuB;QACvB,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;QACzC,IAAI,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC1C,CAAC;QAED,gBAAgB;QAChB,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QAED,sCAAsC;QACtC,IAAI,WAAW,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,UAAU,GAAG,GAAG,WAAW,CAAC,IAAI,QAAQ,CAAC;YAC/C,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACrC,MAAM,KAAK,GAAG,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC;gBACpF,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;oBACvB,OAAO,MAAM,CAAC;gBAClB,CAAC;YACL,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;OAEG;IACI,WAAW,CAAC,MAAW;QAC1B,IAAI,OAAO,MAAM,KAAK,UAAU;YAAE,OAAO,MAAM,CAAC;QAEhD,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACI,eAAe,CAAC,MAAW,EAAE,OAAe;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAE1C,IAAI,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,UAAU,EAAE,CAAC;YAC1C,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO,IAAI,CAAC;IAChB,CAAC;CACJ;AApED,wCAoEC"}

package/dist/RolePermission.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Contracts for entities that have roles and permissions.
+ */
+export interface HasRoles {
+    roles?: string[] | {
+        name: string;
+    }[];
+    hasRole(role: string | string[]): boolean;
+    hasAnyRole(roles: string[]): boolean;
+    hasAllRoles(roles: string[]): boolean;
+}
+export interface HasPermissions {
+    permissions?: string[] | {
+        name: string;
+    }[];
+    hasPermission(permission: string): boolean;
+    hasAnyPermission(permissions: string[]): boolean;
+    hasAllPermissions(permissions: string[]): boolean;
+}
+/**
+ * Mixin helper to add Role & Permission checking to any user object.
+ * Works with both string arrays and object arrays ({name: string}).
+ */
+export declare class RolePermissionMixin {
+    /**
+     * Normalize roles/permissions to string arrays.
+     */
+    private static normalize;
+    static hasRole(user: any, role: string | string[]): boolean;
+    static hasAnyRole(user: any, roles: string[]): boolean;
+    static hasAllRoles(user: any, roles: string[]): boolean;
+    static hasPermission(user: any, permission: string): boolean;
+    static hasAnyPermission(user: any, permissions: string[]): boolean;
+    static hasAllPermissions(user: any, permissions: string[]): boolean;
+}
+//# sourceMappingURL=RolePermission.d.ts.map

package/dist/RolePermission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RolePermission.d.ts","sourceRoot":"","sources":["../src/RolePermission.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,QAAQ;IACrB,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACtC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC;IAC1C,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACrC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;CACzC;AAED,MAAM,WAAW,cAAc;IAC3B,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC5C,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3C,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACjD,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;CACrD;AAED;;;GAGG;AACH,qBAAa,mBAAmB;IAE5B;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,SAAS;WAKV,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO;WAQpD,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO;WAK/C,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO;WAKhD,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO;WAiBrD,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO;WAI3D,iBAAiB,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO;CAG7E"}