@canopy-io/nestjs 0.4.0 → 0.4.1

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @canopy-io/nestjs
 
+## 0.4.1
+
+### Patch Changes
+
+- 436d639: Follows Canopy's paged hierarchy, grant, session and directory group reads. These endpoints now answer `{ items, pagination }`, at most 100 to a page, where they used to answer the whole collection.
+  
+  `LocalAuthorizer`, and so `CanopyGuard`, reads every page of an identity's grant roots (now one row per permission and node) and every page of the hierarchy's parent edges, 100 at a time. Revalidation still costs one request: only the hierarchy's first page is sent with its `ETag`, and a `304` keeps the held copy. When the hierarchy has changed, every page is read again, and a rebuild over several pages is confirmed against the first page's `ETag` so a change made mid-read is not kept half-applied. `snapshot()` gains `grantPages` and `treePages`, the page requests behind `grantFetches` and `treeRequests`. Earlier versions deny every check against a Canopy that answers grants as one row per node, so upgrade before that API reaches you.
+  
+  Caller shapes that changed:
+  
+  - `identities.sessions(id, query?)` returns a `Paginator` instead of a promise of `{ items }`, and takes `page` and `take`. Use `for await`, `.all()` or `.first()`.
+  - `organizations.listDirectoryGroups(id, query?)` returns a `Paginator`, and takes `page`, `take`, `q` (display name or external id) and `sort_by` (`name`, the default, or `created`). The item type is exported as `OrganizationDirectoryGroupItem`.
+  - `permissions.evaluateBulk` takes between 1 and 100 checks; more is refused with a `400`.
+  - The generated types follow the API: `GET /api/v1/nodes` and `GET /api/v1/nodes/:id/tree` answer pages of flat nodes (`ScopedNodeResponseDto`, linked by `parent_node_id`) instead of a nested tree with its scope, `GET /api/v1/nodes/:id/children` is paged, and `IdentityGrantResponseDto` carries `node_id` instead of `nodes`. Several lists' `sort_by` is now typed to the columns each accepts.
+  
+  `@canopy-io/nestjs` picks up the new authorizer; its own options and behaviour are unchanged.
+- Updated dependencies [436d639]
+  - @canopy-io/node@0.9.0
+
 ## 0.4.0
 
 ### Minor Changes

package/README.md

@@ -230,7 +230,7 @@ So two things are held, split by what they depend on:
 
 and a check is a walk up from the node in question looking for a grant root. An `app_wide` check is simpler still: the permission appearing at all is the answer, and no hierarchy is needed.
 
-**Both are held for at most 60 seconds**, which is therefore the delay between an access change and it taking effect. `authorizationTtlMs` changes it, up to five minutes (`300_000`); a longer value throws at startup. The hierarchy is revalidated rather than re-read — a conditional request that normally answers `304`, so nothing transfers.
+**Both are held for at most 60 seconds**, which is therefore the delay between an access change and it taking effect. `authorizationTtlMs` changes it, up to five minutes (`300_000`); a longer value throws at startup. The hierarchy is revalidated rather than re-read — a conditional request for its first page that normally answers `304`, so nothing transfers. Both reads are paged and read in full, 100 rows to a page; when the hierarchy has changed, every page of it is read again (see [`LocalAuthorizer`](../node#authorizing-without-a-call-per-request) for how a rebuild over several pages is kept consistent).
 
 ```ts
 CanopyModule.forRoot({
@@ -250,7 +250,7 @@ of the permissions the guard reads with, because a scoped key is granted
 exactly the permission keys listed on it:
 
 - **`identity.view`** — to read an identity's grant roots.
-- **`hierarchy.view`** — to read the hierarchy the walk runs against, taken as parent edges (`GET /api/v1/nodes/parents`) rather than the dashboard's tree.
+- **`hierarchy.view`** — to read the hierarchy the walk runs against, taken as parent edges (`GET /api/v1/nodes/parents`, every page) rather than the dashboard's node list.
 
 Miss the first and every guarded route answers `500` naming the failed read.
 Miss the second and the tree comes back **empty with a `200`** — the API is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canopy-io/nestjs",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Official NestJS integration for Canopy \u2014 hierarchical identity and access management.",
   "license": "MIT",
   "author": "Canopy Identity Inc.",
@@ -62,7 +62,7 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@canopy-io/node": "^0.8.0"
+    "@canopy-io/node": "^0.9.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^10.0.0 || ^11.0.0",