@carlonicora/nestjs-neo4jsonapi 6.6.0 → 6.6.2

package/dist/common/decorators/index.d.ts

@@ -5,6 +5,7 @@ export * from "./module.decorator";
 export * from "./oauth.scopes.decorator";
 export * from "./rate-limit.decorator";
 export * from "./roles.decorator";
+export * from "./token-scopes.decorator";
 export * from "./tool.decorator";
 export * from "./validate-id.decorator";
 //# sourceMappingURL=index.d.ts.map

package/dist/common/decorators/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/common/decorators/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iCAAiC,CAAC;AAChD,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,wBAAwB,CAAC;AACvC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/common/decorators/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iCAAiC,CAAC;AAChD,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,wBAAwB,CAAC;AACvC,cAAc,mBAAmB,CAAC;AAClC,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAC"}

package/dist/common/decorators/index.js

@@ -21,6 +21,7 @@ __exportStar(require("./module.decorator"), exports);
 __exportStar(require("./oauth.scopes.decorator"), exports);
 __exportStar(require("./rate-limit.decorator"), exports);
 __exportStar(require("./roles.decorator"), exports);
+__exportStar(require("./token-scopes.decorator"), exports);
 __exportStar(require("./tool.decorator"), exports);
 __exportStar(require("./validate-id.decorator"), exports);
 //# sourceMappingURL=index.js.map

package/dist/common/decorators/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/common/decorators/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAkC;AAClC,+DAA6C;AAC7C,kEAAgD;AAChD,qDAAmC;AACnC,2DAAyC;AACzC,yDAAuC;AACvC,oDAAkC;AAClC,mDAAiC;AACjC,0DAAwC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/common/decorators/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAkC;AAClC,+DAA6C;AAC7C,kEAAgD;AAChD,qDAAmC;AACnC,2DAAyC;AACzC,yDAAuC;AACvC,oDAAkC;AAClC,2DAAyC;AACzC,mDAAiC;AACjC,0DAAwC"}

package/dist/common/decorators/token-scopes.decorator.d.ts

@@ -0,0 +1,14 @@
+import type { TokenScope } from "../guards/session.token";
+/** Metadata key read by `AnyScopeAuthGuard`. */
+export declare const TOKEN_SCOPES_KEY = "token_scopes";
+/**
+ * The selection-token scopes `AnyScopeAuthGuard` admits on a route, besides a full
+ * session. Without this decorator the guard admits a full session only.
+ *
+ * @example
+ * @UseGuards(AnyScopeAuthGuard)
+ * @AllowedTokenScopes("company-selection")
+ * async selectCompany() { ... }
+ */
+export declare const AllowedTokenScopes: (...scopes: TokenScope[]) => import("@nestjs/common", { with: { "resolution-mode": "import" } }).CustomDecorator<string>;
+//# sourceMappingURL=token-scopes.decorator.d.ts.map

package/dist/common/decorators/token-scopes.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-scopes.decorator.d.ts","sourceRoot":"","sources":["../../../src/common/decorators/token-scopes.decorator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAE1D,gDAAgD;AAChD,eAAO,MAAM,gBAAgB,iBAAiB,CAAC;AAE/C;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAAI,GAAG,QAAQ,UAAU,EAAE,gGAA0C,CAAC"}

package/dist/common/decorators/token-scopes.decorator.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AllowedTokenScopes = exports.TOKEN_SCOPES_KEY = void 0;
+const common_1 = require("@nestjs/common");
+/** Metadata key read by `AnyScopeAuthGuard`. */
+exports.TOKEN_SCOPES_KEY = "token_scopes";
+/**
+ * The selection-token scopes `AnyScopeAuthGuard` admits on a route, besides a full
+ * session. Without this decorator the guard admits a full session only.
+ *
+ * @example
+ * @UseGuards(AnyScopeAuthGuard)
+ * @AllowedTokenScopes("company-selection")
+ * async selectCompany() { ... }
+ */
+const AllowedTokenScopes = (...scopes) => (0, common_1.SetMetadata)(exports.TOKEN_SCOPES_KEY, scopes);
+exports.AllowedTokenScopes = AllowedTokenScopes;
+//# sourceMappingURL=token-scopes.decorator.js.map

package/dist/common/decorators/token-scopes.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-scopes.decorator.js","sourceRoot":"","sources":["../../../src/common/decorators/token-scopes.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAA6C;AAG7C,gDAAgD;AACnC,QAAA,gBAAgB,GAAG,cAAc,CAAC;AAE/C;;;;;;;;GAQG;AACI,MAAM,kBAAkB,GAAG,CAAC,GAAG,MAAoB,EAAE,EAAE,CAAC,IAAA,oBAAW,EAAC,wBAAgB,EAAE,MAAM,CAAC,CAAC;AAAxF,QAAA,kBAAkB,sBAAsE"}

package/dist/common/guards/index.d.ts

@@ -4,4 +4,5 @@ export * from "./jwt.auth.any-scope.guard";
 export * from "./jwt.auth.guard";
 export * from "./jwt.auth.optional.guard";
 export * from "./jwt.or.oauth.guard";
+export * from "./session.token";
 //# sourceMappingURL=index.d.ts.map

package/dist/common/guards/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/common/guards/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAC;AACzC,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/common/guards/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAC;AACzC,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC"}

package/dist/common/guards/index.js

@@ -20,4 +20,5 @@ __exportStar(require("./jwt.auth.any-scope.guard"), exports);
 __exportStar(require("./jwt.auth.guard"), exports);
 __exportStar(require("./jwt.auth.optional.guard"), exports);
 __exportStar(require("./jwt.or.oauth.guard"), exports);
+__exportStar(require("./session.token"), exports);
 //# sourceMappingURL=index.js.map

package/dist/common/guards/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/common/guards/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2DAAyC;AACzC,yDAAuC;AACvC,6DAA2C;AAC3C,mDAAiC;AACjC,4DAA0C;AAC1C,uDAAqC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/common/guards/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2DAAyC;AACzC,yDAAuC;AACvC,6DAA2C;AAC3C,mDAAiC;AACjC,4DAA0C;AAC1C,uDAAqC;AACrC,kDAAgC"}

package/dist/common/guards/jwt.auth.admin.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.auth.admin.guard.d.ts","sourceRoot":"","sources":["../../../src/common/guards/jwt.auth.admin.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAA+C,MAAM,gBAAgB,CAAC;AAC5G,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,yCAAyC,CAAC;AACvE,OAAO,EAAqB,wBAAwB,EAAgB,oBAAoB,EAAE,MAAM,WAAW,CAAC;;AAE5G,qBACa,iBAAkB,SAAQ,sBAAiB,YAAW,WAAW;IAE1E,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAGtB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAQ7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAbhB,GAAG,EAAE,UAAU,EACxB,SAAS,EAAE,SAAS,EACX,KAAK,EAAE,YAAY,EAGnB,WAAW,CAAC,EAAE,oBAAoB,EAQlC,eAAe,CAAC,EAAE,wBAAwB;IAKvD,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAe9D,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB;IAmCvE,OAAO,CAAC,cAAc;CAQvB"}
+{"version":3,"file":"jwt.auth.admin.guard.d.ts","sourceRoot":"","sources":["../../../src/common/guards/jwt.auth.admin.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAA+C,MAAM,gBAAgB,CAAC;AAC5G,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,yCAAyC,CAAC;AACvE,OAAO,EAAqB,wBAAwB,EAAgB,oBAAoB,EAAE,MAAM,WAAW,CAAC;;AAG5G,qBACa,iBAAkB,SAAQ,sBAAiB,YAAW,WAAW;IAE1E,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAGtB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAQ7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAbhB,GAAG,EAAE,UAAU,EACxB,SAAS,EAAE,SAAS,EACX,KAAK,EAAE,YAAY,EAGnB,WAAW,CAAC,EAAE,oBAAoB,EAQlC,eAAe,CAAC,EAAE,wBAAwB;IAKvD,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAe9D,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB;IAgDvE,OAAO,CAAC,cAAc;CAWvB"}

package/dist/common/guards/jwt.auth.admin.guard.js

@@ -19,6 +19,7 @@ const passport_1 = require("@nestjs/passport");
 const nestjs_cls_1 = require("nestjs-cls");
 const neo4j_service_1 = require("../../core/neo4j/services/neo4j.service");
 const tokens_1 = require("../tokens");
+const session_token_1 = require("./session.token");
 let AdminJwtAuthGuard = class AdminJwtAuthGuard extends (0, passport_1.AuthGuard)("jwt") {
     constructor(cls, reflector, neo4j, systemRoles, authContextHook) {
         super();
@@ -63,15 +64,29 @@ let AdminJwtAuthGuard = class AdminJwtAuthGuard extends (0, passport_1.AuthGuard
             // package's own rbac, feature, company, waitlist and stripe-* controllers.
             throw new common_1.HttpException("Unauthorised", 401);
         }
-        this._validateRoles(user, context);
-        this.cls.set("userId", user.userId);
-        this.cls.set("companyId", user.companyId ?? request.headers["x-companyid"]);
+        // Only a full session passes: pending-2FA, selection and portal tokens are signed
+        // with the same secret and verify, but must never act as a session.
+        // Asserted on a local copy: narrowing `user` itself would change the return type
+        // away from IAuthGuard's generic `TUser`.
+        const session = user;
+        (0, session_token_1.assertSessionPayload)(session);
+        this._validateRoles(session, context);
+        const companyId = (0, session_token_1.resolveSessionCompanyId)({
+            payload: session,
+            headerCompanyId: request.headers["x-companyid"],
+            administratorRole: this.systemRoles?.Administrator,
+        });
+        this.cls.set("userId", session.userId);
+        this.cls.set("companyId", companyId);
         this.cls.set("language", request.headers["x-language"]);
-        this.cls.set("roles", user.roles);
+        this.cls.set("roles", session.roles);
         return user;
     }
     _validateRoles(user, context) {
-        const requiredRoles = this.reflector.get("roles", context.getHandler()) ?? [];
+        // Handler AND class, copied so pushing the admin role never mutates the metadata.
+        const requiredRoles = [
+            ...(this.reflector.getAllAndOverride("roles", [context.getHandler(), context.getClass()]) ?? []),
+        ];
         const adminRole = this.systemRoles?.Administrator ?? "administrator";
         if (!requiredRoles.includes(adminRole))
             requiredRoles.push(adminRole);

package/dist/common/guards/jwt.auth.admin.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.auth.admin.guard.js","sourceRoot":"","sources":["../../../src/common/guards/jwt.auth.admin.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA4G;AAC5G,uCAAyC;AACzC,+CAA6C;AAC7C,2CAAwC;AACxC,2EAAuE;AACvE,sCAA4G;AAGrG,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,IAAA,oBAAS,EAAC,KAAK,CAAC;IACrD,YACmB,GAAe,EACxB,SAAoB,EACX,KAAmB,EAGnB,WAAkC,EAQlC,eAA0C;QAE3D,KAAK,EAAE,CAAC;QAfS,QAAG,GAAH,GAAG,CAAY;QACxB,cAAS,GAAT,SAAS,CAAW;QACX,UAAK,GAAL,KAAK,CAAc;QAGnB,gBAAW,GAAX,WAAW,CAAuB;QAQlC,oBAAe,GAAf,eAAe,CAA2B;IAG7D,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE1D,IAAI,CAAC,mBAAmB;YAAE,OAAO,KAAK,CAAC;QAEvC,MAAM,eAAe,GAAG,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAY,CAAC;QAEtE,2EAA2E;QAC3E,IAAI,eAAe,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,eAAe;YACzD,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAEnE,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,aAAa,CAAC,GAAQ,EAAE,IAAS,EAAE,IAAS,EAAE,OAAyB;QACrE,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE5C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAEzD,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,IAAI,EAAE,OAAO,KAAK,aAAa,EAAE,CAAC;gBACpC,MAAM,IAAI,sBAAa,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;YAChD,CAAC;iBAAM,IAAI,GAAG,EAAE,CAAC;gBACf,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,6CAA6C;YAC7C,EAAE;YACF,0EAA0E;YAC1E,oEAAoE;YACpE,0EAA0E;YAC1E,wEAAwE;YACxE,0EAA0E;YAC1E,0EAA0E;YAC1E,mEAAmE;YACnE,2EAA2E;YAC3E,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAEnC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAElC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,CAAC,IAAS,EAAE,OAAY;QAC5C,MAAM,aAAa,GAAa,IAAI,CAAC,SAAS,CAAC,GAAG,CAAW,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC;QAElG,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,IAAI,eAAe,CAAC;QACrE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEtE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IAC7G,CAAC;CACF,CAAA;AA9EY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,qBAAY,CAAC,CAAA;IAOpB,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,0BAAiB,CAAC,CAAA;qCAZJ,uBAAU;QACb,gBAAS;QACJ,4BAAY;GAJ3B,iBAAiB,CA8E7B"}
+{"version":3,"file":"jwt.auth.admin.guard.js","sourceRoot":"","sources":["../../../src/common/guards/jwt.auth.admin.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA4G;AAC5G,uCAAyC;AACzC,+CAA6C;AAC7C,2CAAwC;AACxC,2EAAuE;AACvE,sCAA4G;AAC5G,mDAAgG;AAGzF,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,IAAA,oBAAS,EAAC,KAAK,CAAC;IACrD,YACmB,GAAe,EACxB,SAAoB,EACX,KAAmB,EAGnB,WAAkC,EAQlC,eAA0C;QAE3D,KAAK,EAAE,CAAC;QAfS,QAAG,GAAH,GAAG,CAAY;QACxB,cAAS,GAAT,SAAS,CAAW;QACX,UAAK,GAAL,KAAK,CAAc;QAGnB,gBAAW,GAAX,WAAW,CAAuB;QAQlC,oBAAe,GAAf,eAAe,CAA2B;IAG7D,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE1D,IAAI,CAAC,mBAAmB;YAAE,OAAO,KAAK,CAAC;QAEvC,MAAM,eAAe,GAAG,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAY,CAAC;QAEtE,2EAA2E;QAC3E,IAAI,eAAe,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,eAAe;YACzD,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAEnE,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,aAAa,CAAC,GAAQ,EAAE,IAAS,EAAE,IAAS,EAAE,OAAyB;QACrE,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE5C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAEzD,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,IAAI,EAAE,OAAO,KAAK,aAAa,EAAE,CAAC;gBACpC,MAAM,IAAI,sBAAa,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;YAChD,CAAC;iBAAM,IAAI,GAAG,EAAE,CAAC;gBACf,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,6CAA6C;YAC7C,EAAE;YACF,0EAA0E;YAC1E,oEAAoE;YACpE,0EAA0E;YAC1E,wEAAwE;YACxE,0EAA0E;YAC1E,0EAA0E;YAC1E,mEAAmE;YACnE,2EAA2E;YAC3E,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;QAED,kFAAkF;QAClF,oEAAoE;QACpE,iFAAiF;QACjF,0CAA0C;QAC1C,MAAM,OAAO,GAAY,IAAI,CAAC;QAC9B,IAAA,oCAAoB,EAAC,OAAO,CAAC,CAAC;QAE9B,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAEtC,MAAM,SAAS,GAAG,IAAA,uCAAuB,EAAC;YACxC,OAAO,EAAE,OAAO;YAChB,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;YAC/C,iBAAiB,EAAE,IAAI,CAAC,WAAW,EAAE,aAAa;SACnD,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAErC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,CAAC,IAAoB,EAAE,OAAyB;QACpE,kFAAkF;QAClF,MAAM,aAAa,GAAa;YAC9B,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAW,OAAO,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;SAC3G,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,IAAI,eAAe,CAAC;QACrE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEtE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IAC7G,CAAC;CACF,CAAA;AA9FY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,qBAAY,CAAC,CAAA;IAOpB,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,0BAAiB,CAAC,CAAA;qCAZJ,uBAAU;QACb,gBAAS;QACJ,4BAAY;GAJ3B,iBAAiB,CA8F7B"}

package/dist/common/guards/jwt.auth.any-scope.guard.d.ts

@@ -1,18 +1,25 @@
 import { ExecutionContext } from "@nestjs/common";
+import { Reflector } from "@nestjs/core";
 import { ClsService } from "nestjs-cls";
 declare const AnyScopeAuthGuard_base: import("@nestjs/passport", { with: { "resolution-mode": "import" } }).Type<import("@nestjs/passport", { with: { "resolution-mode": "import" } }).IAuthGuard>;
 /**
- * Admits BOTH a full session JWT and a scoped selection JWT (e.g. the
- * short-lived "company-selection" token issued at login).
+ * Admits a full session JWT, or a selection JWT whose scope the route lists with
+ * `@AllowedTokenScopes(...)` (handler or class). Without that decorator only a full
+ * session passes.
  *
  * The company-selection routes are legitimately reachable by either: a user
  * who belongs to more than one company arrives from the login screen holding
  * only a selection token, while a user switching company from inside the app
  * arrives holding a full token.
+ *
+ * Always refused: a pending-2FA token (it would otherwise mint a full session through
+ * POST /auth/company-selection with a password only), a portal token, and a selection
+ * token of a scope the route does not list.
  */
 export declare class AnyScopeAuthGuard extends AnyScopeAuthGuard_base {
     private readonly cls;
-    constructor(cls: ClsService);
+    private readonly reflector;
+    constructor(cls: ClsService, reflector: Reflector);
     canActivate(context: ExecutionContext): Promise<boolean>;
     handleRequest(err: any, user: any, info: any, context: any): any;
 }

package/dist/common/guards/jwt.auth.any-scope.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.auth.any-scope.guard.d.ts","sourceRoot":"","sources":["../../../src/common/guards/jwt.auth.any-scope.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAA6B,MAAM,gBAAgB,CAAC;AAE7E,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;;AAExC;;;;;;;;GAQG;AACH,qBACa,iBAAkB,SAAQ,sBAAgB;IACzC,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,UAAU;IAItC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAU9D,aAAa,CAAC,GAAG,KAAA,EAAE,IAAI,KAAA,EAAE,IAAI,KAAA,EAAE,OAAO,KAAA;CAiBvC"}
+{"version":3,"file":"jwt.auth.any-scope.guard.d.ts","sourceRoot":"","sources":["../../../src/common/guards/jwt.auth.any-scope.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAA6B,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;;AAIxC;;;;;;;;;;;;;GAaG;AACH,qBACa,iBAAkB,SAAQ,sBAAgB;IAEnD,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,GAAG,EAAE,UAAU,EACf,SAAS,EAAE,SAAS;IAKjC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAU9D,aAAa,CAAC,GAAG,KAAA,EAAE,IAAI,KAAA,EAAE,IAAI,KAAA,EAAE,OAAO,KAAA;CAsBvC"}

package/dist/common/guards/jwt.auth.any-scope.guard.js

@@ -11,21 +11,30 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AnyScopeAuthGuard = void 0;
 const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
 const passport_1 = require("@nestjs/passport");
 const nestjs_cls_1 = require("nestjs-cls");
+const token_scopes_decorator_1 = require("../decorators/token-scopes.decorator");
+const session_token_1 = require("./session.token");
 /**
- * Admits BOTH a full session JWT and a scoped selection JWT (e.g. the
- * short-lived "company-selection" token issued at login).
+ * Admits a full session JWT, or a selection JWT whose scope the route lists with
+ * `@AllowedTokenScopes(...)` (handler or class). Without that decorator only a full
+ * session passes.
  *
  * The company-selection routes are legitimately reachable by either: a user
  * who belongs to more than one company arrives from the login screen holding
  * only a selection token, while a user switching company from inside the app
  * arrives holding a full token.
+ *
+ * Always refused: a pending-2FA token (it would otherwise mint a full session through
+ * POST /auth/company-selection with a password only), a portal token, and a selection
+ * token of a scope the route does not list.
  */
 let AnyScopeAuthGuard = class AnyScopeAuthGuard extends (0, passport_1.AuthGuard)("jwt") {
-    constructor(cls) {
+    constructor(cls, reflector) {
         super();
         this.cls = cls;
+        this.reflector = reflector;
     }
     async canActivate(context) {
         const request = context.switchToHttp().getRequest();
@@ -48,6 +57,9 @@ let AnyScopeAuthGuard = class AnyScopeAuthGuard extends (0, passport_1.AuthGuard
                 throw err;
             throw new common_1.HttpException("Unauthorised", 401);
         }
+        const allowedScopes = this.reflector.getAllAndOverride(token_scopes_decorator_1.TOKEN_SCOPES_KEY, [context.getHandler(), context.getClass()]) ?? [];
+        if (!(0, session_token_1.isAcceptedScopedPayload)(user, allowedScopes))
+            throw new common_1.HttpException("Unauthorised", 401);
         this.cls.set("userId", user.userId);
         this.cls.set("token", token.startsWith("Bearer ") ? token.slice(7) : token);
         return user;
@@ -56,6 +68,7 @@ let AnyScopeAuthGuard = class AnyScopeAuthGuard extends (0, passport_1.AuthGuard
 exports.AnyScopeAuthGuard = AnyScopeAuthGuard;
 exports.AnyScopeAuthGuard = AnyScopeAuthGuard = __decorate([
     (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [nestjs_cls_1.ClsService])
+    __metadata("design:paramtypes", [nestjs_cls_1.ClsService,
+        core_1.Reflector])
 ], AnyScopeAuthGuard);
 //# sourceMappingURL=jwt.auth.any-scope.guard.js.map

package/dist/common/guards/jwt.auth.any-scope.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.auth.any-scope.guard.js","sourceRoot":"","sources":["../../../src/common/guards/jwt.auth.any-scope.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA6E;AAC7E,+CAA6C;AAC7C,2CAAwC;AAExC;;;;;;;;GAQG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,IAAA,oBAAS,EAAC,KAAK,CAAC;IACrD,YAA6B,GAAe;QAC1C,KAAK,EAAE,CAAC;QADmB,QAAG,GAAH,GAAG,CAAY;IAE5C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,4EAA4E;QAC5E,sEAAsE;QACtE,sEAAsE;QACtE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa;YAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAEjF,OAAO,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAY,CAAC;IACvD,CAAC;IAED,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO;QACpC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE5C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAEzD,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,IAAI,EAAE,OAAO,KAAK,aAAa;gBAAE,MAAM,IAAI,sBAAa,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;YACnF,IAAI,GAAG;gBAAE,MAAM,GAAG,CAAC;YACnB,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAE5E,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAhCY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAEuB,uBAAU;GADjC,iBAAiB,CAgC7B"}
+{"version":3,"file":"jwt.auth.any-scope.guard.js","sourceRoot":"","sources":["../../../src/common/guards/jwt.auth.any-scope.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA6E;AAC7E,uCAAyC;AACzC,+CAA6C;AAC7C,2CAAwC;AACxC,iFAAwE;AACxE,mDAA0D;AAE1D;;;;;;;;;;;;;GAaG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,IAAA,oBAAS,EAAC,KAAK,CAAC;IACrD,YACmB,GAAe,EACf,SAAoB;QAErC,KAAK,EAAE,CAAC;QAHS,QAAG,GAAH,GAAG,CAAY;QACf,cAAS,GAAT,SAAS,CAAW;IAGvC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,4EAA4E;QAC5E,sEAAsE;QACtE,sEAAsE;QACtE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa;YAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAEjF,OAAO,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAY,CAAC;IACvD,CAAC;IAED,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO;QACpC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE5C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAEzD,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,IAAI,EAAE,OAAO,KAAK,aAAa;gBAAE,MAAM,IAAI,sBAAa,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;YACnF,IAAI,GAAG;gBAAE,MAAM,GAAG,CAAC;YACnB,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,aAAa,GACjB,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAW,yCAAgB,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAEjH,IAAI,CAAC,IAAA,uCAAuB,EAAC,IAAI,EAAE,aAAa,CAAC;YAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAEhG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAE5E,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAxCY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAGa,uBAAU;QACJ,gBAAS;GAH5B,iBAAiB,CAwC7B"}

package/dist/common/guards/jwt.auth.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.auth.guard.d.ts","sourceRoot":"","sources":["../../../src/common/guards/jwt.auth.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAA+C,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,yCAAyC,CAAC;AACvE,OAAO,EAAqB,wBAAwB,EAAgB,oBAAoB,EAAE,MAAM,WAAW,CAAC;;AAE5G,qBACa,YAAa,SAAQ,iBAAgB;IAE9C,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAItB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAG7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAThB,GAAG,EAAE,UAAU,EACxB,SAAS,EAAE,SAAS,EACX,KAAK,EAAE,YAAY,EAInB,WAAW,CAAC,EAAE,oBAAoB,EAGlC,eAAe,CAAC,EAAE,wBAAwB;IAKvD,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAc9D,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB;IA2BvE,OAAO,CAAC,cAAc;CAQvB"}
+{"version":3,"file":"jwt.auth.guard.d.ts","sourceRoot":"","sources":["../../../src/common/guards/jwt.auth.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAA+C,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,yCAAyC,CAAC;AACvE,OAAO,EAAqB,wBAAwB,EAAgB,oBAAoB,EAAE,MAAM,WAAW,CAAC;;AAG5G,qBACa,YAAa,SAAQ,iBAAgB;IAE9C,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAGtB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAG7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBARhB,GAAG,EAAE,UAAU,EACxB,SAAS,EAAE,SAAS,EACX,KAAK,EAAE,YAAY,EAGnB,WAAW,CAAC,EAAE,oBAAoB,EAGlC,eAAe,CAAC,EAAE,wBAAwB;IAKvD,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAc9D,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB;IAwCvE,OAAO,CAAC,cAAc;CAavB"}

package/dist/common/guards/jwt.auth.guard.js

@@ -19,6 +19,7 @@ const passport_1 = require("@nestjs/passport");
 const nestjs_cls_1 = require("nestjs-cls");
 const neo4j_service_1 = require("../../core/neo4j/services/neo4j.service");
 const tokens_1 = require("../tokens");
+const session_token_1 = require("./session.token");
 let JwtAuthGuard = class JwtAuthGuard extends (0, passport_1.AuthGuard)("jwt") {
     constructor(cls, reflector, neo4j, systemRoles, authContextHook) {
         super();
@@ -52,17 +53,33 @@ let JwtAuthGuard = class JwtAuthGuard extends (0, passport_1.AuthGuard)("jwt") {
             }
             throw new common_1.HttpException("Unauthorised", 401);
         }
-        this._validateRoles(user, context);
-        this.cls.set("userId", user.userId);
-        this.cls.set("companyId", user.companyId ?? request.headers["x-companyid"]);
-        this.cls.set("roles", user.roles);
+        // Only a full session passes: pending-2FA, selection and portal tokens are signed
+        // with the same secret and verify, but must never act as a session.
+        // Asserted on a local copy: narrowing `user` itself would change the return type
+        // away from IAuthGuard's generic `TUser`.
+        const session = user;
+        (0, session_token_1.assertSessionPayload)(session);
+        this._validateRoles(session, context);
+        const companyId = (0, session_token_1.resolveSessionCompanyId)({
+            payload: session,
+            headerCompanyId: request.headers["x-companyid"],
+            administratorRole: this.systemRoles?.Administrator,
+        });
+        this.cls.set("userId", session.userId);
+        this.cls.set("companyId", companyId);
+        this.cls.set("roles", session.roles);
         this.cls.set("language", request.headers["x-language"]);
         this.cls.set("token", token.startsWith("Bearer ") ? token.slice(7) : token);
         this.cls.set("ipAddress", request.ip);
         return user;
     }
     _validateRoles(user, context) {
-        const requiredRoles = this.reflector.get("roles", context.getHandler()) ?? [];
+        // Handler AND class: a class-level @Roles was inert while only the handler was read.
+        // Copied, because pushing into the array returned by the reflector mutates the
+        // decorator metadata for every later request.
+        const requiredRoles = [
+            ...(this.reflector.getAllAndOverride("roles", [context.getHandler(), context.getClass()]) ?? []),
+        ];
         if (requiredRoles.length > 0) {
             const adminRole = this.systemRoles?.Administrator ?? "administrator";
             if (!requiredRoles.includes(adminRole))
@@ -76,7 +93,6 @@ exports.JwtAuthGuard = JwtAuthGuard;
 exports.JwtAuthGuard = JwtAuthGuard = __decorate([
     (0, common_1.Injectable)(),
     __param(3, (0, common_1.Optional)()),
-    __param(3, (0, common_1.Optional)()),
     __param(3, (0, common_1.Inject)(tokens_1.SYSTEM_ROLES)),
     __param(4, (0, common_1.Optional)()),
     __param(4, (0, common_1.Inject)(tokens_1.AUTH_CONTEXT_HOOK)),

package/dist/common/guards/jwt.auth.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.auth.guard.js","sourceRoot":"","sources":["../../../src/common/guards/jwt.auth.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA+F;AAC/F,uCAAyC;AACzC,+CAA6C;AAC7C,2CAAwC;AACxC,2EAAuE;AACvE,sCAA4G;AAGrG,IAAM,YAAY,GAAlB,MAAM,YAAa,SAAQ,IAAA,oBAAS,EAAC,KAAK,CAAC;IAChD,YACmB,GAAe,EACxB,SAAoB,EACX,KAAmB,EAInB,WAAkC,EAGlC,eAA0C;QAE3D,KAAK,EAAE,CAAC;QAXS,QAAG,GAAH,GAAG,CAAY;QACxB,cAAS,GAAT,SAAS,CAAW;QACX,UAAK,GAAL,KAAK,CAAc;QAInB,gBAAW,GAAX,WAAW,CAAuB;QAGlC,oBAAe,GAAf,eAAe,CAA2B;IAG7D,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE1D,IAAI,CAAC,mBAAmB;YAAE,OAAO,KAAK,CAAC;QAEvC,MAAM,eAAe,GAAG,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAY,CAAC;QAEtE,IAAI,eAAe,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,eAAe;YACzD,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAEnE,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,aAAa,CAAC,GAAQ,EAAE,IAAS,EAAE,IAAS,EAAE,OAAyB;QACrE,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE5C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAEzD,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,IAAI,EAAE,OAAO,KAAK,aAAa,EAAE,CAAC;gBACpC,MAAM,IAAI,sBAAa,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;YAChD,CAAC;iBAAM,IAAI,GAAG,EAAE,CAAC;gBACf,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAEnC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5E,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAEtC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,CAAC,IAAS,EAAE,OAAY;QAC5C,MAAM,aAAa,GAAa,IAAI,CAAC,SAAS,CAAC,GAAG,CAAW,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC;QAClG,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,IAAI,eAAe,CAAC;YACrE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;CACF,CAAA;AAjEY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,qBAAY,CAAC,CAAA;IAEpB,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,0BAAiB,CAAC,CAAA;qCARJ,uBAAU;QACb,gBAAS;QACJ,4BAAY;GAJ3B,YAAY,CAiExB"}
+{"version":3,"file":"jwt.auth.guard.js","sourceRoot":"","sources":["../../../src/common/guards/jwt.auth.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA+F;AAC/F,uCAAyC;AACzC,+CAA6C;AAC7C,2CAAwC;AACxC,2EAAuE;AACvE,sCAA4G;AAC5G,mDAAgG;AAGzF,IAAM,YAAY,GAAlB,MAAM,YAAa,SAAQ,IAAA,oBAAS,EAAC,KAAK,CAAC;IAChD,YACmB,GAAe,EACxB,SAAoB,EACX,KAAmB,EAGnB,WAAkC,EAGlC,eAA0C;QAE3D,KAAK,EAAE,CAAC;QAVS,QAAG,GAAH,GAAG,CAAY;QACxB,cAAS,GAAT,SAAS,CAAW;QACX,UAAK,GAAL,KAAK,CAAc;QAGnB,gBAAW,GAAX,WAAW,CAAuB;QAGlC,oBAAe,GAAf,eAAe,CAA2B;IAG7D,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE1D,IAAI,CAAC,mBAAmB;YAAE,OAAO,KAAK,CAAC;QAEvC,MAAM,eAAe,GAAG,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAY,CAAC;QAEtE,IAAI,eAAe,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,eAAe;YACzD,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAEnE,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,aAAa,CAAC,GAAQ,EAAE,IAAS,EAAE,IAAS,EAAE,OAAyB;QACrE,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE5C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAEzD,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,IAAI,EAAE,OAAO,KAAK,aAAa,EAAE,CAAC;gBACpC,MAAM,IAAI,sBAAa,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;YAChD,CAAC;iBAAM,IAAI,GAAG,EAAE,CAAC;gBACf,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC/C,CAAC;QAED,kFAAkF;QAClF,oEAAoE;QACpE,iFAAiF;QACjF,0CAA0C;QAC1C,MAAM,OAAO,GAAY,IAAI,CAAC;QAC9B,IAAA,oCAAoB,EAAC,OAAO,CAAC,CAAC;QAE9B,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAEtC,MAAM,SAAS,GAAG,IAAA,uCAAuB,EAAC;YACxC,OAAO,EAAE,OAAO;YAChB,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;YAC/C,iBAAiB,EAAE,IAAI,CAAC,WAAW,EAAE,aAAa;SACnD,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5E,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAEtC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,CAAC,IAAoB,EAAE,OAAyB;QACpE,qFAAqF;QACrF,+EAA+E;QAC/E,8CAA8C;QAC9C,MAAM,aAAa,GAAa;YAC9B,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAW,OAAO,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;SAC3G,CAAC;QACF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,IAAI,eAAe,CAAC;YACrE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;CACF,CAAA;AAlFY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,qBAAY,CAAC,CAAA;IAEpB,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,0BAAiB,CAAC,CAAA;qCAPJ,uBAAU;QACb,gBAAS;QACJ,4BAAY;GAJ3B,YAAY,CAkFxB"}

package/dist/common/guards/jwt.auth.optional.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.auth.optional.guard.d.ts","sourceRoot":"","sources":["../../../src/common/guards/jwt.auth.optional.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAA+C,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAgB,oBAAoB,EAAE,MAAM,WAAW,CAAC;;AAE/D,qBACa,oBAAqB,SAAQ,yBAAgB;IAEtD,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,SAAS;IAGjB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAJZ,GAAG,EAAE,UAAU,EACxB,SAAS,EAAE,SAAS,EAGX,WAAW,CAAC,EAAE,oBAAoB;IAK/C,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAW9D,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB;IAyBvE,OAAO,CAAC,cAAc;CASvB"}
+{"version":3,"file":"jwt.auth.optional.guard.d.ts","sourceRoot":"","sources":["../../../src/common/guards/jwt.auth.optional.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAA+C,MAAM,gBAAgB,CAAC;AAC/F,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAgB,oBAAoB,EAAE,MAAM,WAAW,CAAC;;AAG/D,qBACa,oBAAqB,SAAQ,yBAAgB;IAEtD,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,SAAS;IAGjB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAJZ,GAAG,EAAE,UAAU,EACxB,SAAS,EAAE,SAAS,EAGX,WAAW,CAAC,EAAE,oBAAoB;IAK/C,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAW9D,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB;IAsCvE,OAAO,CAAC,cAAc;CAYvB"}

package/dist/common/guards/jwt.auth.optional.guard.js

@@ -18,6 +18,7 @@ const core_1 = require("@nestjs/core");
 const passport_1 = require("@nestjs/passport");
 const nestjs_cls_1 = require("nestjs-cls");
 const tokens_1 = require("../tokens");
+const session_token_1 = require("./session.token");
 let OptionalJwtAuthGuard = class OptionalJwtAuthGuard extends (0, passport_1.AuthGuard)("jwt") {
     constructor(cls, reflector, systemRoles) {
         super();
@@ -47,15 +48,29 @@ let OptionalJwtAuthGuard = class OptionalJwtAuthGuard extends (0, passport_1.Aut
             }
             return null;
         }
-        this._validateRoles(user, context);
-        this.cls.set("userId", user.userId);
-        this.cls.set("companyId", user.companyId ?? request.headers["x-companyid"]);
+        // A token that is present and verifies but is not a full session (pending-2FA,
+        // selection, portal) is refused, not downgraded to anonymous.
+        // Asserted on a local copy: narrowing `user` itself would change the return type
+        // away from IAuthGuard's generic `TUser`.
+        const session = user;
+        (0, session_token_1.assertSessionPayload)(session);
+        this._validateRoles(session, context);
+        const companyId = (0, session_token_1.resolveSessionCompanyId)({
+            payload: session,
+            headerCompanyId: request.headers["x-companyid"],
+            administratorRole: this.systemRoles?.Administrator,
+        });
+        this.cls.set("userId", session.userId);
+        this.cls.set("companyId", companyId);
         this.cls.set("language", request.headers["x-language"]);
-        this.cls.set("roles", user.roles);
+        this.cls.set("roles", session.roles);
         return user;
     }
     _validateRoles(user, context) {
-        const requiredRoles = this.reflector.get("roles", context.getHandler()) ?? [];
+        // Handler AND class, copied so pushing the admin role never mutates the metadata.
+        const requiredRoles = [
+            ...(this.reflector.getAllAndOverride("roles", [context.getHandler(), context.getClass()]) ?? []),
+        ];
         if (requiredRoles.length > 0) {
             if (!user)
                 throw new common_1.HttpException("Unauthorised", 401);

package/dist/common/guards/jwt.auth.optional.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.auth.optional.guard.js","sourceRoot":"","sources":["../../../src/common/guards/jwt.auth.optional.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA+F;AAC/F,uCAAyC;AACzC,+CAA6C;AAC7C,2CAAwC;AACxC,sCAA+D;AAGxD,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,IAAA,oBAAS,EAAC,KAAK,CAAC;IACxD,YACmB,GAAe,EACxB,SAAoB,EAGX,WAAkC;QAEnD,KAAK,EAAE,CAAC;QANS,QAAG,GAAH,GAAG,CAAY;QACxB,cAAS,GAAT,SAAS,CAAW;QAGX,gBAAW,GAAX,WAAW,CAAuB;IAGrD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE1D,IAAI,CAAC,mBAAmB,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC,WAAW,CAAC,OAAO,CAAY,CAAC;IAC/C,CAAC;IAED,aAAa,CAAC,GAAQ,EAAE,IAAS,EAAE,IAAS,EAAE,OAAyB;QACrE,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE5C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,IAAI,EAAE,OAAO,KAAK,aAAa,EAAE,CAAC;gBACpC,MAAM,IAAI,sBAAa,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;YAChD,CAAC;iBAAM,IAAI,GAAG,EAAE,CAAC;gBACf,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAEnC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAElC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,CAAC,IAAS,EAAE,OAAY;QAC5C,MAAM,aAAa,GAAa,IAAI,CAAC,SAAS,CAAC,GAAG,CAAW,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC;QAClG,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;YACxD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,IAAI,eAAe,CAAC;YACrE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;CACF,CAAA;AAxDY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,qBAAY,CAAC,CAAA;qCAHC,uBAAU;QACb,gBAAS;GAHnB,oBAAoB,CAwDhC"}
+{"version":3,"file":"jwt.auth.optional.guard.js","sourceRoot":"","sources":["../../../src/common/guards/jwt.auth.optional.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA+F;AAC/F,uCAAyC;AACzC,+CAA6C;AAC7C,2CAAwC;AACxC,sCAA+D;AAC/D,mDAAgG;AAGzF,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,IAAA,oBAAS,EAAC,KAAK,CAAC;IACxD,YACmB,GAAe,EACxB,SAAoB,EAGX,WAAkC;QAEnD,KAAK,EAAE,CAAC;QANS,QAAG,GAAH,GAAG,CAAY;QACxB,cAAS,GAAT,SAAS,CAAW;QAGX,gBAAW,GAAX,WAAW,CAAuB;IAGrD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE1D,IAAI,CAAC,mBAAmB,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC,WAAW,CAAC,OAAO,CAAY,CAAC;IAC/C,CAAC;IAED,aAAa,CAAC,GAAQ,EAAE,IAAS,EAAE,IAAS,EAAE,OAAyB;QACrE,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAE5C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,IAAI,EAAE,OAAO,KAAK,aAAa,EAAE,CAAC;gBACpC,MAAM,IAAI,sBAAa,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;YAChD,CAAC;iBAAM,IAAI,GAAG,EAAE,CAAC;gBACf,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,+EAA+E;QAC/E,8DAA8D;QAC9D,iFAAiF;QACjF,0CAA0C;QAC1C,MAAM,OAAO,GAAY,IAAI,CAAC;QAC9B,IAAA,oCAAoB,EAAC,OAAO,CAAC,CAAC;QAE9B,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAEtC,MAAM,SAAS,GAAG,IAAA,uCAAuB,EAAC;YACxC,OAAO,EAAE,OAAO;YAChB,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;YAC/C,iBAAiB,EAAE,IAAI,CAAC,WAAW,EAAE,aAAa;SACnD,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAErC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,CAAC,IAAoB,EAAE,OAAyB;QACpE,kFAAkF;QAClF,MAAM,aAAa,GAAa;YAC9B,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAW,OAAO,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;SAC3G,CAAC;QACF,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;YACxD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,IAAI,eAAe,CAAC;YACrE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;CACF,CAAA;AAxEY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,qBAAY,CAAC,CAAA;qCAHC,uBAAU;QACb,gBAAS;GAHnB,oBAAoB,CAwEhC"}

package/dist/common/guards/session.token.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Every token the library issues is signed with the same `jwt.secret`, so a valid
+ * signature alone does not make a session. `JwtStrategy` accepts all of them:
+ *
+ * - full session (`SecurityService.signJwt`): `{ userId, roles, companyId?, features, userName, expiration }`
+ * - pending 2FA (`signPendingJwt`): `{ userId, pendingId, pending: true, type: "pending_2fa", expiration }`
+ * - company selection (`signCompanySelectionJwt`): `{ userId, scope: "company-selection", expiration }`
+ * - invitation selection (`signInvitationSelectionJwt`): `{ userId, scope: "invitation-selection", expiration }`
+ *
+ * Apps may also sign portal tokens (`personEmail`) with the same secret. The helpers
+ * below tell these classes apart, so each guard admits only the class it is meant for.
+ */
+export interface SessionPayload {
+    userId: string;
+    roles: string[];
+    companyId?: string | null;
+    features?: string[];
+    userName?: string;
+    expiration?: string | Date;
+}
+/** The selection scopes the library signs. */
+export type TokenScope = "company-selection" | "invitation-selection";
+/**
+ * True only for a full session payload: a non-empty string `userId`, a `roles` array
+ * of strings, a string-or-absent `companyId`, and none of the non-session markers.
+ */
+export declare function isSessionPayload(payload: unknown): payload is SessionPayload;
+/** Throws 401 unless `payload` is a full session payload. */
+export declare function assertSessionPayload(payload: unknown): asserts payload is SessionPayload;
+/**
+ * True for a full session, or for a selection token whose `scope` is in
+ * `allowedScopes`. A pending-2FA token, a portal token and a selection token of
+ * another scope are refused: a pending-2FA token must never reach a route that can
+ * mint a full session.
+ */
+export declare function isAcceptedScopedPayload(payload: unknown, allowedScopes: readonly string[]): boolean;
+/**
+ * The company a session acts in.
+ *
+ * - The token carries a company: that company, whatever the `x-companyid` header says.
+ * - The token carries no company: only a system Administrator may pick one through the
+ *   header (or act without one). Any other user is refused with 401, because a request
+ *   without a company runs with no tenant filter.
+ */
+export declare function resolveSessionCompanyId(params: {
+    payload: SessionPayload;
+    headerCompanyId: unknown;
+    administratorRole?: string;
+}): string | undefined;
+//# sourceMappingURL=session.token.d.ts.map

package/dist/common/guards/session.token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.token.d.ts","sourceRoot":"","sources":["../../../src/common/guards/session.token.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,8CAA8C;AAC9C,MAAM,MAAM,UAAU,GAAG,mBAAmB,GAAG,sBAAsB,CAAC;AAQtE;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,IAAI,cAAc,CAW5E;AAED,6DAA6D;AAC7D,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,cAAc,CAExF;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CASnG;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,OAAO,EAAE,cAAc,CAAC;IACxB,eAAe,EAAE,OAAO,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,GAAG,MAAM,GAAG,SAAS,CASrB"}

package/dist/common/guards/session.token.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSessionPayload = isSessionPayload;
+exports.assertSessionPayload = assertSessionPayload;
+exports.isAcceptedScopedPayload = isAcceptedScopedPayload;
+exports.resolveSessionCompanyId = resolveSessionCompanyId;
+const common_1 = require("@nestjs/common");
+const system_roles_1 = require("../constants/system.roles");
+/** Keys that only non-session tokens carry. */
+const NON_SESSION_KEYS = ["personEmail", "pending", "pendingId", "scope", "type"];
+/** Keys a selection token must never carry (it carries `scope`, nothing else of these). */
+const NON_SELECTION_KEYS = ["personEmail", "pending", "pendingId", "type"];
+/**
+ * True only for a full session payload: a non-empty string `userId`, a `roles` array
+ * of strings, a string-or-absent `companyId`, and none of the non-session markers.
+ */
+function isSessionPayload(payload) {
+    if (!payload || typeof payload !== "object")
+        return false;
+    const candidate = payload;
+    if (typeof candidate.userId !== "string" || candidate.userId.length === 0)
+        return false;
+    if (!Array.isArray(candidate.roles) || !candidate.roles.every((role) => typeof role === "string"))
+        return false;
+    if (NON_SESSION_KEYS.some((key) => candidate[key] !== undefined))
+        return false;
+    if (candidate.companyId !== undefined && candidate.companyId !== null && typeof candidate.companyId !== "string")
+        return false;
+    return true;
+}
+/** Throws 401 unless `payload` is a full session payload. */
+function assertSessionPayload(payload) {
+    if (!isSessionPayload(payload))
+        throw new common_1.HttpException("Unauthorised", 401);
+}
+/**
+ * True for a full session, or for a selection token whose `scope` is in
+ * `allowedScopes`. A pending-2FA token, a portal token and a selection token of
+ * another scope are refused: a pending-2FA token must never reach a route that can
+ * mint a full session.
+ */
+function isAcceptedScopedPayload(payload, allowedScopes) {
+    if (isSessionPayload(payload))
+        return true;
+    if (!payload || typeof payload !== "object")
+        return false;
+    const candidate = payload;
+    if (typeof candidate.userId !== "string" || candidate.userId.length === 0)
+        return false;
+    if (NON_SELECTION_KEYS.some((key) => candidate[key] !== undefined))
+        return false;
+    return typeof candidate.scope === "string" && allowedScopes.includes(candidate.scope);
+}
+/**
+ * The company a session acts in.
+ *
+ * - The token carries a company: that company, whatever the `x-companyid` header says.
+ * - The token carries no company: only a system Administrator may pick one through the
+ *   header (or act without one). Any other user is refused with 401, because a request
+ *   without a company runs with no tenant filter.
+ */
+function resolveSessionCompanyId(params) {
+    const { payload, headerCompanyId } = params;
+    if (typeof payload.companyId === "string" && payload.companyId.length > 0)
+        return payload.companyId;
+    const administratorRole = params.administratorRole ?? system_roles_1.SystemRoles.Administrator;
+    if (!payload.roles.includes(administratorRole))
+        throw new common_1.HttpException("Unauthorised", 401);
+    return typeof headerCompanyId === "string" && headerCompanyId.length > 0 ? headerCompanyId : undefined;
+}
+//# sourceMappingURL=session.token.js.map

package/dist/common/guards/session.token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.token.js","sourceRoot":"","sources":["../../../src/common/guards/session.token.ts"],"names":[],"mappings":";;AAqCA,4CAWC;AAGD,oDAEC;AAQD,0DASC;AAUD,0DAaC;AA7FD,2CAA+C;AAC/C,4DAAwD;AA0BxD,+CAA+C;AAC/C,MAAM,gBAAgB,GAAG,CAAC,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AAE3F,2FAA2F;AAC3F,MAAM,kBAAkB,GAAG,CAAC,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,CAAU,CAAC;AAEpF;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,OAAgB;IAC/C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE1D,MAAM,SAAS,GAAG,OAAkC,CAAC;IACrD,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAChH,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/E,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ;QAC9G,OAAO,KAAK,CAAC;IAEf,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6DAA6D;AAC7D,SAAgB,oBAAoB,CAAC,OAAgB;IACnD,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;GAKG;AACH,SAAgB,uBAAuB,CAAC,OAAgB,EAAE,aAAgC;IACxF,IAAI,gBAAgB,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE1D,MAAM,SAAS,GAAG,OAAkC,CAAC;IACrD,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxF,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAEjF,OAAO,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,uBAAuB,CAAC,MAIvC;IACC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IAE5C,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,SAAS,CAAC;IAEpG,MAAM,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,IAAI,0BAAW,CAAC,aAAa,CAAC;IAChF,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAAE,MAAM,IAAI,sBAAa,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IAE7F,OAAO,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;AACzG,CAAC"}

package/dist/common/helpers/define-entity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"define-entity.d.ts","sourceRoot":"","sources":["../../../src/common/helpers/define-entity.ts"],"names":[],"mappings":"AASA,OAAO,EAEL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EAEjB,eAAe,EAEhB,MAAM,uCAAuC,CAAC;AAE/C,2IAA2I;AAC3I,eAAO,MAAM,iBAAiB,IAAI,CAAC;AAqEnC;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,GAAG,GAAG,CAoBnE;AA+BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,wBAAgB,YAAY,CAAC,CAAC,MACX,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,QAAQ,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,KAAG,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,CAgSrH;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,EAC5E,cAAc,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,EACtC,SAAS,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACjF,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,CAYxB"}
+{"version":3,"file":"define-entity.d.ts","sourceRoot":"","sources":["../../../src/common/helpers/define-entity.ts"],"names":[],"mappings":"AASA,OAAO,EAEL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EAEjB,eAAe,EAEhB,MAAM,uCAAuC,CAAC;AAE/C,2IAA2I;AAC3I,eAAO,MAAM,iBAAiB,IAAI,CAAC;AAqEnC;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,GAAG,GAAG,CAoBnE;AA+BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,wBAAgB,YAAY,CAAC,CAAC,MACX,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,EAAE,QAAQ,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,KAAG,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,CAoSrH;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,EAC5E,cAAc,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,EACtC,SAAS,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACjF,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,CAYxB"}

package/dist/common/helpers/define-entity.js

@@ -191,7 +191,7 @@ function createSerialiserForDescriptor(descriptor, labelName) {
  */
 function defineEntity() {
     return function (schema) {
-        const { type, endpoint, nodeName, labelName, fields, relationships, computed = {}, virtualFields = {}, serialiser: customSerialiser, injectServices = [], isCompanyScoped = true, description, chat, bridge, tenancy, linkScope, } = schema;
+        const { type, endpoint, nodeName, labelName, fields, relationships, computed = {}, virtualFields = {}, serialiser: customSerialiser, injectServices = [], isCompanyScoped = true, description, chat, bridge, tenancy, linkScope, isProjection = false, } = schema;
         if (isCompanyScoped && tenancy) {
             throw new Error(`defineEntity(${type}): "tenancy" is only valid with isCompanyScoped: false.`);
         }
@@ -412,7 +412,10 @@ function defineEntity() {
         descriptor.model = model;
         // Label → tenancy, read by the generic relationship writers to decide what a
         // client-supplied target id of this label must satisfy (see entity-tenancy.registry.ts).
-        entity_tenancy_registry_1.entityTenancyRegistry.register({ labelName, isCompanyScoped, tenancy, linkScope, via: viaHop });
+        // A projection is another view of a label owned by a different descriptor: it never sets the rule.
+        if (!isProjection) {
+            entity_tenancy_registry_1.entityTenancyRegistry.register({ labelName, type, isCompanyScoped, tenancy, linkScope, via: viaHop });
+        }
         return descriptor;
     };
 }