@carlonicora/nestjs-neo4jsonapi 6.6.1 → 6.7.0

package/dist/foundations/rbac/rbac.tokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"rbac.tokens.js","sourceRoot":"","sources":["../../../src/foundations/rbac/rbac.tokens.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;GAQG;AACU,QAAA,iBAAiB,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC"}
+{"version":3,"file":"rbac.tokens.js","sourceRoot":"","sources":["../../../src/foundations/rbac/rbac.tokens.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;GAQG;AACU,QAAA,iBAAiB,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC;AAE7D;;;;;;GAMG;AACU,QAAA,mBAAmB,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC"}

package/dist/foundations/rbac/repositories/rbac-permission.repository.d.ts

@@ -1,5 +1,11 @@
 import { Neo4jService } from "../../../core/neo4j/services/neo4j.service";
 import type { RbacAction } from "../services/rbac-permission.service";
+/**
+ * Effective permission values per module id. A value is `true`, `false` or a
+ * record path (a non-empty string such as `"id"`), exactly as resolved by
+ * `modulePermissionResolutionQuery`.
+ */
+export type EffectivePermissions = Map<string, Record<RbacAction, boolean | string>>;
 /**
  * Resolves the effective per-module permission flags for a user. Mirrors the
  * permission model used by the rest of the app (see AuthRepository and
@@ -9,7 +15,7 @@ import type { RbacAction } from "../services/rbac-permission.service";
  * `permissions` JSON with any role-level `HAS_PERMISSIONS` overrides.
  *
  * Used by RbacPermissionService to answer `can(userId, moduleId, action)`
- * for the MCP layer.
+ * for the MCP layer, and by ModulePermissionService for the request gate.
  */
 export declare class RbacPermissionRepository {
     private readonly neo4j;
@@ -27,5 +33,27 @@ export declare class RbacPermissionRepository {
      * types (`read`, `create`, `update`, `delete`).
      */
     findEffectivePermissionsForUser(userId: string): Promise<Map<string, Record<RbacAction, boolean>>>;
+    /**
+     * Effective permissions of a user in ONE company: the module defaults plus
+     * the grants of the roles on the user's membership in that company and on
+     * the user's platform memberships (no `IN_COMPANY`). Never follows the
+     * legacy `(User)-[:BELONGS_TO]->(Company)` edge.
+     *
+     * With no `companyId` (a platform session) it resolves through the
+     * platform membership only (`adminModuleQuery`).
+     *
+     * Record-path values are kept as strings: the request gate allows them at
+     * the section level and leaves the record decision to the app.
+     *
+     * Intentional exception to "use buildDefaultMatch": this is the library's
+     * own permission resolution (the same `company` binding UserModulesRepository
+     * uses), not an entity read.
+     */
+    findEffectivePermissions(params: {
+        userId: string;
+        companyId: string | undefined;
+    }): Promise<EffectivePermissions>;
+    /** The subset of `ids` that exist as `(:Module)` nodes. */
+    findExistingModuleIds(ids: string[]): Promise<Set<string>>;
 }
 //# sourceMappingURL=rbac-permission.repository.d.ts.map

package/dist/foundations/rbac/repositories/rbac-permission.repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rbac-permission.repository.d.ts","sourceRoot":"","sources":["../../../../src/foundations/rbac/repositories/rbac-permission.repository.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,4CAA4C,CAAC;AAE1E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAOtE;;;;;;;;;;GAUG;AACH,qBACa,wBAAwB;IAGvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAFlC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6C;gBAEvC,KAAK,EAAE,YAAY;IAEhD;;;;;;;;;;OAUG;IACG,+BAA+B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;CA+BzG"}
+{"version":3,"file":"rbac-permission.repository.d.ts","sourceRoot":"","sources":["../../../../src/foundations/rbac/repositories/rbac-permission.repository.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,4CAA4C,CAAC;AAI1E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAOtE;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC;AAErF;;;;;;;;;;GAUG;AACH,qBACa,wBAAwB;IAGvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAFlC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6C;gBAEvC,KAAK,EAAE,YAAY;IAEhD;;;;;;;;;;OAUG;IACG,+BAA+B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAgCxG;;;;;;;;;;;;;;;OAeG;IACG,wBAAwB,CAAC,MAAM,EAAE;QACrC,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;KAC/B,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAyCjC,2DAA2D;IACrD,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;CAcjE"}

package/dist/foundations/rbac/repositories/rbac-permission.repository.js

@@ -13,6 +13,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.RbacPermissionRepository = void 0;
 const common_1 = require("@nestjs/common");
 const neo4j_service_1 = require("../../../core/neo4j/services/neo4j.service");
+const module_model_1 = require("../../module/entities/module.model");
 const feature_module_query_1 = require("../../module/queries/feature.module.query");
 /**
  * Resolves the effective per-module permission flags for a user. Mirrors the
@@ -23,7 +24,7 @@ const feature_module_query_1 = require("../../module/queries/feature.module.quer
  * `permissions` JSON with any role-level `HAS_PERMISSIONS` overrides.
  *
  * Used by RbacPermissionService to answer `can(userId, moduleId, action)`
- * for the MCP layer.
+ * for the MCP layer, and by ModulePermissionService for the request gate.
  */
 let RbacPermissionRepository = RbacPermissionRepository_1 = class RbacPermissionRepository {
     constructor(neo4j) {
@@ -71,6 +72,77 @@ let RbacPermissionRepository = RbacPermissionRepository_1 = class RbacPermission
         }
         return map;
     }
+    /**
+     * Effective permissions of a user in ONE company: the module defaults plus
+     * the grants of the roles on the user's membership in that company and on
+     * the user's platform memberships (no `IN_COMPANY`). Never follows the
+     * legacy `(User)-[:BELONGS_TO]->(Company)` edge.
+     *
+     * With no `companyId` (a platform session) it resolves through the
+     * platform membership only (`adminModuleQuery`).
+     *
+     * Record-path values are kept as strings: the request gate allows them at
+     * the section level and leaves the record decision to the app.
+     *
+     * Intentional exception to "use buildDefaultMatch": this is the library's
+     * own permission resolution (the same `company` binding UserModulesRepository
+     * uses), not an entity read.
+     */
+    async findEffectivePermissions(params) {
+        const result = params.companyId
+            ? await this.neo4j.read(`
+          MATCH (user:User {id: $userId})
+          MATCH (company:Company {id: $companyId})
+          ${feature_module_query_1.featureModuleQuery}
+          `, { userId: params.userId, companyId: params.companyId })
+            : await this.neo4j.read(feature_module_query_1.adminModuleQuery, { searchValue: params.userId });
+        const map = new Map();
+        for (const record of result.records) {
+            const moduleNode = record.get("module");
+            const props = moduleNode?.properties;
+            if (!props)
+                continue;
+            const id = props.id;
+            const permsJson = props.permissions;
+            if (typeof id !== "string" || !id.length || typeof permsJson !== "string")
+                continue;
+            try {
+                const perms = JSON.parse(permsJson);
+                const value = (type) => {
+                    const raw = perms.find((p) => p.type === type)?.value;
+                    if (raw === true)
+                        return true;
+                    if (typeof raw === "string" && raw.length > 0)
+                        return raw;
+                    return false;
+                };
+                map.set(id, {
+                    read: value("read"),
+                    create: value("create"),
+                    update: value("update"),
+                    delete: value("delete"),
+                });
+            }
+            catch {
+                this.logger.warn(`findEffectivePermissions: malformed permissions JSON on module ${id}`);
+            }
+        }
+        return map;
+    }
+    /** The subset of `ids` that exist as `(:Module)` nodes. */
+    async findExistingModuleIds(ids) {
+        if (ids.length === 0)
+            return new Set();
+        const query = this.neo4j.initQuery({ serialiser: module_model_1.ModuleModel });
+        query.queryParams = { ...query.queryParams, ids };
+        query.query += `
+      MATCH (module:Module)
+      WHERE module.id IN $ids
+      RETURN module
+    `;
+        const modules = await this.neo4j.readMany(query);
+        return new Set(modules.map((module) => module.id));
+    }
 };
 exports.RbacPermissionRepository = RbacPermissionRepository;
 exports.RbacPermissionRepository = RbacPermissionRepository = RbacPermissionRepository_1 = __decorate([

package/dist/foundations/rbac/repositories/rbac-permission.repository.js.map

@@ -1 +1 @@
-{"version":3,"file":"rbac-permission.repository.js","sourceRoot":"","sources":["../../../../src/foundations/rbac/repositories/rbac-permission.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAoD;AACpD,8EAA0E;AAC1E,oFAA+E;AAQ/E;;;;;;;;;;GAUG;AAEI,IAAM,wBAAwB,gCAA9B,MAAM,wBAAwB;IAGnC,YAA6B,KAAmB;QAAnB,UAAK,GAAL,KAAK,CAAc;QAF/B,WAAM,GAAG,IAAI,eAAM,CAAC,0BAAwB,CAAC,IAAI,CAAC,CAAC;IAEjB,CAAC;IAEpD;;;;;;;;;;OAUG;IACH,KAAK,CAAC,+BAA+B,CAAC,MAAc;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAClC;;QAEE,yCAAkB;OACnB,EACD,EAAE,MAAM,EAAE,CACX,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuC,CAAC;QAC3D,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,UAAU,GAAQ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,UAAU,EAAE,UAAU,CAAC;YACrC,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;YACpB,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC;YACpC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,MAAM,IAAI,OAAO,SAAS,KAAK,QAAQ;gBAAE,SAAS;YACpF,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAsB,CAAC;gBACzD,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE;oBACV,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,KAAK,KAAK,IAAI;oBAC1D,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,KAAK,KAAK,IAAI;oBAC9D,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,KAAK,KAAK,IAAI;oBAC9D,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,KAAK,KAAK,IAAI;iBAC/D,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yEAAyE,EAAE,EAAE,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF,CAAA;AA/CY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;qCAIyB,4BAAY;GAHrC,wBAAwB,CA+CpC"}
+{"version":3,"file":"rbac-permission.repository.js","sourceRoot":"","sources":["../../../../src/foundations/rbac/repositories/rbac-permission.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAoD;AACpD,8EAA0E;AAE1E,qEAAiE;AACjE,oFAAiG;AAejG;;;;;;;;;;GAUG;AAEI,IAAM,wBAAwB,gCAA9B,MAAM,wBAAwB;IAGnC,YAA6B,KAAmB;QAAnB,UAAK,GAAL,KAAK,CAAc;QAF/B,WAAM,GAAG,IAAI,eAAM,CAAC,0BAAwB,CAAC,IAAI,CAAC,CAAC;IAEjB,CAAC;IAEpD;;;;;;;;;;OAUG;IACH,KAAK,CAAC,+BAA+B,CAAC,MAAc;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAClC;;QAEE,yCAAkB;OACnB,EACD,EAAE,MAAM,EAAE,CACX,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuC,CAAC;QAC3D,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,UAAU,GAAQ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,UAAU,EAAE,UAAU,CAAC;YACrC,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;YACpB,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC;YACpC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,MAAM,IAAI,OAAO,SAAS,KAAK,QAAQ;gBAAE,SAAS;YACpF,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAsB,CAAC;gBACzD,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE;oBACV,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,KAAK,KAAK,IAAI;oBAC1D,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,KAAK,KAAK,IAAI;oBAC9D,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,KAAK,KAAK,IAAI;oBAC9D,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,KAAK,KAAK,IAAI;iBAC/D,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yEAAyE,EAAE,EAAE,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,wBAAwB,CAAC,MAG9B;QACC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS;YAC7B,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CACnB;;;YAGE,yCAAkB;WACnB,EACD,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CACvD;YACH,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,uCAAgB,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAE5E,MAAM,GAAG,GAAyB,IAAI,GAAG,EAAE,CAAC;QAC5C,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,UAAU,GAAQ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,UAAU,EAAE,UAAU,CAAC;YACrC,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;YACpB,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC;YACpC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,MAAM,IAAI,OAAO,SAAS,KAAK,QAAQ;gBAAE,SAAS;YACpF,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAsB,CAAC;gBACzD,MAAM,KAAK,GAAG,CAAC,IAAgB,EAAoB,EAAE;oBACnD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,KAAK,CAAC;oBACtD,IAAI,GAAG,KAAK,IAAI;wBAAE,OAAO,IAAI,CAAC;oBAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;wBAAE,OAAO,GAAG,CAAC;oBAC1D,OAAO,KAAK,CAAC;gBACf,CAAC,CAAC;gBACF,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE;oBACV,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;oBACnB,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC;oBACvB,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC;oBACvB,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC;iBACxB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kEAAkE,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,2DAA2D;IAC3D,KAAK,CAAC,qBAAqB,CAAC,GAAa;QACvC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QAEvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,0BAAW,EAAE,CAAC,CAAC;QAChE,KAAK,CAAC,WAAW,GAAG,EAAE,GAAG,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC;QAClD,KAAK,CAAC,KAAK,IAAI;;;;KAId,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAS,KAAK,CAAC,CAAC;QACzD,OAAO,IAAI,GAAG,CAAS,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7D,CAAC;CACF,CAAA;AA3HY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;qCAIyB,4BAAY;GAHrC,wBAAwB,CA2HpC"}

package/dist/foundations/rbac/services/module-permission-audit.service.d.ts

@@ -0,0 +1,34 @@
+import { OnApplicationBootstrap } from "@nestjs/common";
+import { DiscoveryService, MetadataScanner, Reflector } from "@nestjs/core";
+import { RbacPermissionRepository } from "../repositories/rbac-permission.repository";
+interface AuditedRoute {
+    label: string;
+    module: string | undefined;
+    isWrite: boolean;
+}
+/**
+ * Boot audit for the permission gate. Runs only when the app bootstraps with
+ * `permissions: { enforce: true }` (API and worker).
+ *
+ * Refuses to start when:
+ * - a route guarded by a session guard is a write (POST/PUT/PATCH/DELETE, or a
+ *   `@ModuleACL` action that is a write) and has no section;
+ * - a section id referenced by any session-guarded route has no `(:Module)` node.
+ *
+ * This is what makes the gate fail closed for writes at startup instead of at
+ * request time.
+ */
+export declare class ModulePermissionAuditService implements OnApplicationBootstrap {
+    private readonly discovery;
+    private readonly metadataScanner;
+    private readonly reflector;
+    private readonly repository;
+    private readonly enforce?;
+    constructor(discovery: DiscoveryService, metadataScanner: MetadataScanner, reflector: Reflector, repository: RbacPermissionRepository, enforce?: boolean);
+    onApplicationBootstrap(): Promise<void>;
+    /** Every session-guarded route with its resolved section. Exposed for tests. */
+    collectRoutes(): AuditedRoute[];
+    audit(): Promise<void>;
+}
+export {};
+//# sourceMappingURL=module-permission-audit.service.d.ts.map

package/dist/foundations/rbac/services/module-permission-audit.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-permission-audit.service.d.ts","sourceRoot":"","sources":["../../../../src/foundations/rbac/services/module-permission-audit.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,sBAAsB,EAA2B,MAAM,gBAAgB,CAAC;AAErG,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAM5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AAatF,UAAU,YAAY;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,OAAO,EAAE,OAAO,CAAC;CAClB;AAcD;;;;;;;;;;;GAWG;AACH,qBACa,4BAA6B,YAAW,sBAAsB;IAEvE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAG3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;gBANR,SAAS,EAAE,gBAAgB,EAC3B,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,SAAS,EACpB,UAAU,EAAE,wBAAwB,EAGpC,OAAO,CAAC,EAAE,OAAO;IAG9B,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAK7C,gFAAgF;IAChF,aAAa,IAAI,YAAY,EAAE;IAyCzB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CA0B7B"}

package/dist/foundations/rbac/services/module-permission-audit.service.js

@@ -0,0 +1,137 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ModulePermissionAuditService = void 0;
+const common_1 = require("@nestjs/common");
+const constants_1 = require("@nestjs/common/constants");
+const core_1 = require("@nestjs/core");
+const module_decorator_1 = require("../../../common/decorators/module.decorator");
+const jwt_auth_admin_guard_1 = require("../../../common/guards/jwt.auth.admin.guard");
+const jwt_auth_guard_1 = require("../../../common/guards/jwt.auth.guard");
+const jwt_auth_optional_guard_1 = require("../../../common/guards/jwt.auth.optional.guard");
+const rbac_permission_repository_1 = require("../repositories/rbac-permission.repository");
+const rbac_tokens_1 = require("../rbac.tokens");
+const module_permission_gate_1 = require("./module-permission.gate");
+/** The guards that run `ModulePermissionGate`. Subclasses count too. */
+const SESSION_GUARDS = [
+    jwt_auth_guard_1.JwtAuthGuard,
+    jwt_auth_admin_guard_1.AdminJwtAuthGuard,
+    jwt_auth_optional_guard_1.OptionalJwtAuthGuard,
+];
+const WRITE_ACTIONS = new Set(["create", "update", "delete"]);
+function isSessionGuard(guard) {
+    const type = typeof guard === "function" ? guard : guard?.constructor;
+    if (typeof type !== "function")
+        return false;
+    return SESSION_GUARDS.some((g) => type === g || type.prototype instanceof g);
+}
+function joinPaths(prefix, path) {
+    const first = (value) => (Array.isArray(value) ? String(value[0] ?? "") : String(value ?? ""));
+    const parts = [first(prefix), first(path)].map((p) => p.replace(/^\/+|\/+$/g, "")).filter((p) => p.length);
+    return `/${parts.join("/")}`;
+}
+/**
+ * Boot audit for the permission gate. Runs only when the app bootstraps with
+ * `permissions: { enforce: true }` (API and worker).
+ *
+ * Refuses to start when:
+ * - a route guarded by a session guard is a write (POST/PUT/PATCH/DELETE, or a
+ *   `@ModuleACL` action that is a write) and has no section;
+ * - a section id referenced by any session-guarded route has no `(:Module)` node.
+ *
+ * This is what makes the gate fail closed for writes at startup instead of at
+ * request time.
+ */
+let ModulePermissionAuditService = class ModulePermissionAuditService {
+    constructor(discovery, metadataScanner, reflector, repository, enforce) {
+        this.discovery = discovery;
+        this.metadataScanner = metadataScanner;
+        this.reflector = reflector;
+        this.repository = repository;
+        this.enforce = enforce;
+    }
+    async onApplicationBootstrap() {
+        if (this.enforce !== true)
+            return;
+        await this.audit();
+    }
+    /** Every session-guarded route with its resolved section. Exposed for tests. */
+    collectRoutes() {
+        const routes = [];
+        for (const wrapper of this.discovery.getControllers()) {
+            const controller = wrapper.metatype;
+            if (typeof controller !== "function" || !controller.prototype)
+                continue;
+            const prototype = controller.prototype;
+            const classGuards = this.reflector.get(constants_1.GUARDS_METADATA, controller) ?? [];
+            const classDefinition = this.reflector.get(module_decorator_1.MODULE_ACL_METADATA, controller);
+            const controllerPath = this.reflector.get(constants_1.PATH_METADATA, controller);
+            for (const methodName of this.metadataScanner.getAllMethodNames(prototype)) {
+                const handler = prototype[methodName];
+                if (typeof handler !== "function")
+                    continue;
+                const requestMethod = this.reflector.get(constants_1.METHOD_METADATA, handler);
+                const routePath = this.reflector.get(constants_1.PATH_METADATA, handler);
+                if (requestMethod === undefined || routePath === undefined)
+                    continue;
+                const handlerGuards = this.reflector.get(constants_1.GUARDS_METADATA, handler) ?? [];
+                if (![...classGuards, ...handlerGuards].some(isSessionGuard))
+                    continue;
+                const method = common_1.RequestMethod[requestMethod] ?? String(requestMethod);
+                const { module, action } = (0, module_permission_gate_1.resolveRouteAcl)({
+                    classDefinition,
+                    handlerDefinition: this.reflector.get(module_decorator_1.MODULE_ACL_METADATA, handler),
+                    method,
+                });
+                routes.push({
+                    label: `${method} ${joinPaths(controllerPath, routePath)} (${controller.name}.${methodName})`,
+                    module,
+                    isWrite: WRITE_ACTIONS.has(action),
+                });
+            }
+        }
+        return routes;
+    }
+    async audit() {
+        const routes = this.collectRoutes();
+        const unsectioned = routes.filter((r) => r.isWrite && !r.module).map((r) => r.label);
+        if (unsectioned.length > 0) {
+            throw new Error(`Permission audit failed: ${unsectioned.length} session-guarded write route(s) have no @ModuleACL section:\n` +
+                unsectioned.map((label) => `  - ${label}`).join("\n"));
+        }
+        const referenced = Array.from(new Set(routes.map((r) => r.module).filter((m) => !!m))).sort();
+        const existing = await this.repository.findExistingModuleIds(referenced);
+        const missing = referenced.filter((id) => !existing.has(id));
+        if (missing.length > 0) {
+            const byModule = missing.map((id) => {
+                const example = routes.find((r) => r.module === id)?.label ?? "";
+                return `  - ${id} (e.g. ${example})`;
+            });
+            throw new Error(`Permission audit failed: ${missing.length} section id(s) referenced by @ModuleACL have no (:Module) node. ` +
+                `Seed them in a migration before switching permissions.enforce on:\n` +
+                byModule.join("\n"));
+        }
+    }
+};
+exports.ModulePermissionAuditService = ModulePermissionAuditService;
+exports.ModulePermissionAuditService = ModulePermissionAuditService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(4, (0, common_1.Optional)()),
+    __param(4, (0, common_1.Inject)(rbac_tokens_1.PERMISSIONS_ENFORCE)),
+    __metadata("design:paramtypes", [core_1.DiscoveryService,
+        core_1.MetadataScanner,
+        core_1.Reflector,
+        rbac_permission_repository_1.RbacPermissionRepository, Boolean])
+], ModulePermissionAuditService);
+//# sourceMappingURL=module-permission-audit.service.js.map

package/dist/foundations/rbac/services/module-permission-audit.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-permission-audit.service.js","sourceRoot":"","sources":["../../../../src/foundations/rbac/services/module-permission-audit.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAqG;AACrG,wDAA2F;AAC3F,uCAA4E;AAC5E,kFAAkF;AAElF,sFAAgF;AAChF,0EAAqE;AACrE,4FAAsF;AACtF,2FAAsF;AACtF,gDAAqD;AACrD,qEAA2D;AAE3D,wEAAwE;AACxE,MAAM,cAAc,GAAoD;IACtE,6BAAY;IACZ,wCAAiB;IACjB,8CAAoB;CACrB,CAAC;AAEF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAQ9D,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,IAAI,GAAQ,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,KAAa,EAAE,WAAW,CAAC;IACpF,IAAI,OAAO,IAAI,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,SAAS,CAAC,MAAe,EAAE,IAAa;IAC/C,MAAM,KAAK,GAAG,CAAC,KAAc,EAAU,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IAChH,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3G,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;GAWG;AAEI,IAAM,4BAA4B,GAAlC,MAAM,4BAA4B;IACvC,YACmB,SAA2B,EAC3B,eAAgC,EAChC,SAAoB,EACpB,UAAoC,EAGpC,OAAiB;QANjB,cAAS,GAAT,SAAS,CAAkB;QAC3B,oBAAe,GAAf,eAAe,CAAiB;QAChC,cAAS,GAAT,SAAS,CAAW;QACpB,eAAU,GAAV,UAAU,CAA0B;QAGpC,YAAO,GAAP,OAAO,CAAU;IACjC,CAAC;IAEJ,KAAK,CAAC,sBAAsB;QAC1B,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;YAAE,OAAO;QAClC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,gFAAgF;IAChF,aAAa;QACX,MAAM,MAAM,GAAmB,EAAE,CAAC;QAElC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,CAAC;YACtD,MAAM,UAAU,GAAG,OAAO,CAAC,QAAe,CAAC;YAC3C,IAAI,OAAO,UAAU,KAAK,UAAU,IAAI,CAAC,UAAU,CAAC,SAAS;gBAAE,SAAS;YAExE,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;YACvC,MAAM,WAAW,GAAc,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,2BAAe,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;YACrF,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAmB,sCAAmB,EAAE,UAAU,CAAC,CAAC;YAC9F,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,yBAAa,EAAE,UAAU,CAAC,CAAC;YAErE,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3E,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;gBACtC,IAAI,OAAO,OAAO,KAAK,UAAU;oBAAE,SAAS;gBAE5C,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAgB,2BAAe,EAAE,OAAO,CAAC,CAAC;gBAClF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,yBAAa,EAAE,OAAO,CAAC,CAAC;gBAC7D,IAAI,aAAa,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;oBAAE,SAAS;gBAErE,MAAM,aAAa,GAAc,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,2BAAe,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;gBACpF,IAAI,CAAC,CAAC,GAAG,WAAW,EAAE,GAAG,aAAa,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;oBAAE,SAAS;gBAEvE,MAAM,MAAM,GAAG,sBAAa,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC;gBACrE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,wCAAe,EAAC;oBACzC,eAAe;oBACf,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAmB,sCAAmB,EAAE,OAAO,CAAC;oBACrF,MAAM;iBACP,CAAC,CAAC;gBAEH,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,GAAG,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,SAAS,CAAC,KAAK,UAAU,CAAC,IAAI,IAAI,UAAU,GAAG;oBAC7F,MAAM;oBACN,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC;iBACnC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAEpC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACrF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,4BAA4B,WAAW,CAAC,MAAM,+DAA+D;gBAC3G,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACxD,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3G,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;gBAClC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;gBACjE,OAAO,OAAO,EAAE,UAAU,OAAO,GAAG,CAAC;YACvC,CAAC,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CACb,4BAA4B,OAAO,CAAC,MAAM,kEAAkE;gBAC1G,qEAAqE;gBACrE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CACtB,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAA;AApFY,oEAA4B;uCAA5B,4BAA4B;IADxC,IAAA,mBAAU,GAAE;IAOR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,iCAAmB,CAAC,CAAA;qCALA,uBAAgB;QACV,sBAAe;QACrB,gBAAS;QACR,qDAAwB;GAL5C,4BAA4B,CAoFxC"}

package/dist/foundations/rbac/services/module-permission.gate.d.ts

@@ -0,0 +1,51 @@
+import { ExecutionContext } from "@nestjs/common";
+import { Reflector } from "@nestjs/core";
+import { ClsService } from "nestjs-cls";
+import type { ModuleDefinition } from "../../../common/decorators/module.decorator";
+import { ModulePermissionService } from "./module-permission.service";
+import type { RbacAction } from "./rbac-permission.service";
+/**
+ * HTTP method → permission action. GET/HEAD/OPTIONS read, POST create, PUT/PATCH
+ * update, DELETE delete. Anything else is treated as a write (update), so an
+ * unexpected verb never slips through as a read.
+ */
+export declare function rbacActionForHttpMethod(method: string | undefined): RbacAction;
+/**
+ * Section and action of a route: the handler `@ModuleACL` wins over the class
+ * one, field by field; the action falls back to the HTTP-method mapping.
+ */
+export declare function resolveRouteAcl(params: {
+    classDefinition: ModuleDefinition | undefined;
+    handlerDefinition: ModuleDefinition | undefined;
+    method: string | undefined;
+}): {
+    module: string | undefined;
+    action: RbacAction;
+};
+/**
+ * Request-level permission check, run by the session guards (`JwtAuthGuard`,
+ * `AdminJwtAuthGuard`, `OptionalJwtAuthGuard`) right after authentication.
+ *
+ * Off unless the app bootstraps with `permissions: { enforce: true }`: with it
+ * off, `assert` returns before reading metadata or touching the database.
+ *
+ * Rules:
+ * - A read with no section is allowed (company scoping still applies).
+ * - A write with no section is refused (the boot audit makes this unreachable).
+ * - Otherwise the caller's effective permission in the token's company decides:
+ *   `true` or a record path allows, `false` or absent refuses with 403.
+ * - No administrator bypass.
+ */
+export declare class ModulePermissionGate {
+    private readonly reflector;
+    private readonly cls;
+    private readonly permissions;
+    private readonly enforce?;
+    constructor(reflector: Reflector, cls: ClsService, permissions: ModulePermissionService, enforce?: boolean);
+    get enabled(): boolean;
+    assert(params: {
+        request: any;
+        context: ExecutionContext;
+    }): Promise<void>;
+}
+//# sourceMappingURL=module-permission.gate.d.ts.map

package/dist/foundations/rbac/services/module-permission.gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-permission.gate.d.ts","sourceRoot":"","sources":["../../../../src/foundations/rbac/services/module-permission.gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAoD,MAAM,gBAAgB,CAAC;AACpG,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAC;AAEpF,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAE5D;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,CAa9E;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE;IACtC,eAAe,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC9C,iBAAiB,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAChD,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B,GAAG;IAAE,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,CAKrD;AAED;;;;;;;;;;;;;GAaG;AACH,qBACa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAG5B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;gBALR,SAAS,EAAE,SAAS,EACpB,GAAG,EAAE,UAAU,EACf,WAAW,EAAE,uBAAuB,EAGpC,OAAO,CAAC,EAAE,OAAO;IAGpC,IAAI,OAAO,IAAI,OAAO,CAErB;IAEK,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,GAAG,CAAC;QAAC,OAAO,EAAE,gBAAgB,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAuBjF"}

package/dist/foundations/rbac/services/module-permission.gate.js

@@ -0,0 +1,108 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ModulePermissionGate = void 0;
+exports.rbacActionForHttpMethod = rbacActionForHttpMethod;
+exports.resolveRouteAcl = resolveRouteAcl;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const nestjs_cls_1 = require("nestjs-cls");
+const module_decorator_1 = require("../../../common/decorators/module.decorator");
+const rbac_tokens_1 = require("../rbac.tokens");
+const module_permission_service_1 = require("./module-permission.service");
+/**
+ * HTTP method → permission action. GET/HEAD/OPTIONS read, POST create, PUT/PATCH
+ * update, DELETE delete. Anything else is treated as a write (update), so an
+ * unexpected verb never slips through as a read.
+ */
+function rbacActionForHttpMethod(method) {
+    switch ((method ?? "").toUpperCase()) {
+        case "GET":
+        case "HEAD":
+        case "OPTIONS":
+            return "read";
+        case "POST":
+            return "create";
+        case "DELETE":
+            return "delete";
+        default:
+            return "update";
+    }
+}
+/**
+ * Section and action of a route: the handler `@ModuleACL` wins over the class
+ * one, field by field; the action falls back to the HTTP-method mapping.
+ */
+function resolveRouteAcl(params) {
+    const module = params.handlerDefinition?.module ?? params.classDefinition?.module;
+    const action = params.handlerDefinition?.action ?? params.classDefinition?.action ?? rbacActionForHttpMethod(params.method);
+    return { module: module || undefined, action };
+}
+/**
+ * Request-level permission check, run by the session guards (`JwtAuthGuard`,
+ * `AdminJwtAuthGuard`, `OptionalJwtAuthGuard`) right after authentication.
+ *
+ * Off unless the app bootstraps with `permissions: { enforce: true }`: with it
+ * off, `assert` returns before reading metadata or touching the database.
+ *
+ * Rules:
+ * - A read with no section is allowed (company scoping still applies).
+ * - A write with no section is refused (the boot audit makes this unreachable).
+ * - Otherwise the caller's effective permission in the token's company decides:
+ *   `true` or a record path allows, `false` or absent refuses with 403.
+ * - No administrator bypass.
+ */
+let ModulePermissionGate = class ModulePermissionGate {
+    constructor(reflector, cls, permissions, enforce) {
+        this.reflector = reflector;
+        this.cls = cls;
+        this.permissions = permissions;
+        this.enforce = enforce;
+    }
+    get enabled() {
+        return this.enforce === true;
+    }
+    async assert(params) {
+        if (!this.enabled)
+            return;
+        const userId = params.request?.user?.userId;
+        // No authenticated session (optional guard, anonymous caller): nothing to evaluate.
+        if (!userId)
+            return;
+        const { module, action } = resolveRouteAcl({
+            classDefinition: this.reflector.get(module_decorator_1.MODULE_ACL_METADATA, params.context.getClass()),
+            handlerDefinition: this.reflector.get(module_decorator_1.MODULE_ACL_METADATA, params.context.getHandler()),
+            method: params.request?.method,
+        });
+        if (!module) {
+            if (action === "read")
+                return;
+            throw new common_1.ForbiddenException();
+        }
+        const companyId = (this.cls.isActive() ? this.cls.get("companyId") : undefined) ?? undefined;
+        const allowed = await this.permissions.allows({ userId, companyId, moduleId: module, action });
+        if (!allowed)
+            throw new common_1.ForbiddenException();
+    }
+};
+exports.ModulePermissionGate = ModulePermissionGate;
+exports.ModulePermissionGate = ModulePermissionGate = __decorate([
+    (0, common_1.Injectable)(),
+    __param(3, (0, common_1.Optional)()),
+    __param(3, (0, common_1.Inject)(rbac_tokens_1.PERMISSIONS_ENFORCE)),
+    __metadata("design:paramtypes", [core_1.Reflector,
+        nestjs_cls_1.ClsService,
+        module_permission_service_1.ModulePermissionService, Boolean])
+], ModulePermissionGate);
+//# sourceMappingURL=module-permission.gate.js.map

package/dist/foundations/rbac/services/module-permission.gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-permission.gate.js","sourceRoot":"","sources":["../../../../src/foundations/rbac/services/module-permission.gate.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAcA,0DAaC;AAMD,0CASC;AA1CD,2CAAoG;AACpG,uCAAyC;AACzC,2CAAwC;AACxC,kFAAkF;AAElF,gDAAqD;AACrD,2EAAsE;AAGtE;;;;GAIG;AACH,SAAgB,uBAAuB,CAAC,MAA0B;IAChE,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACrC,KAAK,KAAK,CAAC;QACX,KAAK,MAAM,CAAC;QACZ,KAAK,SAAS;YACZ,OAAO,MAAM,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,QAAQ,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB;YACE,OAAO,QAAQ,CAAC;IACpB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAAC,MAI/B;IACC,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,EAAE,MAAM,IAAI,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC;IAClF,MAAM,MAAM,GACV,MAAM,CAAC,iBAAiB,EAAE,MAAM,IAAI,MAAM,CAAC,eAAe,EAAE,MAAM,IAAI,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/G,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;;;GAaG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B,YACmB,SAAoB,EACpB,GAAe,EACf,WAAoC,EAGpC,OAAiB;QALjB,cAAS,GAAT,SAAS,CAAW;QACpB,QAAG,GAAH,GAAG,CAAY;QACf,gBAAW,GAAX,WAAW,CAAyB;QAGpC,YAAO,GAAP,OAAO,CAAU;IACjC,CAAC;IAEJ,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAmD;QAC9D,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAE1B,MAAM,MAAM,GAAuB,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC;QAChE,oFAAoF;QACpF,IAAI,CAAC,MAAM;YAAE,OAAO;QAEpB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC;YACzC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAmB,sCAAmB,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrG,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAmB,sCAAmB,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACzG,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM;SAC/B,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,MAAM,KAAK,MAAM;gBAAE,OAAO;YAC9B,MAAM,IAAI,2BAAkB,EAAE,CAAC;QACjC,CAAC;QAED,MAAM,SAAS,GAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;QAEjH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/F,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,2BAAkB,EAAE,CAAC;IAC/C,CAAC;CACF,CAAA;AArCY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,iCAAmB,CAAC,CAAA;qCAJA,gBAAS;QACf,uBAAU;QACF,mDAAuB;GAJ5C,oBAAoB,CAqChC"}

package/dist/foundations/rbac/services/module-permission.service.d.ts

@@ -0,0 +1,34 @@
+import { ClsService } from "nestjs-cls";
+import { RbacPermissionRepository } from "../repositories/rbac-permission.repository";
+import type { EffectivePermissions } from "../repositories/rbac-permission.repository";
+import type { RbacAction } from "./rbac-permission.service";
+export type { EffectivePermissions } from "../repositories/rbac-permission.repository";
+/**
+ * Resolves a caller's effective permissions in the token's company, for the
+ * request-level permission gate (`ModulePermissionGate`).
+ *
+ * Mirrors `RbacPermissionService` (same `featureModuleQuery` resolution) with
+ * three differences: it binds the token's company instead of the legacy
+ * `BELONGS_TO` edge, it keeps record-path values (a string allows at the
+ * section level), and it resolves once per request (cached in CLS).
+ *
+ * No administrator bypass: the platform Administrator is resolved like any
+ * role, so its grants must exist in the app's permission table.
+ */
+export declare class ModulePermissionService {
+    private readonly repository;
+    private readonly cls;
+    constructor(repository: RbacPermissionRepository, cls: ClsService);
+    resolve(params: {
+        userId: string;
+        companyId: string | undefined;
+    }): Promise<EffectivePermissions>;
+    /** True when the effective value is `true` or a non-empty record path. */
+    allows(params: {
+        userId: string;
+        companyId: string | undefined;
+        moduleId: string;
+        action: RbacAction;
+    }): Promise<boolean>;
+}
+//# sourceMappingURL=module-permission.service.d.ts.map

package/dist/foundations/rbac/services/module-permission.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-permission.service.d.ts","sourceRoot":"","sources":["../../../../src/foundations/rbac/services/module-permission.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AACtF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAE5D,YAAY,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAUvF;;;;;;;;;;;GAWG;AACH,qBACa,uBAAuB;IAEhC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,GAAG;gBADH,UAAU,EAAE,wBAAwB,EACpC,GAAG,EAAE,UAAU;IAG5B,OAAO,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAmBvG,0EAA0E;IACpE,MAAM,CAAC,MAAM,EAAE;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,UAAU,CAAC;KACpB,GAAG,OAAO,CAAC,OAAO,CAAC;CAKrB"}

package/dist/foundations/rbac/services/module-permission.service.js

@@ -0,0 +1,64 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ModulePermissionService = void 0;
+const common_1 = require("@nestjs/common");
+const nestjs_cls_1 = require("nestjs-cls");
+const rbac_permission_repository_1 = require("../repositories/rbac-permission.repository");
+/** CLS key holding the permissions resolved for the current request. */
+const CLS_KEY = "effectivePermissions";
+/**
+ * Resolves a caller's effective permissions in the token's company, for the
+ * request-level permission gate (`ModulePermissionGate`).
+ *
+ * Mirrors `RbacPermissionService` (same `featureModuleQuery` resolution) with
+ * three differences: it binds the token's company instead of the legacy
+ * `BELONGS_TO` edge, it keeps record-path values (a string allows at the
+ * section level), and it resolves once per request (cached in CLS).
+ *
+ * No administrator bypass: the platform Administrator is resolved like any
+ * role, so its grants must exist in the app's permission table.
+ */
+let ModulePermissionService = class ModulePermissionService {
+    constructor(repository, cls) {
+        this.repository = repository;
+        this.cls = cls;
+    }
+    async resolve(params) {
+        const key = `${params.userId}|${params.companyId ?? ""}`;
+        const clsActive = this.cls.isActive();
+        if (clsActive) {
+            const cached = this.cls.get(CLS_KEY);
+            if (cached && cached.key === key)
+                return cached.permissions;
+        }
+        const permissions = await this.repository.findEffectivePermissions({
+            userId: params.userId,
+            companyId: params.companyId || undefined,
+        });
+        if (clsActive)
+            this.cls.set(CLS_KEY, { key, permissions });
+        return permissions;
+    }
+    /** True when the effective value is `true` or a non-empty record path. */
+    async allows(params) {
+        const permissions = await this.resolve({ userId: params.userId, companyId: params.companyId });
+        const value = permissions.get(params.moduleId)?.[params.action];
+        return value === true || (typeof value === "string" && value.length > 0);
+    }
+};
+exports.ModulePermissionService = ModulePermissionService;
+exports.ModulePermissionService = ModulePermissionService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [rbac_permission_repository_1.RbacPermissionRepository,
+        nestjs_cls_1.ClsService])
+], ModulePermissionService);
+//# sourceMappingURL=module-permission.service.js.map

package/dist/foundations/rbac/services/module-permission.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-permission.service.js","sourceRoot":"","sources":["../../../../src/foundations/rbac/services/module-permission.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,2CAAwC;AACxC,2FAAsF;AAMtF,wEAAwE;AACxE,MAAM,OAAO,GAAG,sBAAsB,CAAC;AAOvC;;;;;;;;;;;GAWG;AAEI,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAClC,YACmB,UAAoC,EACpC,GAAe;QADf,eAAU,GAAV,UAAU,CAA0B;QACpC,QAAG,GAAH,GAAG,CAAY;IAC/B,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,MAAyD;QACrE,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAEtC,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAgC,OAAO,CAAC,CAAC;YACpE,IAAI,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG;gBAAE,OAAO,MAAM,CAAC,WAAW,CAAC;QAC9D,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC;YACjE,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,SAAS;SACzC,CAAC,CAAC;QAEH,IAAI,SAAS;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAoB,OAAO,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;QAE9E,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,MAAM,CAAC,MAKZ;QACC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAC/F,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChE,OAAO,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC;CACF,CAAA;AApCY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;qCAGoB,qDAAwB;QAC/B,uBAAU;GAHvB,uBAAuB,CAoCnC"}