@carlonicora/nestjs-neo4jsonapi 6.6.2 → 6.7.0

package/dist/foundations/rbac/controllers/rbac.controller.js

@@ -17,6 +17,8 @@ const roles_decorator_1 = require("../../../common/decorators/roles.decorator");
 const system_roles_1 = require("../../../common/constants/system.roles");
 const rbac_service_1 = require("../services/rbac.service");
 const permission_mapping_meta_1 = require("../entities/permission-mapping.meta");
+const module_decorator_1 = require("../../../common/decorators/module.decorator");
+const core_module_ids_1 = require("../../../common/constants/core-module.ids");
 let RbacController = class RbacController {
     constructor(rbacService) {
         this.rbacService = rbacService;
@@ -35,6 +37,7 @@ __decorate([
     __metadata("design:returntype", Promise)
 ], RbacController.prototype, "findPermissionMappings", null);
 exports.RbacController = RbacController = __decorate([
+    (0, module_decorator_1.ModuleACL)({ module: core_module_ids_1.CoreModuleId.Role }),
     (0, common_1.Controller)(permission_mapping_meta_1.permissionMappingMeta.endpoint),
     __metadata("design:paramtypes", [rbac_service_1.RbacService])
 ], RbacController);

package/dist/foundations/rbac/controllers/rbac.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"rbac.controller.js","sourceRoot":"","sources":["../../../../src/foundations/rbac/controllers/rbac.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4D;AAC5D,sFAAgF;AAChF,0EAAqE;AACrE,gFAAmE;AACnE,yEAAgE;AAChE,2DAAuD;AACvD,iFAA4E;AAGrE,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,YAA6B,WAAwB;QAAxB,gBAAW,GAAX,WAAW,CAAa;IAAG,CAAC;IAKnD,AAAN,KAAK,CAAC,sBAAsB;QAC1B,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,sBAAsB,EAAE,CAAC;IACzD,CAAC;CACF,CAAA;AATY,wCAAc;AAMnB;IAHL,IAAA,kBAAS,EAAC,wCAAiB,EAAE,6BAAY,CAAC;IAC1C,IAAA,YAAG,GAAE;IACL,IAAA,uBAAK,EAAC,qBAAM,CAAC,aAAa,CAAC;;;;4DAG3B;yBARU,cAAc;IAD1B,IAAA,mBAAU,EAAC,+CAAqB,CAAC,QAAQ,CAAC;qCAEC,0BAAW;GAD1C,cAAc,CAS1B"}
+{"version":3,"file":"rbac.controller.js","sourceRoot":"","sources":["../../../../src/foundations/rbac/controllers/rbac.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4D;AAC5D,sFAAgF;AAChF,0EAAqE;AACrE,gFAAmE;AACnE,yEAAgE;AAChE,2DAAuD;AACvD,iFAA4E;AAC5E,kFAAwE;AACxE,+EAAyE;AAIlE,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,YAA6B,WAAwB;QAAxB,gBAAW,GAAX,WAAW,CAAa;IAAG,CAAC;IAKnD,AAAN,KAAK,CAAC,sBAAsB;QAC1B,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,sBAAsB,EAAE,CAAC;IACzD,CAAC;CACF,CAAA;AATY,wCAAc;AAMnB;IAHL,IAAA,kBAAS,EAAC,wCAAiB,EAAE,6BAAY,CAAC;IAC1C,IAAA,YAAG,GAAE;IACL,IAAA,uBAAK,EAAC,qBAAM,CAAC,aAAa,CAAC;;;;4DAG3B;yBARU,cAAc;IAF1B,IAAA,4BAAS,EAAC,EAAE,MAAM,EAAE,8BAAY,CAAC,IAAI,EAAE,CAAC;IACxC,IAAA,mBAAU,EAAC,+CAAqB,CAAC,QAAQ,CAAC;qCAEC,0BAAW;GAD1C,cAAc,CAS1B"}

package/dist/foundations/rbac/index.d.ts

@@ -4,6 +4,11 @@ export { RbacPermissionService } from "./services/rbac-permission.service";
 export type { RbacAction } from "./services/rbac-permission.service";
 export { RbacPermissionRepository } from "./repositories/rbac-permission.repository";
 export { MODULE_USER_PATHS_TOKEN } from "./rbac.constants";
+export { PERMISSIONS_ENFORCE } from "./rbac.tokens";
+export { ModulePermissionService } from "./services/module-permission.service";
+export type { EffectivePermissions } from "./services/module-permission.service";
+export { ModulePermissionGate, rbacActionForHttpMethod, resolveRouteAcl } from "./services/module-permission.gate";
+export { ModulePermissionAuditService } from "./services/module-permission-audit.service";
 export { permissionMappingMeta } from "./entities/permission-mapping.meta";
 export { modulePathsMeta } from "./entities/module-paths.meta";
 export type { PermissionMapping } from "./entities/permission-mapping.entity";

package/dist/foundations/rbac/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/foundations/rbac/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,YAAY,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,YAAY,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,YAAY,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAI9E,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,OAAO,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,OAAO,CAAC;AACrG,OAAO,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AACrC,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,OAAO,CAAC;AAKrF,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AACxC,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/foundations/rbac/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,YAAY,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAGpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAC/E,YAAY,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACnH,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,YAAY,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,YAAY,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAI9E,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,OAAO,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,OAAO,CAAC;AACrG,OAAO,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AACrC,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,OAAO,CAAC;AAKrF,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AACxC,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC"}

package/dist/foundations/rbac/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.dumpRbacMatrix = exports.ACTION_ORDER = exports.iterateDeclaredModules = exports.iterateDeclaredEdges = exports.resolveDefault = exports.resolveForRole = exports.toPermissionsJson = exports.defineRbac = exports.perm = exports.modulePathsMeta = exports.permissionMappingMeta = exports.MODULE_USER_PATHS_TOKEN = exports.RbacPermissionRepository = exports.RbacPermissionService = exports.RbacPermissionModule = exports.RbacModule = void 0;
+exports.dumpRbacMatrix = exports.ACTION_ORDER = exports.iterateDeclaredModules = exports.iterateDeclaredEdges = exports.resolveDefault = exports.resolveForRole = exports.toPermissionsJson = exports.defineRbac = exports.perm = exports.modulePathsMeta = exports.permissionMappingMeta = exports.ModulePermissionAuditService = exports.resolveRouteAcl = exports.rbacActionForHttpMethod = exports.ModulePermissionGate = exports.ModulePermissionService = exports.PERMISSIONS_ENFORCE = exports.MODULE_USER_PATHS_TOKEN = exports.RbacPermissionRepository = exports.RbacPermissionService = exports.RbacPermissionModule = exports.RbacModule = void 0;
 var rbac_module_1 = require("./rbac.module");
 Object.defineProperty(exports, "RbacModule", { enumerable: true, get: function () { return rbac_module_1.RbacModule; } });
 var rbac_permission_module_1 = require("./rbac-permission.module");
@@ -11,6 +11,17 @@ var rbac_permission_repository_1 = require("./repositories/rbac-permission.repos
 Object.defineProperty(exports, "RbacPermissionRepository", { enumerable: true, get: function () { return rbac_permission_repository_1.RbacPermissionRepository; } });
 var rbac_constants_1 = require("./rbac.constants");
 Object.defineProperty(exports, "MODULE_USER_PATHS_TOKEN", { enumerable: true, get: function () { return rbac_constants_1.MODULE_USER_PATHS_TOKEN; } });
+var rbac_tokens_1 = require("./rbac.tokens");
+Object.defineProperty(exports, "PERMISSIONS_ENFORCE", { enumerable: true, get: function () { return rbac_tokens_1.PERMISSIONS_ENFORCE; } });
+// Request permission gate (bootstrap option `permissions: { enforce: true }`).
+var module_permission_service_1 = require("./services/module-permission.service");
+Object.defineProperty(exports, "ModulePermissionService", { enumerable: true, get: function () { return module_permission_service_1.ModulePermissionService; } });
+var module_permission_gate_1 = require("./services/module-permission.gate");
+Object.defineProperty(exports, "ModulePermissionGate", { enumerable: true, get: function () { return module_permission_gate_1.ModulePermissionGate; } });
+Object.defineProperty(exports, "rbacActionForHttpMethod", { enumerable: true, get: function () { return module_permission_gate_1.rbacActionForHttpMethod; } });
+Object.defineProperty(exports, "resolveRouteAcl", { enumerable: true, get: function () { return module_permission_gate_1.resolveRouteAcl; } });
+var module_permission_audit_service_1 = require("./services/module-permission-audit.service");
+Object.defineProperty(exports, "ModulePermissionAuditService", { enumerable: true, get: function () { return module_permission_audit_service_1.ModulePermissionAuditService; } });
 var permission_mapping_meta_1 = require("./entities/permission-mapping.meta");
 Object.defineProperty(exports, "permissionMappingMeta", { enumerable: true, get: function () { return permission_mapping_meta_1.permissionMappingMeta; } });
 var module_paths_meta_1 = require("./entities/module-paths.meta");

package/dist/foundations/rbac/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/foundations/rbac/index.ts"],"names":[],"mappings":";;;AAAA,6CAA2C;AAAlC,yGAAA,UAAU,OAAA;AACnB,mEAAgE;AAAvD,8HAAA,oBAAoB,OAAA;AAC7B,8EAA2E;AAAlE,gIAAA,qBAAqB,OAAA;AAE9B,wFAAqF;AAA5E,sIAAA,wBAAwB,OAAA;AACjC,mDAA2D;AAAlD,yHAAA,uBAAuB,OAAA;AAChC,8EAA2E;AAAlE,gIAAA,qBAAqB,OAAA;AAC9B,kEAA+D;AAAtD,oHAAA,eAAe,OAAA;AAIxB,mEAAmE;AACnE,gDAAgD;AAChD,6BAA4D;AAAnD,2FAAA,IAAI,OAAA;AAAE,iGAAA,UAAU,OAAA;AAAE,wGAAA,iBAAiB,OAAA;AAC5C,6BAAqG;AAA5F,qGAAA,cAAc,OAAA;AAAE,qGAAA,cAAc,OAAA;AAAE,2GAAA,oBAAoB,OAAA;AAAE,6GAAA,sBAAsB,OAAA;AACrF,6BAAqC;AAA5B,mGAAA,YAAY,OAAA;AAGrB,uEAAuE;AACvE,yEAAyE;AACzE,yDAAyD;AACzD,+BAAwC;AAA/B,sGAAA,cAAc,OAAA;AAEvB,iFAAiF;AACjF,8EAA8E;AAC9E,qEAAqE;AACrE,oEAAoE"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/foundations/rbac/index.ts"],"names":[],"mappings":";;;AAAA,6CAA2C;AAAlC,yGAAA,UAAU,OAAA;AACnB,mEAAgE;AAAvD,8HAAA,oBAAoB,OAAA;AAC7B,8EAA2E;AAAlE,gIAAA,qBAAqB,OAAA;AAE9B,wFAAqF;AAA5E,sIAAA,wBAAwB,OAAA;AACjC,mDAA2D;AAAlD,yHAAA,uBAAuB,OAAA;AAChC,6CAAoD;AAA3C,kHAAA,mBAAmB,OAAA;AAE5B,+EAA+E;AAC/E,kFAA+E;AAAtE,oIAAA,uBAAuB,OAAA;AAEhC,4EAAmH;AAA1G,8HAAA,oBAAoB,OAAA;AAAE,iIAAA,uBAAuB,OAAA;AAAE,yHAAA,eAAe,OAAA;AACvE,8FAA0F;AAAjF,+IAAA,4BAA4B,OAAA;AACrC,8EAA2E;AAAlE,gIAAA,qBAAqB,OAAA;AAC9B,kEAA+D;AAAtD,oHAAA,eAAe,OAAA;AAIxB,mEAAmE;AACnE,gDAAgD;AAChD,6BAA4D;AAAnD,2FAAA,IAAI,OAAA;AAAE,iGAAA,UAAU,OAAA;AAAE,wGAAA,iBAAiB,OAAA;AAC5C,6BAAqG;AAA5F,qGAAA,cAAc,OAAA;AAAE,qGAAA,cAAc,OAAA;AAAE,2GAAA,oBAAoB,OAAA;AAAE,6GAAA,sBAAsB,OAAA;AACrF,6BAAqC;AAA5B,mGAAA,YAAY,OAAA;AAGrB,uEAAuE;AACvE,yEAAyE;AACzE,yDAAyD;AACzD,+BAAwC;AAA/B,sGAAA,cAAc,OAAA;AAEvB,iFAAiF;AACjF,8EAA8E;AAC9E,qEAAqE;AACrE,oEAAoE"}

package/dist/foundations/rbac/rbac-permission.module.d.ts

@@ -8,6 +8,10 @@
  * configuration and no controllers — `Neo4jService` is available through the
  * global core module, mirroring how `GraphModule` provides
  * `UserModulesRepository` without importing `Neo4JModule`.
+ *
+ * Global so the session guards, which are instantiated in every controller's
+ * module, can inject `ModulePermissionGate`. The generated app module imports
+ * it; every service in it is inert while `permissions.enforce` is off.
  */
 export declare class RbacPermissionModule {
 }

package/dist/foundations/rbac/rbac-permission.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rbac-permission.module.d.ts","sourceRoot":"","sources":["../../../src/foundations/rbac/rbac-permission.module.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;GAUG;AACH,qBAIa,oBAAoB;CAAG"}
+{"version":3,"file":"rbac-permission.module.d.ts","sourceRoot":"","sources":["../../../src/foundations/rbac/rbac-permission.module.ts"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;;GAcG;AACH,qBAYa,oBAAoB;CAAG"}

package/dist/foundations/rbac/rbac-permission.module.js

@@ -8,7 +8,11 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RbacPermissionModule = void 0;
 const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
 const rbac_permission_repository_1 = require("./repositories/rbac-permission.repository");
+const module_permission_audit_service_1 = require("./services/module-permission-audit.service");
+const module_permission_gate_1 = require("./services/module-permission.gate");
+const module_permission_service_1 = require("./services/module-permission.service");
 const rbac_permission_service_1 = require("./services/rbac-permission.service");
 /**
  * Standalone provider module for RBAC permission checks.
@@ -20,14 +24,26 @@ const rbac_permission_service_1 = require("./services/rbac-permission.service");
  * configuration and no controllers — `Neo4jService` is available through the
  * global core module, mirroring how `GraphModule` provides
  * `UserModulesRepository` without importing `Neo4JModule`.
+ *
+ * Global so the session guards, which are instantiated in every controller's
+ * module, can inject `ModulePermissionGate`. The generated app module imports
+ * it; every service in it is inert while `permissions.enforce` is off.
  */
 let RbacPermissionModule = class RbacPermissionModule {
 };
 exports.RbacPermissionModule = RbacPermissionModule;
 exports.RbacPermissionModule = RbacPermissionModule = __decorate([
+    (0, common_1.Global)(),
     (0, common_1.Module)({
-        providers: [rbac_permission_repository_1.RbacPermissionRepository, rbac_permission_service_1.RbacPermissionService],
-        exports: [rbac_permission_repository_1.RbacPermissionRepository, rbac_permission_service_1.RbacPermissionService],
+        imports: [core_1.DiscoveryModule],
+        providers: [
+            rbac_permission_repository_1.RbacPermissionRepository,
+            rbac_permission_service_1.RbacPermissionService,
+            module_permission_service_1.ModulePermissionService,
+            module_permission_gate_1.ModulePermissionGate,
+            module_permission_audit_service_1.ModulePermissionAuditService,
+        ],
+        exports: [rbac_permission_repository_1.RbacPermissionRepository, rbac_permission_service_1.RbacPermissionService, module_permission_service_1.ModulePermissionService, module_permission_gate_1.ModulePermissionGate],
     })
 ], RbacPermissionModule);
 //# sourceMappingURL=rbac-permission.module.js.map

package/dist/foundations/rbac/rbac-permission.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"rbac-permission.module.js","sourceRoot":"","sources":["../../../src/foundations/rbac/rbac-permission.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,0FAAqF;AACrF,gFAA2E;AAE3E;;;;;;;;;;GAUG;AAKI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;CAAG,CAAA;AAAvB,oDAAoB;+BAApB,oBAAoB;IAJhC,IAAA,eAAM,EAAC;QACN,SAAS,EAAE,CAAC,qDAAwB,EAAE,+CAAqB,CAAC;QAC5D,OAAO,EAAE,CAAC,qDAAwB,EAAE,+CAAqB,CAAC;KAC3D,CAAC;GACW,oBAAoB,CAAG"}
+{"version":3,"file":"rbac-permission.module.js","sourceRoot":"","sources":["../../../src/foundations/rbac/rbac-permission.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAgD;AAChD,uCAA+C;AAC/C,0FAAqF;AACrF,gGAA0F;AAC1F,8EAAyE;AACzE,oFAA+E;AAC/E,gFAA2E;AAE3E;;;;;;;;;;;;;;GAcG;AAaI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;CAAG,CAAA;AAAvB,oDAAoB;+BAApB,oBAAoB;IAZhC,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,sBAAe,CAAC;QAC1B,SAAS,EAAE;YACT,qDAAwB;YACxB,+CAAqB;YACrB,mDAAuB;YACvB,6CAAoB;YACpB,8DAA4B;SAC7B;QACD,OAAO,EAAE,CAAC,qDAAwB,EAAE,+CAAqB,EAAE,mDAAuB,EAAE,6CAAoB,CAAC;KAC1G,CAAC;GACW,oBAAoB,CAAG"}

package/dist/foundations/rbac/rbac.tokens.d.ts

@@ -8,4 +8,12 @@
  * it from there rather than duplicating it here.
  */
 export declare const RBAC_MATRIX_TOKEN: unique symbol;
+/**
+ * DI token carrying the bootstrap option `permissions.enforce` (boolean).
+ *
+ * Provided globally by the generated app module. Every consumer injects it
+ * `@Optional()` and treats a missing value as `false`, so an app that never
+ * sets the option behaves exactly as before.
+ */
+export declare const PERMISSIONS_ENFORCE: unique symbol;
 //# sourceMappingURL=rbac.tokens.d.ts.map

package/dist/foundations/rbac/rbac.tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rbac.tokens.d.ts","sourceRoot":"","sources":["../../../src/foundations/rbac/rbac.tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,eAA8B,CAAC"}
+{"version":3,"file":"rbac.tokens.d.ts","sourceRoot":"","sources":["../../../src/foundations/rbac/rbac.tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,eAA8B,CAAC;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,eAAgC,CAAC"}

package/dist/foundations/rbac/rbac.tokens.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RBAC_MATRIX_TOKEN = void 0;
+exports.PERMISSIONS_ENFORCE = exports.RBAC_MATRIX_TOKEN = void 0;
 /**
  * DI token for the declarative RBAC matrix.
  *
@@ -11,4 +11,12 @@ exports.RBAC_MATRIX_TOKEN = void 0;
  * it from there rather than duplicating it here.
  */
 exports.RBAC_MATRIX_TOKEN = Symbol("RBAC_MATRIX_TOKEN");
+/**
+ * DI token carrying the bootstrap option `permissions.enforce` (boolean).
+ *
+ * Provided globally by the generated app module. Every consumer injects it
+ * `@Optional()` and treats a missing value as `false`, so an app that never
+ * sets the option behaves exactly as before.
+ */
+exports.PERMISSIONS_ENFORCE = Symbol("PERMISSIONS_ENFORCE");
 //# sourceMappingURL=rbac.tokens.js.map

package/dist/foundations/rbac/rbac.tokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"rbac.tokens.js","sourceRoot":"","sources":["../../../src/foundations/rbac/rbac.tokens.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;GAQG;AACU,QAAA,iBAAiB,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC"}
+{"version":3,"file":"rbac.tokens.js","sourceRoot":"","sources":["../../../src/foundations/rbac/rbac.tokens.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;GAQG;AACU,QAAA,iBAAiB,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC;AAE7D;;;;;;GAMG;AACU,QAAA,mBAAmB,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC"}

package/dist/foundations/rbac/repositories/rbac-permission.repository.d.ts

@@ -1,5 +1,11 @@
 import { Neo4jService } from "../../../core/neo4j/services/neo4j.service";
 import type { RbacAction } from "../services/rbac-permission.service";
+/**
+ * Effective permission values per module id. A value is `true`, `false` or a
+ * record path (a non-empty string such as `"id"`), exactly as resolved by
+ * `modulePermissionResolutionQuery`.
+ */
+export type EffectivePermissions = Map<string, Record<RbacAction, boolean | string>>;
 /**
  * Resolves the effective per-module permission flags for a user. Mirrors the
  * permission model used by the rest of the app (see AuthRepository and
@@ -9,7 +15,7 @@ import type { RbacAction } from "../services/rbac-permission.service";
  * `permissions` JSON with any role-level `HAS_PERMISSIONS` overrides.
  *
  * Used by RbacPermissionService to answer `can(userId, moduleId, action)`
- * for the MCP layer.
+ * for the MCP layer, and by ModulePermissionService for the request gate.
  */
 export declare class RbacPermissionRepository {
     private readonly neo4j;
@@ -27,5 +33,27 @@ export declare class RbacPermissionRepository {
      * types (`read`, `create`, `update`, `delete`).
      */
     findEffectivePermissionsForUser(userId: string): Promise<Map<string, Record<RbacAction, boolean>>>;
+    /**
+     * Effective permissions of a user in ONE company: the module defaults plus
+     * the grants of the roles on the user's membership in that company and on
+     * the user's platform memberships (no `IN_COMPANY`). Never follows the
+     * legacy `(User)-[:BELONGS_TO]->(Company)` edge.
+     *
+     * With no `companyId` (a platform session) it resolves through the
+     * platform membership only (`adminModuleQuery`).
+     *
+     * Record-path values are kept as strings: the request gate allows them at
+     * the section level and leaves the record decision to the app.
+     *
+     * Intentional exception to "use buildDefaultMatch": this is the library's
+     * own permission resolution (the same `company` binding UserModulesRepository
+     * uses), not an entity read.
+     */
+    findEffectivePermissions(params: {
+        userId: string;
+        companyId: string | undefined;
+    }): Promise<EffectivePermissions>;
+    /** The subset of `ids` that exist as `(:Module)` nodes. */
+    findExistingModuleIds(ids: string[]): Promise<Set<string>>;
 }
 //# sourceMappingURL=rbac-permission.repository.d.ts.map

package/dist/foundations/rbac/repositories/rbac-permission.repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rbac-permission.repository.d.ts","sourceRoot":"","sources":["../../../../src/foundations/rbac/repositories/rbac-permission.repository.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,4CAA4C,CAAC;AAE1E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAOtE;;;;;;;;;;GAUG;AACH,qBACa,wBAAwB;IAGvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAFlC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6C;gBAEvC,KAAK,EAAE,YAAY;IAEhD;;;;;;;;;;OAUG;IACG,+BAA+B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;CA+BzG"}
+{"version":3,"file":"rbac-permission.repository.d.ts","sourceRoot":"","sources":["../../../../src/foundations/rbac/repositories/rbac-permission.repository.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,4CAA4C,CAAC;AAI1E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAC;AAOtE;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC;AAErF;;;;;;;;;;GAUG;AACH,qBACa,wBAAwB;IAGvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAFlC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6C;gBAEvC,KAAK,EAAE,YAAY;IAEhD;;;;;;;;;;OAUG;IACG,+BAA+B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAgCxG;;;;;;;;;;;;;;;OAeG;IACG,wBAAwB,CAAC,MAAM,EAAE;QACrC,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;KAC/B,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAyCjC,2DAA2D;IACrD,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;CAcjE"}

package/dist/foundations/rbac/repositories/rbac-permission.repository.js

@@ -13,6 +13,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.RbacPermissionRepository = void 0;
 const common_1 = require("@nestjs/common");
 const neo4j_service_1 = require("../../../core/neo4j/services/neo4j.service");
+const module_model_1 = require("../../module/entities/module.model");
 const feature_module_query_1 = require("../../module/queries/feature.module.query");
 /**
  * Resolves the effective per-module permission flags for a user. Mirrors the
@@ -23,7 +24,7 @@ const feature_module_query_1 = require("../../module/queries/feature.module.quer
  * `permissions` JSON with any role-level `HAS_PERMISSIONS` overrides.
  *
  * Used by RbacPermissionService to answer `can(userId, moduleId, action)`
- * for the MCP layer.
+ * for the MCP layer, and by ModulePermissionService for the request gate.
  */
 let RbacPermissionRepository = RbacPermissionRepository_1 = class RbacPermissionRepository {
     constructor(neo4j) {
@@ -71,6 +72,77 @@ let RbacPermissionRepository = RbacPermissionRepository_1 = class RbacPermission
         }
         return map;
     }
+    /**
+     * Effective permissions of a user in ONE company: the module defaults plus
+     * the grants of the roles on the user's membership in that company and on
+     * the user's platform memberships (no `IN_COMPANY`). Never follows the
+     * legacy `(User)-[:BELONGS_TO]->(Company)` edge.
+     *
+     * With no `companyId` (a platform session) it resolves through the
+     * platform membership only (`adminModuleQuery`).
+     *
+     * Record-path values are kept as strings: the request gate allows them at
+     * the section level and leaves the record decision to the app.
+     *
+     * Intentional exception to "use buildDefaultMatch": this is the library's
+     * own permission resolution (the same `company` binding UserModulesRepository
+     * uses), not an entity read.
+     */
+    async findEffectivePermissions(params) {
+        const result = params.companyId
+            ? await this.neo4j.read(`
+          MATCH (user:User {id: $userId})
+          MATCH (company:Company {id: $companyId})
+          ${feature_module_query_1.featureModuleQuery}
+          `, { userId: params.userId, companyId: params.companyId })
+            : await this.neo4j.read(feature_module_query_1.adminModuleQuery, { searchValue: params.userId });
+        const map = new Map();
+        for (const record of result.records) {
+            const moduleNode = record.get("module");
+            const props = moduleNode?.properties;
+            if (!props)
+                continue;
+            const id = props.id;
+            const permsJson = props.permissions;
+            if (typeof id !== "string" || !id.length || typeof permsJson !== "string")
+                continue;
+            try {
+                const perms = JSON.parse(permsJson);
+                const value = (type) => {
+                    const raw = perms.find((p) => p.type === type)?.value;
+                    if (raw === true)
+                        return true;
+                    if (typeof raw === "string" && raw.length > 0)
+                        return raw;
+                    return false;
+                };
+                map.set(id, {
+                    read: value("read"),
+                    create: value("create"),
+                    update: value("update"),
+                    delete: value("delete"),
+                });
+            }
+            catch {
+                this.logger.warn(`findEffectivePermissions: malformed permissions JSON on module ${id}`);
+            }
+        }
+        return map;
+    }
+    /** The subset of `ids` that exist as `(:Module)` nodes. */
+    async findExistingModuleIds(ids) {
+        if (ids.length === 0)
+            return new Set();
+        const query = this.neo4j.initQuery({ serialiser: module_model_1.ModuleModel });
+        query.queryParams = { ...query.queryParams, ids };
+        query.query += `
+      MATCH (module:Module)
+      WHERE module.id IN $ids
+      RETURN module
+    `;
+        const modules = await this.neo4j.readMany(query);
+        return new Set(modules.map((module) => module.id));
+    }
 };
 exports.RbacPermissionRepository = RbacPermissionRepository;
 exports.RbacPermissionRepository = RbacPermissionRepository = RbacPermissionRepository_1 = __decorate([

package/dist/foundations/rbac/repositories/rbac-permission.repository.js.map

@@ -1 +1 @@
-{"version":3,"file":"rbac-permission.repository.js","sourceRoot":"","sources":["../../../../src/foundations/rbac/repositories/rbac-permission.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAoD;AACpD,8EAA0E;AAC1E,oFAA+E;AAQ/E;;;;;;;;;;GAUG;AAEI,IAAM,wBAAwB,gCAA9B,MAAM,wBAAwB;IAGnC,YAA6B,KAAmB;QAAnB,UAAK,GAAL,KAAK,CAAc;QAF/B,WAAM,GAAG,IAAI,eAAM,CAAC,0BAAwB,CAAC,IAAI,CAAC,CAAC;IAEjB,CAAC;IAEpD;;;;;;;;;;OAUG;IACH,KAAK,CAAC,+BAA+B,CAAC,MAAc;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAClC;;QAEE,yCAAkB;OACnB,EACD,EAAE,MAAM,EAAE,CACX,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuC,CAAC;QAC3D,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,UAAU,GAAQ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,UAAU,EAAE,UAAU,CAAC;YACrC,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;YACpB,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC;YACpC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,MAAM,IAAI,OAAO,SAAS,KAAK,QAAQ;gBAAE,SAAS;YACpF,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAsB,CAAC;gBACzD,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE;oBACV,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,KAAK,KAAK,IAAI;oBAC1D,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,KAAK,KAAK,IAAI;oBAC9D,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,KAAK,KAAK,IAAI;oBAC9D,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,KAAK,KAAK,IAAI;iBAC/D,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yEAAyE,EAAE,EAAE,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF,CAAA;AA/CY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;qCAIyB,4BAAY;GAHrC,wBAAwB,CA+CpC"}
+{"version":3,"file":"rbac-permission.repository.js","sourceRoot":"","sources":["../../../../src/foundations/rbac/repositories/rbac-permission.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAoD;AACpD,8EAA0E;AAE1E,qEAAiE;AACjE,oFAAiG;AAejG;;;;;;;;;;GAUG;AAEI,IAAM,wBAAwB,gCAA9B,MAAM,wBAAwB;IAGnC,YAA6B,KAAmB;QAAnB,UAAK,GAAL,KAAK,CAAc;QAF/B,WAAM,GAAG,IAAI,eAAM,CAAC,0BAAwB,CAAC,IAAI,CAAC,CAAC;IAEjB,CAAC;IAEpD;;;;;;;;;;OAUG;IACH,KAAK,CAAC,+BAA+B,CAAC,MAAc;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAClC;;QAEE,yCAAkB;OACnB,EACD,EAAE,MAAM,EAAE,CACX,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuC,CAAC;QAC3D,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,UAAU,GAAQ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,UAAU,EAAE,UAAU,CAAC;YACrC,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;YACpB,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC;YACpC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,MAAM,IAAI,OAAO,SAAS,KAAK,QAAQ;gBAAE,SAAS;YACpF,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAsB,CAAC;gBACzD,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE;oBACV,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,KAAK,KAAK,IAAI;oBAC1D,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,KAAK,KAAK,IAAI;oBAC9D,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,KAAK,KAAK,IAAI;oBAC9D,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,KAAK,KAAK,IAAI;iBAC/D,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yEAAyE,EAAE,EAAE,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,wBAAwB,CAAC,MAG9B;QACC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS;YAC7B,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CACnB;;;YAGE,yCAAkB;WACnB,EACD,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CACvD;YACH,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,uCAAgB,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAE5E,MAAM,GAAG,GAAyB,IAAI,GAAG,EAAE,CAAC;QAC5C,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,UAAU,GAAQ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,UAAU,EAAE,UAAU,CAAC;YACrC,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;YACpB,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC;YACpC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,MAAM,IAAI,OAAO,SAAS,KAAK,QAAQ;gBAAE,SAAS;YACpF,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAsB,CAAC;gBACzD,MAAM,KAAK,GAAG,CAAC,IAAgB,EAAoB,EAAE;oBACnD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,KAAK,CAAC;oBACtD,IAAI,GAAG,KAAK,IAAI;wBAAE,OAAO,IAAI,CAAC;oBAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;wBAAE,OAAO,GAAG,CAAC;oBAC1D,OAAO,KAAK,CAAC;gBACf,CAAC,CAAC;gBACF,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE;oBACV,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;oBACnB,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC;oBACvB,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC;oBACvB,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC;iBACxB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kEAAkE,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,2DAA2D;IAC3D,KAAK,CAAC,qBAAqB,CAAC,GAAa;QACvC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QAEvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,0BAAW,EAAE,CAAC,CAAC;QAChE,KAAK,CAAC,WAAW,GAAG,EAAE,GAAG,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC;QAClD,KAAK,CAAC,KAAK,IAAI;;;;KAId,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAS,KAAK,CAAC,CAAC;QACzD,OAAO,IAAI,GAAG,CAAS,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7D,CAAC;CACF,CAAA;AA3HY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;qCAIyB,4BAAY;GAHrC,wBAAwB,CA2HpC"}

package/dist/foundations/rbac/services/module-permission-audit.service.d.ts

@@ -0,0 +1,34 @@
+import { OnApplicationBootstrap } from "@nestjs/common";
+import { DiscoveryService, MetadataScanner, Reflector } from "@nestjs/core";
+import { RbacPermissionRepository } from "../repositories/rbac-permission.repository";
+interface AuditedRoute {
+    label: string;
+    module: string | undefined;
+    isWrite: boolean;
+}
+/**
+ * Boot audit for the permission gate. Runs only when the app bootstraps with
+ * `permissions: { enforce: true }` (API and worker).
+ *
+ * Refuses to start when:
+ * - a route guarded by a session guard is a write (POST/PUT/PATCH/DELETE, or a
+ *   `@ModuleACL` action that is a write) and has no section;
+ * - a section id referenced by any session-guarded route has no `(:Module)` node.
+ *
+ * This is what makes the gate fail closed for writes at startup instead of at
+ * request time.
+ */
+export declare class ModulePermissionAuditService implements OnApplicationBootstrap {
+    private readonly discovery;
+    private readonly metadataScanner;
+    private readonly reflector;
+    private readonly repository;
+    private readonly enforce?;
+    constructor(discovery: DiscoveryService, metadataScanner: MetadataScanner, reflector: Reflector, repository: RbacPermissionRepository, enforce?: boolean);
+    onApplicationBootstrap(): Promise<void>;
+    /** Every session-guarded route with its resolved section. Exposed for tests. */
+    collectRoutes(): AuditedRoute[];
+    audit(): Promise<void>;
+}
+export {};
+//# sourceMappingURL=module-permission-audit.service.d.ts.map

package/dist/foundations/rbac/services/module-permission-audit.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-permission-audit.service.d.ts","sourceRoot":"","sources":["../../../../src/foundations/rbac/services/module-permission-audit.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,sBAAsB,EAA2B,MAAM,gBAAgB,CAAC;AAErG,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAM5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AAatF,UAAU,YAAY;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,OAAO,EAAE,OAAO,CAAC;CAClB;AAcD;;;;;;;;;;;GAWG;AACH,qBACa,4BAA6B,YAAW,sBAAsB;IAEvE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAG3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;gBANR,SAAS,EAAE,gBAAgB,EAC3B,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,SAAS,EACpB,UAAU,EAAE,wBAAwB,EAGpC,OAAO,CAAC,EAAE,OAAO;IAG9B,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAK7C,gFAAgF;IAChF,aAAa,IAAI,YAAY,EAAE;IAyCzB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CA0B7B"}

package/dist/foundations/rbac/services/module-permission-audit.service.js

@@ -0,0 +1,137 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ModulePermissionAuditService = void 0;
+const common_1 = require("@nestjs/common");
+const constants_1 = require("@nestjs/common/constants");
+const core_1 = require("@nestjs/core");
+const module_decorator_1 = require("../../../common/decorators/module.decorator");
+const jwt_auth_admin_guard_1 = require("../../../common/guards/jwt.auth.admin.guard");
+const jwt_auth_guard_1 = require("../../../common/guards/jwt.auth.guard");
+const jwt_auth_optional_guard_1 = require("../../../common/guards/jwt.auth.optional.guard");
+const rbac_permission_repository_1 = require("../repositories/rbac-permission.repository");
+const rbac_tokens_1 = require("../rbac.tokens");
+const module_permission_gate_1 = require("./module-permission.gate");
+/** The guards that run `ModulePermissionGate`. Subclasses count too. */
+const SESSION_GUARDS = [
+    jwt_auth_guard_1.JwtAuthGuard,
+    jwt_auth_admin_guard_1.AdminJwtAuthGuard,
+    jwt_auth_optional_guard_1.OptionalJwtAuthGuard,
+];
+const WRITE_ACTIONS = new Set(["create", "update", "delete"]);
+function isSessionGuard(guard) {
+    const type = typeof guard === "function" ? guard : guard?.constructor;
+    if (typeof type !== "function")
+        return false;
+    return SESSION_GUARDS.some((g) => type === g || type.prototype instanceof g);
+}
+function joinPaths(prefix, path) {
+    const first = (value) => (Array.isArray(value) ? String(value[0] ?? "") : String(value ?? ""));
+    const parts = [first(prefix), first(path)].map((p) => p.replace(/^\/+|\/+$/g, "")).filter((p) => p.length);
+    return `/${parts.join("/")}`;
+}
+/**
+ * Boot audit for the permission gate. Runs only when the app bootstraps with
+ * `permissions: { enforce: true }` (API and worker).
+ *
+ * Refuses to start when:
+ * - a route guarded by a session guard is a write (POST/PUT/PATCH/DELETE, or a
+ *   `@ModuleACL` action that is a write) and has no section;
+ * - a section id referenced by any session-guarded route has no `(:Module)` node.
+ *
+ * This is what makes the gate fail closed for writes at startup instead of at
+ * request time.
+ */
+let ModulePermissionAuditService = class ModulePermissionAuditService {
+    constructor(discovery, metadataScanner, reflector, repository, enforce) {
+        this.discovery = discovery;
+        this.metadataScanner = metadataScanner;
+        this.reflector = reflector;
+        this.repository = repository;
+        this.enforce = enforce;
+    }
+    async onApplicationBootstrap() {
+        if (this.enforce !== true)
+            return;
+        await this.audit();
+    }
+    /** Every session-guarded route with its resolved section. Exposed for tests. */
+    collectRoutes() {
+        const routes = [];
+        for (const wrapper of this.discovery.getControllers()) {
+            const controller = wrapper.metatype;
+            if (typeof controller !== "function" || !controller.prototype)
+                continue;
+            const prototype = controller.prototype;
+            const classGuards = this.reflector.get(constants_1.GUARDS_METADATA, controller) ?? [];
+            const classDefinition = this.reflector.get(module_decorator_1.MODULE_ACL_METADATA, controller);
+            const controllerPath = this.reflector.get(constants_1.PATH_METADATA, controller);
+            for (const methodName of this.metadataScanner.getAllMethodNames(prototype)) {
+                const handler = prototype[methodName];
+                if (typeof handler !== "function")
+                    continue;
+                const requestMethod = this.reflector.get(constants_1.METHOD_METADATA, handler);
+                const routePath = this.reflector.get(constants_1.PATH_METADATA, handler);
+                if (requestMethod === undefined || routePath === undefined)
+                    continue;
+                const handlerGuards = this.reflector.get(constants_1.GUARDS_METADATA, handler) ?? [];
+                if (![...classGuards, ...handlerGuards].some(isSessionGuard))
+                    continue;
+                const method = common_1.RequestMethod[requestMethod] ?? String(requestMethod);
+                const { module, action } = (0, module_permission_gate_1.resolveRouteAcl)({
+                    classDefinition,
+                    handlerDefinition: this.reflector.get(module_decorator_1.MODULE_ACL_METADATA, handler),
+                    method,
+                });
+                routes.push({
+                    label: `${method} ${joinPaths(controllerPath, routePath)} (${controller.name}.${methodName})`,
+                    module,
+                    isWrite: WRITE_ACTIONS.has(action),
+                });
+            }
+        }
+        return routes;
+    }
+    async audit() {
+        const routes = this.collectRoutes();
+        const unsectioned = routes.filter((r) => r.isWrite && !r.module).map((r) => r.label);
+        if (unsectioned.length > 0) {
+            throw new Error(`Permission audit failed: ${unsectioned.length} session-guarded write route(s) have no @ModuleACL section:\n` +
+                unsectioned.map((label) => `  - ${label}`).join("\n"));
+        }
+        const referenced = Array.from(new Set(routes.map((r) => r.module).filter((m) => !!m))).sort();
+        const existing = await this.repository.findExistingModuleIds(referenced);
+        const missing = referenced.filter((id) => !existing.has(id));
+        if (missing.length > 0) {
+            const byModule = missing.map((id) => {
+                const example = routes.find((r) => r.module === id)?.label ?? "";
+                return `  - ${id} (e.g. ${example})`;
+            });
+            throw new Error(`Permission audit failed: ${missing.length} section id(s) referenced by @ModuleACL have no (:Module) node. ` +
+                `Seed them in a migration before switching permissions.enforce on:\n` +
+                byModule.join("\n"));
+        }
+    }
+};
+exports.ModulePermissionAuditService = ModulePermissionAuditService;
+exports.ModulePermissionAuditService = ModulePermissionAuditService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(4, (0, common_1.Optional)()),
+    __param(4, (0, common_1.Inject)(rbac_tokens_1.PERMISSIONS_ENFORCE)),
+    __metadata("design:paramtypes", [core_1.DiscoveryService,
+        core_1.MetadataScanner,
+        core_1.Reflector,
+        rbac_permission_repository_1.RbacPermissionRepository, Boolean])
+], ModulePermissionAuditService);
+//# sourceMappingURL=module-permission-audit.service.js.map

package/dist/foundations/rbac/services/module-permission-audit.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-permission-audit.service.js","sourceRoot":"","sources":["../../../../src/foundations/rbac/services/module-permission-audit.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAqG;AACrG,wDAA2F;AAC3F,uCAA4E;AAC5E,kFAAkF;AAElF,sFAAgF;AAChF,0EAAqE;AACrE,4FAAsF;AACtF,2FAAsF;AACtF,gDAAqD;AACrD,qEAA2D;AAE3D,wEAAwE;AACxE,MAAM,cAAc,GAAoD;IACtE,6BAAY;IACZ,wCAAiB;IACjB,8CAAoB;CACrB,CAAC;AAEF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAQ9D,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,IAAI,GAAQ,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,KAAa,EAAE,WAAW,CAAC;IACpF,IAAI,OAAO,IAAI,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,SAAS,CAAC,MAAe,EAAE,IAAa;IAC/C,MAAM,KAAK,GAAG,CAAC,KAAc,EAAU,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IAChH,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3G,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;GAWG;AAEI,IAAM,4BAA4B,GAAlC,MAAM,4BAA4B;IACvC,YACmB,SAA2B,EAC3B,eAAgC,EAChC,SAAoB,EACpB,UAAoC,EAGpC,OAAiB;QANjB,cAAS,GAAT,SAAS,CAAkB;QAC3B,oBAAe,GAAf,eAAe,CAAiB;QAChC,cAAS,GAAT,SAAS,CAAW;QACpB,eAAU,GAAV,UAAU,CAA0B;QAGpC,YAAO,GAAP,OAAO,CAAU;IACjC,CAAC;IAEJ,KAAK,CAAC,sBAAsB;QAC1B,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;YAAE,OAAO;QAClC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,gFAAgF;IAChF,aAAa;QACX,MAAM,MAAM,GAAmB,EAAE,CAAC;QAElC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,CAAC;YACtD,MAAM,UAAU,GAAG,OAAO,CAAC,QAAe,CAAC;YAC3C,IAAI,OAAO,UAAU,KAAK,UAAU,IAAI,CAAC,UAAU,CAAC,SAAS;gBAAE,SAAS;YAExE,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;YACvC,MAAM,WAAW,GAAc,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,2BAAe,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;YACrF,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAmB,sCAAmB,EAAE,UAAU,CAAC,CAAC;YAC9F,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,yBAAa,EAAE,UAAU,CAAC,CAAC;YAErE,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3E,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;gBACtC,IAAI,OAAO,OAAO,KAAK,UAAU;oBAAE,SAAS;gBAE5C,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAgB,2BAAe,EAAE,OAAO,CAAC,CAAC;gBAClF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,yBAAa,EAAE,OAAO,CAAC,CAAC;gBAC7D,IAAI,aAAa,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;oBAAE,SAAS;gBAErE,MAAM,aAAa,GAAc,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,2BAAe,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;gBACpF,IAAI,CAAC,CAAC,GAAG,WAAW,EAAE,GAAG,aAAa,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;oBAAE,SAAS;gBAEvE,MAAM,MAAM,GAAG,sBAAa,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC;gBACrE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,wCAAe,EAAC;oBACzC,eAAe;oBACf,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAmB,sCAAmB,EAAE,OAAO,CAAC;oBACrF,MAAM;iBACP,CAAC,CAAC;gBAEH,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,GAAG,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,SAAS,CAAC,KAAK,UAAU,CAAC,IAAI,IAAI,UAAU,GAAG;oBAC7F,MAAM;oBACN,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC;iBACnC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAEpC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACrF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,4BAA4B,WAAW,CAAC,MAAM,+DAA+D;gBAC3G,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACxD,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3G,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;gBAClC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;gBACjE,OAAO,OAAO,EAAE,UAAU,OAAO,GAAG,CAAC;YACvC,CAAC,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CACb,4BAA4B,OAAO,CAAC,MAAM,kEAAkE;gBAC1G,qEAAqE;gBACrE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CACtB,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAA;AApFY,oEAA4B;uCAA5B,4BAA4B;IADxC,IAAA,mBAAU,GAAE;IAOR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,iCAAmB,CAAC,CAAA;qCALA,uBAAgB;QACV,sBAAe;QACrB,gBAAS;QACR,qDAAwB;GAL5C,4BAA4B,CAoFxC"}

package/dist/foundations/rbac/services/module-permission.gate.d.ts

@@ -0,0 +1,51 @@
+import { ExecutionContext } from "@nestjs/common";
+import { Reflector } from "@nestjs/core";
+import { ClsService } from "nestjs-cls";
+import type { ModuleDefinition } from "../../../common/decorators/module.decorator";
+import { ModulePermissionService } from "./module-permission.service";
+import type { RbacAction } from "./rbac-permission.service";
+/**
+ * HTTP method → permission action. GET/HEAD/OPTIONS read, POST create, PUT/PATCH
+ * update, DELETE delete. Anything else is treated as a write (update), so an
+ * unexpected verb never slips through as a read.
+ */
+export declare function rbacActionForHttpMethod(method: string | undefined): RbacAction;
+/**
+ * Section and action of a route: the handler `@ModuleACL` wins over the class
+ * one, field by field; the action falls back to the HTTP-method mapping.
+ */
+export declare function resolveRouteAcl(params: {
+    classDefinition: ModuleDefinition | undefined;
+    handlerDefinition: ModuleDefinition | undefined;
+    method: string | undefined;
+}): {
+    module: string | undefined;
+    action: RbacAction;
+};
+/**
+ * Request-level permission check, run by the session guards (`JwtAuthGuard`,
+ * `AdminJwtAuthGuard`, `OptionalJwtAuthGuard`) right after authentication.
+ *
+ * Off unless the app bootstraps with `permissions: { enforce: true }`: with it
+ * off, `assert` returns before reading metadata or touching the database.
+ *
+ * Rules:
+ * - A read with no section is allowed (company scoping still applies).
+ * - A write with no section is refused (the boot audit makes this unreachable).
+ * - Otherwise the caller's effective permission in the token's company decides:
+ *   `true` or a record path allows, `false` or absent refuses with 403.
+ * - No administrator bypass.
+ */
+export declare class ModulePermissionGate {
+    private readonly reflector;
+    private readonly cls;
+    private readonly permissions;
+    private readonly enforce?;
+    constructor(reflector: Reflector, cls: ClsService, permissions: ModulePermissionService, enforce?: boolean);
+    get enabled(): boolean;
+    assert(params: {
+        request: any;
+        context: ExecutionContext;
+    }): Promise<void>;
+}
+//# sourceMappingURL=module-permission.gate.d.ts.map

package/dist/foundations/rbac/services/module-permission.gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-permission.gate.d.ts","sourceRoot":"","sources":["../../../../src/foundations/rbac/services/module-permission.gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAoD,MAAM,gBAAgB,CAAC;AACpG,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAC;AAEpF,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAE5D;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,CAa9E;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE;IACtC,eAAe,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC9C,iBAAiB,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAChD,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B,GAAG;IAAE,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,CAKrD;AAED;;;;;;;;;;;;;GAaG;AACH,qBACa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAG5B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;gBALR,SAAS,EAAE,SAAS,EACpB,GAAG,EAAE,UAAU,EACf,WAAW,EAAE,uBAAuB,EAGpC,OAAO,CAAC,EAAE,OAAO;IAGpC,IAAI,OAAO,IAAI,OAAO,CAErB;IAEK,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,GAAG,CAAC;QAAC,OAAO,EAAE,gBAAgB,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAuBjF"}