@carlonicora/nestjs-neo4jsonapi 6.6.2 → 6.8.0

package/dist/foundations/rbac/services/module-permission-audit.service.d.ts

@@ -0,0 +1,34 @@
+import { OnApplicationBootstrap } from "@nestjs/common";
+import { DiscoveryService, MetadataScanner, Reflector } from "@nestjs/core";
+import { RbacPermissionRepository } from "../repositories/rbac-permission.repository";
+interface AuditedRoute {
+    label: string;
+    module: string | undefined;
+    isWrite: boolean;
+}
+/**
+ * Boot audit for the permission gate. Runs only when the app bootstraps with
+ * `permissions: { enforce: true }` (API and worker).
+ *
+ * Refuses to start when:
+ * - a route guarded by a session guard is a write (POST/PUT/PATCH/DELETE, or a
+ *   `@ModuleACL` action that is a write) and has no section;
+ * - a section id referenced by any session-guarded route has no `(:Module)` node.
+ *
+ * This is what makes the gate fail closed for writes at startup instead of at
+ * request time.
+ */
+export declare class ModulePermissionAuditService implements OnApplicationBootstrap {
+    private readonly discovery;
+    private readonly metadataScanner;
+    private readonly reflector;
+    private readonly repository;
+    private readonly enforce?;
+    constructor(discovery: DiscoveryService, metadataScanner: MetadataScanner, reflector: Reflector, repository: RbacPermissionRepository, enforce?: boolean);
+    onApplicationBootstrap(): Promise<void>;
+    /** Every session-guarded route with its resolved section. Exposed for tests. */
+    collectRoutes(): AuditedRoute[];
+    audit(): Promise<void>;
+}
+export {};
+//# sourceMappingURL=module-permission-audit.service.d.ts.map

package/dist/foundations/rbac/services/module-permission-audit.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-permission-audit.service.d.ts","sourceRoot":"","sources":["../../../../src/foundations/rbac/services/module-permission-audit.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,sBAAsB,EAA2B,MAAM,gBAAgB,CAAC;AAErG,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAM5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AAatF,UAAU,YAAY;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,OAAO,EAAE,OAAO,CAAC;CAClB;AAcD;;;;;;;;;;;GAWG;AACH,qBACa,4BAA6B,YAAW,sBAAsB;IAEvE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAG3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;gBANR,SAAS,EAAE,gBAAgB,EAC3B,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,SAAS,EACpB,UAAU,EAAE,wBAAwB,EAGpC,OAAO,CAAC,EAAE,OAAO;IAG9B,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAK7C,gFAAgF;IAChF,aAAa,IAAI,YAAY,EAAE;IAyCzB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CA0B7B"}

package/dist/foundations/rbac/services/module-permission-audit.service.js

@@ -0,0 +1,137 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ModulePermissionAuditService = void 0;
+const common_1 = require("@nestjs/common");
+const constants_1 = require("@nestjs/common/constants");
+const core_1 = require("@nestjs/core");
+const module_decorator_1 = require("../../../common/decorators/module.decorator");
+const jwt_auth_admin_guard_1 = require("../../../common/guards/jwt.auth.admin.guard");
+const jwt_auth_guard_1 = require("../../../common/guards/jwt.auth.guard");
+const jwt_auth_optional_guard_1 = require("../../../common/guards/jwt.auth.optional.guard");
+const rbac_permission_repository_1 = require("../repositories/rbac-permission.repository");
+const rbac_tokens_1 = require("../rbac.tokens");
+const module_permission_gate_1 = require("./module-permission.gate");
+/** The guards that run `ModulePermissionGate`. Subclasses count too. */
+const SESSION_GUARDS = [
+    jwt_auth_guard_1.JwtAuthGuard,
+    jwt_auth_admin_guard_1.AdminJwtAuthGuard,
+    jwt_auth_optional_guard_1.OptionalJwtAuthGuard,
+];
+const WRITE_ACTIONS = new Set(["create", "update", "delete"]);
+function isSessionGuard(guard) {
+    const type = typeof guard === "function" ? guard : guard?.constructor;
+    if (typeof type !== "function")
+        return false;
+    return SESSION_GUARDS.some((g) => type === g || type.prototype instanceof g);
+}
+function joinPaths(prefix, path) {
+    const first = (value) => (Array.isArray(value) ? String(value[0] ?? "") : String(value ?? ""));
+    const parts = [first(prefix), first(path)].map((p) => p.replace(/^\/+|\/+$/g, "")).filter((p) => p.length);
+    return `/${parts.join("/")}`;
+}
+/**
+ * Boot audit for the permission gate. Runs only when the app bootstraps with
+ * `permissions: { enforce: true }` (API and worker).
+ *
+ * Refuses to start when:
+ * - a route guarded by a session guard is a write (POST/PUT/PATCH/DELETE, or a
+ *   `@ModuleACL` action that is a write) and has no section;
+ * - a section id referenced by any session-guarded route has no `(:Module)` node.
+ *
+ * This is what makes the gate fail closed for writes at startup instead of at
+ * request time.
+ */
+let ModulePermissionAuditService = class ModulePermissionAuditService {
+    constructor(discovery, metadataScanner, reflector, repository, enforce) {
+        this.discovery = discovery;
+        this.metadataScanner = metadataScanner;
+        this.reflector = reflector;
+        this.repository = repository;
+        this.enforce = enforce;
+    }
+    async onApplicationBootstrap() {
+        if (this.enforce !== true)
+            return;
+        await this.audit();
+    }
+    /** Every session-guarded route with its resolved section. Exposed for tests. */
+    collectRoutes() {
+        const routes = [];
+        for (const wrapper of this.discovery.getControllers()) {
+            const controller = wrapper.metatype;
+            if (typeof controller !== "function" || !controller.prototype)
+                continue;
+            const prototype = controller.prototype;
+            const classGuards = this.reflector.get(constants_1.GUARDS_METADATA, controller) ?? [];
+            const classDefinition = this.reflector.get(module_decorator_1.MODULE_ACL_METADATA, controller);
+            const controllerPath = this.reflector.get(constants_1.PATH_METADATA, controller);
+            for (const methodName of this.metadataScanner.getAllMethodNames(prototype)) {
+                const handler = prototype[methodName];
+                if (typeof handler !== "function")
+                    continue;
+                const requestMethod = this.reflector.get(constants_1.METHOD_METADATA, handler);
+                const routePath = this.reflector.get(constants_1.PATH_METADATA, handler);
+                if (requestMethod === undefined || routePath === undefined)
+                    continue;
+                const handlerGuards = this.reflector.get(constants_1.GUARDS_METADATA, handler) ?? [];
+                if (![...classGuards, ...handlerGuards].some(isSessionGuard))
+                    continue;
+                const method = common_1.RequestMethod[requestMethod] ?? String(requestMethod);
+                const { module, action } = (0, module_permission_gate_1.resolveRouteAcl)({
+                    classDefinition,
+                    handlerDefinition: this.reflector.get(module_decorator_1.MODULE_ACL_METADATA, handler),
+                    method,
+                });
+                routes.push({
+                    label: `${method} ${joinPaths(controllerPath, routePath)} (${controller.name}.${methodName})`,
+                    module,
+                    isWrite: WRITE_ACTIONS.has(action),
+                });
+            }
+        }
+        return routes;
+    }
+    async audit() {
+        const routes = this.collectRoutes();
+        const unsectioned = routes.filter((r) => r.isWrite && !r.module).map((r) => r.label);
+        if (unsectioned.length > 0) {
+            throw new Error(`Permission audit failed: ${unsectioned.length} session-guarded write route(s) have no @ModuleACL section:\n` +
+                unsectioned.map((label) => `  - ${label}`).join("\n"));
+        }
+        const referenced = Array.from(new Set(routes.map((r) => r.module).filter((m) => !!m))).sort();
+        const existing = await this.repository.findExistingModuleIds(referenced);
+        const missing = referenced.filter((id) => !existing.has(id));
+        if (missing.length > 0) {
+            const byModule = missing.map((id) => {
+                const example = routes.find((r) => r.module === id)?.label ?? "";
+                return `  - ${id} (e.g. ${example})`;
+            });
+            throw new Error(`Permission audit failed: ${missing.length} section id(s) referenced by @ModuleACL have no (:Module) node. ` +
+                `Seed them in a migration before switching permissions.enforce on:\n` +
+                byModule.join("\n"));
+        }
+    }
+};
+exports.ModulePermissionAuditService = ModulePermissionAuditService;
+exports.ModulePermissionAuditService = ModulePermissionAuditService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(4, (0, common_1.Optional)()),
+    __param(4, (0, common_1.Inject)(rbac_tokens_1.PERMISSIONS_ENFORCE)),
+    __metadata("design:paramtypes", [core_1.DiscoveryService,
+        core_1.MetadataScanner,
+        core_1.Reflector,
+        rbac_permission_repository_1.RbacPermissionRepository, Boolean])
+], ModulePermissionAuditService);
+//# sourceMappingURL=module-permission-audit.service.js.map

package/dist/foundations/rbac/services/module-permission-audit.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-permission-audit.service.js","sourceRoot":"","sources":["../../../../src/foundations/rbac/services/module-permission-audit.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAqG;AACrG,wDAA2F;AAC3F,uCAA4E;AAC5E,kFAAkF;AAElF,sFAAgF;AAChF,0EAAqE;AACrE,4FAAsF;AACtF,2FAAsF;AACtF,gDAAqD;AACrD,qEAA2D;AAE3D,wEAAwE;AACxE,MAAM,cAAc,GAAoD;IACtE,6BAAY;IACZ,wCAAiB;IACjB,8CAAoB;CACrB,CAAC;AAEF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAQ9D,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,IAAI,GAAQ,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,KAAa,EAAE,WAAW,CAAC;IACpF,IAAI,OAAO,IAAI,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,SAAS,CAAC,MAAe,EAAE,IAAa;IAC/C,MAAM,KAAK,GAAG,CAAC,KAAc,EAAU,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IAChH,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3G,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;GAWG;AAEI,IAAM,4BAA4B,GAAlC,MAAM,4BAA4B;IACvC,YACmB,SAA2B,EAC3B,eAAgC,EAChC,SAAoB,EACpB,UAAoC,EAGpC,OAAiB;QANjB,cAAS,GAAT,SAAS,CAAkB;QAC3B,oBAAe,GAAf,eAAe,CAAiB;QAChC,cAAS,GAAT,SAAS,CAAW;QACpB,eAAU,GAAV,UAAU,CAA0B;QAGpC,YAAO,GAAP,OAAO,CAAU;IACjC,CAAC;IAEJ,KAAK,CAAC,sBAAsB;QAC1B,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;YAAE,OAAO;QAClC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,gFAAgF;IAChF,aAAa;QACX,MAAM,MAAM,GAAmB,EAAE,CAAC;QAElC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,CAAC;YACtD,MAAM,UAAU,GAAG,OAAO,CAAC,QAAe,CAAC;YAC3C,IAAI,OAAO,UAAU,KAAK,UAAU,IAAI,CAAC,UAAU,CAAC,SAAS;gBAAE,SAAS;YAExE,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;YACvC,MAAM,WAAW,GAAc,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,2BAAe,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;YACrF,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAmB,sCAAmB,EAAE,UAAU,CAAC,CAAC;YAC9F,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,yBAAa,EAAE,UAAU,CAAC,CAAC;YAErE,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3E,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;gBACtC,IAAI,OAAO,OAAO,KAAK,UAAU;oBAAE,SAAS;gBAE5C,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAgB,2BAAe,EAAE,OAAO,CAAC,CAAC;gBAClF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,yBAAa,EAAE,OAAO,CAAC,CAAC;gBAC7D,IAAI,aAAa,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;oBAAE,SAAS;gBAErE,MAAM,aAAa,GAAc,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,2BAAe,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;gBACpF,IAAI,CAAC,CAAC,GAAG,WAAW,EAAE,GAAG,aAAa,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;oBAAE,SAAS;gBAEvE,MAAM,MAAM,GAAG,sBAAa,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC;gBACrE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,wCAAe,EAAC;oBACzC,eAAe;oBACf,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAmB,sCAAmB,EAAE,OAAO,CAAC;oBACrF,MAAM;iBACP,CAAC,CAAC;gBAEH,MAAM,CAAC,IAAI,CAAC;oBACV,KAAK,EAAE,GAAG,MAAM,IAAI,SAAS,CAAC,cAAc,EAAE,SAAS,CAAC,KAAK,UAAU,CAAC,IAAI,IAAI,UAAU,GAAG;oBAC7F,MAAM;oBACN,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC;iBACnC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAEpC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACrF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,4BAA4B,WAAW,CAAC,MAAM,+DAA+D;gBAC3G,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACxD,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3G,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;gBAClC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;gBACjE,OAAO,OAAO,EAAE,UAAU,OAAO,GAAG,CAAC;YACvC,CAAC,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CACb,4BAA4B,OAAO,CAAC,MAAM,kEAAkE;gBAC1G,qEAAqE;gBACrE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CACtB,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAA;AApFY,oEAA4B;uCAA5B,4BAA4B;IADxC,IAAA,mBAAU,GAAE;IAOR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,iCAAmB,CAAC,CAAA;qCALA,uBAAgB;QACV,sBAAe;QACrB,gBAAS;QACR,qDAAwB;GAL5C,4BAA4B,CAoFxC"}

package/dist/foundations/rbac/services/module-permission.gate.d.ts

@@ -0,0 +1,51 @@
+import { ExecutionContext } from "@nestjs/common";
+import { Reflector } from "@nestjs/core";
+import { ClsService } from "nestjs-cls";
+import type { ModuleDefinition } from "../../../common/decorators/module.decorator";
+import { ModulePermissionService } from "./module-permission.service";
+import type { RbacAction } from "./rbac-permission.service";
+/**
+ * HTTP method → permission action. GET/HEAD/OPTIONS read, POST create, PUT/PATCH
+ * update, DELETE delete. Anything else is treated as a write (update), so an
+ * unexpected verb never slips through as a read.
+ */
+export declare function rbacActionForHttpMethod(method: string | undefined): RbacAction;
+/**
+ * Section and action of a route: the handler `@ModuleACL` wins over the class
+ * one, field by field; the action falls back to the HTTP-method mapping.
+ */
+export declare function resolveRouteAcl(params: {
+    classDefinition: ModuleDefinition | undefined;
+    handlerDefinition: ModuleDefinition | undefined;
+    method: string | undefined;
+}): {
+    module: string | undefined;
+    action: RbacAction;
+};
+/**
+ * Request-level permission check, run by the session guards (`JwtAuthGuard`,
+ * `AdminJwtAuthGuard`, `OptionalJwtAuthGuard`) right after authentication.
+ *
+ * Off unless the app bootstraps with `permissions: { enforce: true }`: with it
+ * off, `assert` returns before reading metadata or touching the database.
+ *
+ * Rules:
+ * - A read with no section is allowed (company scoping still applies).
+ * - A write with no section is refused (the boot audit makes this unreachable).
+ * - Otherwise the caller's effective permission in the token's company decides:
+ *   `true` or a record path allows, `false` or absent refuses with 403.
+ * - No administrator bypass.
+ */
+export declare class ModulePermissionGate {
+    private readonly reflector;
+    private readonly cls;
+    private readonly permissions;
+    private readonly enforce?;
+    constructor(reflector: Reflector, cls: ClsService, permissions: ModulePermissionService, enforce?: boolean);
+    get enabled(): boolean;
+    assert(params: {
+        request: any;
+        context: ExecutionContext;
+    }): Promise<void>;
+}
+//# sourceMappingURL=module-permission.gate.d.ts.map

package/dist/foundations/rbac/services/module-permission.gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-permission.gate.d.ts","sourceRoot":"","sources":["../../../../src/foundations/rbac/services/module-permission.gate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAoD,MAAM,gBAAgB,CAAC;AACpG,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAC;AAEpF,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAE5D;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,CAa9E;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE;IACtC,eAAe,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC9C,iBAAiB,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAChD,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B,GAAG;IAAE,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,CAKrD;AAED;;;;;;;;;;;;;GAaG;AACH,qBACa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAG5B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;gBALR,SAAS,EAAE,SAAS,EACpB,GAAG,EAAE,UAAU,EACf,WAAW,EAAE,uBAAuB,EAGpC,OAAO,CAAC,EAAE,OAAO;IAGpC,IAAI,OAAO,IAAI,OAAO,CAErB;IAEK,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,GAAG,CAAC;QAAC,OAAO,EAAE,gBAAgB,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAuBjF"}

package/dist/foundations/rbac/services/module-permission.gate.js

@@ -0,0 +1,108 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ModulePermissionGate = void 0;
+exports.rbacActionForHttpMethod = rbacActionForHttpMethod;
+exports.resolveRouteAcl = resolveRouteAcl;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const nestjs_cls_1 = require("nestjs-cls");
+const module_decorator_1 = require("../../../common/decorators/module.decorator");
+const rbac_tokens_1 = require("../rbac.tokens");
+const module_permission_service_1 = require("./module-permission.service");
+/**
+ * HTTP method → permission action. GET/HEAD/OPTIONS read, POST create, PUT/PATCH
+ * update, DELETE delete. Anything else is treated as a write (update), so an
+ * unexpected verb never slips through as a read.
+ */
+function rbacActionForHttpMethod(method) {
+    switch ((method ?? "").toUpperCase()) {
+        case "GET":
+        case "HEAD":
+        case "OPTIONS":
+            return "read";
+        case "POST":
+            return "create";
+        case "DELETE":
+            return "delete";
+        default:
+            return "update";
+    }
+}
+/**
+ * Section and action of a route: the handler `@ModuleACL` wins over the class
+ * one, field by field; the action falls back to the HTTP-method mapping.
+ */
+function resolveRouteAcl(params) {
+    const module = params.handlerDefinition?.module ?? params.classDefinition?.module;
+    const action = params.handlerDefinition?.action ?? params.classDefinition?.action ?? rbacActionForHttpMethod(params.method);
+    return { module: module || undefined, action };
+}
+/**
+ * Request-level permission check, run by the session guards (`JwtAuthGuard`,
+ * `AdminJwtAuthGuard`, `OptionalJwtAuthGuard`) right after authentication.
+ *
+ * Off unless the app bootstraps with `permissions: { enforce: true }`: with it
+ * off, `assert` returns before reading metadata or touching the database.
+ *
+ * Rules:
+ * - A read with no section is allowed (company scoping still applies).
+ * - A write with no section is refused (the boot audit makes this unreachable).
+ * - Otherwise the caller's effective permission in the token's company decides:
+ *   `true` or a record path allows, `false` or absent refuses with 403.
+ * - No administrator bypass.
+ */
+let ModulePermissionGate = class ModulePermissionGate {
+    constructor(reflector, cls, permissions, enforce) {
+        this.reflector = reflector;
+        this.cls = cls;
+        this.permissions = permissions;
+        this.enforce = enforce;
+    }
+    get enabled() {
+        return this.enforce === true;
+    }
+    async assert(params) {
+        if (!this.enabled)
+            return;
+        const userId = params.request?.user?.userId;
+        // No authenticated session (optional guard, anonymous caller): nothing to evaluate.
+        if (!userId)
+            return;
+        const { module, action } = resolveRouteAcl({
+            classDefinition: this.reflector.get(module_decorator_1.MODULE_ACL_METADATA, params.context.getClass()),
+            handlerDefinition: this.reflector.get(module_decorator_1.MODULE_ACL_METADATA, params.context.getHandler()),
+            method: params.request?.method,
+        });
+        if (!module) {
+            if (action === "read")
+                return;
+            throw new common_1.ForbiddenException();
+        }
+        const companyId = (this.cls.isActive() ? this.cls.get("companyId") : undefined) ?? undefined;
+        const allowed = await this.permissions.allows({ userId, companyId, moduleId: module, action });
+        if (!allowed)
+            throw new common_1.ForbiddenException();
+    }
+};
+exports.ModulePermissionGate = ModulePermissionGate;
+exports.ModulePermissionGate = ModulePermissionGate = __decorate([
+    (0, common_1.Injectable)(),
+    __param(3, (0, common_1.Optional)()),
+    __param(3, (0, common_1.Inject)(rbac_tokens_1.PERMISSIONS_ENFORCE)),
+    __metadata("design:paramtypes", [core_1.Reflector,
+        nestjs_cls_1.ClsService,
+        module_permission_service_1.ModulePermissionService, Boolean])
+], ModulePermissionGate);
+//# sourceMappingURL=module-permission.gate.js.map

package/dist/foundations/rbac/services/module-permission.gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-permission.gate.js","sourceRoot":"","sources":["../../../../src/foundations/rbac/services/module-permission.gate.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAcA,0DAaC;AAMD,0CASC;AA1CD,2CAAoG;AACpG,uCAAyC;AACzC,2CAAwC;AACxC,kFAAkF;AAElF,gDAAqD;AACrD,2EAAsE;AAGtE;;;;GAIG;AACH,SAAgB,uBAAuB,CAAC,MAA0B;IAChE,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACrC,KAAK,KAAK,CAAC;QACX,KAAK,MAAM,CAAC;QACZ,KAAK,SAAS;YACZ,OAAO,MAAM,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,QAAQ,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB;YACE,OAAO,QAAQ,CAAC;IACpB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAAC,MAI/B;IACC,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,EAAE,MAAM,IAAI,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC;IAClF,MAAM,MAAM,GACV,MAAM,CAAC,iBAAiB,EAAE,MAAM,IAAI,MAAM,CAAC,eAAe,EAAE,MAAM,IAAI,uBAAuB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/G,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;;;GAaG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B,YACmB,SAAoB,EACpB,GAAe,EACf,WAAoC,EAGpC,OAAiB;QALjB,cAAS,GAAT,SAAS,CAAW;QACpB,QAAG,GAAH,GAAG,CAAY;QACf,gBAAW,GAAX,WAAW,CAAyB;QAGpC,YAAO,GAAP,OAAO,CAAU;IACjC,CAAC;IAEJ,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAmD;QAC9D,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAE1B,MAAM,MAAM,GAAuB,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC;QAChE,oFAAoF;QACpF,IAAI,CAAC,MAAM;YAAE,OAAO;QAEpB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC;YACzC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAmB,sCAAmB,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrG,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAmB,sCAAmB,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACzG,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM;SAC/B,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,MAAM,KAAK,MAAM;gBAAE,OAAO;YAC9B,MAAM,IAAI,2BAAkB,EAAE,CAAC;QACjC,CAAC;QAED,MAAM,SAAS,GAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;QAEjH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/F,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,2BAAkB,EAAE,CAAC;IAC/C,CAAC;CACF,CAAA;AArCY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IACV,WAAA,IAAA,eAAM,EAAC,iCAAmB,CAAC,CAAA;qCAJA,gBAAS;QACf,uBAAU;QACF,mDAAuB;GAJ5C,oBAAoB,CAqChC"}

package/dist/foundations/rbac/services/module-permission.service.d.ts

@@ -0,0 +1,34 @@
+import { ClsService } from "nestjs-cls";
+import { RbacPermissionRepository } from "../repositories/rbac-permission.repository";
+import type { EffectivePermissions } from "../repositories/rbac-permission.repository";
+import type { RbacAction } from "./rbac-permission.service";
+export type { EffectivePermissions } from "../repositories/rbac-permission.repository";
+/**
+ * Resolves a caller's effective permissions in the token's company, for the
+ * request-level permission gate (`ModulePermissionGate`).
+ *
+ * Mirrors `RbacPermissionService` (same `featureModuleQuery` resolution) with
+ * three differences: it binds the token's company instead of the legacy
+ * `BELONGS_TO` edge, it keeps record-path values (a string allows at the
+ * section level), and it resolves once per request (cached in CLS).
+ *
+ * No administrator bypass: the platform Administrator is resolved like any
+ * role, so its grants must exist in the app's permission table.
+ */
+export declare class ModulePermissionService {
+    private readonly repository;
+    private readonly cls;
+    constructor(repository: RbacPermissionRepository, cls: ClsService);
+    resolve(params: {
+        userId: string;
+        companyId: string | undefined;
+    }): Promise<EffectivePermissions>;
+    /** True when the effective value is `true` or a non-empty record path. */
+    allows(params: {
+        userId: string;
+        companyId: string | undefined;
+        moduleId: string;
+        action: RbacAction;
+    }): Promise<boolean>;
+}
+//# sourceMappingURL=module-permission.service.d.ts.map

package/dist/foundations/rbac/services/module-permission.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-permission.service.d.ts","sourceRoot":"","sources":["../../../../src/foundations/rbac/services/module-permission.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AACtF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAE5D,YAAY,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAUvF;;;;;;;;;;;GAWG;AACH,qBACa,uBAAuB;IAEhC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,GAAG;gBADH,UAAU,EAAE,wBAAwB,EACpC,GAAG,EAAE,UAAU;IAG5B,OAAO,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAmBvG,0EAA0E;IACpE,MAAM,CAAC,MAAM,EAAE;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;QAC9B,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,UAAU,CAAC;KACpB,GAAG,OAAO,CAAC,OAAO,CAAC;CAKrB"}

package/dist/foundations/rbac/services/module-permission.service.js

@@ -0,0 +1,64 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ModulePermissionService = void 0;
+const common_1 = require("@nestjs/common");
+const nestjs_cls_1 = require("nestjs-cls");
+const rbac_permission_repository_1 = require("../repositories/rbac-permission.repository");
+/** CLS key holding the permissions resolved for the current request. */
+const CLS_KEY = "effectivePermissions";
+/**
+ * Resolves a caller's effective permissions in the token's company, for the
+ * request-level permission gate (`ModulePermissionGate`).
+ *
+ * Mirrors `RbacPermissionService` (same `featureModuleQuery` resolution) with
+ * three differences: it binds the token's company instead of the legacy
+ * `BELONGS_TO` edge, it keeps record-path values (a string allows at the
+ * section level), and it resolves once per request (cached in CLS).
+ *
+ * No administrator bypass: the platform Administrator is resolved like any
+ * role, so its grants must exist in the app's permission table.
+ */
+let ModulePermissionService = class ModulePermissionService {
+    constructor(repository, cls) {
+        this.repository = repository;
+        this.cls = cls;
+    }
+    async resolve(params) {
+        const key = `${params.userId}|${params.companyId ?? ""}`;
+        const clsActive = this.cls.isActive();
+        if (clsActive) {
+            const cached = this.cls.get(CLS_KEY);
+            if (cached && cached.key === key)
+                return cached.permissions;
+        }
+        const permissions = await this.repository.findEffectivePermissions({
+            userId: params.userId,
+            companyId: params.companyId || undefined,
+        });
+        if (clsActive)
+            this.cls.set(CLS_KEY, { key, permissions });
+        return permissions;
+    }
+    /** True when the effective value is `true` or a non-empty record path. */
+    async allows(params) {
+        const permissions = await this.resolve({ userId: params.userId, companyId: params.companyId });
+        const value = permissions.get(params.moduleId)?.[params.action];
+        return value === true || (typeof value === "string" && value.length > 0);
+    }
+};
+exports.ModulePermissionService = ModulePermissionService;
+exports.ModulePermissionService = ModulePermissionService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [rbac_permission_repository_1.RbacPermissionRepository,
+        nestjs_cls_1.ClsService])
+], ModulePermissionService);
+//# sourceMappingURL=module-permission.service.js.map

package/dist/foundations/rbac/services/module-permission.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module-permission.service.js","sourceRoot":"","sources":["../../../../src/foundations/rbac/services/module-permission.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,2CAAwC;AACxC,2FAAsF;AAMtF,wEAAwE;AACxE,MAAM,OAAO,GAAG,sBAAsB,CAAC;AAOvC;;;;;;;;;;;GAWG;AAEI,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAClC,YACmB,UAAoC,EACpC,GAAe;QADf,eAAU,GAAV,UAAU,CAA0B;QACpC,QAAG,GAAH,GAAG,CAAY;IAC/B,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,MAAyD;QACrE,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAEtC,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAgC,OAAO,CAAC,CAAC;YACpE,IAAI,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG;gBAAE,OAAO,MAAM,CAAC,WAAW,CAAC;QAC9D,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC;YACjE,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,SAAS;SACzC,CAAC,CAAC;QAEH,IAAI,SAAS;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAoB,OAAO,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;QAE9E,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,MAAM,CAAC,MAKZ;QACC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAC/F,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChE,OAAO,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC;CACF,CAAA;AApCY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;qCAGoB,qDAAwB;QAC/B,uBAAU;GAHvB,uBAAuB,CAoCnC"}

package/dist/foundations/rbac/services/rbac-permission.service.d.ts

@@ -1,4 +1,6 @@
+import { ClsService } from "nestjs-cls";
 import { RbacPermissionRepository } from "../repositories/rbac-permission.repository";
+import { ModulePermissionService } from "./module-permission.service";
 /**
  * The four permission flags resolved per module by the RBAC permission model.
  *
@@ -13,10 +15,17 @@ export type RbacAction = "read" | "create" | "update" | "delete";
  * UserModulesRepository for the chatbot catalog).
  *
  * Consumed by the MCP layer to gate reads and writes per tool call.
+ *
+ * With `permissions.enforce` on, it delegates to `ModulePermissionService`
+ * (token company from CLS, record paths allow) so tool calls and HTTP routes
+ * never disagree. With it off, it behaves exactly as before.
  */
 export declare class RbacPermissionService {
     private readonly repository;
-    constructor(repository: RbacPermissionRepository);
+    private readonly modulePermissions?;
+    private readonly cls?;
+    private readonly enforce?;
+    constructor(repository: RbacPermissionRepository, modulePermissions?: ModulePermissionService, cls?: ClsService, enforce?: boolean);
     /**
      * True iff the user's effective permission flag for `action` on the module
      * resolves to `true`. Unknown modules (not in the user's effective set)

package/dist/foundations/rbac/services/rbac-permission.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rbac-permission.service.d.ts","sourceRoot":"","sources":["../../../../src/foundations/rbac/services/rbac-permission.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AAEtF;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEjE;;;;;;GAMG;AACH,qBACa,qBAAqB;IACpB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,wBAAwB;IAEjE;;;;OAIG;IACG,GAAG,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;CAI9F"}
+{"version":3,"file":"rbac-permission.service.d.ts","sourceRoot":"","sources":["../../../../src/foundations/rbac/services/rbac-permission.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,wBAAwB,EAAE,MAAM,4CAA4C,CAAC;AAEtF,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEjE;;;;;;;;;;GAUG;AACH,qBACa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,UAAU;IACkB,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAChD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;IACZ,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAHjD,UAAU,EAAE,wBAAwB,EACS,iBAAiB,CAAC,EAAE,uBAAuB,EACxD,GAAG,CAAC,EAAE,UAAU,EACP,OAAO,CAAC,EAAE,OAAO;IAG7E;;;;OAIG;IACG,GAAG,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;CAc9F"}

package/dist/foundations/rbac/services/rbac-permission.service.js

@@ -8,20 +8,33 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RbacPermissionService = void 0;
 const common_1 = require("@nestjs/common");
+const nestjs_cls_1 = require("nestjs-cls");
 const rbac_permission_repository_1 = require("../repositories/rbac-permission.repository");
+const rbac_tokens_1 = require("../rbac.tokens");
+const module_permission_service_1 = require("./module-permission.service");
 /**
  * Answers `can(userId, moduleId, action)` using the same `featureModuleQuery`
  * permission resolution as the rest of the app (AuthRepository at login,
  * UserModulesRepository for the chatbot catalog).
  *
  * Consumed by the MCP layer to gate reads and writes per tool call.
+ *
+ * With `permissions.enforce` on, it delegates to `ModulePermissionService`
+ * (token company from CLS, record paths allow) so tool calls and HTTP routes
+ * never disagree. With it off, it behaves exactly as before.
  */
 let RbacPermissionService = class RbacPermissionService {
-    constructor(repository) {
+    constructor(repository, modulePermissions, cls, enforce) {
         this.repository = repository;
+        this.modulePermissions = modulePermissions;
+        this.cls = cls;
+        this.enforce = enforce;
     }
     /**
      * True iff the user's effective permission flag for `action` on the module
@@ -29,6 +42,15 @@ let RbacPermissionService = class RbacPermissionService {
      * always deny.
      */
     async can(params) {
+        if (this.enforce === true && this.modulePermissions) {
+            const companyId = this.cls?.isActive() ? (this.cls.get("companyId") ?? undefined) : undefined;
+            return this.modulePermissions.allows({
+                userId: params.userId,
+                companyId,
+                moduleId: params.moduleId,
+                action: params.action,
+            });
+        }
         const perms = await this.repository.findEffectivePermissionsForUser(params.userId);
         return perms.get(params.moduleId)?.[params.action] === true;
     }
@@ -36,6 +58,14 @@ let RbacPermissionService = class RbacPermissionService {
 exports.RbacPermissionService = RbacPermissionService;
 exports.RbacPermissionService = RbacPermissionService = __decorate([
     (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [rbac_permission_repository_1.RbacPermissionRepository])
+    __param(1, (0, common_1.Optional)()),
+    __param(1, (0, common_1.Inject)(module_permission_service_1.ModulePermissionService)),
+    __param(2, (0, common_1.Optional)()),
+    __param(2, (0, common_1.Inject)(nestjs_cls_1.ClsService)),
+    __param(3, (0, common_1.Optional)()),
+    __param(3, (0, common_1.Inject)(rbac_tokens_1.PERMISSIONS_ENFORCE)),
+    __metadata("design:paramtypes", [rbac_permission_repository_1.RbacPermissionRepository,
+        module_permission_service_1.ModulePermissionService,
+        nestjs_cls_1.ClsService, Boolean])
 ], RbacPermissionService);
 //# sourceMappingURL=rbac-permission.service.js.map

package/dist/foundations/rbac/services/rbac-permission.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"rbac-permission.service.js","sourceRoot":"","sources":["../../../../src/foundations/rbac/services/rbac-permission.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,2FAAsF;AAWtF;;;;;;GAMG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAChC,YAA6B,UAAoC;QAApC,eAAU,GAAV,UAAU,CAA0B;IAAG,CAAC;IAErE;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,MAAgE;QACxE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,+BAA+B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnF,OAAO,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;IAC9D,CAAC;CACF,CAAA;AAZY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;qCAE8B,qDAAwB;GADtD,qBAAqB,CAYjC"}
+{"version":3,"file":"rbac-permission.service.js","sourceRoot":"","sources":["../../../../src/foundations/rbac/services/rbac-permission.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA8D;AAC9D,2CAAwC;AACxC,2FAAsF;AACtF,gDAAqD;AACrD,2EAAsE;AAWtE;;;;;;;;;;GAUG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAChC,YACmB,UAAoC,EACS,iBAA2C,EACxD,GAAgB,EACP,OAAiB;QAH1D,eAAU,GAAV,UAAU,CAA0B;QACS,sBAAiB,GAAjB,iBAAiB,CAA0B;QACxD,QAAG,GAAH,GAAG,CAAa;QACP,YAAO,GAAP,OAAO,CAAU;IAC1E,CAAC;IAEJ;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,MAAgE;QACxE,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACpD,MAAM,SAAS,GAAuB,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAClH,OAAO,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC;gBACnC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,SAAS;gBACT,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,+BAA+B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnF,OAAO,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;IAC9D,CAAC;CACF,CAAA;AA3BY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;IAIR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,mDAAuB,CAAC,CAAA;IAC3C,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,uBAAU,CAAC,CAAA;IAC9B,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,iCAAmB,CAAC,CAAA;qCAHX,qDAAwB;QAC6B,mDAAuB;QAClD,uBAAU;GAJxD,qBAAqB,CA2BjC"}

package/dist/foundations/rbac/services/rbac-reconciler.service.d.ts

@@ -7,7 +7,9 @@ import type { RbacMatrix } from "../dsl/types";
  *
  * Behaviour (per spec §6.3):
  *  - Administrator role is never written as an HAS_PERMISSIONS edge — the
- *    security layer short-circuits for it.
+ *    security layer short-circuits for it. Exception: with
+ *    `permissions.enforce` on (no administrator bypass in the request gate)
+ *    its edges are reconciled like any other role's.
  *  - Module defaults are stored on `Module.permissions`.
  *  - Role-specific permissions are stored on `(Role)-[:HAS_PERMISSIONS]->(Module)`.
  *  - Deletions are scoped to modules declared in the matrix: edges for
@@ -19,7 +21,14 @@ export declare class RbacReconcilerService implements OnApplicationBootstrap {
     private readonly neo4j;
     private readonly matrix;
     private readonly logger;
-    constructor(neo4j: Neo4jService, matrix: RbacMatrix | null, logger: AppLoggingService);
+    private readonly enforce?;
+    constructor(neo4j: Neo4jService, matrix: RbacMatrix | null, logger: AppLoggingService, enforce?: boolean);
+    /**
+     * The Administrator role is skipped (never written, never deleted) unless the
+     * request permission gate is on: the gate has no administrator bypass, so the
+     * Administrator's grants must then be reconciled like any other role's.
+     */
+    private skipsRole;
     onApplicationBootstrap(): Promise<void>;
     private preflight;
     private findMissing;

package/dist/foundations/rbac/services/rbac-reconciler.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rbac-reconciler.service.d.ts","sourceRoot":"","sources":["../../../../src/foundations/rbac/services/rbac-reconciler.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgC,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,4CAA4C,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,gDAAgD,CAAC;AAGnF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAe/C;;;;;;;;;;;;GAYG;AACH,qBACa,qBAAsB,YAAW,sBAAsB;IAEhE,OAAO,CAAC,QAAQ,CAAC,KAAK;IACiB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAC9D,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAFN,KAAK,EAAE,YAAY,EACoB,MAAM,EAAE,UAAU,GAAG,IAAI,EAChE,MAAM,EAAE,iBAAiB;IAGtC,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;YAsB/B,SAAS;YAyBT,WAAW;YAOX,eAAe;IAsB7B,OAAO,CAAC,WAAW;YAkEL,KAAK;CA4BpB"}
+{"version":3,"file":"rbac-reconciler.service.d.ts","sourceRoot":"","sources":["../../../../src/foundations/rbac/services/rbac-reconciler.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgC,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,4CAA4C,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,gDAAgD,CAAC;AAGnF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAe/C;;;;;;;;;;;;;;GAcG;AACH,qBACa,qBAAsB,YAAW,sBAAsB;IAEhE,OAAO,CAAC,QAAQ,CAAC,KAAK;IACiB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAC9D,OAAO,CAAC,QAAQ,CAAC,MAAM;IACkB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAHjD,KAAK,EAAE,YAAY,EACoB,MAAM,EAAE,UAAU,GAAG,IAAI,EAChE,MAAM,EAAE,iBAAiB,EACgB,OAAO,CAAC,EAAE,OAAO;IAG7E;;;;OAIG;IACH,OAAO,CAAC,SAAS;IAIX,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;YAsB/B,SAAS;YAyBT,WAAW;YAOX,eAAe;IAsB7B,OAAO,CAAC,WAAW;YAkEL,KAAK;CA4BpB"}