@coopenomics/extension-kit 2026.9.16-1 → 2026.9.16-2

package/dist/index.cjs

@@ -21,10 +21,14 @@ const moment__default = /*#__PURE__*/_interopDefaultCompat(moment);
 const moment__default$1 = /*#__PURE__*/_interopDefaultCompat(moment$1);
 const crypto__default = /*#__PURE__*/_interopDefaultCompat(crypto);
 
+const ROLES_DENY_SELF_KEY = "roles_deny_self";
 function AuthRoles(roles, options = {}) {
   const self = options.self ?? [];
   const args = self.length ? `roles: ${JSON.stringify(roles)}, self: ${JSON.stringify(self)}` : `roles: ${JSON.stringify(roles)}`;
-  return common.applyDecorators(common.SetMetadata("roles", roles), graphql.Directive(`@auth(${args})`));
+  const decorators = [common.SetMetadata("roles", roles), graphql.Directive(`@auth(${args})`)];
+  if (options.allowSelf === false)
+    decorators.push(common.SetMetadata(ROLES_DENY_SELF_KEY, true));
+  return common.applyDecorators(...decorators);
 }
 const CurrentUser = common.createParamDecorator((data, context) => {
   const ctx = graphql.GqlExecutionContext.create(context);
@@ -149,7 +153,8 @@ exports.RolesGuard = class RolesGuard {
     const args = ctx.getArgs();
     const data = args.data;
     const filter = args.filter;
-    if (data && data.username && user.username === data.username || filter && filter.username && user.username === filter.username || args.username && user.username === args.username) {
+    const denySelf = this.reflector.get(ROLES_DENY_SELF_KEY, context.getHandler()) === true;
+    if (!denySelf && (data && data.username && user.username === data.username || filter && filter.username && user.username === filter.username || args.username && user.username === args.username)) {
       return true;
     }
     if (allowedRoles.includes(user.role)) {
@@ -1929,6 +1934,7 @@ exports.OptionalCurrentUser = OptionalCurrentUser;
 exports.PaginationResult = PaginationResult;
 exports.PaginationUtils = PaginationUtils;
 exports.QuantityUtils = QuantityUtils;
+exports.ROLES_DENY_SELF_KEY = ROLES_DENY_SELF_KEY;
 exports.UseBucket = UseBucket;
 exports.bucketProvidersFor = bucketProvidersFor;
 exports.bucketTokenFor = bucketTokenFor;

package/dist/index.d.cts

@@ -16,7 +16,17 @@ import { Cooperative } from 'cooptypes';
  */
 interface AuthRolesOptions {
     self?: string[];
+    /**
+     * Пускает ли `RolesGuard` пайщика без нужной роли, когда `username` в
+     * аргументах — он сам. По умолчанию да: так пайщик читает свои записи и
+     * подаёт свои заявления. Для полномочий совета, где `username` — адресат
+     * действия (подтвердить соглашение, внести данные, импортировать вклад),
+     * ставится `false`: иначе пайщик выполнил бы его над собой.
+     */
+    allowSelf?: boolean;
 }
+/** Ключ метаданных: самообход `RolesGuard` запрещён. */
+declare const ROLES_DENY_SELF_KEY = "roles_deny_self";
 /**
  * Ограничение доступа к резолверу или к отдельному полю объекта.
  *
@@ -87,7 +97,8 @@ declare class HttpJwtAuthGuard extends HttpJwtAuthGuard_base {
  * 1. Валидный `server-secret` — доступ разрешён.
  * 2. Роли не заданы — доступ открыт.
  * 3. Пользователь обращается к своим ресурсам (`username` вложенный в `data`/`filter`
- *    либо плоским аргументом совпадает с `user.username`) — разрешено.
+ *    либо плоским аргументом совпадает с `user.username`) — разрешено, если
+ *    операция не объявила `AuthRoles(..., { allowSelf: false })`.
  * 4. У пользователя есть одна из разрешённых ролей — разрешено.
  * 5. Иначе — отказ.
  */
@@ -1520,5 +1531,5 @@ declare class HttpApiError extends HttpException {
  */
 declare function rethrowChainError(error: unknown): never;
 
-export { ActiveUserStatusGuard, AmountFormatterUtils, AssetUtils, AuthRoles, BaseExtensionModule, BucketRegistry, CandidateFilterInputDTO, CandidateOutputDTO, CandidateStatus, CurrencyValidationUtil, CurrentUser, DEFAULT_DOCUMENT_VERSION, DateUtils, DocumentAggregateDTO, DomainToBlockchainUtils, EMPTY_HASH, EXTENSION_APP_TERMINATE_EVENT, EXTENSION_REPOSITORY, EXTENSION_SECRET_SET, EXTENSION_SECRET_UNSET, ExpenseProposalStatementGenerateDocumentInputDTO, ExpenseProposalStatementSignedDocumentInputDTO, ExpenseProposalStatementSignedMetaDocumentInputDTO, ExtensionAvailability, ExtensionConfigSuppliedBy, ExtensionDomainEntity, GenerateDocumentInputDTO, GenerateDocumentOptionsInputDTO, GenerateMetaDocumentInputDTO, GeneratedDocumentDTO, GqlJwtAuthGuard, HttpApiError, HttpJwtAuthGuard, IPNProvider, InjectBucket, LOG_EXTENSION_REPOSITORY, LangType, LogExtensionDomainEntity, MetaDocumentInputDTO, ONBOARDING_EXPIRY_DAYS, ONBOARDING_EXPIRY_MS, OptionalCurrentUser, OptionalGqlJwtAuthGuard, PaginationInputDTO, PaginationResult, PaginationUtils, PaymentProvider, PollingProvider, QuantityUtils, RolesGuard, SignatureInfoDTO, SignatureInfoInputDTO, SignedDigitalDocumentDTO, SignedDigitalDocumentInputDTO, TransactionDTO, UseBucket, bucketProvidersFor, bucketTokenFor, buildPaginationResult, checkPaymentAmount, checkPaymentSymbol, computeOnboardingExpiresAt, configureExtensionAuth, configurePlatformSettings, createPaginationResult, extensionEntities, generateHashFromString, generateRandomHash, generateUniqueHash, getAmountPlusFee, getAppliedBlockNum, hasServerSecret, isExtensionAvailable, mergeSecretConfig, paginationInputToOffset, platformSettings, providerSuppliedPaths, redactSecretConfig, registerExtensionEntities, resetExtensionEntities, rethrowChainError, verifySignedDocumentAgainstStoredDraft, waitAfterTransactBeforeChainTableRead };
+export { ActiveUserStatusGuard, AmountFormatterUtils, AssetUtils, AuthRoles, BaseExtensionModule, BucketRegistry, CandidateFilterInputDTO, CandidateOutputDTO, CandidateStatus, CurrencyValidationUtil, CurrentUser, DEFAULT_DOCUMENT_VERSION, DateUtils, DocumentAggregateDTO, DomainToBlockchainUtils, EMPTY_HASH, EXTENSION_APP_TERMINATE_EVENT, EXTENSION_REPOSITORY, EXTENSION_SECRET_SET, EXTENSION_SECRET_UNSET, ExpenseProposalStatementGenerateDocumentInputDTO, ExpenseProposalStatementSignedDocumentInputDTO, ExpenseProposalStatementSignedMetaDocumentInputDTO, ExtensionAvailability, ExtensionConfigSuppliedBy, ExtensionDomainEntity, GenerateDocumentInputDTO, GenerateDocumentOptionsInputDTO, GenerateMetaDocumentInputDTO, GeneratedDocumentDTO, GqlJwtAuthGuard, HttpApiError, HttpJwtAuthGuard, IPNProvider, InjectBucket, LOG_EXTENSION_REPOSITORY, LangType, LogExtensionDomainEntity, MetaDocumentInputDTO, ONBOARDING_EXPIRY_DAYS, ONBOARDING_EXPIRY_MS, OptionalCurrentUser, OptionalGqlJwtAuthGuard, PaginationInputDTO, PaginationResult, PaginationUtils, PaymentProvider, PollingProvider, QuantityUtils, ROLES_DENY_SELF_KEY, RolesGuard, SignatureInfoDTO, SignatureInfoInputDTO, SignedDigitalDocumentDTO, SignedDigitalDocumentInputDTO, TransactionDTO, UseBucket, bucketProvidersFor, bucketTokenFor, buildPaginationResult, checkPaymentAmount, checkPaymentSymbol, computeOnboardingExpiresAt, configureExtensionAuth, configurePlatformSettings, createPaginationResult, extensionEntities, generateHashFromString, generateRandomHash, generateUniqueHash, getAmountPlusFee, getAppliedBlockNum, hasServerSecret, isExtensionAvailable, mergeSecretConfig, paginationInputToOffset, platformSettings, providerSuppliedPaths, redactSecretConfig, registerExtensionEntities, resetExtensionEntities, rethrowChainError, verifySignedDocumentAgainstStoredDraft, waitAfterTransactBeforeChainTableRead };
 export type { AuthRolesOptions, BucketSource, BucketSpec, DeserializedDescriptionOfExtension, ExcludeCommonProps, ExtensionAppTerminatePayload, ExtensionAuthOptions, ExtensionConfigFieldPolicy, ExtensionConfigPolicy, ExtensionDomainInterface, ExtensionDomainRepository, ExtensionEntityClass, ExtensionSchemaMigrationAfterContext, GeneratedDocumentDomainInterface, GeneratedDocumentDraft, IDesktopConfig, IExtensionSchemaMigration, IRegistryExtension, IResolvedRegistryExtension, LoadGeneratedDocumentByDocHash, LogExtensionDomainInterface, LogExtensionDomainRepository, LogExtensionFilter, LogExtensionPaginationOptions, LogExtensionPaginationResult, PaymentDetails, PlatformBlockchainSettings, PlatformSettings, RegisteredBucket, RequireFields, SignedDocumentMetaCompareMode, SignedDocumentMetaVerification, SignedDocumentToVerify, TransactResultWithResponse };

package/dist/index.d.mts

@@ -16,7 +16,17 @@ import { Cooperative } from 'cooptypes';
  */
 interface AuthRolesOptions {
     self?: string[];
+    /**
+     * Пускает ли `RolesGuard` пайщика без нужной роли, когда `username` в
+     * аргументах — он сам. По умолчанию да: так пайщик читает свои записи и
+     * подаёт свои заявления. Для полномочий совета, где `username` — адресат
+     * действия (подтвердить соглашение, внести данные, импортировать вклад),
+     * ставится `false`: иначе пайщик выполнил бы его над собой.
+     */
+    allowSelf?: boolean;
 }
+/** Ключ метаданных: самообход `RolesGuard` запрещён. */
+declare const ROLES_DENY_SELF_KEY = "roles_deny_self";
 /**
  * Ограничение доступа к резолверу или к отдельному полю объекта.
  *
@@ -87,7 +97,8 @@ declare class HttpJwtAuthGuard extends HttpJwtAuthGuard_base {
  * 1. Валидный `server-secret` — доступ разрешён.
  * 2. Роли не заданы — доступ открыт.
  * 3. Пользователь обращается к своим ресурсам (`username` вложенный в `data`/`filter`
- *    либо плоским аргументом совпадает с `user.username`) — разрешено.
+ *    либо плоским аргументом совпадает с `user.username`) — разрешено, если
+ *    операция не объявила `AuthRoles(..., { allowSelf: false })`.
  * 4. У пользователя есть одна из разрешённых ролей — разрешено.
  * 5. Иначе — отказ.
  */
@@ -1520,5 +1531,5 @@ declare class HttpApiError extends HttpException {
  */
 declare function rethrowChainError(error: unknown): never;
 
-export { ActiveUserStatusGuard, AmountFormatterUtils, AssetUtils, AuthRoles, BaseExtensionModule, BucketRegistry, CandidateFilterInputDTO, CandidateOutputDTO, CandidateStatus, CurrencyValidationUtil, CurrentUser, DEFAULT_DOCUMENT_VERSION, DateUtils, DocumentAggregateDTO, DomainToBlockchainUtils, EMPTY_HASH, EXTENSION_APP_TERMINATE_EVENT, EXTENSION_REPOSITORY, EXTENSION_SECRET_SET, EXTENSION_SECRET_UNSET, ExpenseProposalStatementGenerateDocumentInputDTO, ExpenseProposalStatementSignedDocumentInputDTO, ExpenseProposalStatementSignedMetaDocumentInputDTO, ExtensionAvailability, ExtensionConfigSuppliedBy, ExtensionDomainEntity, GenerateDocumentInputDTO, GenerateDocumentOptionsInputDTO, GenerateMetaDocumentInputDTO, GeneratedDocumentDTO, GqlJwtAuthGuard, HttpApiError, HttpJwtAuthGuard, IPNProvider, InjectBucket, LOG_EXTENSION_REPOSITORY, LangType, LogExtensionDomainEntity, MetaDocumentInputDTO, ONBOARDING_EXPIRY_DAYS, ONBOARDING_EXPIRY_MS, OptionalCurrentUser, OptionalGqlJwtAuthGuard, PaginationInputDTO, PaginationResult, PaginationUtils, PaymentProvider, PollingProvider, QuantityUtils, RolesGuard, SignatureInfoDTO, SignatureInfoInputDTO, SignedDigitalDocumentDTO, SignedDigitalDocumentInputDTO, TransactionDTO, UseBucket, bucketProvidersFor, bucketTokenFor, buildPaginationResult, checkPaymentAmount, checkPaymentSymbol, computeOnboardingExpiresAt, configureExtensionAuth, configurePlatformSettings, createPaginationResult, extensionEntities, generateHashFromString, generateRandomHash, generateUniqueHash, getAmountPlusFee, getAppliedBlockNum, hasServerSecret, isExtensionAvailable, mergeSecretConfig, paginationInputToOffset, platformSettings, providerSuppliedPaths, redactSecretConfig, registerExtensionEntities, resetExtensionEntities, rethrowChainError, verifySignedDocumentAgainstStoredDraft, waitAfterTransactBeforeChainTableRead };
+export { ActiveUserStatusGuard, AmountFormatterUtils, AssetUtils, AuthRoles, BaseExtensionModule, BucketRegistry, CandidateFilterInputDTO, CandidateOutputDTO, CandidateStatus, CurrencyValidationUtil, CurrentUser, DEFAULT_DOCUMENT_VERSION, DateUtils, DocumentAggregateDTO, DomainToBlockchainUtils, EMPTY_HASH, EXTENSION_APP_TERMINATE_EVENT, EXTENSION_REPOSITORY, EXTENSION_SECRET_SET, EXTENSION_SECRET_UNSET, ExpenseProposalStatementGenerateDocumentInputDTO, ExpenseProposalStatementSignedDocumentInputDTO, ExpenseProposalStatementSignedMetaDocumentInputDTO, ExtensionAvailability, ExtensionConfigSuppliedBy, ExtensionDomainEntity, GenerateDocumentInputDTO, GenerateDocumentOptionsInputDTO, GenerateMetaDocumentInputDTO, GeneratedDocumentDTO, GqlJwtAuthGuard, HttpApiError, HttpJwtAuthGuard, IPNProvider, InjectBucket, LOG_EXTENSION_REPOSITORY, LangType, LogExtensionDomainEntity, MetaDocumentInputDTO, ONBOARDING_EXPIRY_DAYS, ONBOARDING_EXPIRY_MS, OptionalCurrentUser, OptionalGqlJwtAuthGuard, PaginationInputDTO, PaginationResult, PaginationUtils, PaymentProvider, PollingProvider, QuantityUtils, ROLES_DENY_SELF_KEY, RolesGuard, SignatureInfoDTO, SignatureInfoInputDTO, SignedDigitalDocumentDTO, SignedDigitalDocumentInputDTO, TransactionDTO, UseBucket, bucketProvidersFor, bucketTokenFor, buildPaginationResult, checkPaymentAmount, checkPaymentSymbol, computeOnboardingExpiresAt, configureExtensionAuth, configurePlatformSettings, createPaginationResult, extensionEntities, generateHashFromString, generateRandomHash, generateUniqueHash, getAmountPlusFee, getAppliedBlockNum, hasServerSecret, isExtensionAvailable, mergeSecretConfig, paginationInputToOffset, platformSettings, providerSuppliedPaths, redactSecretConfig, registerExtensionEntities, resetExtensionEntities, rethrowChainError, verifySignedDocumentAgainstStoredDraft, waitAfterTransactBeforeChainTableRead };
 export type { AuthRolesOptions, BucketSource, BucketSpec, DeserializedDescriptionOfExtension, ExcludeCommonProps, ExtensionAppTerminatePayload, ExtensionAuthOptions, ExtensionConfigFieldPolicy, ExtensionConfigPolicy, ExtensionDomainInterface, ExtensionDomainRepository, ExtensionEntityClass, ExtensionSchemaMigrationAfterContext, GeneratedDocumentDomainInterface, GeneratedDocumentDraft, IDesktopConfig, IExtensionSchemaMigration, IRegistryExtension, IResolvedRegistryExtension, LoadGeneratedDocumentByDocHash, LogExtensionDomainInterface, LogExtensionDomainRepository, LogExtensionFilter, LogExtensionPaginationOptions, LogExtensionPaginationResult, PaymentDetails, PlatformBlockchainSettings, PlatformSettings, RegisteredBucket, RequireFields, SignedDocumentMetaCompareMode, SignedDocumentMetaVerification, SignedDocumentToVerify, TransactResultWithResponse };

package/dist/index.d.ts

@@ -16,7 +16,17 @@ import { Cooperative } from 'cooptypes';
  */
 interface AuthRolesOptions {
     self?: string[];
+    /**
+     * Пускает ли `RolesGuard` пайщика без нужной роли, когда `username` в
+     * аргументах — он сам. По умолчанию да: так пайщик читает свои записи и
+     * подаёт свои заявления. Для полномочий совета, где `username` — адресат
+     * действия (подтвердить соглашение, внести данные, импортировать вклад),
+     * ставится `false`: иначе пайщик выполнил бы его над собой.
+     */
+    allowSelf?: boolean;
 }
+/** Ключ метаданных: самообход `RolesGuard` запрещён. */
+declare const ROLES_DENY_SELF_KEY = "roles_deny_self";
 /**
  * Ограничение доступа к резолверу или к отдельному полю объекта.
  *
@@ -87,7 +97,8 @@ declare class HttpJwtAuthGuard extends HttpJwtAuthGuard_base {
  * 1. Валидный `server-secret` — доступ разрешён.
  * 2. Роли не заданы — доступ открыт.
  * 3. Пользователь обращается к своим ресурсам (`username` вложенный в `data`/`filter`
- *    либо плоским аргументом совпадает с `user.username`) — разрешено.
+ *    либо плоским аргументом совпадает с `user.username`) — разрешено, если
+ *    операция не объявила `AuthRoles(..., { allowSelf: false })`.
  * 4. У пользователя есть одна из разрешённых ролей — разрешено.
  * 5. Иначе — отказ.
  */
@@ -1520,5 +1531,5 @@ declare class HttpApiError extends HttpException {
  */
 declare function rethrowChainError(error: unknown): never;
 
-export { ActiveUserStatusGuard, AmountFormatterUtils, AssetUtils, AuthRoles, BaseExtensionModule, BucketRegistry, CandidateFilterInputDTO, CandidateOutputDTO, CandidateStatus, CurrencyValidationUtil, CurrentUser, DEFAULT_DOCUMENT_VERSION, DateUtils, DocumentAggregateDTO, DomainToBlockchainUtils, EMPTY_HASH, EXTENSION_APP_TERMINATE_EVENT, EXTENSION_REPOSITORY, EXTENSION_SECRET_SET, EXTENSION_SECRET_UNSET, ExpenseProposalStatementGenerateDocumentInputDTO, ExpenseProposalStatementSignedDocumentInputDTO, ExpenseProposalStatementSignedMetaDocumentInputDTO, ExtensionAvailability, ExtensionConfigSuppliedBy, ExtensionDomainEntity, GenerateDocumentInputDTO, GenerateDocumentOptionsInputDTO, GenerateMetaDocumentInputDTO, GeneratedDocumentDTO, GqlJwtAuthGuard, HttpApiError, HttpJwtAuthGuard, IPNProvider, InjectBucket, LOG_EXTENSION_REPOSITORY, LangType, LogExtensionDomainEntity, MetaDocumentInputDTO, ONBOARDING_EXPIRY_DAYS, ONBOARDING_EXPIRY_MS, OptionalCurrentUser, OptionalGqlJwtAuthGuard, PaginationInputDTO, PaginationResult, PaginationUtils, PaymentProvider, PollingProvider, QuantityUtils, RolesGuard, SignatureInfoDTO, SignatureInfoInputDTO, SignedDigitalDocumentDTO, SignedDigitalDocumentInputDTO, TransactionDTO, UseBucket, bucketProvidersFor, bucketTokenFor, buildPaginationResult, checkPaymentAmount, checkPaymentSymbol, computeOnboardingExpiresAt, configureExtensionAuth, configurePlatformSettings, createPaginationResult, extensionEntities, generateHashFromString, generateRandomHash, generateUniqueHash, getAmountPlusFee, getAppliedBlockNum, hasServerSecret, isExtensionAvailable, mergeSecretConfig, paginationInputToOffset, platformSettings, providerSuppliedPaths, redactSecretConfig, registerExtensionEntities, resetExtensionEntities, rethrowChainError, verifySignedDocumentAgainstStoredDraft, waitAfterTransactBeforeChainTableRead };
+export { ActiveUserStatusGuard, AmountFormatterUtils, AssetUtils, AuthRoles, BaseExtensionModule, BucketRegistry, CandidateFilterInputDTO, CandidateOutputDTO, CandidateStatus, CurrencyValidationUtil, CurrentUser, DEFAULT_DOCUMENT_VERSION, DateUtils, DocumentAggregateDTO, DomainToBlockchainUtils, EMPTY_HASH, EXTENSION_APP_TERMINATE_EVENT, EXTENSION_REPOSITORY, EXTENSION_SECRET_SET, EXTENSION_SECRET_UNSET, ExpenseProposalStatementGenerateDocumentInputDTO, ExpenseProposalStatementSignedDocumentInputDTO, ExpenseProposalStatementSignedMetaDocumentInputDTO, ExtensionAvailability, ExtensionConfigSuppliedBy, ExtensionDomainEntity, GenerateDocumentInputDTO, GenerateDocumentOptionsInputDTO, GenerateMetaDocumentInputDTO, GeneratedDocumentDTO, GqlJwtAuthGuard, HttpApiError, HttpJwtAuthGuard, IPNProvider, InjectBucket, LOG_EXTENSION_REPOSITORY, LangType, LogExtensionDomainEntity, MetaDocumentInputDTO, ONBOARDING_EXPIRY_DAYS, ONBOARDING_EXPIRY_MS, OptionalCurrentUser, OptionalGqlJwtAuthGuard, PaginationInputDTO, PaginationResult, PaginationUtils, PaymentProvider, PollingProvider, QuantityUtils, ROLES_DENY_SELF_KEY, RolesGuard, SignatureInfoDTO, SignatureInfoInputDTO, SignedDigitalDocumentDTO, SignedDigitalDocumentInputDTO, TransactionDTO, UseBucket, bucketProvidersFor, bucketTokenFor, buildPaginationResult, checkPaymentAmount, checkPaymentSymbol, computeOnboardingExpiresAt, configureExtensionAuth, configurePlatformSettings, createPaginationResult, extensionEntities, generateHashFromString, generateRandomHash, generateUniqueHash, getAmountPlusFee, getAppliedBlockNum, hasServerSecret, isExtensionAvailable, mergeSecretConfig, paginationInputToOffset, platformSettings, providerSuppliedPaths, redactSecretConfig, registerExtensionEntities, resetExtensionEntities, rethrowChainError, verifySignedDocumentAgainstStoredDraft, waitAfterTransactBeforeChainTableRead };
 export type { AuthRolesOptions, BucketSource, BucketSpec, DeserializedDescriptionOfExtension, ExcludeCommonProps, ExtensionAppTerminatePayload, ExtensionAuthOptions, ExtensionConfigFieldPolicy, ExtensionConfigPolicy, ExtensionDomainInterface, ExtensionDomainRepository, ExtensionEntityClass, ExtensionSchemaMigrationAfterContext, GeneratedDocumentDomainInterface, GeneratedDocumentDraft, IDesktopConfig, IExtensionSchemaMigration, IRegistryExtension, IResolvedRegistryExtension, LoadGeneratedDocumentByDocHash, LogExtensionDomainInterface, LogExtensionDomainRepository, LogExtensionFilter, LogExtensionPaginationOptions, LogExtensionPaginationResult, PaymentDetails, PlatformBlockchainSettings, PlatformSettings, RegisteredBucket, RequireFields, SignedDocumentMetaCompareMode, SignedDocumentMetaVerification, SignedDocumentToVerify, TransactResultWithResponse };

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { createParamDecorator, UnauthorizedException, applyDecorators, SetMetadata, Injectable, Inject, ForbiddenException, HttpException, HttpStatus, BadRequestException } from '@nestjs/common';
+import { createParamDecorator, UnauthorizedException, SetMetadata, applyDecorators, Injectable, Inject, ForbiddenException, HttpException, HttpStatus, BadRequestException } from '@nestjs/common';
 import { GqlExecutionContext, Directive, Field, InputType, registerEnumType, Int, IntersectionType, OmitType, ObjectType } from '@nestjs/graphql';
 import { Reflector } from '@nestjs/core';
 import { AuthGuard } from '@nestjs/passport';
@@ -13,10 +13,14 @@ import moment$1 from 'moment-timezone';
 import 'moment/locale/ru';
 import crypto from 'crypto';
 
+const ROLES_DENY_SELF_KEY = "roles_deny_self";
 function AuthRoles(roles, options = {}) {
   const self = options.self ?? [];
   const args = self.length ? `roles: ${JSON.stringify(roles)}, self: ${JSON.stringify(self)}` : `roles: ${JSON.stringify(roles)}`;
-  return applyDecorators(SetMetadata("roles", roles), Directive(`@auth(${args})`));
+  const decorators = [SetMetadata("roles", roles), Directive(`@auth(${args})`)];
+  if (options.allowSelf === false)
+    decorators.push(SetMetadata(ROLES_DENY_SELF_KEY, true));
+  return applyDecorators(...decorators);
 }
 const CurrentUser = createParamDecorator((data, context) => {
   const ctx = GqlExecutionContext.create(context);
@@ -141,7 +145,8 @@ let RolesGuard = class {
     const args = ctx.getArgs();
     const data = args.data;
     const filter = args.filter;
-    if (data && data.username && user.username === data.username || filter && filter.username && user.username === filter.username || args.username && user.username === args.username) {
+    const denySelf = this.reflector.get(ROLES_DENY_SELF_KEY, context.getHandler()) === true;
+    if (!denySelf && (data && data.username && user.username === data.username || filter && filter.username && user.username === filter.username || args.username && user.username === args.username)) {
       return true;
     }
     if (allowedRoles.includes(user.role)) {
@@ -1893,4 +1898,4 @@ function rethrowChainError(error) {
   throw new BadRequestException(clean);
 }
 
-export { ActiveUserStatusGuard, AmountFormatterUtils, AssetUtils, AuthRoles, BaseExtensionModule, BucketRegistry, CandidateFilterInputDTO, CandidateOutputDTO, CandidateStatus, CurrencyValidationUtil, CurrentUser, DEFAULT_DOCUMENT_VERSION, DateUtils, DocumentAggregateDTO, DomainToBlockchainUtils, EMPTY_HASH, EXTENSION_APP_TERMINATE_EVENT, EXTENSION_REPOSITORY, EXTENSION_SECRET_SET, EXTENSION_SECRET_UNSET, ExpenseProposalStatementGenerateDocumentInputDTO, ExpenseProposalStatementSignedDocumentInputDTO, ExpenseProposalStatementSignedMetaDocumentInputDTO, ExtensionAvailability, ExtensionConfigSuppliedBy, ExtensionDomainEntity, GenerateDocumentInputDTO, GenerateDocumentOptionsInputDTO, GenerateMetaDocumentInputDTO, GeneratedDocumentDTO, GqlJwtAuthGuard, HttpApiError, HttpJwtAuthGuard, IPNProvider, InjectBucket, LOG_EXTENSION_REPOSITORY, LangType, LogExtensionDomainEntity, MetaDocumentInputDTO, ONBOARDING_EXPIRY_DAYS, ONBOARDING_EXPIRY_MS, OptionalCurrentUser, OptionalGqlJwtAuthGuard, PaginationInputDTO, PaginationResult, PaginationUtils, PaymentProvider, PollingProvider, QuantityUtils, RolesGuard, SignatureInfoDTO, SignatureInfoInputDTO, SignedDigitalDocumentDTO, SignedDigitalDocumentInputDTO, TransactionDTO, UseBucket, bucketProvidersFor, bucketTokenFor, buildPaginationResult, checkPaymentAmount, checkPaymentSymbol, computeOnboardingExpiresAt, configureExtensionAuth, configurePlatformSettings, createPaginationResult, extensionEntities, generateHashFromString, generateRandomHash, generateUniqueHash, getAmountPlusFee, getAppliedBlockNum, hasServerSecret, isExtensionAvailable, mergeSecretConfig, paginationInputToOffset, platformSettings, providerSuppliedPaths, redactSecretConfig, registerExtensionEntities, resetExtensionEntities, rethrowChainError, verifySignedDocumentAgainstStoredDraft, waitAfterTransactBeforeChainTableRead };
+export { ActiveUserStatusGuard, AmountFormatterUtils, AssetUtils, AuthRoles, BaseExtensionModule, BucketRegistry, CandidateFilterInputDTO, CandidateOutputDTO, CandidateStatus, CurrencyValidationUtil, CurrentUser, DEFAULT_DOCUMENT_VERSION, DateUtils, DocumentAggregateDTO, DomainToBlockchainUtils, EMPTY_HASH, EXTENSION_APP_TERMINATE_EVENT, EXTENSION_REPOSITORY, EXTENSION_SECRET_SET, EXTENSION_SECRET_UNSET, ExpenseProposalStatementGenerateDocumentInputDTO, ExpenseProposalStatementSignedDocumentInputDTO, ExpenseProposalStatementSignedMetaDocumentInputDTO, ExtensionAvailability, ExtensionConfigSuppliedBy, ExtensionDomainEntity, GenerateDocumentInputDTO, GenerateDocumentOptionsInputDTO, GenerateMetaDocumentInputDTO, GeneratedDocumentDTO, GqlJwtAuthGuard, HttpApiError, HttpJwtAuthGuard, IPNProvider, InjectBucket, LOG_EXTENSION_REPOSITORY, LangType, LogExtensionDomainEntity, MetaDocumentInputDTO, ONBOARDING_EXPIRY_DAYS, ONBOARDING_EXPIRY_MS, OptionalCurrentUser, OptionalGqlJwtAuthGuard, PaginationInputDTO, PaginationResult, PaginationUtils, PaymentProvider, PollingProvider, QuantityUtils, ROLES_DENY_SELF_KEY, RolesGuard, SignatureInfoDTO, SignatureInfoInputDTO, SignedDigitalDocumentDTO, SignedDigitalDocumentInputDTO, TransactionDTO, UseBucket, bucketProvidersFor, bucketTokenFor, buildPaginationResult, checkPaymentAmount, checkPaymentSymbol, computeOnboardingExpiresAt, configureExtensionAuth, configurePlatformSettings, createPaginationResult, extensionEntities, generateHashFromString, generateRandomHash, generateUniqueHash, getAmountPlusFee, getAppliedBlockNum, hasServerSecret, isExtensionAvailable, mergeSecretConfig, paginationInputToOffset, platformSettings, providerSuppliedPaths, redactSecretConfig, registerExtensionEntities, resetExtensionEntities, rethrowChainError, verifySignedDocumentAgainstStoredDraft, waitAfterTransactBeforeChainTableRead };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@coopenomics/extension-kit",
   "type": "module",
-  "version": "2026.9.16-1",
+  "version": "2026.9.16-2",
   "description": "Служебный каркас расширения цифрового кооператива: базовый модуль, сущности и репозитории расширения, авторизация, каркас блокчейн-синхронизации, контракт миграций схемы, контракт реестра",
   "author": "Alex Ant <dacom.dark.sun@gmail.com>",
   "license": "MIT",
@@ -38,7 +38,7 @@
     "typecheck": "tsc --noEmit"
   },
   "peerDependencies": {
-    "@coopenomics/sdk": "2026.9.16-1",
+    "@coopenomics/sdk": "2026.9.16-2",
     "@nestjs/common": "^10.0.0",
     "@nestjs/core": "^10.0.0",
     "@nestjs/graphql": "^12.2.1",
@@ -68,7 +68,7 @@
     "@wharfkit/session": "^1.4.0",
     "class-transformer": "^0.5.1",
     "class-validator": "^0.14.1",
-    "cooptypes": "2026.9.16-1",
+    "cooptypes": "2026.9.16-2",
     "graphql": "^16.9.0",
     "graphql-type-json": "^0.3.2",
     "moment": "^2.30.1",
@@ -80,5 +80,5 @@
     "unbuild": "^2.0.0",
     "zod": "^3.0.0"
   },
-  "gitHead": "ae6ac2b74cd63dce6e77ec5763defd5fc24d7af3"
+  "gitHead": "97b9f48f94efe92b20cecb66630e8bf821c73b59"
 }