@dudousxd/nestjs-authz-codegen 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,22 @@
+# @dudousxd/nestjs-authz-codegen
+
+## 0.1.0
+
+### Minor Changes
+
+- [#2](https://github.com/DavideCarvalho/nestjs-authz/pull/2) [`2ecb0f4`](https://github.com/DavideCarvalho/nestjs-authz/commit/2ecb0f46342fa4527fc01f1097720f2e7bcf9aa7) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Initial release of `@dudousxd/nestjs-authz-codegen`: a `@dudousxd/nestjs-codegen` extension that
+  discovers `@Can(ability, Resource?)` decorators on your controllers (and, optionally, `@Policy`
+  method abilities) and emits a typed `can()` helper into your generated `api.ts`. The discovered
+  abilities become a string-literal `AuthzAbility` union, so calling `can()` with an ability that
+  doesn't exist on the server is a compile-time error. Routes carrying a `@Can` also expose a
+  route-pinned `can()` handle member when a client layer is active.
+
+### Patch Changes
+
+- [#2](https://github.com/DavideCarvalho/nestjs-authz/pull/2) [`2ecb0f4`](https://github.com/DavideCarvalho/nestjs-authz/commit/2ecb0f46342fa4527fc01f1097720f2e7bcf9aa7) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - The emitted `can()` now delegates to `@dudousxd/nestjs-authz-client` instead of a
+  hand-rolled POST. The generated `api.ts` imports `AbilityStore` + `createCan`, exports a
+  shared `authzStore` you hydrate once, and `can()` is a thin typed wrapper over the store's
+  `createCan` resolver — so a hydrated decision is answered synchronously with NO request,
+  and a cache miss uses the same configurable `'fetch'` fallback to the `endpoint`. The
+  compile-time `AuthzAbility` string-literal union is unchanged (a wrong ability is still a
+  type error). Adds `@dudousxd/nestjs-authz-client` as an optional peer dependency.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Davi Carvalho
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,107 @@
+# @dudousxd/nestjs-authz-codegen
+
+A [`@dudousxd/nestjs-codegen`](https://www.npmjs.com/package/@dudousxd/nestjs-codegen) **extension**
+that discovers the authorization abilities declared with
+[`@dudousxd/nestjs-authz`](https://github.com/DavideCarvalho/nestjs-authz)'s
+`@Can(ability, Resource?)` (and, optionally, `@Policy` method abilities) and emits a typed `can()`
+helper into your generated `api.ts` — so checking a permission on the frontend is a compile-time
+type, not a magic string.
+
+The discovered abilities become a string-literal union (`AuthzAbility`). Calling `can()` with an
+ability that doesn't exist on the server is a **type error**.
+
+```bash
+pnpm add -D @dudousxd/nestjs-authz-codegen
+```
+
+```ts title="nestjs-codegen.config.ts"
+import { defineConfig } from '@dudousxd/nestjs-codegen';
+import { zodAdapter } from '@dudousxd/nestjs-codegen-zod';
+import { nestjsAuthzCodegen } from '@dudousxd/nestjs-authz-codegen';
+
+export default defineConfig({
+  validation: zodAdapter,
+  extensions: [
+    nestjsAuthzCodegen({ endpoint: '/authz/can' }),
+    // ...other extensions (tanstack, filter, notifications)
+  ],
+});
+```
+
+## What it emits
+
+Given controllers decorated with `@Can(...)`:
+
+```ts
+@Controller('posts')
+export class PostsController {
+  @Patch(':id')
+  @Can('update', Post)
+  update() {}
+
+  @Post(':id/publish')
+  @Can('access-admin')
+  publish() {}
+}
+```
+
+the generated `api.ts` gains:
+
+```ts
+/** Every authorization ability discovered from `@Can`/`@Policy` in your NestJS app. */
+export type AuthzAbility = 'update' | 'access-admin';
+
+/** Map of resource class name → the abilities declared against it. */
+export const authzAbilities = { Post: ['update'] } as const;
+
+/** Ask the server whether the current user `can` perform `ability`. */
+export async function can(
+  ability: AuthzAbility,
+  resource?: { type: string; id?: string | number } | null,
+  init?: RequestInit,
+): Promise<boolean> {
+  /* POSTs { ability, resource } to '/authz/can', returns the server's `allowed` boolean */
+}
+```
+
+```ts
+await can('update', { type: 'Post', id: 42 }); // ✅
+await can('destroy'); // ✗ type error — 'destroy' is not an AuthzAbility
+```
+
+Routes carrying a `@Can` also expose a route-pinned `can()` handle member when a client layer
+(e.g. TanStack) is active: `api.posts.update.can({ type: 'Post', id: 42 })`.
+
+## Server side
+
+> **Per-instance decisions must be hydrated, not fetched.** The fetch fallback (`POST /authz/can`)
+> only resolves **class-level abilities and ad-hoc gates** — the `{ type, id }` resource shim it
+> sends never matches a `@Policy` by constructor. A **resource-bound** ability
+> (`can('update', { type: 'Post', id })`) that misses the hydrated cache and falls through to the
+> endpoint will **deny** (and logs a one-time `console.warn`). Hydrate per-instance decisions via
+> shared props / `authorizeResource` (tiers 1-2 of `@dudousxd/nestjs-authz-inertia`) instead.
+
+The runtime `can()` POSTs `{ ability, resource? }` to the configured `endpoint` and expects
+`{ allowed: boolean }` back. Expose a tiny controller in your NestJS app that delegates to the
+`Gate`:
+
+```ts
+@Post('authz/can')
+async can(@Body() body: { ability: string; resource?: { type: string; id?: string } | null }) {
+  return { allowed: await this.gate.allows(body.ability, body.resource ?? undefined) };
+}
+```
+
+## Options
+
+| Option | Default | Description |
+| --- | --- | --- |
+| `endpoint` | `'/authz/can'` | Server endpoint the generated `can()` POSTs to (expects `{ allowed }`). |
+| `discoverPolicies` | `true` | Also treat `@Policy(Resource)` method names as class-level abilities. |
+
+## Caveats
+
+Decorators are discovered by their **canonical names** — import `@Can` / `@Policy` under their real
+names. An aliased import (`import { Can as Authorize } from '@dudousxd/nestjs-authz'`) is NOT
+discovered, because codegen matches the decorator identifier (`Can` / `Policy`) syntactically and
+does not resolve aliases.

package/dist/index.d.ts

@@ -0,0 +1,49 @@
+import type { CodegenExtension } from '@dudousxd/nestjs-codegen/extension';
+/**
+ * The `@Can(ability, Resource?)` descriptor discovered on a controller route, plus the optional
+ * class-level abilities discovered on `@Policy(Resource)` classes. Mirrors the shapes stored by
+ * `@dudousxd/nestjs-authz`'s `CAN_METADATA` / `POLICY_RESOURCE_METADATA` — read statically from
+ * the AST rather than from reflect-metadata (which isn't available at codegen time).
+ */
+export interface AuthzAbilityInfo {
+    /** The ability string, e.g. `'update'` or `'access-admin'`. */
+    ability: string;
+    /** The resource class name the ability targets, when `@Can(ability, Resource)` names one. */
+    resource?: string;
+}
+/** Options for {@link nestjsAuthzCodegen}. */
+export interface AuthzCodegenOptions {
+    /**
+     * Server endpoint the generated `can()` helper falls back to when an ability/resource is not
+     * already hydrated in the shared store. Default `'/authz/can'`. Wired through to
+     * `@dudousxd/nestjs-authz-client`'s `createCan` as its `'fetch'` fallback endpoint; expose a tiny
+     * controller in your app that delegates to the `Gate` (`gate.allows(ability, resource)`).
+     */
+    endpoint?: string;
+    /**
+     * Also discover `@Policy(Resource)` classes and treat their public method names as class-level
+     * abilities (so e.g. `PostPolicy.publish` contributes `'publish'` to the union even when no
+     * route is decorated with it yet). Default `true`.
+     */
+    discoverPolicies?: boolean;
+}
+/**
+ * `@dudousxd/nestjs-authz` codegen extension. Discovers every `@Can(ability, Resource?)` decorator
+ * on your controllers (and, optionally, `@Policy` method abilities) and emits a typed `can()` helper
+ * into your generated `api.ts`: `ability` is a string-literal union of the discovered abilities, so a
+ * wrong ability is a compile error. The runtime `can()` delegates to `@dudousxd/nestjs-authz-client`
+ * (a shared `AbilityStore` + `createCan`) — so a hydrated decision answers with no request, and a
+ * cache miss falls back to the configured endpoint. Routes carrying a `@Can` also expose a `can()`
+ * handle member (when a client layer such as TanStack is active).
+ *
+ * Register it in your codegen config:
+ *
+ * ```ts
+ * defineConfig({
+ *   extensions: [nestjsAuthzCodegen({ endpoint: '/authz/can' })],
+ * });
+ * ```
+ */
+export declare function nestjsAuthzCodegen(options?: AuthzCodegenOptions): CodegenExtension;
+export default nestjsAuthzCodegen;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,gBAAgB,EAGjB,MAAM,oCAAoC,CAAC;AAG5C;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,6FAA6F;IAC7F,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAQD,8CAA8C;AAC9C,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAyKD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,mBAAwB,GAAG,gBAAgB,CAkEtF;AAED,eAAe,kBAAkB,CAAC"}

package/dist/index.js

@@ -0,0 +1,245 @@
+import { Node } from 'ts-morph';
+const DEFAULT_ENDPOINT = '/authz/can';
+/** Read the ability + resource from a single `@Can(...)` decorator's arguments. */
+function readCanDecorator(args) {
+    const abilityArg = args[0];
+    if (!abilityArg || !Node.isStringLiteral(abilityArg))
+        return null;
+    const info = { ability: abilityArg.getLiteralValue() };
+    const resourceArg = args[1];
+    // `@Can('update', Post)` — second arg is the resource class identifier.
+    if (resourceArg && Node.isIdentifier(resourceArg)) {
+        info.resource = resourceArg.getText();
+    }
+    return info;
+}
+/**
+ * Discover the `@Can(...)` ability on the controller method backing a route. Opens the route's
+ * controller source via the shared ts-morph project, finds the method, and reads its (or its
+ * class's) `@Can` decorator. Class-level `@Can` applies when the method has none.
+ */
+function discoverRouteAbility(route, project) {
+    const ref = route.controllerRef;
+    if (!ref)
+        return null;
+    let sourceFile;
+    try {
+        sourceFile = project.addSourceFileAtPathIfExists(ref.filePath) ?? undefined;
+    }
+    catch {
+        sourceFile = undefined;
+    }
+    if (!sourceFile)
+        sourceFile = project.getSourceFile(ref.filePath);
+    if (!sourceFile)
+        return null;
+    const classDecl = sourceFile.getClass(ref.className);
+    if (!classDecl)
+        return null;
+    const method = classDecl.getMethod(ref.methodName);
+    if (method) {
+        const dec = method.getDecorators().find((d) => d.getName() === 'Can');
+        if (dec) {
+            const info = readCanDecorator(dec.getArguments());
+            if (info)
+                return info;
+        }
+    }
+    // Fall back to a class-level `@Can(...)` guarding the whole controller.
+    const classDec = classDecl.getDecorators().find((d) => d.getName() === 'Can');
+    if (classDec)
+        return readCanDecorator(classDec.getArguments());
+    return null;
+}
+/**
+ * Discover class-level abilities from `@Policy(Resource)` classes: each public, non-lifecycle
+ * method name is an ability keyed to that resource. Mirrors how the authz `PolicyRegistry`
+ * dispatches `PostPolicy.update(user, post)` for `@Can('update', Post)`.
+ */
+function discoverPolicyAbilities(project) {
+    const found = [];
+    for (const sourceFile of project.getSourceFiles()) {
+        for (const classDecl of sourceFile.getClasses()) {
+            const policyDec = classDecl.getDecorators().find((d) => d.getName() === 'Policy');
+            if (!policyDec)
+                continue;
+            const resource = resourceNameFromPolicy(policyDec.getArguments(), classDecl);
+            for (const method of classDecl.getMethods()) {
+                if (method.isStatic())
+                    continue;
+                const name = method.getName();
+                // Skip the optional `before(user, ability)` hook — it isn't an ability itself.
+                if (name === 'before')
+                    continue;
+                const ability = { ability: name };
+                if (resource)
+                    ability.resource = resource;
+                found.push(ability);
+            }
+        }
+    }
+    return found;
+}
+/** `@Policy(Post)` → `'Post'`; derive from the class name (`PostPolicy` → `Post`) as a fallback. */
+function resourceNameFromPolicy(args, classDecl) {
+    const arg = args[0];
+    if (arg && Node.isIdentifier(arg))
+        return arg.getText();
+    const className = classDecl.getName();
+    if (className?.endsWith('Policy'))
+        return className.slice(0, -'Policy'.length);
+    return undefined;
+}
+/** The string-literal union of all discovered abilities, e.g. `"update" | "create"` (or `never`). */
+function abilityUnion(abilities) {
+    if (abilities.size === 0)
+        return 'never';
+    return [...abilities].map((a) => JSON.stringify(a)).join(' | ');
+}
+/** The `{ "Post": ["update", "create"] }` literal mapping each resource to its abilities. */
+function resourceAbilityMapLiteral(byResource) {
+    if (byResource.size === 0)
+        return '{}';
+    const entries = [...byResource.entries()].map(([resource, abilities]) => `${JSON.stringify(resource)}: [${[...abilities].map((a) => JSON.stringify(a)).join(', ')}]`);
+    return `{ ${entries.join(', ')} }`;
+}
+/** The `import { ... } from '@dudousxd/nestjs-authz-client'` line the header contributes. */
+function canHelperImports() {
+    return [
+        "import { AbilityStore, createCan } from '@dudousxd/nestjs-authz-client';",
+        "import type { ResourceRef } from '@dudousxd/nestjs-authz-client';",
+    ];
+}
+/**
+ * The top-level `can()` helper + `AuthzAbility` type contributed to `api.ts`. Rather than a
+ * hand-rolled POST, this DELEGATES to `@dudousxd/nestjs-authz-client`: it exports a shared
+ * `authzStore` ({@link AbilityStore}) you hydrate once (e.g. from Inertia props), and `can()` is a
+ * thin typed wrapper over the store's `createCan` resolver — so a hydrated decision is answered
+ * SYNCHRONOUSLY with NO request, and a cache miss uses the same configurable `'fetch'` fallback to
+ * {@link AuthzCodegenOptions.endpoint}. `ability` is a compile-time-checked union of discovered
+ * abilities, so a typo'd ability is a type error.
+ */
+function canHelperStatements(union, mapLiteral, endpoint) {
+    return [
+        '/** Every authorization ability discovered from `@Can`/`@Policy` in your NestJS app. */',
+        `export type AuthzAbility = ${union};`,
+        '',
+        '/** Map of resource class name → the abilities declared against it. */',
+        `export const authzAbilities = ${mapLiteral} as const;`,
+        '',
+        '/**',
+        ' * The shared ability store backing `can()`. Hydrate it once from your server-shared',
+        " * decisions (e.g. `hydrateFromInertiaProps(authzStore, props)` from '@dudousxd/nestjs-authz-client')",
+        ' * so checks resolve with no network request.',
+        ' */',
+        'export const authzStore = new AbilityStore();',
+        '',
+        '/**',
+        " * Resolver from '@dudousxd/nestjs-authz-client', bound to `authzStore`. Peek-first: a hydrated",
+        ` * decision returns synchronously; a cache miss POSTs to \`${endpoint}\` and reads \`{ allowed }\`.`,
+        ' */',
+        'const authzCan = createCan(authzStore, {',
+        `  fallback: 'fetch',`,
+        `  endpoint: ${JSON.stringify(endpoint)},`,
+        '});',
+        '',
+        '/**',
+        ' * Whether the current user `can` perform `ability` (optionally on a resource identified by',
+        ' * `resource`). Typed against the abilities discovered at build time, so an unknown ability is a',
+        " * compile error. Delegates to `@dudousxd/nestjs-authz-client`'s store/`createCan`: a hydrated",
+        ' * decision is returned synchronously (no request); otherwise it falls back to the configured',
+        ' * endpoint. Returns a `boolean` on a cache hit or a `Promise<boolean>` on a fetch fallback.',
+        ' *',
+        ' * NOTE: per-instance decisions MUST be hydrated into `authzStore` (e.g. via shared props /',
+        ' * `authorizeResource`). The fetch fallback only resolves class-level abilities and ad-hoc',
+        ' * gates — a resource-bound ability that misses the cache will deny.',
+        ' */',
+        'export function can(',
+        '  ability: AuthzAbility,',
+        '  resource?: ResourceRef | null,',
+        '): boolean | Promise<boolean> {',
+        '  return authzCan(ability, resource ?? undefined);',
+        '}',
+    ];
+}
+function markerOf(route) {
+    return route.contract?.contractSource?.authz;
+}
+/**
+ * `@dudousxd/nestjs-authz` codegen extension. Discovers every `@Can(ability, Resource?)` decorator
+ * on your controllers (and, optionally, `@Policy` method abilities) and emits a typed `can()` helper
+ * into your generated `api.ts`: `ability` is a string-literal union of the discovered abilities, so a
+ * wrong ability is a compile error. The runtime `can()` delegates to `@dudousxd/nestjs-authz-client`
+ * (a shared `AbilityStore` + `createCan`) — so a hydrated decision answers with no request, and a
+ * cache miss falls back to the configured endpoint. Routes carrying a `@Can` also expose a `can()`
+ * handle member (when a client layer such as TanStack is active).
+ *
+ * Register it in your codegen config:
+ *
+ * ```ts
+ * defineConfig({
+ *   extensions: [nestjsAuthzCodegen({ endpoint: '/authz/can' })],
+ * });
+ * ```
+ */
+export function nestjsAuthzCodegen(options = {}) {
+    const endpoint = options.endpoint ?? DEFAULT_ENDPOINT;
+    const discoverPolicies = options.discoverPolicies ?? true;
+    // Discovered once during transformRoutes, then read by apiHeader/apiMembers.
+    const abilities = new Set();
+    const byResource = new Map();
+    function record(info) {
+        abilities.add(info.ability);
+        if (info.resource) {
+            const set = byResource.get(info.resource) ?? new Set();
+            set.add(info.ability);
+            byResource.set(info.resource, set);
+        }
+    }
+    const ext = {
+        name: 'nestjs-authz',
+        transformRoutes(routes, ctx) {
+            const project = ctx.project();
+            const out = routes.map((route) => {
+                const info = discoverRouteAbility(route, project);
+                if (!info)
+                    return route;
+                record(info);
+                const marker = { ability: info.ability };
+                if (info.resource)
+                    marker.resource = info.resource;
+                // Attach the marker to the route's contract so apiMembers can read it later.
+                const contractSource = { ...(route.contract?.contractSource ?? {}), authz: marker };
+                return { ...route, contract: { ...route.contract, contractSource } };
+            });
+            if (discoverPolicies) {
+                for (const info of discoverPolicyAbilities(project))
+                    record(info);
+            }
+            return out;
+        },
+        apiHeader() {
+            if (abilities.size === 0)
+                return undefined;
+            return {
+                imports: canHelperImports(),
+                statements: canHelperStatements(abilityUnion(abilities), resourceAbilityMapLiteral(byResource), endpoint),
+            };
+        },
+        apiMembers(leaf) {
+            const marker = markerOf(leaf.route);
+            if (!marker)
+                return undefined;
+            const resourceArg = marker.resource ? 'resource: ResourceRef | null = null' : '';
+            const callResource = marker.resource ? ', resource' : '';
+            return {
+                // A typed `can()` pinned to THIS route's ability — no argument needed, can't be wrong.
+                can: `(${resourceArg}) => can(${JSON.stringify(marker.ability)}${callResource})`,
+                ability: JSON.stringify(marker.ability),
+            };
+        },
+    };
+    return ext;
+}
+export default nestjsAuthzCodegen;
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,EAAyB,IAAI,EAAiC,MAAM,UAAU,CAAC;AAsCtF,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAEtC,mFAAmF;AACnF,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,MAAM,IAAI,GAAqB,EAAE,OAAO,EAAE,UAAU,CAAC,eAAe,EAAE,EAAE,CAAC;IACzE,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,wEAAwE;IACxE,IAAI,WAAW,IAAI,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,QAAQ,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,KAAsB,EAAE,OAAgB;IACpE,MAAM,GAAG,GAAG,KAAK,CAAC,aAAa,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,UAAkC,CAAC;IACvC,IAAI,CAAC;QACH,UAAU,GAAG,OAAO,CAAC,2BAA2B,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,SAAS,CAAC;IACzB,CAAC;IACD,IAAI,CAAC,UAAU;QAAE,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAE7B,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACnD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,KAAK,CAAC,CAAC;QACtE,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC;YAClD,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC;QACxB,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,MAAM,QAAQ,GAAG,SAAS,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,KAAK,CAAC,CAAC;IAC9E,IAAI,QAAQ;QAAE,OAAO,gBAAgB,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;IAE/D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAAC,OAAgB;IAC/C,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;QAClD,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC;YAChD,MAAM,SAAS,GAAG,SAAS,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC;YAClF,IAAI,CAAC,SAAS;gBAAE,SAAS;YACzB,MAAM,QAAQ,GAAG,sBAAsB,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,CAAC,CAAC;YAC7E,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC;gBAC5C,IAAI,MAAM,CAAC,QAAQ,EAAE;oBAAE,SAAS;gBAChC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC9B,+EAA+E;gBAC/E,IAAI,IAAI,KAAK,QAAQ;oBAAE,SAAS;gBAChC,MAAM,OAAO,GAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBACpD,IAAI,QAAQ;oBAAE,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;gBAC1C,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oGAAoG;AACpG,SAAS,sBAAsB,CAAC,IAAY,EAAE,SAA2B;IACvE,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,GAAG,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC;IACxD,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;IACtC,IAAI,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qGAAqG;AACrG,SAAS,YAAY,CAAC,SAAsB;IAC1C,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACzC,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,6FAA6F;AAC7F,SAAS,yBAAyB,CAAC,UAAoC;IACrE,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,OAAO,GAAG,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAC3C,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE,CACxB,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC9F,CAAC;IACF,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACrC,CAAC;AAED,6FAA6F;AAC7F,SAAS,gBAAgB;IACvB,OAAO;QACL,0EAA0E;QAC1E,mEAAmE;KACpE,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,KAAa,EAAE,UAAkB,EAAE,QAAgB;IAC9E,OAAO;QACL,yFAAyF;QACzF,8BAA8B,KAAK,GAAG;QACtC,EAAE;QACF,wEAAwE;QACxE,iCAAiC,UAAU,YAAY;QACvD,EAAE;QACF,KAAK;QACL,sFAAsF;QACtF,uGAAuG;QACvG,+CAA+C;QAC/C,KAAK;QACL,+CAA+C;QAC/C,EAAE;QACF,KAAK;QACL,iGAAiG;QACjG,8DAA8D,QAAQ,+BAA+B;QACrG,KAAK;QACL,0CAA0C;QAC1C,sBAAsB;QACtB,eAAe,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG;QAC1C,KAAK;QACL,EAAE;QACF,KAAK;QACL,6FAA6F;QAC7F,kGAAkG;QAClG,gGAAgG;QAChG,+FAA+F;QAC/F,8FAA8F;QAC9F,IAAI;QACJ,6FAA6F;QAC7F,4FAA4F;QAC5F,sEAAsE;QACtE,KAAK;QACL,sBAAsB;QACtB,0BAA0B;QAC1B,kCAAkC;QAClC,iCAAiC;QACjC,oDAAoD;QACpD,GAAG;KACJ,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAsB;IACtC,OAAQ,KAAK,CAAC,QAAQ,EAAE,cAA2D,EAAE,KAAK,CAAC;AAC7F,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAA+B,EAAE;IAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,gBAAgB,CAAC;IACtD,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,IAAI,CAAC;IAE1D,6EAA6E;IAC7E,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAuB,CAAC;IAElD,SAAS,MAAM,CAAC,IAAsB;QACpC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;YAC/D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACtB,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAqB;QAC5B,IAAI,EAAE,cAAc;QAEpB,eAAe,CAAC,MAAM,EAAE,GAAG;YACzB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC/B,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAClD,IAAI,CAAC,IAAI;oBAAE,OAAO,KAAK,CAAC;gBACxB,MAAM,CAAC,IAAI,CAAC,CAAC;gBACb,MAAM,MAAM,GAAqB,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC3D,IAAI,IAAI,CAAC,QAAQ;oBAAE,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;gBACnD,6EAA6E;gBAC7E,MAAM,cAAc,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,cAAc,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;gBACpF,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,cAAc,EAAE,EAAqB,CAAC;YAC1F,CAAC,CAAC,CAAC;YAEH,IAAI,gBAAgB,EAAE,CAAC;gBACrB,KAAK,MAAM,IAAI,IAAI,uBAAuB,CAAC,OAAO,CAAC;oBAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YACpE,CAAC;YAED,OAAO,GAAG,CAAC;QACb,CAAC;QAED,SAAS;YACP,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC3C,OAAO;gBACL,OAAO,EAAE,gBAAgB,EAAE;gBAC3B,UAAU,EAAE,mBAAmB,CAC7B,YAAY,CAAC,SAAS,CAAC,EACvB,yBAAyB,CAAC,UAAU,CAAC,EACrC,QAAQ,CACT;aACF,CAAC;QACJ,CAAC;QAED,UAAU,CAAC,IAAe;YACxB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAC9B,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjF,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,OAAO;gBACL,uFAAuF;gBACvF,GAAG,EAAE,IAAI,WAAW,YAAY,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,YAAY,GAAG;gBAChF,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC;aACxC,CAAC;QACJ,CAAC;KACF,CAAC;IAEF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,eAAe,kBAAkB,CAAC"}

package/package.json

@@ -0,0 +1,63 @@
+{
+  "name": "@dudousxd/nestjs-authz-codegen",
+  "version": "0.1.0",
+  "description": "nestjs-codegen extension for @dudousxd/nestjs-authz — discovers @Can abilities and emits a typed can() into your generated client.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/DavideCarvalho/nestjs-authz.git",
+    "directory": "packages/codegen"
+  },
+  "author": "Davi Carvalho <davi@goflip.ai>",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist/",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "peerDependencies": {
+    "@dudousxd/nestjs-authz": ">=0.2.0",
+    "@dudousxd/nestjs-authz-client": ">=0.0.0",
+    "@dudousxd/nestjs-codegen": ">=0.4.0"
+  },
+  "peerDependenciesMeta": {
+    "@dudousxd/nestjs-authz-client": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@dudousxd/nestjs-codegen": "0.4.0",
+    "ts-morph": "^28.0.0",
+    "typescript": "^5.4.0",
+    "vitest": "^3.0.0",
+    "@dudousxd/nestjs-authz": "^0.3.0",
+    "@dudousxd/nestjs-authz-client": "^0.1.0"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "keywords": [
+    "nestjs",
+    "authorization",
+    "authz",
+    "codegen",
+    "extension",
+    "can",
+    "policy"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "vitest run --passWithNoTests",
+    "test:watch": "vitest",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  }
+}