@dudousxd/nestjs-authz-inertia 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,55 @@
+# @dudousxd/nestjs-authz-inertia
+
+## 0.1.0
+
+### Minor Changes
+
+- [#2](https://github.com/DavideCarvalho/nestjs-authz/pull/2) [`2ecb0f4`](https://github.com/DavideCarvalho/nestjs-authz/commit/2ecb0f46342fa4527fc01f1097720f2e7bcf9aa7) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Add `@dudousxd/nestjs-authz-inertia`: a 3-tier Inertia integration that lets client `can(...)`
+  checks resolve **without a network request** (the Laravel/Inertia model).
+
+  - **Tier 1 — shared props (no request):** `AuthzInertiaModule` (a global interceptor that calls
+    `req.inertia.share(...)`) or `createAuthzShare(gate, policyRegistry)` (a factory for
+    `InertiaModule.forRoot({ share })`) resolves the current user's class-level abilities — all
+    ad-hoc gates + class-level `@Policy` methods — into `props.auth.can` via direct in-process
+    `gate.allows(...)` calls.
+  - **Tier 2 — per-resource map (no request):** `authorizeResource(gate, instance, abilities)`
+    returns a `{ update, delete }` map a controller attaches to a serialized resource.
+  - **Tier 3 — fallback endpoint (last resort):** consumes core's opt-in `POST /authz/can`.
+  - **Framework-neutral client** (`@dudousxd/nestjs-authz-inertia/client`): an `AbilityStore`,
+    `hydrateFromInertiaProps` / `hydrateResource`, and a `createCan` resolver that reads hydrated
+    decisions synchronously (no fetch on a cache hit) and only falls back (fetch the endpoint, or
+    deny) when the ability/resource is unknown.
+  - **Denial filter (`AuthzDenialFilter`):** `AuthzInertiaModule.forRoot` also registers a global
+    `APP_FILTER` that converts `@Roles`/`@Can` denials (`ForbiddenException`) into a friendly 303
+    redirect on Inertia requests (`X-Inertia` header) — `/login` when unauthenticated, `/403` when
+    authenticated-but-forbidden (auth-state read from the optional `CONTEXT_ACCESSOR`). Non-Inertia
+    (REST) requests are rethrown and keep the normal 403 JSON. Configurable via
+    `forRoot({ denial: { loginUrl, forbiddenUrl, enabled, handler } })` (`enabled: false` opts out;
+    `handler(exception, host)` is a full escape hatch). Targets pass the same open-redirect guard
+    nestjs-inertia uses, falling back to a safe default if unsafe.
+
+  `@dudousxd/nestjs-authz` (patch): add an opt-in `POST /authz/can` fallback controller behind
+  `AuthzModule.forRoot({ canEndpoint: true })` (default off; accepts a custom path string). It runs
+  `gate.allows(ability, resource?)` for the current context user and returns `{ allowed }`, failing
+  closed for unresolved abilities. Also exposes `Gate.gateNames()` and `PolicyRegistry.classAbilities()`
+  so integrations can enumerate a user's class-level abilities.
+
+### Patch Changes
+
+- [#2](https://github.com/DavideCarvalho/nestjs-authz/pull/2) [`2ecb0f4`](https://github.com/DavideCarvalho/nestjs-authz/commit/2ecb0f46342fa4527fc01f1097720f2e7bcf9aa7) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Extract the framework-neutral ability store into a new `@dudousxd/nestjs-authz-client`
+  package and add a `@dudousxd/nestjs-authz-react` package.
+
+  - **`@dudousxd/nestjs-authz-client`** (new): the canonical home for the in-memory
+    `AbilityStore`, `createCan` (synchronous cache hit; configurable `fallback: 'deny' | 'fetch'`
+    to `POST /authz/can` on a miss), and `hydrateFromInertiaProps` / `hydrateResource`. Pure
+    TypeScript plus an injectable `fetch` — no React/Vue/NestJS/Inertia dependency.
+  - **`@dudousxd/nestjs-authz-react`** (new): `AuthzProvider` (holds a hydrated `AbilityStore`),
+    `useCan(ability, resource?)` (returns `{ allowed, loading }`, synchronous and request-free on a
+    cache hit; honors the store's fallback on a miss), and `<Can ability of fallback>`. A missing
+    provider fails closed (deny).
+  - **`@dudousxd/nestjs-authz-inertia`** (patch): now depends on `@dudousxd/nestjs-authz-client` and
+    re-exports its store instead of carrying a private copy. The
+    `@dudousxd/nestjs-authz-inertia/client` entry point is unchanged for consumers.
+
+- Updated dependencies [[`2ecb0f4`](https://github.com/DavideCarvalho/nestjs-authz/commit/2ecb0f46342fa4527fc01f1097720f2e7bcf9aa7)]:
+  - @dudousxd/nestjs-authz-client@0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Davi Carvalho
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,117 @@
+# @dudousxd/nestjs-authz-inertia
+
+Inertia.js integration for [`@dudousxd/nestjs-authz`](../core). It makes client-side
+`can(...)` checks resolve **without a network request** by sharing the current
+user's abilities as Inertia props — the Laravel/Inertia model.
+
+```bash
+pnpm add @dudousxd/nestjs-authz-inertia
+# peers: @dudousxd/nestjs-authz, @dudousxd/nestjs-inertia
+#        (optional) @dudousxd/nestjs-context
+```
+
+## The 3-tier model — prefer props → resource map → endpoint fallback
+
+Authorization decisions reach the front end through three tiers. Prefer the earlier
+(no-request) tiers; the endpoint is a last resort.
+
+### Tier 1 — Shared props (no request)
+
+Every Inertia render carries the current user's **class-level abilities** (all ad-hoc
+gates + class-level `@Policy` methods like `create`/`viewAny`) under `props.auth.can`:
+
+```jsonc
+{ "auth": { "can": { "post.create": true, "access-admin": false } } }
+```
+
+Two equivalent ways to wire it:
+
+**A. Module (auto, via `req.inertia.share`)** — register `AuthzInertiaModule`; a global
+interceptor shares the map on every Inertia request:
+
+```ts
+@Module({
+  imports: [
+    AuthzModule.forRoot({ policies: [PostPolicy] }),
+    InertiaModule.forRoot({ /* ... */ }),
+    AuthzInertiaModule.forRoot(), // shares props.auth.can automatically
+  ],
+})
+export class AppModule {}
+```
+
+**B. Share factory (explicit, via inertia's own seam)** — drop a factory into
+`InertiaModule.forRoot({ share })`:
+
+```ts
+InertiaModule.forRoot({
+  share: createAuthzShare(gate, policyRegistry),
+})
+```
+
+Both resolve abilities by direct in-process `gate.allows(...)` calls — no HTTP round-trip.
+The ability name defaults to `"<resourceLower>.<method>"` (e.g. `post.create`); pass
+`abilityNamer: (_, m) => m` for bare method names, or a custom `propKey`.
+
+### Tier 2 — Per-resource `can` map (no request)
+
+For instance-specific decisions (`update`/`delete` of *this* post), serialize a `can`
+map onto the resource in your controller:
+
+```ts
+const post = await this.posts.find(id);
+const can = await authorizeResource(this.gate, post, ['update', 'delete']);
+return this.inertia.render('Post/Show', { post: { ...post, can } });
+// → { post: { id, title, can: { update: true, delete: false } } }
+```
+
+On the client, hydrate it into the store keyed by `type#id` so `can('update', post)`
+answers synchronously. (`authorizeResourceForUser` checks an explicit user.)
+
+### Tier 3 — Fallback endpoint (request, last resort)
+
+For abilities not hydrated on the client, enable the opt-in endpoint in **core**:
+
+```ts
+AuthzModule.forRoot({ canEndpoint: true }) // POST /authz/can → { allowed }
+// or a custom path: canEndpoint: 'api/authz/can'
+```
+
+It runs `gate.allows(ability, resource?)` for the current context user and returns
+`{ allowed }`. Off by default. This is the path the codegen-emitted `can()` targets.
+
+> **Class-level only.** The endpoint can resolve **class-level abilities and ad-hoc gates**
+> only — the `{ type, id }` resource shim it receives never matches a `@Policy` by constructor.
+> Per-instance decisions MUST be hydrated via tiers 1-2 (shared props / `authorizeResource`);
+> a **resource-bound** ability that misses the cache and falls through to `/authz/can` will
+> **deny** (and `createCan` logs a one-time `console.warn`). Treat tier 3 as a class-level /
+> ad-hoc fallback, not a per-instance one.
+
+## Client store (framework-neutral)
+
+`@dudousxd/nestjs-authz-inertia/client` is a tiny in-memory store + resolver with no
+framework dependency — `-react` and the codegen client reuse it.
+
+```ts
+import { AbilityStore, hydrateFromInertiaProps, hydrateResource, createCan } from '@dudousxd/nestjs-authz-inertia/client';
+
+const store = new AbilityStore();
+hydrateFromInertiaProps(store, page.props);              // tier 1: props.auth.can
+hydrateResource(store, { type: 'Post', id: post.id }, post.can); // tier 2
+
+const can = createCan(store, { fallback: 'fetch', endpoint: '/authz/can' });
+
+can('post.create');                       // → true   (sync, no request)
+can('update', { type: 'Post', id: 7 });   // → false  (sync, from resource map)
+can('mystery');                           // fallback: 'deny' → false; 'fetch' → Promise<boolean>
+```
+
+- **Cache hit** → returns a `boolean` synchronously, never touches the network.
+- **Cache miss** → `fallback: 'deny'` (default) returns `false`; `fallback: 'fetch'`
+  POSTs to the tier-3 endpoint and returns a `Promise<boolean>`. A **resource-bound**
+  miss under `'fetch'` can only deny (the endpoint resolves class-level abilities only)
+  and logs a one-time `console.warn` — hydrate per-instance decisions via tiers 1-2.
+
+## License
+
+MIT

package/dist/authorize-resource.d.ts

@@ -0,0 +1,28 @@
+import type { Gate, Resource } from '@dudousxd/nestjs-authz';
+import type { CanMap } from './resolve-abilities.js';
+/**
+ * Resolve a per-INSTANCE `can` map for one resource, with NO HTTP round-trip:
+ * each ability is a direct `gate.allows(ability, resource)` call against the
+ * in-process Gate for the current (context) user.
+ *
+ * Use it controller-side to attach decisions to a serialized resource:
+ *
+ * ```ts
+ * const post = await this.posts.find(id);
+ * const can = await authorizeResource(this.gate, post, ['update', 'delete']);
+ * return this.inertia.render('Post/Show', { post: { ...post, can } });
+ * ```
+ *
+ * The client store keys these maps by `type#id`, so hydrating them lets
+ * `can('update', post)` return the cached verdict synchronously on the front end.
+ *
+ * @returns e.g. `{ update: true, delete: false }`
+ */
+export declare function authorizeResource(gate: Gate, resource: Resource, abilities: string[]): Promise<CanMap>;
+/**
+ * Like {@link authorizeResource}, but resolves for an explicit user via
+ * `gate.forUser(user)` instead of the current context user. Useful outside a
+ * request, or to serialize decisions for a user other than the caller.
+ */
+export declare function authorizeResourceForUser(gate: Gate, user: unknown, resource: Resource, abilities: string[]): Promise<CanMap>;
+//# sourceMappingURL=authorize-resource.d.ts.map

package/dist/authorize-resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize-resource.d.ts","sourceRoot":"","sources":["../src/authorize-resource.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAErD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EAAE,GAClB,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,IAAI,EACV,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,MAAM,EAAE,GAClB,OAAO,CAAC,MAAM,CAAC,CAWjB"}

package/dist/authorize-resource.js

@@ -0,0 +1,49 @@
+/**
+ * Resolve a per-INSTANCE `can` map for one resource, with NO HTTP round-trip:
+ * each ability is a direct `gate.allows(ability, resource)` call against the
+ * in-process Gate for the current (context) user.
+ *
+ * Use it controller-side to attach decisions to a serialized resource:
+ *
+ * ```ts
+ * const post = await this.posts.find(id);
+ * const can = await authorizeResource(this.gate, post, ['update', 'delete']);
+ * return this.inertia.render('Post/Show', { post: { ...post, can } });
+ * ```
+ *
+ * The client store keys these maps by `type#id`, so hydrating them lets
+ * `can('update', post)` return the cached verdict synchronously on the front end.
+ *
+ * @returns e.g. `{ update: true, delete: false }`
+ */
+export async function authorizeResource(gate, resource, abilities) {
+    const out = {};
+    for (const ability of abilities) {
+        try {
+            out[ability] = await gate.allows(ability, resource);
+        }
+        catch {
+            out[ability] = false;
+        }
+    }
+    return out;
+}
+/**
+ * Like {@link authorizeResource}, but resolves for an explicit user via
+ * `gate.forUser(user)` instead of the current context user. Useful outside a
+ * request, or to serialize decisions for a user other than the caller.
+ */
+export async function authorizeResourceForUser(gate, user, resource, abilities) {
+    const bound = gate.forUser(user);
+    const out = {};
+    for (const ability of abilities) {
+        try {
+            out[ability] = await bound.allows(ability, resource);
+        }
+        catch {
+            out[ability] = false;
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=authorize-resource.js.map

package/dist/authorize-resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize-resource.js","sourceRoot":"","sources":["../src/authorize-resource.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAU,EACV,QAAkB,EAClB,SAAmB;IAEnB,MAAM,GAAG,GAAW,EAAE,CAAC;IACvB,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,GAAG,CAAC,OAAO,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAU,EACV,IAAa,EACb,QAAkB,EAClB,SAAmB;IAEnB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,GAAG,GAAW,EAAE,CAAC;IACvB,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,GAAG,CAAC,OAAO,CAAC,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/authz-denial.filter.d.ts

@@ -0,0 +1,42 @@
+import { type ContextAccessor } from '@dudousxd/nestjs-authz';
+import { type ArgumentsHost, type ExceptionFilter, ForbiddenException } from '@nestjs/common';
+import type { AuthzInertiaOptions } from './types.js';
+/**
+ * Default redirect target for an UNAUTHENTICATED Inertia denial.
+ */
+export declare const DEFAULT_LOGIN_URL = "/login";
+/**
+ * Default redirect target for an AUTHENTICATED-but-FORBIDDEN Inertia denial.
+ */
+export declare const DEFAULT_FORBIDDEN_URL = "/403";
+/**
+ * Catches authorization denials (`@Roles`/`@Can` → `ForbiddenException`) and, on
+ * an Inertia request (`X-Inertia` header), 303-redirects to a friendly page
+ * instead of bubbling a raw 403. Mirrors the structure of nestjs-inertia's
+ * `InertiaValidationFilter`: detect the Inertia request via the `X-Inertia`
+ * header, issue a safe same-origin redirect (303 + `Location`), and rethrow
+ * everything else so normal Nest handling (JSON 403) applies — preserving REST
+ * clients.
+ *
+ * Redirect targets are decided by auth-state, read from the OPTIONAL
+ * `CONTEXT_ACCESSOR` (`userRef()` undefined → unauthenticated):
+ * - unauthenticated → `loginUrl` (default `/login`)
+ * - authenticated but forbidden → `forbiddenUrl` (default `/403`)
+ *
+ * Registered unconditionally as an `APP_FILTER` by
+ * `AuthzInertiaModule.forRoot`; on by default and disabled via
+ * `forRoot({ denial: { enabled: false } })`. A `handler(exception, host)`
+ * escape hatch fully overrides the behavior on Inertia requests.
+ */
+export declare class AuthzDenialFilter implements ExceptionFilter {
+    private readonly options;
+    private readonly context?;
+    constructor(options?: AuthzInertiaOptions, context?: ContextAccessor | undefined);
+    catch(exception: ForbiddenException, host: ArgumentsHost): void;
+    /**
+     * Pick the redirect target from auth-state. An undefined `userRef()` (or no
+     * context accessor at all) is treated as unauthenticated.
+     */
+    private resolveRedirectTarget;
+}
+//# sourceMappingURL=authz-denial.filter.d.ts.map

package/dist/authz-denial.filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-denial.filter.d.ts","sourceRoot":"","sources":["../src/authz-denial.filter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,EACL,KAAK,aAAa,EAElB,KAAK,eAAe,EACpB,kBAAkB,EAGnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAsB,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAE1E;;GAEG;AACH,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C;;GAEG;AACH,eAAO,MAAM,qBAAqB,SAAS,CAAC;AAE5C;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBACa,iBAAkB,YAAW,eAAe;IAIrD,OAAO,CAAC,QAAQ,CAAC,OAAO;IAGxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAHR,OAAO,GAAE,mBAAwB,EAGjC,OAAO,CAAC,EAAE,eAAe,YAAA;IAG5C,KAAK,CAAC,SAAS,EAAE,kBAAkB,EAAE,IAAI,EAAE,aAAa,GAAG,IAAI;IA2B/D;;;OAGG;IACH,OAAO,CAAC,qBAAqB;CAO9B"}

package/dist/authz-denial.filter.js

@@ -0,0 +1,172 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { CONTEXT_ACCESSOR } from '@dudousxd/nestjs-authz';
+import { Catch, ForbiddenException, Inject, Optional, } from '@nestjs/common';
+import { AUTHZ_INERTIA_OPTIONS } from './tokens.js';
+/**
+ * Default redirect target for an UNAUTHENTICATED Inertia denial.
+ */
+export const DEFAULT_LOGIN_URL = '/login';
+/**
+ * Default redirect target for an AUTHENTICATED-but-FORBIDDEN Inertia denial.
+ */
+export const DEFAULT_FORBIDDEN_URL = '/403';
+/**
+ * Catches authorization denials (`@Roles`/`@Can` → `ForbiddenException`) and, on
+ * an Inertia request (`X-Inertia` header), 303-redirects to a friendly page
+ * instead of bubbling a raw 403. Mirrors the structure of nestjs-inertia's
+ * `InertiaValidationFilter`: detect the Inertia request via the `X-Inertia`
+ * header, issue a safe same-origin redirect (303 + `Location`), and rethrow
+ * everything else so normal Nest handling (JSON 403) applies — preserving REST
+ * clients.
+ *
+ * Redirect targets are decided by auth-state, read from the OPTIONAL
+ * `CONTEXT_ACCESSOR` (`userRef()` undefined → unauthenticated):
+ * - unauthenticated → `loginUrl` (default `/login`)
+ * - authenticated but forbidden → `forbiddenUrl` (default `/403`)
+ *
+ * Registered unconditionally as an `APP_FILTER` by
+ * `AuthzInertiaModule.forRoot`; on by default and disabled via
+ * `forRoot({ denial: { enabled: false } })`. A `handler(exception, host)`
+ * escape hatch fully overrides the behavior on Inertia requests.
+ */
+let AuthzDenialFilter = class AuthzDenialFilter {
+    options;
+    context;
+    constructor(options = {}, context) {
+        this.options = options;
+        this.context = context;
+    }
+    catch(exception, host) {
+        const denial = this.options.denial ?? {};
+        // Disabled, or non-HTTP context: rethrow so normal Nest handling applies.
+        if (denial.enabled === false || host.getType() !== 'http') {
+            throw exception;
+        }
+        const http = host.switchToHttp();
+        const req = http.getRequest();
+        const res = http.getResponse();
+        // Gate: only Inertia requests. Else rethrow → normal 403 JSON for REST.
+        if (!getHeader(req, 'X-Inertia')) {
+            throw exception;
+        }
+        // Escape hatch: a custom handler takes full control on Inertia requests.
+        if (denial.handler) {
+            denial.handler(exception, host);
+            return;
+        }
+        const target = this.resolveRedirectTarget(denial);
+        sendRedirect(res, 303, target);
+    }
+    /**
+     * Pick the redirect target from auth-state. An undefined `userRef()` (or no
+     * context accessor at all) is treated as unauthenticated.
+     */
+    resolveRedirectTarget(denial) {
+        const loginUrl = denial.loginUrl ?? DEFAULT_LOGIN_URL;
+        const forbiddenUrl = denial.forbiddenUrl ?? DEFAULT_FORBIDDEN_URL;
+        const authenticated = this.context?.userRef() !== undefined;
+        const target = authenticated ? forbiddenUrl : loginUrl;
+        return toSafePath(target, authenticated ? DEFAULT_FORBIDDEN_URL : DEFAULT_LOGIN_URL);
+    }
+};
+AuthzDenialFilter = __decorate([
+    Catch(ForbiddenException),
+    __param(0, Optional()),
+    __param(0, Inject(AUTHZ_INERTIA_OPTIONS)),
+    __param(1, Optional()),
+    __param(1, Inject(CONTEXT_ACCESSOR)),
+    __metadata("design:paramtypes", [Object, Object])
+], AuthzDenialFilter);
+export { AuthzDenialFilter };
+/**
+ * Reduce a configured target to a safe same-origin path via the same
+ * open-redirect guard nestjs-inertia uses (`validateLocationUrl`), falling back
+ * to a known-safe default if the target is rejected.
+ */
+function toSafePath(target, fallback) {
+    try {
+        return validateLocationUrl(target);
+    }
+    catch {
+        return fallback;
+    }
+}
+/**
+ * Local mirror of nestjs-inertia's `getHeader`. Reads a request header in a
+ * cross-runtime way (Express `req.header(name)` / raw Fastify `req.headers`).
+ * The package couples to nestjs-inertia STRUCTURALLY (request/response shape),
+ * so this is replicated rather than imported.
+ */
+function getHeader(req, name) {
+    const r = req;
+    if (typeof r.header === 'function')
+        return r.header(name);
+    const v = r.headers?.[name.toLowerCase()];
+    return Array.isArray(v) ? v[0] : v;
+}
+/**
+ * Local mirror of nestjs-inertia's `validateLocationUrl` open-redirect guard.
+ * Only relative URLs (single leading `/`) or recognizable relative paths are
+ * permitted; absolute/protocol-relative/unsafe-scheme URLs throw.
+ */
+function validateLocationUrl(url) {
+    if (url.startsWith('/') && !url.startsWith('//'))
+        return url;
+    if (url.startsWith('//')) {
+        throw new Error(`[nestjs-authz-inertia] denial redirect rejected protocol-relative URL: ${url}`);
+    }
+    try {
+        const parsed = new URL(url);
+        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+            throw new Error(`[nestjs-authz-inertia] denial redirect rejected unsafe URL scheme: ${url}`);
+        }
+        throw new Error(`[nestjs-authz-inertia] denial redirect rejected absolute URL to external host: ${url}.`);
+    }
+    catch (err) {
+        if (err instanceof TypeError) {
+            if (/^[a-zA-Z0-9]/.test(url) || url.startsWith('.')) {
+                return url;
+            }
+            throw new Error(`[nestjs-authz-inertia] denial redirect rejected unrecognized URL: ${url}`);
+        }
+        throw err;
+    }
+}
+/**
+ * Local mirror of nestjs-inertia's cross-runtime redirect emit. Sets the status
+ * code + `Location` header and ends the response, duck-typing Express
+ * (`status`/`setHeader`/`end`) vs raw Fastify (`code`/`header`/`send`).
+ */
+function sendRedirect(res, status, url) {
+    const r = res;
+    if (typeof r.status === 'function') {
+        r.status(status);
+    }
+    else if (typeof r.code === 'function') {
+        r.code(status);
+    }
+    if (typeof r.setHeader === 'function') {
+        r.setHeader('Location', url);
+    }
+    else if (typeof r.header === 'function') {
+        r.header('Location', url);
+    }
+    if (typeof r.end === 'function') {
+        r.end();
+    }
+    else if (typeof r.send === 'function') {
+        r.send();
+    }
+}
+//# sourceMappingURL=authz-denial.filter.js.map

package/dist/authz-denial.filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-denial.filter.js","sourceRoot":"","sources":["../src/authz-denial.filter.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,gBAAgB,EAAwB,MAAM,wBAAwB,CAAC;AAChF,OAAO,EAEL,KAAK,EAEL,kBAAkB,EAClB,MAAM,EACN,QAAQ,GACT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAE1C;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAE5C;;;;;;;;;;;;;;;;;;GAkBG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAIT;IAGA;IANnB,YAGmB,UAA+B,EAAE,EAGjC,OAAyB;QAHzB,YAAO,GAAP,OAAO,CAA0B;QAGjC,YAAO,GAAP,OAAO,CAAkB;IACzC,CAAC;IAEJ,KAAK,CAAC,SAA6B,EAAE,IAAmB;QACtD,MAAM,MAAM,GAAuB,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;QAE7D,0EAA0E;QAC1E,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;YAC1D,MAAM,SAAS,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAW,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAW,CAAC;QAExC,wEAAwE;QACxE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;YACjC,MAAM,SAAS,CAAC;QAClB,CAAC;QAED,yEAAyE;QACzE,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAClD,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IAED;;;OAGG;IACK,qBAAqB,CAAC,MAA0B;QACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,iBAAiB,CAAC;QACtD,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,qBAAqB,CAAC;QAClE,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,SAAS,CAAC;QAC5D,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC;QACvD,OAAO,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACvF,CAAC;CACF,CAAA;AAhDY,iBAAiB;IAD7B,KAAK,CAAC,kBAAkB,CAAC;IAGrB,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,MAAM,CAAC,qBAAqB,CAAC,CAAA;IAE7B,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,MAAM,CAAC,gBAAgB,CAAC,CAAA;;GANhB,iBAAiB,CAgD7B;;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,MAAc,EAAE,QAAgB;IAClD,IAAI,CAAC;QACH,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,GAAY,EAAE,IAAY;IAC3C,MAAM,CAAC,GAAG,GAGT,CAAC;IACF,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,GAAW;IACtC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IAC7D,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,0EAA0E,GAAG,EAAE,CAChF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,sEAAsE,GAAG,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,IAAI,KAAK,CACb,kFAAkF,GAAG,GAAG,CACzF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,SAAS,EAAE,CAAC;YAC7B,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpD,OAAO,GAAG,CAAC;YACb,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,qEAAqE,GAAG,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,GAAY,EAAE,MAAc,EAAE,GAAW;IAC7D,MAAM,CAAC,GAAG,GAOT,CAAC;IAEF,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACnC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC;SAAM,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjB,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QACtC,CAAC,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;SAAM,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1C,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAChC,CAAC,CAAC,GAAG,EAAE,CAAC;IACV,CAAC;SAAM,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACxC,CAAC,CAAC,IAAI,EAAE,CAAC;IACX,CAAC;AACH,CAAC"}

package/dist/authz-inertia.interceptor.d.ts

@@ -0,0 +1,21 @@
+import { Gate, PolicyRegistry } from '@dudousxd/nestjs-authz';
+import { type CallHandler, type ExecutionContext, type NestInterceptor } from '@nestjs/common';
+import type { Observable } from 'rxjs';
+import type { AuthzInertiaOptions } from './types.js';
+/**
+ * Auto-shares the current user's class-level abilities into `props.<propKey>.can`
+ * for every HTTP request that carries an attached Inertia service (`req.inertia`),
+ * by calling `req.inertia.share(...)` BEFORE the route handler renders.
+ *
+ * No network request: abilities are resolved by direct `gate.allows` calls.
+ * Non-HTTP contexts and requests without `req.inertia` are passed through untouched.
+ */
+export declare class AuthzInertiaInterceptor implements NestInterceptor {
+    private readonly gate;
+    private readonly policies;
+    private readonly options;
+    private readonly propKey;
+    constructor(gate: Gate, policies: PolicyRegistry, options?: AuthzInertiaOptions);
+    intercept(context: ExecutionContext, next: CallHandler): Observable<unknown>;
+}
+//# sourceMappingURL=authz-inertia.interceptor.d.ts.map

package/dist/authz-inertia.interceptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-inertia.interceptor.d.ts","sourceRoot":"","sources":["../src/authz-inertia.interceptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,gBAAgB,EAGrB,KAAK,eAAe,EAErB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAKvC,OAAO,KAAK,EAAE,mBAAmB,EAAsB,MAAM,YAAY,CAAC;AAE1E;;;;;;;GAOG;AACH,qBACa,uBAAwB,YAAW,eAAe;IAI3D,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAGzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAP1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAGd,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,cAAc,EAGxB,OAAO,GAAE,mBAAwB;IAKpD,SAAS,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC;CAuB7E"}

package/dist/authz-inertia.interceptor.js

@@ -0,0 +1,67 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Gate, PolicyRegistry } from '@dudousxd/nestjs-authz';
+import { Inject, Injectable, Optional, } from '@nestjs/common';
+import { from, switchMap } from 'rxjs';
+import { resolveClassAbilities } from './resolve-abilities.js';
+import { DEFAULT_PROP_KEY } from './share.js';
+import { AUTHZ_INERTIA_OPTIONS } from './tokens.js';
+/**
+ * Auto-shares the current user's class-level abilities into `props.<propKey>.can`
+ * for every HTTP request that carries an attached Inertia service (`req.inertia`),
+ * by calling `req.inertia.share(...)` BEFORE the route handler renders.
+ *
+ * No network request: abilities are resolved by direct `gate.allows` calls.
+ * Non-HTTP contexts and requests without `req.inertia` are passed through untouched.
+ */
+let AuthzInertiaInterceptor = class AuthzInertiaInterceptor {
+    gate;
+    policies;
+    options;
+    propKey;
+    constructor(gate, policies, options = {}) {
+        this.gate = gate;
+        this.policies = policies;
+        this.options = options;
+        this.propKey = options?.propKey ?? DEFAULT_PROP_KEY;
+    }
+    intercept(context, next) {
+        if (context.getType() !== 'http')
+            return next.handle();
+        const req = context.switchToHttp().getRequest();
+        const inertia = req?.inertia;
+        if (!inertia || typeof inertia.share !== 'function')
+            return next.handle();
+        return from(resolveClassAbilities(this.gate, this.policies, {
+            ...(this.options.abilities !== undefined ? { abilities: this.options.abilities } : {}),
+            ...(this.options.abilityNamer !== undefined
+                ? { abilityNamer: this.options.abilityNamer }
+                : {}),
+            ...(this.options.includeBareMethodNames !== undefined
+                ? { includeBareMethodNames: this.options.includeBareMethodNames }
+                : {}),
+        })).pipe(switchMap((can) => {
+            inertia.share({ [this.propKey]: { can } });
+            return next.handle();
+        }));
+    }
+};
+AuthzInertiaInterceptor = __decorate([
+    Injectable(),
+    __param(2, Optional()),
+    __param(2, Inject(AUTHZ_INERTIA_OPTIONS)),
+    __metadata("design:paramtypes", [Gate,
+        PolicyRegistry, Object])
+], AuthzInertiaInterceptor);
+export { AuthzInertiaInterceptor };
+//# sourceMappingURL=authz-inertia.interceptor.js.map

package/dist/authz-inertia.interceptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-inertia.interceptor.js","sourceRoot":"","sources":["../src/authz-inertia.interceptor.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAGL,MAAM,EACN,UAAU,EAEV,QAAQ,GACT,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACvC,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;GAOG;AAEI,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAIf;IACA;IAGA;IAPF,OAAO,CAAS;IAEjC,YACmB,IAAU,EACV,QAAwB,EAGxB,UAA+B,EAAE;QAJjC,SAAI,GAAJ,IAAI,CAAM;QACV,aAAQ,GAAR,QAAQ,CAAgB;QAGxB,YAAO,GAAP,OAAO,CAA0B;QAElD,IAAI,CAAC,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,gBAAgB,CAAC;IACtD,CAAC;IAED,SAAS,CAAC,OAAyB,EAAE,IAAiB;QACpD,IAAI,OAAO,CAAC,OAAO,EAAE,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACvD,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAsB,CAAC;QACpE,MAAM,OAAO,GAAG,GAAG,EAAE,OAAO,CAAC;QAC7B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QAE1E,OAAO,IAAI,CACT,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YAC9C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS;gBACzC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE;gBAC7C,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,KAAK,SAAS;gBACnD,CAAC,CAAC,EAAE,sBAAsB,EAAE,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE;gBACjE,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CACH,CAAC,IAAI,CACJ,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE;YAChB,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAC3C,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;CACF,CAAA;AApCY,uBAAuB;IADnC,UAAU,EAAE;IAOR,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,MAAM,CAAC,qBAAqB,CAAC,CAAA;qCAHP,IAAI;QACA,cAAc;GALhC,uBAAuB,CAoCnC"}

package/dist/client.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Re-export of the framework-neutral ability store, now canonicalized in
+ * {@link @dudousxd/nestjs-authz-client}. Kept here so the long-standing
+ * `@dudousxd/nestjs-authz-inertia/client` entry point continues to work.
+ *
+ * @module client
+ */
+export { AbilityStore, createCan, hydrateFromInertiaProps, hydrateResource, } from '@dudousxd/nestjs-authz-client';
+export type { CanMap, ResourceRef, HydratableProps, FallbackMode, AbilityStoreOptions, CanResolver, } from '@dudousxd/nestjs-authz-client';
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,YAAY,EACZ,SAAS,EACT,uBAAuB,EACvB,eAAe,GAChB,MAAM,+BAA+B,CAAC;AACvC,YAAY,EACV,MAAM,EACN,WAAW,EACX,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,WAAW,GACZ,MAAM,+BAA+B,CAAC"}

package/dist/client.js

@@ -0,0 +1,9 @@
+/**
+ * Re-export of the framework-neutral ability store, now canonicalized in
+ * {@link @dudousxd/nestjs-authz-client}. Kept here so the long-standing
+ * `@dudousxd/nestjs-authz-inertia/client` entry point continues to work.
+ *
+ * @module client
+ */
+export { AbilityStore, createCan, hydrateFromInertiaProps, hydrateResource, } from '@dudousxd/nestjs-authz-client';
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,YAAY,EACZ,SAAS,EACT,uBAAuB,EACvB,eAAe,GAChB,MAAM,+BAA+B,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+export declare const VERSION = "0.0.0";
+export { AuthzInertiaModule } from './module.js';
+export { AuthzInertiaInterceptor } from './authz-inertia.interceptor.js';
+export { AuthzDenialFilter, DEFAULT_LOGIN_URL, DEFAULT_FORBIDDEN_URL, } from './authz-denial.filter.js';
+export { createAuthzShare, DEFAULT_PROP_KEY } from './share.js';
+export type { CreateAuthzShareOptions } from './share.js';
+export { resolveClassAbilities, defaultAbilityNamer, } from './resolve-abilities.js';
+export type { CanMap, AbilityNamer, ResolveAbilitiesOptions, } from './resolve-abilities.js';
+export { authorizeResource, authorizeResourceForUser } from './authorize-resource.js';
+export { AUTHZ_INERTIA_OPTIONS } from './tokens.js';
+export type { AuthzInertiaOptions, AuthzDenialOptions, SharedAuthProps, InertiaShareable, RequestWithInertia, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,OAAO,UAAU,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAChE,YAAY,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,MAAM,EACN,YAAY,EACZ,uBAAuB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,YAAY,EACV,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,9 @@
+export const VERSION = '0.0.0';
+export { AuthzInertiaModule } from './module.js';
+export { AuthzInertiaInterceptor } from './authz-inertia.interceptor.js';
+export { AuthzDenialFilter, DEFAULT_LOGIN_URL, DEFAULT_FORBIDDEN_URL, } from './authz-denial.filter.js';
+export { createAuthzShare, DEFAULT_PROP_KEY } from './share.js';
+export { resolveClassAbilities, defaultAbilityNamer, } from './resolve-abilities.js';
+export { authorizeResource, authorizeResourceForUser } from './authorize-resource.js';
+export { AUTHZ_INERTIA_OPTIONS } from './tokens.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEhE,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAMhC,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC"}

package/dist/module.d.ts

@@ -0,0 +1,25 @@
+import { type DynamicModule } from '@nestjs/common';
+import type { AuthzInertiaOptions } from './types.js';
+/**
+ * Wires the {@link AuthzInertiaInterceptor} as a global `APP_INTERCEPTOR` so every
+ * Inertia render automatically carries `props.<propKey>.can` — the current user's
+ * class-level abilities, resolved in-process (no network request).
+ *
+ * Requires `@dudousxd/nestjs-authz`'s `AuthzModule` (for `Gate`/`PolicyRegistry`)
+ * and `@dudousxd/nestjs-inertia`'s `InertiaModule` (for `req.inertia`) to be
+ * imported. Order does not matter; the interceptor no-ops when `req.inertia` is
+ * absent.
+ *
+ * Alternatively, skip this module and pass `createAuthzShare(gate, policies)` to
+ * `InertiaModule.forRoot({ share })` for the same result via inertia's own
+ * prop-sharing seam.
+ *
+ * It also registers the {@link AuthzDenialFilter} as a global `APP_FILTER`, so
+ * `@Roles`/`@Can` denials (`ForbiddenException`) redirect nicely on Inertia
+ * requests (`/login` when unauthenticated, `/403` when forbidden) while staying
+ * a normal 403 JSON for REST. Opt out via `forRoot({ denial: { enabled: false } })`.
+ */
+export declare class AuthzInertiaModule {
+    static forRoot(options?: AuthzInertiaOptions): DynamicModule;
+}
+//# sourceMappingURL=module.d.ts.map

package/dist/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAyB,MAAM,gBAAgB,CAAC;AAK3E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBACa,kBAAkB;IAC7B,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,mBAAwB,GAAG,aAAa;CAejE"}

package/dist/module.js

@@ -0,0 +1,53 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var AuthzInertiaModule_1;
+import { Module } from '@nestjs/common';
+import { APP_FILTER, APP_INTERCEPTOR } from '@nestjs/core';
+import { AuthzDenialFilter } from './authz-denial.filter.js';
+import { AuthzInertiaInterceptor } from './authz-inertia.interceptor.js';
+import { AUTHZ_INERTIA_OPTIONS } from './tokens.js';
+/**
+ * Wires the {@link AuthzInertiaInterceptor} as a global `APP_INTERCEPTOR` so every
+ * Inertia render automatically carries `props.<propKey>.can` — the current user's
+ * class-level abilities, resolved in-process (no network request).
+ *
+ * Requires `@dudousxd/nestjs-authz`'s `AuthzModule` (for `Gate`/`PolicyRegistry`)
+ * and `@dudousxd/nestjs-inertia`'s `InertiaModule` (for `req.inertia`) to be
+ * imported. Order does not matter; the interceptor no-ops when `req.inertia` is
+ * absent.
+ *
+ * Alternatively, skip this module and pass `createAuthzShare(gate, policies)` to
+ * `InertiaModule.forRoot({ share })` for the same result via inertia's own
+ * prop-sharing seam.
+ *
+ * It also registers the {@link AuthzDenialFilter} as a global `APP_FILTER`, so
+ * `@Roles`/`@Can` denials (`ForbiddenException`) redirect nicely on Inertia
+ * requests (`/login` when unauthenticated, `/403` when forbidden) while staying
+ * a normal 403 JSON for REST. Opt out via `forRoot({ denial: { enabled: false } })`.
+ */
+let AuthzInertiaModule = AuthzInertiaModule_1 = class AuthzInertiaModule {
+    static forRoot(options = {}) {
+        const providers = [
+            { provide: AUTHZ_INERTIA_OPTIONS, useValue: options },
+            AuthzInertiaInterceptor,
+            { provide: APP_INTERCEPTOR, useClass: AuthzInertiaInterceptor },
+            AuthzDenialFilter,
+            { provide: APP_FILTER, useClass: AuthzDenialFilter },
+        ];
+        return {
+            module: AuthzInertiaModule_1,
+            global: true,
+            providers,
+            exports: [AUTHZ_INERTIA_OPTIONS, AuthzInertiaInterceptor, AuthzDenialFilter],
+        };
+    }
+};
+AuthzInertiaModule = AuthzInertiaModule_1 = __decorate([
+    Module({})
+], AuthzInertiaModule);
+export { AuthzInertiaModule };
+//# sourceMappingURL=module.js.map

package/dist/module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":";;;;;;;AAAA,OAAO,EAAsB,MAAM,EAAiB,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;;;;;;;;;;;GAkBG;AAEI,IAAM,kBAAkB,0BAAxB,MAAM,kBAAkB;IAC7B,MAAM,CAAC,OAAO,CAAC,UAA+B,EAAE;QAC9C,MAAM,SAAS,GAAe;YAC5B,EAAE,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,OAAO,EAAE;YACrD,uBAAuB;YACvB,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,uBAAuB,EAAE;YAC/D,iBAAiB;YACjB,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,EAAE;SACrD,CAAC;QACF,OAAO;YACL,MAAM,EAAE,oBAAkB;YAC1B,MAAM,EAAE,IAAI;YACZ,SAAS;YACT,OAAO,EAAE,CAAC,qBAAqB,EAAE,uBAAuB,EAAE,iBAAiB,CAAC;SAC7E,CAAC;IACJ,CAAC;CACF,CAAA;AAhBY,kBAAkB;IAD9B,MAAM,CAAC,EAAE,CAAC;GACE,kBAAkB,CAgB9B"}

package/dist/resolve-abilities.d.ts

@@ -0,0 +1,58 @@
+import type { Gate, PolicyRegistry } from '@dudousxd/nestjs-authz';
+import type { CanMap } from '@dudousxd/nestjs-authz-client';
+/**
+ * A flat record of `ability -> verdict`, e.g. `{ 'posts.create': true }`.
+ * Re-exported from `@dudousxd/nestjs-authz-client` so there is a single source
+ * of truth shared with the client store.
+ */
+export type { CanMap };
+/**
+ * How an ability name is built from a policy's resource class + method name when
+ * enumerating class-level policy abilities. Default: `"<ResourceName>.<method>"`
+ * lower-cased on the resource (e.g. `Post` + `create` → `posts.create`... no — see
+ * below). Kept overridable so an app can match the naming its `@Can` decorators use.
+ */
+export type AbilityNamer = (resourceName: string, method: string) => string;
+/**
+ * Default namer: `"<resourceNameLower>.<method>"` (e.g. `Post`,`create` →
+ * `post.create`). Apps whose `@Can` abilities are bare method names
+ * (`create`, `viewAny`) can pass `(_, m) => m`.
+ */
+export declare const defaultAbilityNamer: AbilityNamer;
+export interface ResolveAbilitiesOptions {
+    /**
+     * Extra ad-hoc gate / explicit ability names to resolve in addition to the
+     * gates auto-discovered via {@link Gate.gateNames}. Useful for gates registered
+     * lazily or abilities you always want present in props.
+     */
+    abilities?: string[];
+    /**
+     * Build the ability name from a policy's `(resourceClassName, method)`. Defaults
+     * to {@link defaultAbilityNamer}. Use `(_, m) => m` for bare method-name abilities.
+     */
+    abilityNamer?: AbilityNamer;
+    /**
+     * Include the bare policy method name as an additional key alongside the
+     * namespaced one (so both `post.create` and `create` resolve). Default `false`.
+     */
+    includeBareMethodNames?: boolean;
+}
+/**
+ * Resolve the current user's CLASS-LEVEL abilities into a flat `{ ability: boolean }`
+ * map, with NO per-request HTTP round-trip — each entry is a direct `gate.allows`
+ * call against the in-process Gate.
+ *
+ * Sources, in order:
+ *  1. Ad-hoc gates registered via `gate.define(...)` (model-less, e.g. `access-admin`).
+ *  2. Class-level `@Policy` methods (those taking no resource instance — heuristically
+ *     arity `<= 1`, e.g. `create(user)`/`viewAny(user)`), dispatched against the resource
+ *     CLASS so no instance is loaded. Instance methods like `update(user, post)` are NOT
+ *     enumerated (see {@link PolicyRegistry.classAbilities}) — dispatching them against the
+ *     class would write a bogus class-level verdict.
+ *  3. Any extra `options.abilities` names.
+ *
+ * Gates are checked by name; policy methods are checked by passing the resource
+ * class as the dispatch target (Gate resolves the class-level policy method).
+ */
+export declare function resolveClassAbilities(gate: Gate, policies: PolicyRegistry, options?: ResolveAbilitiesOptions): Promise<CanMap>;
+//# sourceMappingURL=resolve-abilities.d.ts.map

package/dist/resolve-abilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-abilities.d.ts","sourceRoot":"","sources":["../src/resolve-abilities.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,cAAc,EAAY,MAAM,wBAAwB,CAAC;AAC7E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,+BAA+B,CAAC;AAE5D;;;;GAIG;AACH,YAAY,EAAE,MAAM,EAAE,CAAC;AAEvB;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC;AAE5E;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,YACS,CAAC;AAE5C,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB;;;OAGG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B;;;OAGG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,cAAc,EACxB,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,MAAM,CAAC,CAwBjB"}

package/dist/resolve-abilities.js

@@ -0,0 +1,58 @@
+/**
+ * Default namer: `"<resourceNameLower>.<method>"` (e.g. `Post`,`create` →
+ * `post.create`). Apps whose `@Can` abilities are bare method names
+ * (`create`, `viewAny`) can pass `(_, m) => m`.
+ */
+export const defaultAbilityNamer = (resourceName, method) => `${resourceName.toLowerCase()}.${method}`;
+/**
+ * Resolve the current user's CLASS-LEVEL abilities into a flat `{ ability: boolean }`
+ * map, with NO per-request HTTP round-trip — each entry is a direct `gate.allows`
+ * call against the in-process Gate.
+ *
+ * Sources, in order:
+ *  1. Ad-hoc gates registered via `gate.define(...)` (model-less, e.g. `access-admin`).
+ *  2. Class-level `@Policy` methods (those taking no resource instance — heuristically
+ *     arity `<= 1`, e.g. `create(user)`/`viewAny(user)`), dispatched against the resource
+ *     CLASS so no instance is loaded. Instance methods like `update(user, post)` are NOT
+ *     enumerated (see {@link PolicyRegistry.classAbilities}) — dispatching them against the
+ *     class would write a bogus class-level verdict.
+ *  3. Any extra `options.abilities` names.
+ *
+ * Gates are checked by name; policy methods are checked by passing the resource
+ * class as the dispatch target (Gate resolves the class-level policy method).
+ */
+export async function resolveClassAbilities(gate, policies, options = {}) {
+    const namer = options.abilityNamer ?? defaultAbilityNamer;
+    const out = {};
+    // 1. Ad-hoc gates (model-less). Resolve by ability name only.
+    const gateNames = new Set([...gate.gateNames(), ...(options.abilities ?? [])]);
+    for (const ability of gateNames) {
+        out[ability] = await safeAllows(gate, ability);
+    }
+    // 2. Class-level policy methods, dispatched against the resource CLASS.
+    for (const { resource, abilities } of policies.classAbilities()) {
+        const resourceName = resource.name ?? 'Resource';
+        for (const method of abilities) {
+            const key = namer(resourceName, method);
+            // Gate.allows accepts a Type (class) as the resource for class-level abilities.
+            out[key] = await safeAllows(gate, method, resource);
+            if (options.includeBareMethodNames && out[method] === undefined) {
+                out[method] = out[key];
+            }
+        }
+    }
+    return out;
+}
+/**
+ * `gate.allows` may throw (unresolved/ambiguous ability). For prop sharing we
+ * fail closed (deny) rather than crash the render.
+ */
+async function safeAllows(gate, ability, resource) {
+    try {
+        return await gate.allows(ability, resource);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=resolve-abilities.js.map

package/dist/resolve-abilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-abilities.js","sourceRoot":"","sources":["../src/resolve-abilities.ts"],"names":[],"mappings":"AAkBA;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE,CACxE,GAAG,YAAY,CAAC,WAAW,EAAE,IAAI,MAAM,EAAE,CAAC;AAqB5C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAU,EACV,QAAwB,EACxB,UAAmC,EAAE;IAErC,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,IAAI,mBAAmB,CAAC;IAC1D,MAAM,GAAG,GAAW,EAAE,CAAC;IAEvB,8DAA8D;IAC9D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACvF,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,GAAG,CAAC,OAAO,CAAC,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAED,wEAAwE;IACxE,KAAK,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;QAChE,MAAM,YAAY,GAAI,QAA8B,CAAC,IAAI,IAAI,UAAU,CAAC;QACxE,KAAK,MAAM,MAAM,IAAI,SAAS,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACxC,gFAAgF;YAChF,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAA+B,CAAC,CAAC;YAC3E,IAAI,OAAO,CAAC,sBAAsB,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;gBAChE,GAAG,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,UAAU,CAAC,IAAU,EAAE,OAAe,EAAE,QAAmB;IACxE,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/share.d.ts

@@ -0,0 +1,28 @@
+import type { Gate, PolicyRegistry } from '@dudousxd/nestjs-authz';
+import { type ResolveAbilitiesOptions } from './resolve-abilities.js';
+/** Default prop namespace: `props.auth.can`. */
+export declare const DEFAULT_PROP_KEY = "auth";
+export interface CreateAuthzShareOptions extends ResolveAbilitiesOptions {
+    /** Prop key the `{ can }` object nests under. Default `'auth'`. */
+    propKey?: string;
+}
+/**
+ * Build an Inertia **share factory** that resolves the current user's class-level
+ * abilities into `props.<propKey>.can` — with NO network request (direct in-process
+ * `gate.allows` calls).
+ *
+ * Drop it into `InertiaModule.forRoot({ share })` (matching nestjs-inertia's
+ * prop-sharing idiom):
+ *
+ * ```ts
+ * InertiaModule.forRoot({
+ *   share: createAuthzShare(gate, policyRegistry),
+ * })
+ * ```
+ *
+ * The returned factory is an async `(req) => Props`; nestjs-inertia awaits it per
+ * render and merges the result into every page's shared props. The client store's
+ * `hydrateFromInertiaProps` then reads `props.auth.can`.
+ */
+export declare function createAuthzShare(gate: Gate, policies: PolicyRegistry, options?: CreateAuthzShareOptions): () => Promise<Record<string, unknown>>;
+//# sourceMappingURL=share.d.ts.map

package/dist/share.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"share.d.ts","sourceRoot":"","sources":["../src/share.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,KAAK,uBAAuB,EAAyB,MAAM,wBAAwB,CAAC;AAE7F,gDAAgD;AAChD,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAEvC,MAAM,WAAW,uBAAwB,SAAQ,uBAAuB;IACtE,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,cAAc,EACxB,OAAO,GAAE,uBAA4B,GACpC,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAMxC"}

package/dist/share.js

@@ -0,0 +1,29 @@
+import { resolveClassAbilities } from './resolve-abilities.js';
+/** Default prop namespace: `props.auth.can`. */
+export const DEFAULT_PROP_KEY = 'auth';
+/**
+ * Build an Inertia **share factory** that resolves the current user's class-level
+ * abilities into `props.<propKey>.can` — with NO network request (direct in-process
+ * `gate.allows` calls).
+ *
+ * Drop it into `InertiaModule.forRoot({ share })` (matching nestjs-inertia's
+ * prop-sharing idiom):
+ *
+ * ```ts
+ * InertiaModule.forRoot({
+ *   share: createAuthzShare(gate, policyRegistry),
+ * })
+ * ```
+ *
+ * The returned factory is an async `(req) => Props`; nestjs-inertia awaits it per
+ * render and merges the result into every page's shared props. The client store's
+ * `hydrateFromInertiaProps` then reads `props.auth.can`.
+ */
+export function createAuthzShare(gate, policies, options = {}) {
+    const propKey = options.propKey ?? DEFAULT_PROP_KEY;
+    return async () => {
+        const can = await resolveClassAbilities(gate, policies, options);
+        return { [propKey]: { can } };
+    };
+}
+//# sourceMappingURL=share.js.map

package/dist/share.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"share.js","sourceRoot":"","sources":["../src/share.ts"],"names":[],"mappings":"AACA,OAAO,EAAgC,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE7F,gDAAgD;AAChD,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAOvC;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAU,EACV,QAAwB,EACxB,UAAmC,EAAE;IAErC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;IACpD,OAAO,KAAK,IAAI,EAAE;QAChB,MAAM,GAAG,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjE,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC;IAChC,CAAC,CAAC;AACJ,CAAC"}

package/dist/tokens.d.ts

@@ -0,0 +1,3 @@
+/** Injection token holding the resolved {@link AuthzInertiaOptions}. */
+export declare const AUTHZ_INERTIA_OPTIONS: unique symbol;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,eAAuD,CAAC"}

package/dist/tokens.js

@@ -0,0 +1,3 @@
+/** Injection token holding the resolved {@link AuthzInertiaOptions}. */
+export const AUTHZ_INERTIA_OPTIONS = Symbol.for('@dudousxd/nestjs-authz-inertia:options');
+//# sourceMappingURL=tokens.js.map

package/dist/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,83 @@
+import type { ArgumentsHost, ForbiddenException } from '@nestjs/common';
+import type { AbilityNamer, CanMap } from './resolve-abilities.js';
+/**
+ * Configures the {@link AuthzDenialFilter}: how authorization denials
+ * (`@Roles`/`@Can` → `ForbiddenException`) render on Inertia requests. Non-Inertia
+ * (REST) requests are unaffected — they keep the normal 403 JSON.
+ */
+export interface AuthzDenialOptions {
+    /**
+     * Disable the filter entirely (it is registered unconditionally; this opts
+     * out at runtime, leaving the raw 403 for Inertia requests too).
+     *
+     * Default: `true` (denials redirect on Inertia requests).
+     */
+    enabled?: boolean;
+    /**
+     * Redirect target for an UNAUTHENTICATED denial (no `CONTEXT_ACCESSOR` user).
+     *
+     * Default: `'/login'`.
+     */
+    loginUrl?: string;
+    /**
+     * Redirect target for an AUTHENTICATED-but-FORBIDDEN denial.
+     *
+     * Default: `'/403'`.
+     */
+    forbiddenUrl?: string;
+    /**
+     * Escape hatch: fully handle the denial on an Inertia request yourself (e.g.
+     * render an error page instead of redirecting). Receives the thrown
+     * `ForbiddenException` and the `ArgumentsHost`. When provided, it replaces the
+     * default redirect behavior for Inertia requests.
+     */
+    handler?: (exception: ForbiddenException, host: ArgumentsHost) => void;
+}
+/**
+ * Minimal structural mirror of the request object carrying `req.inertia`, set by
+ * `@dudousxd/nestjs-inertia`'s middleware. We deliberately do NOT import the
+ * InertiaService type to keep the coupling structural (the real service satisfies
+ * this shape). `share(input)` merges `input` into the page's shared props.
+ */
+export interface InertiaShareable {
+    share(input: Record<string, unknown>): unknown;
+}
+/** A request that may carry an attached Inertia service. */
+export interface RequestWithInertia {
+    inertia?: InertiaShareable;
+}
+export interface AuthzInertiaOptions {
+    /**
+     * Prop key the resolved ability map is shared under. The client store reads
+     * `props.auth.can`, so the default nests the map at `auth.can`. Override to
+     * change the namespace (e.g. `'abilities'` → `props.abilities`).
+     *
+     * Default: `'auth'` → `{ auth: { can: { ... } } }`.
+     */
+    propKey?: string;
+    /**
+     * Extra ad-hoc ability names to resolve in addition to auto-discovered gates.
+     */
+    abilities?: string[];
+    /**
+     * Build a policy ability name from `(resourceClassName, method)`. Defaults to
+     * `"<resourceLower>.<method>"`. Use `(_, m) => m` for bare method names.
+     */
+    abilityNamer?: AbilityNamer;
+    /**
+     * Also emit the bare policy method name as a key alongside the namespaced one.
+     * Default `false`.
+     */
+    includeBareMethodNames?: boolean;
+    /**
+     * Configures how authorization denials render on Inertia requests via the
+     * {@link AuthzDenialFilter}. Omit to use the defaults (redirect on; `/login`
+     * unauthenticated, `/403` forbidden).
+     */
+    denial?: AuthzDenialOptions;
+}
+/** The shape shared into props (under {@link AuthzInertiaOptions.propKey}). */
+export interface SharedAuthProps {
+    can: CanMap;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAEnE;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,kBAAkB,EAAE,IAAI,EAAE,aAAa,KAAK,IAAI,CAAC;CACxE;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC;CAChD;AAED,4DAA4D;AAC5D,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB;;;OAGG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B;;;OAGG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;;OAIG;IACH,MAAM,CAAC,EAAE,kBAAkB,CAAC;CAC7B;AAED,+EAA+E;AAC/E,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;CACb"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,78 @@
+{
+  "name": "@dudousxd/nestjs-authz-inertia",
+  "version": "0.1.0",
+  "description": "Inertia.js integration for @dudousxd/nestjs-authz — share a user's abilities as props so client `can()` checks need no network request.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/DavideCarvalho/nestjs-authz.git",
+    "directory": "packages/inertia"
+  },
+  "author": "Davi Carvalho <davi@goflip.ai>",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./client": {
+      "types": "./dist/client.d.ts",
+      "import": "./dist/client.js",
+      "default": "./dist/client.js"
+    }
+  },
+  "files": [
+    "dist/",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "dependencies": {
+    "@dudousxd/nestjs-authz-client": "^0.1.0"
+  },
+  "peerDependencies": {
+    "@dudousxd/nestjs-authz": ">=0.2.0",
+    "@dudousxd/nestjs-context": ">=0.1.0",
+    "@dudousxd/nestjs-inertia": ">=1.0.0",
+    "@nestjs/common": ">=10.0.0",
+    "@nestjs/core": ">=10.0.0",
+    "reflect-metadata": ">=0.1.13"
+  },
+  "peerDependenciesMeta": {
+    "@dudousxd/nestjs-context": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@dudousxd/nestjs-inertia": "^1.5.0",
+    "@nestjs/common": "^11.0.0",
+    "@nestjs/core": "^11.0.0",
+    "@nestjs/testing": "^11.0.0",
+    "@types/node": "^20.0.0",
+    "reflect-metadata": "^0.2.2",
+    "rxjs": "^7.8.1",
+    "typescript": "^5.4.0",
+    "vitest": "^3.0.0",
+    "@dudousxd/nestjs-authz": "^0.3.0"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "keywords": [
+    "nestjs",
+    "authorization",
+    "authz",
+    "inertia",
+    "inertia.js",
+    "abilities",
+    "can"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "vitest run --passWithNoTests",
+    "test:watch": "vitest",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  }
+}