@dudousxd/nestjs-authz-inertia 0.1.0 → 0.1.2

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @dudousxd/nestjs-authz-inertia
 
+## 0.1.2
+
+### Patch Changes
+
+- [#15](https://github.com/DavideCarvalho/nestjs-authz/pull/15) [`7294ff5`](https://github.com/DavideCarvalho/nestjs-authz/commit/7294ff5c01454d9fea6d42a6c3f80eff2f00dc48) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Fix the exported `VERSION` const shipping as `'0.0.0'`.
+
+  The build is plain `tsc` with no version injection, and `changeset version` only bumps `package.json` — leaving the `export const VERSION` in `src/index.ts` stale, so the published dist reported `'0.0.0'`. The const is now corrected to match each package's `package.json`, and a new `scripts/sync-version.mjs` (chained into the `version-packages` script) re-syncs it on every release bump to prevent future drift. Run with `--check` to fail a build on mismatch.
+
+- Updated dependencies [[`7294ff5`](https://github.com/DavideCarvalho/nestjs-authz/commit/7294ff5c01454d9fea6d42a6c3f80eff2f00dc48)]:
+  - @dudousxd/nestjs-authz-client@0.2.1
+
+## 0.1.1
+
+### Patch Changes
+
+- Updated dependencies [[`07d01de`](https://github.com/DavideCarvalho/nestjs-authz/commit/07d01de286e7dfcae5fbeb10b7e8d48533214087)]:
+  - @dudousxd/nestjs-authz-client@0.2.0
+
 ## 0.1.0
 
 ### Minor Changes

package/README.md

@@ -80,12 +80,23 @@ AuthzModule.forRoot({ canEndpoint: true }) // POST /authz/can → { allowed }
 It runs `gate.allows(ability, resource?)` for the current context user and returns
 `{ allowed }`. Off by default. This is the path the codegen-emitted `can()` targets.
 
-> **Class-level only.** The endpoint can resolve **class-level abilities and ad-hoc gates**
-> only — the `{ type, id }` resource shim it receives never matches a `@Policy` by constructor.
-> Per-instance decisions MUST be hydrated via tiers 1-2 (shared props / `authorizeResource`);
-> a **resource-bound** ability that misses the cache and falls through to `/authz/can` will
-> **deny** (and `createCan` logs a one-time `console.warn`). Treat tier 3 as a class-level /
-> ad-hoc fallback, not a per-instance one.
+> **Class-level by default; per-instance with a loader.** Out of the box the endpoint resolves
+> **class-level abilities and ad-hoc gates** only — the `{ type, id }` shim it receives never
+> matches a `@Policy` by constructor, so a **resource-bound** ability that misses the cache and
+> falls through to `/authz/can` will **deny**. To make per-instance decisions resolve at tier 3,
+> register `resourceLoaders` keyed by the resource `type`:
+>
+> ```ts
+> AuthzModule.forRoot({
+>   canEndpoint: true,
+>   resourceLoaders: { Post: (id) => postRepo.findOneBy({ id: Number(id) }) },
+> })
+> ```
+>
+> The endpoint then loads the real entity before authorizing, so the instance `@Policy` matches
+> and decides correctly (a loader returning nullish → deny / not found). Prefer hydrating via
+> tiers 1-2 (shared props / `authorizeResource`) when you can; use `resourceLoaders` for the
+> abilities that genuinely need a tier-3 round-trip.
 
 ## Client store (framework-neutral)
 
@@ -109,8 +120,9 @@ can('mystery');                           // fallback: 'deny' → false; 'fetch'
 - **Cache hit** → returns a `boolean` synchronously, never touches the network.
 - **Cache miss** → `fallback: 'deny'` (default) returns `false`; `fallback: 'fetch'`
   POSTs to the tier-3 endpoint and returns a `Promise<boolean>`. A **resource-bound**
-  miss under `'fetch'` can only deny (the endpoint resolves class-level abilities only)
-  and logs a one-time `console.warn` — hydrate per-instance decisions via tiers 1-2.
+  miss under `'fetch'` resolves on the server only if the app registered a `resourceLoaders`
+  entry for that `type`; otherwise it denies (and `createCan` logs a one-time `console.warn`)
+  — hydrate per-instance decisions via tiers 1-2 or register a loader.
 
 ## License
 

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export declare const VERSION = "0.0.0";
+export declare const VERSION = "0.1.2";
 export { AuthzInertiaModule } from './module.js';
 export { AuthzInertiaInterceptor } from './authz-inertia.interceptor.js';
 export { AuthzDenialFilter, DEFAULT_LOGIN_URL, DEFAULT_FORBIDDEN_URL, } from './authz-denial.filter.js';

package/dist/index.js

@@ -1,4 +1,4 @@
-export const VERSION = '0.0.0';
+export const VERSION = '0.1.2';
 export { AuthzInertiaModule } from './module.js';
 export { AuthzInertiaInterceptor } from './authz-inertia.interceptor.js';
 export { AuthzDenialFilter, DEFAULT_LOGIN_URL, DEFAULT_FORBIDDEN_URL, } from './authz-denial.filter.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dudousxd/nestjs-authz-inertia",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Inertia.js integration for @dudousxd/nestjs-authz — share a user's abilities as props so client `can()` checks need no network request.",
   "license": "MIT",
   "repository": {
@@ -30,7 +30,7 @@
     "CHANGELOG.md"
   ],
   "dependencies": {
-    "@dudousxd/nestjs-authz-client": "^0.1.0"
+    "@dudousxd/nestjs-authz-client": "^0.2.1"
   },
   "peerDependencies": {
     "@dudousxd/nestjs-authz": ">=0.2.0",
@@ -55,7 +55,7 @@
     "rxjs": "^7.8.1",
     "typescript": "^5.4.0",
     "vitest": "^3.0.0",
-    "@dudousxd/nestjs-authz": "^0.3.0"
+    "@dudousxd/nestjs-authz": "^0.6.4"
   },
   "engines": {
     "node": ">=20"