@dudousxd/nestjs-authz-mikro-orm 0.5.1 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,48 @@
 # @dudousxd/nestjs-authz-mikro-orm
 
+## 0.7.0
+
+### Minor Changes
+
+- [#61](https://github.com/DavideCarvalho/nestjs-authz/pull/61) [`d1c719d`](https://github.com/DavideCarvalho/nestjs-authz/commit/d1c719d9ee973bc802ba8bf6854246875c4c2da9) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Admin management operations on every RBAC store adapter (TypeORM, MikroORM, Prisma, Drizzle), with the same semantics everywhere:
+
+  - `deleteRole(roleName): Promise<boolean>` deletes the role, its role→permission links and every user assignment of it (all tenants, all sources) in one transaction. Returns whether the role existed. Permissions are kept.
+  - `syncRolePermissions(roleName, permissionNames): Promise<void>` replaces the role's permission set with exactly these names (spatie's `syncPermissions`), creating the role and permissions by name when missing.
+  - `getRolePermissions(roleNames): Promise<Record<string, string[]>>` returns each role's sorted permission names without N+1 queries. Every existing requested role is a key, even with no permissions (`[]`). Roles that don't exist are absent.
+  - `listRoleAssignments(filter?): Promise<UserRoleAssignment[]>` returns raw `{ userType, userId, role, source, tenantId }` rows for admin listings, ordered by `(userType, userId, role, source, tenantId)`. Filters: `role` (a name or a list), `user`, `source`, and `tenantId`. Omitting `tenantId` applies no tenant filter, `null` returns global assignments only, and a string returns only that tenant's scoped assignments, without the global ones. MikroORM and Prisma have no tenant-scoped assignments, so there a tenant id string matches nothing.
+  - `removeUser(user): Promise<void>` deletes every role assignment of the user (all tenants, all sources) and, on TypeORM and Drizzle, every direct permission.
+
+  Core's `store-kit` exports the `RoleAssignmentFilter` and `UserRoleAssignment` types, plus the `roleFilterNames` and `compareUserRoleAssignments` helpers the adapters share. The adapters now require `@dudousxd/nestjs-authz >= 0.8.0`.
+
+## 0.6.0
+
+### Minor Changes
+
+- [#58](https://github.com/DavideCarvalho/nestjs-authz/pull/58) [`8b65088`](https://github.com/DavideCarvalho/nestjs-authz/commit/8b6508804216d46384ec3a734a55b9c0ac1e48b6) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Per-source role assignments (manual vs SSO/SCIM/…).
+
+  Each role assignment now records a `source`, default `'manual'`. Every store adapter gains:
+
+  - `setUserRoles(user, roleNames, { source?, tenantId? })` replaces only that source's assignments, so an SSO sync never removes a role that was granted by hand. It creates missing roles and runs in a transaction.
+  - `assignRole(user, role, { source })` and `removeRole(user, role, { source })`. Without `source`, `removeRole` removes the role from every source.
+  - `getRoleAssignments(user, scope?)` returns `{ role, source, tenantId }[]`.
+  - `getRolesForUser` and the Gate seams still return distinct role names.
+
+  Core's `store-kit` exports `DEFAULT_ROLE_SOURCE` and `RoleAssignment`. The adapters now require `@dudousxd/nestjs-authz >= 0.7.0`.
+
+  **Migration**
+
+  - **TypeORM:** `ensureAuthzSchema` / `autoCreateSchema` adds `source varchar(64) NOT NULL DEFAULT 'manual'` to `authz_user_role`, so existing rows become manual assignments. It never rewrites an existing primary key. Until you widen the key, a role can come from only one source per user, and a second-source insert is silently ignored. Widen it once:
+
+    - PostgreSQL: `ALTER TABLE authz_user_role DROP CONSTRAINT <pk_name>, ADD PRIMARY KEY ("userType","userId","roleId","tenantId","source");`
+    - MySQL (utf8mb4 needs the shorter key columns): `ALTER TABLE authz_user_role MODIFY roleId varchar(64) NOT NULL, MODIFY source varchar(64) NOT NULL DEFAULT 'manual', DROP PRIMARY KEY, ADD PRIMARY KEY (userType, userId, roleId, tenantId, source);`
+    - SQLite: rebuild the table.
+
+    New tables are created with the 5-column key, and `roleId` is now `varchar(64)` so the key fits MySQL's 3072-byte limit.
+
+  - **MikroORM:** the column self-heals the same way. The PK does not. See the adapter README for the SQL.
+  - **Prisma:** opt-in with `roleSources: true` after adding `source String @default("manual")` to `UserRole` and including it in `@@id`. See the adapter README. Without the option the adapter behaves exactly as before.
+  - **Drizzle:** `createAuthzTables()` now includes the column and the widened key, so regenerate with drizzle-kit. `ensureSchema()` adds the column. See the README for the key SQL.
+
 ## 0.5.1
 
 ### Patch Changes

package/README.md

@@ -139,6 +139,70 @@ export class AddAuthz extends Migration {
 }
 ```
 
+## Role sources (manual vs SSO/SCIM)
+
+Every role assignment records a `source`. It defaults to `'manual'`, so existing calls and existing
+rows keep their meaning. A sync replaces only its own source:
+
+```ts
+// On each SSO login: exactly these roles come from SSO. Manual grants are untouched.
+await store.setUserRoles(user, rolesFromIdpGroups, { source: 'sso' });
+
+await store.assignRole(user, 'editor');                      // source 'manual'
+await store.assignRole(user, 'editor', { source: 'scim' });  // a second assignment of the same role
+await store.removeRole(user, 'editor', { source: 'scim' });  // still an editor (manual)
+await store.removeRole(user, 'editor');                      // no source: removed from every source
+await store.getRoleAssignments(user); // [{ role, source, tenantId }]
+```
+
+`getRolesForUser` and the Gate seams see the distinct role names from all sources.
+
+### Migrating an existing database
+
+`ensureAuthzSchema` / `autoCreateSchema` add the `source` column to `authz_user_role`
+(`NOT NULL DEFAULT 'manual'`), so existing rows become manual assignments. They don't widen the
+primary key. Until you widen it, a role can come from only one source per user: assigning it from
+a second source fails with a duplicate-key error. Widen the key once:
+
+```sql
+-- PostgreSQL (default constraint name; check yours with \d authz_user_role)
+ALTER TABLE authz_user_role DROP CONSTRAINT authz_user_role_pkey,
+  ADD PRIMARY KEY (user_type, user_id, role_id, source);
+-- MySQL
+ALTER TABLE authz_user_role DROP PRIMARY KEY, ADD PRIMARY KEY (user_type, user_id, role_id, source);
+-- SQLite: recreate the table with the 4-column key (SQLite cannot alter a primary key).
+```
+
+## Admin management
+
+Operations for an admin UI (role editor, member list, account deletion):
+
+```ts
+// Replace a role's permissions with exactly this set (spatie's syncPermissions). Creates missing
+// roles/permissions by name; the link swap is transactional.
+await store.syncRolePermissions('editor', ['posts.view', 'posts.edit']);
+
+// Each role's permission names in one query. Existing roles are keys (even with no permissions);
+// roles that don't exist are absent.
+await store.getRolePermissions(['editor', 'viewer']); // { editor: ['posts.edit', 'posts.view'], viewer: [] }
+
+// Delete a role, its permission links and every assignment of it (all sources). Returns false
+// when the role didn't exist. Permissions are kept.
+await store.deleteRole('editor');
+
+// Raw assignment rows: { userType, userId, role, source, tenantId }[],
+// ordered by (userType, userId, role, source).
+await store.listRoleAssignments({ role: ['admin', 'owner'], source: 'sso' });
+await store.listRoleAssignments({ user: { type: 'user', id: 7 } });
+
+// Account deleted: drop every role assignment of the user (all sources).
+await store.removeUser({ type: 'user', id: 7 });
+```
+
+This adapter has no tenant-scoped assignments, so every row has `tenantId: null`:
+`listRoleAssignments({ tenantId: null })` lists everything and a tenant id string matches
+nothing.
+
 ## License
 
 MIT

package/dist/entities.d.ts

@@ -76,6 +76,11 @@ export declare class UserRoleEntity {
     userType: string;
     userId: string;
     roleId: string;
+    /**
+     * Where the assignment came from (`'manual'`, `'sso'`, …). Part of the PK so a role can be held
+     * through two sources. Defaults to `'manual'` (older rows self-heal to it).
+     */
+    source: string;
 }
 /** The four {@link EntitySchema} definitions produced by {@link createAuthzEntitySchemas}. */
 export interface AuthzEntitySchemas {

package/dist/entities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entities.d.ts","sourceRoot":"","sources":["../src/entities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,mBAAmB,CAAC;AAE3B;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB;;;;;CAKtB,CAAC;AAEX,sDAAsD;AACtD,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;GAGG;AACH,qBAAa,UAAU;IACb,CAAC,oBAAoB,CAAC,CAAC,EAAE,mBAAmB,CAAC;IACrD,EAAE,EAAG,MAAM,CAAC;IACZ,IAAI,EAAG,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAG,IAAI,CAAC;CAClB;AAED,oGAAoG;AACpG,qBAAa,gBAAgB;IACnB,CAAC,oBAAoB,CAAC,CAAC,EAAE,yBAAyB,CAAC;IAC3D,EAAE,EAAG,MAAM,CAAC;IACZ,IAAI,EAAG,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAG,IAAI,CAAC;CAClB;AAED,uEAAuE;AACvE,qBAAa,oBAAoB;IACvB,CAAC,oBAAoB,CAAC,CAAC,EAAE,6BAA6B,CAAC;IAC/D,MAAM,EAAG,MAAM,CAAC;IAChB,YAAY,EAAG,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,qBAAa,cAAc;IACjB,CAAC,oBAAoB,CAAC,CAAC,EAAE,uBAAuB,CAAC;IACzD,QAAQ,EAAG,MAAM,CAAC;IAClB,MAAM,EAAG,MAAM,CAAC;IAChB,MAAM,EAAG,MAAM,CAAC;CACjB;AAED,8FAA8F;AAC9F,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;IAC/B,UAAU,EAAE,YAAY,CAAC,gBAAgB,CAAC,CAAC;IAC3C,cAAc,EAAE,YAAY,CAAC,oBAAoB,CAAC,CAAC;IACnD,QAAQ,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC;IACvC,qEAAqE;IACrE,GAAG,EAAE;QACH,YAAY,CAAC,UAAU,CAAC;QACxB,YAAY,CAAC,gBAAgB,CAAC;QAC9B,YAAY,CAAC,oBAAoB,CAAC;QAClC,YAAY,CAAC,cAAc,CAAC;KAC7B,CAAC;CACH;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,GAAE,OAAO,CAAC,eAAe,CAAM,GACxC,kBAAkB,CAkEpB;AAID,eAAO,MAAM,gBAAgB,iCAAsB,CAAC;AACpD,eAAO,MAAM,sBAAsB,uCAA4B,CAAC;AAChE,eAAO,MAAM,0BAA0B,2CAAgC,CAAC;AACxE,eAAO,MAAM,oBAAoB,qCAA0B,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,cAAc,0JAAqB,CAAC;AAEjD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,2GAKvB,CAAC"}
+{"version":3,"file":"entities.d.ts","sourceRoot":"","sources":["../src/entities.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,mBAAmB,CAAC;AAE3B;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB;;;;;CAKtB,CAAC;AAEX,sDAAsD;AACtD,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;GAGG;AACH,qBAAa,UAAU;IACb,CAAC,oBAAoB,CAAC,CAAC,EAAE,mBAAmB,CAAC;IACrD,EAAE,EAAG,MAAM,CAAC;IACZ,IAAI,EAAG,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAG,IAAI,CAAC;CAClB;AAED,oGAAoG;AACpG,qBAAa,gBAAgB;IACnB,CAAC,oBAAoB,CAAC,CAAC,EAAE,yBAAyB,CAAC;IAC3D,EAAE,EAAG,MAAM,CAAC;IACZ,IAAI,EAAG,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAG,IAAI,CAAC;CAClB;AAED,uEAAuE;AACvE,qBAAa,oBAAoB;IACvB,CAAC,oBAAoB,CAAC,CAAC,EAAE,6BAA6B,CAAC;IAC/D,MAAM,EAAG,MAAM,CAAC;IAChB,YAAY,EAAG,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,qBAAa,cAAc;IACjB,CAAC,oBAAoB,CAAC,CAAC,EAAE,uBAAuB,CAAC;IACzD,QAAQ,EAAG,MAAM,CAAC;IAClB,MAAM,EAAG,MAAM,CAAC;IAChB,MAAM,EAAG,MAAM,CAAC;IAChB;;;OAGG;IACH,MAAM,EAAG,MAAM,CAAC;CACjB;AAED,8FAA8F;AAC9F,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;IAC/B,UAAU,EAAE,YAAY,CAAC,gBAAgB,CAAC,CAAC;IAC3C,cAAc,EAAE,YAAY,CAAC,oBAAoB,CAAC,CAAC;IACnD,QAAQ,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC;IACvC,qEAAqE;IACrE,GAAG,EAAE;QACH,YAAY,CAAC,UAAU,CAAC;QACxB,YAAY,CAAC,gBAAgB,CAAC;QAC9B,YAAY,CAAC,oBAAoB,CAAC;QAClC,YAAY,CAAC,cAAc,CAAC;KAC7B,CAAC;CACH;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,GAAE,OAAO,CAAC,eAAe,CAAM,GACxC,kBAAkB,CAwEpB;AAID,eAAO,MAAM,gBAAgB,iCAAsB,CAAC;AACpD,eAAO,MAAM,sBAAsB,uCAA4B,CAAC;AAChE,eAAO,MAAM,0BAA0B,2CAAgC,CAAC;AACxE,eAAO,MAAM,oBAAoB,qCAA0B,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,cAAc,0JAAqB,CAAC;AAEjD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,2GAKvB,CAAC"}

package/dist/entities.js

@@ -1,3 +1,4 @@
+import { DEFAULT_ROLE_SOURCE } from '@dudousxd/nestjs-authz/store-kit';
 import { EntitySchema } from '@mikro-orm/core';
 import { AuthzPermissionRepository, AuthzRolePermissionRepository, AuthzRoleRepository, AuthzUserRoleRepository, } from './repositories.js';
 /**
@@ -65,6 +66,11 @@ export class UserRoleEntity {
     userType;
     userId;
     roleId;
+    /**
+     * Where the assignment came from (`'manual'`, `'sso'`, …). Part of the PK so a role can be held
+     * through two sources. Defaults to `'manual'` (older rows self-heal to it).
+     */
+    source;
 }
 /**
  * Build the four authz {@link EntitySchema} definitions, optionally under your own table
@@ -130,6 +136,12 @@ export function createAuthzEntitySchemas(tableNames = {}) {
             userType: { type: 'string', length: 191, primary: true },
             userId: { type: 'string', length: 191, primary: true },
             roleId: { type: 'string', length: 191, primary: true },
+            source: {
+                type: 'string',
+                length: 64,
+                primary: true,
+                default: DEFAULT_ROLE_SOURCE,
+            },
         },
         indexes: [{ name: `${names.userRole}_user_idx`, properties: ['userType', 'userId'] }],
     });

package/dist/entities.js.map

@@ -1 +1 @@
-{"version":3,"file":"entities.js","sourceRoot":"","sources":["../src/entities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAE3B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,KAAK,EAAE,aAAa;IACpB,WAAW,EAAE,mBAAmB;IAChC,cAAc,EAAE,uBAAuB;IACvC,QAAQ,EAAE,iBAAiB;CACnB,CAAC;AAUX;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;GAGG;AACH,MAAM,OAAO,UAAU;IAErB,EAAE,CAAU;IACZ,IAAI,CAAU;IACd,KAAK,CAAiB;IACtB,SAAS,CAAQ;CAClB;AAED,oGAAoG;AACpG,MAAM,OAAO,gBAAgB;IAE3B,EAAE,CAAU;IACZ,IAAI,CAAU;IACd,KAAK,CAAiB;IACtB,SAAS,CAAQ;CAClB;AAED,uEAAuE;AACvE,MAAM,OAAO,oBAAoB;IAE/B,MAAM,CAAU;IAChB,YAAY,CAAU;CACvB;AAED;;;;GAIG;AACH,MAAM,OAAO,cAAc;IAEzB,QAAQ,CAAU;IAClB,MAAM,CAAU;IAChB,MAAM,CAAU;CACjB;AAiBD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CACtC,aAAuC,EAAE;IAEzC,MAAM,KAAK,GAAoB,EAAE,GAAG,mBAAmB,EAAE,GAAG,UAAU,EAAE,CAAC;IAEzE,MAAM,IAAI,GAAG,IAAI,YAAY,CAAa;QACxC,KAAK,EAAE,UAAU;QACjB,SAAS,EAAE,KAAK,CAAC,KAAK;QACtB,UAAU,EAAE,GAAG,EAAE,CAAC,mBAAmB;QACrC,UAAU,EAAE;YACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;YAClD,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,GAAG;gBACX,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,YAAY;aAClC;YACD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YACzC,SAAS,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;SAChC;KACF,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAI,YAAY,CAAmB;QACpD,KAAK,EAAE,gBAAgB;QACvB,SAAS,EAAE,KAAK,CAAC,WAAW;QAC5B,UAAU,EAAE,GAAG,EAAE,CAAC,yBAAyB;QAC3C,UAAU,EAAE;YACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;YAClD,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,GAAG;gBACX,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,GAAG,KAAK,CAAC,WAAW,YAAY;aACxC;YACD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YACzC,SAAS,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;SAChC;KACF,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,IAAI,YAAY,CAAuB;QAC5D,KAAK,EAAE,oBAAoB;QAC3B,SAAS,EAAE,KAAK,CAAC,cAAc;QAC/B,UAAU,EAAE,GAAG,EAAE,CAAC,6BAA6B;QAC/C,UAAU,EAAE;YACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;YACtD,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;SAC7D;KACF,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,YAAY,CAAiB;QAChD,KAAK,EAAE,cAAc;QACrB,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,UAAU,EAAE,GAAG,EAAE,CAAC,uBAAuB;QACzC,UAAU,EAAE;YACV,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;YACxD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;YACtD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;SACvD;QACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,QAAQ,WAAW,EAAE,UAAU,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;KACtF,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,UAAU;QACV,cAAc;QACd,QAAQ;QACR,GAAG,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,MAAM,cAAc,GAAG,wBAAwB,EAAE,CAAC;AAElD,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC,IAAI,CAAC;AACpD,MAAM,CAAC,MAAM,sBAAsB,GAAG,cAAc,CAAC,UAAU,CAAC;AAChE,MAAM,CAAC,MAAM,0BAA0B,GAAG,cAAc,CAAC,cAAc,CAAC;AACxE,MAAM,CAAC,MAAM,oBAAoB,GAAG,cAAc,CAAC,QAAQ,CAAC;AAE5D;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,cAAc,CAAC,GAAG,CAAC;AAEjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,UAAU;IACV,gBAAgB;IAChB,oBAAoB;IACpB,cAAc;CACN,CAAC"}
+{"version":3,"file":"entities.js","sourceRoot":"","sources":["../src/entities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAwB,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAE3B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,KAAK,EAAE,aAAa;IACpB,WAAW,EAAE,mBAAmB;IAChC,cAAc,EAAE,uBAAuB;IACvC,QAAQ,EAAE,iBAAiB;CACnB,CAAC;AAUX;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;GAGG;AACH,MAAM,OAAO,UAAU;IAErB,EAAE,CAAU;IACZ,IAAI,CAAU;IACd,KAAK,CAAiB;IACtB,SAAS,CAAQ;CAClB;AAED,oGAAoG;AACpG,MAAM,OAAO,gBAAgB;IAE3B,EAAE,CAAU;IACZ,IAAI,CAAU;IACd,KAAK,CAAiB;IACtB,SAAS,CAAQ;CAClB;AAED,uEAAuE;AACvE,MAAM,OAAO,oBAAoB;IAE/B,MAAM,CAAU;IAChB,YAAY,CAAU;CACvB;AAED;;;;GAIG;AACH,MAAM,OAAO,cAAc;IAEzB,QAAQ,CAAU;IAClB,MAAM,CAAU;IAChB,MAAM,CAAU;IAChB;;;OAGG;IACH,MAAM,CAAU;CACjB;AAiBD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CACtC,aAAuC,EAAE;IAEzC,MAAM,KAAK,GAAoB,EAAE,GAAG,mBAAmB,EAAE,GAAG,UAAU,EAAE,CAAC;IAEzE,MAAM,IAAI,GAAG,IAAI,YAAY,CAAa;QACxC,KAAK,EAAE,UAAU;QACjB,SAAS,EAAE,KAAK,CAAC,KAAK;QACtB,UAAU,EAAE,GAAG,EAAE,CAAC,mBAAmB;QACrC,UAAU,EAAE;YACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;YAClD,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,GAAG;gBACX,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,YAAY;aAClC;YACD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YACzC,SAAS,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;SAChC;KACF,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAI,YAAY,CAAmB;QACpD,KAAK,EAAE,gBAAgB;QACvB,SAAS,EAAE,KAAK,CAAC,WAAW;QAC5B,UAAU,EAAE,GAAG,EAAE,CAAC,yBAAyB;QAC3C,UAAU,EAAE;YACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;YAClD,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,GAAG;gBACX,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,GAAG,KAAK,CAAC,WAAW,YAAY;aACxC;YACD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YACzC,SAAS,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;SAChC;KACF,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,IAAI,YAAY,CAAuB;QAC5D,KAAK,EAAE,oBAAoB;QAC3B,SAAS,EAAE,KAAK,CAAC,cAAc;QAC/B,UAAU,EAAE,GAAG,EAAE,CAAC,6BAA6B;QAC/C,UAAU,EAAE;YACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;YACtD,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;SAC7D;KACF,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,YAAY,CAAiB;QAChD,KAAK,EAAE,cAAc;QACrB,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,UAAU,EAAE,GAAG,EAAE,CAAC,uBAAuB;QACzC,UAAU,EAAE;YACV,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;YACxD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;YACtD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;YACtD,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,EAAE;gBACV,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,mBAAmB;aAC7B;SACF;QACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,QAAQ,WAAW,EAAE,UAAU,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;KACtF,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,UAAU;QACV,cAAc;QACd,QAAQ;QACR,GAAG,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,MAAM,cAAc,GAAG,wBAAwB,EAAE,CAAC;AAElD,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC,IAAI,CAAC;AACpD,MAAM,CAAC,MAAM,sBAAsB,GAAG,cAAc,CAAC,UAAU,CAAC;AAChE,MAAM,CAAC,MAAM,0BAA0B,GAAG,cAAc,CAAC,cAAc,CAAC;AACxE,MAAM,CAAC,MAAM,oBAAoB,GAAG,cAAc,CAAC,QAAQ,CAAC;AAE5D;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,cAAc,CAAC,GAAG,CAAC;AAEjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,UAAU;IACV,gBAAgB;IAChB,oBAAoB;IACpB,cAAc;CACN,CAAC"}

package/dist/index.d.ts

@@ -3,7 +3,7 @@ export type { AuthzEntitySchemas, AuthzTableNames } from './entities.js';
 export { AuthzPermissionRepository, AuthzRolePermissionRepository, AuthzRoleRepository, AuthzUserRoleRepository, } from './repositories.js';
 export { authzSchemaSql, ensureAuthzSchema } from './schema.js';
 export { MikroOrmAuthzStore } from './mikro-orm-authz.store.js';
-export type { UserAuthz } from './mikro-orm-authz.store.js';
+export type { RoleAssignment, RoleAssignmentFilter, RoleSourceOptions, UserAuthz, UserRoleAssignment, } from './mikro-orm-authz.store.js';
 export { AUTHZ_RBAC_OPTIONS, AUTHZ_RBAC_STORE, AuthzRbacModule, defaultUserRefMapper, } from './authz-rbac.module.js';
 export type { AuthzRbacModuleAsyncOptions, AuthzRbacModuleOptions, UserRefMapper, } from './authz-rbac.module.js';
 export type { AuthzStoreOptions } from './types.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,cAAc,EACd,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGzE,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,YAAY,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,2BAA2B,EAC3B,sBAAsB,EACtB,aAAa,GACd,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACtD,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,cAAc,EACd,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGzE,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,SAAS,EACT,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,2BAA2B,EAC3B,sBAAsB,EACtB,aAAa,GACd,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACtD,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,cAAc,EACd,oBAAoB,GACrB,MAAM,eAAe,CAAC;AAEvB,0FAA0F;AAC1F,iFAAiF;AACjF,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,cAAc,EACd,oBAAoB,GACrB,MAAM,eAAe,CAAC;AAEvB,0FAA0F;AAC1F,iFAAiF;AACjF,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAQhE,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC"}

package/dist/mikro-orm-authz.store.d.ts

@@ -1,6 +1,10 @@
-import { type UserAuthz, type UserRef } from '@dudousxd/nestjs-authz/store-kit';
+import { type RoleAssignment, type RoleAssignmentFilter, type UserAuthz, type UserRef, type UserRoleAssignment } from '@dudousxd/nestjs-authz/store-kit';
 import type { EntityManager } from '@mikro-orm/core';
-export type { UserAuthz };
+export type { RoleAssignment, RoleAssignmentFilter, UserAuthz, UserRoleAssignment };
+/** Assignment source for role mutations (default `'manual'`) — see `setUserRoles`. */
+export interface RoleSourceOptions {
+    source?: string;
+}
 /**
  * MikroORM-backed RBAC store. A plain POJO that receives the `EntityManager` in its
  * constructor — NOT `@Injectable`, no internal connection token (the app owns the
@@ -28,10 +32,58 @@ export declare class MikroOrmAuthzStore {
     givePermissionToRole(roleName: string, permissionName: string): Promise<void>;
     /** Revoke a permission from a role. No-op if either is absent or not linked. */
     revokePermissionFromRole(roleName: string, permissionName: string): Promise<void>;
-    /** Assign a role to a user (creating the role by name if needed). Idempotent. */
-    assignRole(user: UserRef, roleName: string): Promise<void>;
-    /** Remove a role from a user. No-op if the role or assignment is absent. */
-    removeRole(user: UserRef, roleName: string): Promise<void>;
+    /**
+     * Delete a role together with its role→permission links and EVERY user assignment of it (all
+     * sources), in one transaction. Returns whether the role existed. The permissions themselves
+     * are kept (other roles may use them).
+     */
+    deleteRole(roleName: string): Promise<boolean>;
+    /**
+     * REPLACE the role's permission set with exactly `permissionNames` (spatie's
+     * `syncPermissions`): links not in the list are removed, missing ones added. The role and the
+     * permissions are created by name when missing (idempotently, before the swap); the delete +
+     * re-insert of the links is transactional. An empty list leaves the role with no permissions.
+     */
+    syncRolePermissions(roleName: string, permissionNames: readonly string[]): Promise<void>;
+    /**
+     * The permission names of each named role, in one query. Every EXISTING requested role is a
+     * key (mapped to `[]` when it has no permissions); roles that don't exist are ABSENT from the
+     * result. Names are sorted.
+     */
+    getRolePermissions(roleNames: readonly string[]): Promise<Record<string, string[]>>;
+    /**
+     * Assign a role to a user (creating the role by name if needed). Idempotent. `{ source }`
+     * (default `'manual'`) records where the assignment came from.
+     */
+    assignRole(user: UserRef, roleName: string, opts?: RoleSourceOptions): Promise<void>;
+    /**
+     * Remove a role from a user. No-op if the role or assignment is absent. With `{ source }` only
+     * that source's assignment goes; without it, the role is removed from every source.
+     */
+    removeRole(user: UserRef, roleName: string, opts?: RoleSourceOptions): Promise<void>;
+    /**
+     * REPLACE the user's role assignments of ONE source (default `'manual'`) with exactly
+     * `roleNames` — e.g. an SSO/SCIM sync calls `setUserRoles(user, mappedRoles, { source: 'sso' })`
+     * on every login. Other sources' assignments are untouched, so a role held both manually and via
+     * SSO survives an SSO sync that drops it. Roles are created by name when missing. Transactional.
+     */
+    setUserRoles(user: UserRef, roleNames: readonly string[], opts?: RoleSourceOptions): Promise<void>;
+    /** Every role assignment of a user, one entry per `(role, source)`. */
+    getRoleAssignments(user: UserRef): Promise<RoleAssignment[]>;
+    /**
+     * Raw role-assignment rows for admin listings — e.g. who holds a role (`{ role: 'admin' }`) or
+     * a user's assignments with their sources (`{ user }`). `role` accepts one name or a list;
+     * `user` and `source` narrow further. Ordered by `(userType, userId, role, source)`.
+     *
+     * This adapter has no tenant-scoped assignments — every row is global (`tenantId: null`). So
+     * `tenantId: undefined` or `null` lists everything, and a tenant id string matches nothing.
+     */
+    listRoleAssignments(filter?: RoleAssignmentFilter): Promise<UserRoleAssignment[]>;
+    /**
+     * Delete every role assignment of the user (all sources) — e.g. when the account is deleted.
+     * Roles and permissions are kept. (This adapter has no direct user permissions.)
+     */
+    removeUser(user: UserRef): Promise<void>;
     /** The role names a user holds. */
     getRolesForUser(user: UserRef): Promise<string[]>;
     /**

package/dist/mikro-orm-authz.store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mikro-orm-authz.store.d.ts","sourceRoot":"","sources":["../src/mikro-orm-authz.store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,OAAO,EAAoB,MAAM,kCAAkC,CAAC;AAClG,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,iBAAiB,CAAC;AAM/D,YAAY,EAAE,SAAS,EAAE,CAAC;AAE1B;;;;;;;;GAQG;AACH,qBAAa,kBAAkB;IAI3B,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,aAAa,EAClC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAM;IAGnC,gGAAgG;IAChG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAM7B;;;OAGG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAoB/C,qFAAqF;IAC/E,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAoBvC,UAAU;YAKV,gBAAgB;IAO9B,kFAAkF;IAC5E,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUnF,gFAAgF;IAC1E,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASvF,iFAAiF;IAC3E,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUhE,4EAA4E;IACtE,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAShE,mCAAmC;IAC7B,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAUvD;;;;;;;;OAQG;IACG,qBAAqB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAyC7D,0DAA0D;IACpD,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;IAQrD,wEAAwE;IAClE,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAI7E"}
+{"version":3,"file":"mikro-orm-authz.store.d.ts","sourceRoot":"","sources":["../src/mikro-orm-authz.store.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,kBAAkB,EAIxB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,aAAa,EAAY,MAAM,iBAAiB,CAAC;AAM/D,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC;AAEpF,sFAAsF;AACtF,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,qBAAa,kBAAkB;IAI3B,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,aAAa,EAClC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAM;IAGnC,gGAAgG;IAChG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAM7B;;;OAGG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAoB/C,qFAAqF;IAC/E,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAoBvC,UAAU;YAKV,gBAAgB;IAO9B,kFAAkF;IAC5E,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUnF,gFAAgF;IAC1E,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvF;;;;OAIG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWpD;;;;;OAKG;IACG,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAe9F;;;;OAIG;IACG,kBAAkB,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAuCzF;;;OAGG;IACG,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB1F;;;OAGG;IACG,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAY1F;;;;;OAKG;IACG,YAAY,CAChB,IAAI,EAAE,OAAO,EACb,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,IAAI,CAAC;IAchB,uEAAuE;IACjE,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAalE;;;;;;;OAOG;IACG,mBAAmB,CAAC,MAAM,GAAE,oBAAyB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAmC3F;;;OAGG;IACG,UAAU,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAO9C,mCAAmC;IAC7B,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAUvD;;;;;;;;OAQG;IACG,qBAAqB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAyC7D,0DAA0D;IACpD,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;IAQrD,wEAAwE;IAClE,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAI7E"}

package/dist/mikro-orm-authz.store.js

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto';
-import { normalizeUserRef } from '@dudousxd/nestjs-authz/store-kit';
+import { DEFAULT_ROLE_SOURCE, compareUserRoleAssignments, normalizeUserRef, roleFilterNames, } from '@dudousxd/nestjs-authz/store-kit';
 import { PermissionEntity, RoleEntity, RolePermissionEntity, UserRoleEntity } from './entities.js';
 import { ensureAuthzSchema } from './schema.js';
 /**
@@ -100,25 +100,208 @@ export class MikroOrmAuthzStore {
             return;
         await this.em.fork().nativeDelete(RolePermissionEntity, { roleId, permissionId });
     }
+    /**
+     * Delete a role together with its role→permission links and EVERY user assignment of it (all
+     * sources), in one transaction. Returns whether the role existed. The permissions themselves
+     * are kept (other roles may use them).
+     */
+    async deleteRole(roleName) {
+        return this.em.fork().transactional(async (tx) => {
+            const role = await tx.findOne(RoleEntity, { name: roleName });
+            if (!role)
+                return false;
+            await tx.nativeDelete(UserRoleEntity, { roleId: role.id });
+            await tx.nativeDelete(RolePermissionEntity, { roleId: role.id });
+            await tx.nativeDelete(RoleEntity, { id: role.id });
+            return true;
+        });
+    }
+    /**
+     * REPLACE the role's permission set with exactly `permissionNames` (spatie's
+     * `syncPermissions`): links not in the list are removed, missing ones added. The role and the
+     * permissions are created by name when missing (idempotently, before the swap); the delete +
+     * re-insert of the links is transactional. An empty list leaves the role with no permissions.
+     */
+    async syncRolePermissions(roleName, permissionNames) {
+        const roleId = await this.createRole(roleName);
+        const permissionIds = [];
+        for (const name of new Set(permissionNames)) {
+            permissionIds.push(await this.createPermission(name));
+        }
+        await this.em.fork().transactional(async (tx) => {
+            await tx.nativeDelete(RolePermissionEntity, { roleId });
+            for (const permissionId of permissionIds) {
+                tx.create(RolePermissionEntity, { roleId, permissionId });
+            }
+            await tx.flush();
+        });
+    }
+    /**
+     * The permission names of each named role, in one query. Every EXISTING requested role is a
+     * key (mapped to `[]` when it has no permissions); roles that don't exist are ABSENT from the
+     * result. Names are sorted.
+     */
+    async getRolePermissions(roleNames) {
+        const names = [...new Set(roleNames)];
+        const out = {};
+        if (names.length === 0)
+            return out;
+        const em = this.em.fork();
+        const meta = em.getMetadata();
+        const role = meta.get(RoleEntity.name);
+        const perm = meta.get(PermissionEntity.name);
+        const rolePerm = meta.get(RolePermissionEntity.name);
+        const col = (m, prop) => {
+            const field = m.properties[prop]?.fieldNames?.[0];
+            if (!field)
+                throw new Error(`Missing column metadata for ${m.className}.${prop}`);
+            return field;
+        };
+        // Identifiers come from entity metadata (trusted); role names are bound parameters.
+        const sql = `select r.${col(role, 'name')} as role, p.${col(perm, 'name')} as permission ` +
+            `from ${role.tableName} r ` +
+            `left join ${rolePerm.tableName} rp on rp.${col(rolePerm, 'roleId')} = r.${col(role, 'id')} ` +
+            `left join ${perm.tableName} p on p.${col(perm, 'id')} = rp.${col(rolePerm, 'permissionId')} ` +
+            `where r.${col(role, 'name')} in (${names.map(() => '?').join(', ')})`;
+        const rows = (await em.getConnection().execute(sql, names));
+        for (const row of rows) {
+            let list = out[row.role];
+            if (!list) {
+                list = [];
+                out[row.role] = list;
+            }
+            if (row.permission !== null && row.permission !== undefined)
+                list.push(row.permission);
+        }
+        for (const list of Object.values(out))
+            list.sort();
+        return out;
+    }
     // --- user ↔ role ---
-    /** Assign a role to a user (creating the role by name if needed). Idempotent. */
-    async assignRole(user, roleName) {
+    /**
+     * Assign a role to a user (creating the role by name if needed). Idempotent. `{ source }`
+     * (default `'manual'`) records where the assignment came from.
+     */
+    async assignRole(user, roleName, opts) {
         const { type, id } = normalizeUserRef(user);
         const roleId = await this.createRole(roleName);
+        const source = opts?.source ?? DEFAULT_ROLE_SOURCE;
         const em = this.em.fork();
-        const existing = await em.findOne(UserRoleEntity, { userType: type, userId: id, roleId });
+        const existing = await em.findOne(UserRoleEntity, {
+            userType: type,
+            userId: id,
+            roleId,
+            source,
+        });
         if (existing)
             return;
-        em.create(UserRoleEntity, { userType: type, userId: id, roleId });
+        em.create(UserRoleEntity, { userType: type, userId: id, roleId, source });
         await em.flush();
     }
-    /** Remove a role from a user. No-op if the role or assignment is absent. */
-    async removeRole(user, roleName) {
+    /**
+     * Remove a role from a user. No-op if the role or assignment is absent. With `{ source }` only
+     * that source's assignment goes; without it, the role is removed from every source.
+     */
+    async removeRole(user, roleName, opts) {
         const { type, id } = normalizeUserRef(user);
         const roleId = await this.findRoleId(roleName);
         if (!roleId)
             return;
-        await this.em.fork().nativeDelete(UserRoleEntity, { userType: type, userId: id, roleId });
+        await this.em.fork().nativeDelete(UserRoleEntity, {
+            userType: type,
+            userId: id,
+            roleId,
+            ...(opts?.source !== undefined ? { source: opts.source } : {}),
+        });
+    }
+    /**
+     * REPLACE the user's role assignments of ONE source (default `'manual'`) with exactly
+     * `roleNames` — e.g. an SSO/SCIM sync calls `setUserRoles(user, mappedRoles, { source: 'sso' })`
+     * on every login. Other sources' assignments are untouched, so a role held both manually and via
+     * SSO survives an SSO sync that drops it. Roles are created by name when missing. Transactional.
+     */
+    async setUserRoles(user, roleNames, opts) {
+        const { type, id } = normalizeUserRef(user);
+        const source = opts?.source ?? DEFAULT_ROLE_SOURCE;
+        const roleIds = [];
+        for (const name of new Set(roleNames))
+            roleIds.push(await this.createRole(name));
+        await this.em.fork().transactional(async (tx) => {
+            await tx.nativeDelete(UserRoleEntity, { userType: type, userId: id, source });
+            for (const roleId of roleIds) {
+                tx.create(UserRoleEntity, { userType: type, userId: id, roleId, source });
+            }
+            await tx.flush();
+        });
+    }
+    /** Every role assignment of a user, one entry per `(role, source)`. */
+    async getRoleAssignments(user) {
+        const { type, id } = normalizeUserRef(user);
+        const em = this.em.fork();
+        const assignments = await em.find(UserRoleEntity, { userType: type, userId: id });
+        if (assignments.length === 0)
+            return [];
+        const roles = await em.find(RoleEntity, { id: { $in: assignments.map((a) => a.roleId) } });
+        const nameById = new Map(roles.map((r) => [r.id, r.name]));
+        return assignments
+            .filter((a) => nameById.has(a.roleId))
+            .map((a) => ({ role: nameById.get(a.roleId), source: a.source, tenantId: null }))
+            .sort((a, b) => a.role.localeCompare(b.role) || a.source.localeCompare(b.source));
+    }
+    /**
+     * Raw role-assignment rows for admin listings — e.g. who holds a role (`{ role: 'admin' }`) or
+     * a user's assignments with their sources (`{ user }`). `role` accepts one name or a list;
+     * `user` and `source` narrow further. Ordered by `(userType, userId, role, source)`.
+     *
+     * This adapter has no tenant-scoped assignments — every row is global (`tenantId: null`). So
+     * `tenantId: undefined` or `null` lists everything, and a tenant id string matches nothing.
+     */
+    async listRoleAssignments(filter = {}) {
+        if (typeof filter.tenantId === 'string')
+            return [];
+        const em = this.em.fork();
+        const where = {};
+        const roleNames = roleFilterNames(filter.role);
+        if (roleNames !== undefined) {
+            if (roleNames.length === 0)
+                return [];
+            const roles = await em.find(RoleEntity, { name: { $in: roleNames } });
+            if (roles.length === 0)
+                return [];
+            where.roleId = { $in: roles.map((r) => r.id) };
+        }
+        if (filter.user !== undefined) {
+            const { type, id } = normalizeUserRef(filter.user);
+            where.userType = type;
+            where.userId = id;
+        }
+        if (filter.source !== undefined)
+            where.source = filter.source;
+        const assignments = await em.find(UserRoleEntity, where);
+        if (assignments.length === 0)
+            return [];
+        const roles = await em.find(RoleEntity, {
+            id: { $in: [...new Set(assignments.map((a) => a.roleId))] },
+        });
+        const nameById = new Map(roles.map((r) => [r.id, r.name]));
+        return assignments
+            .filter((a) => nameById.has(a.roleId))
+            .map((a) => ({
+            userType: a.userType,
+            userId: a.userId,
+            role: nameById.get(a.roleId),
+            source: a.source,
+            tenantId: null,
+        }))
+            .sort(compareUserRoleAssignments);
+    }
+    /**
+     * Delete every role assignment of the user (all sources) — e.g. when the account is deleted.
+     * Roles and permissions are kept. (This adapter has no direct user permissions.)
+     */
+    async removeUser(user) {
+        const { type, id } = normalizeUserRef(user);
+        await this.em.fork().nativeDelete(UserRoleEntity, { userType: type, userId: id });
     }
     // --- queries ---
     /** The role names a user holds. */

package/dist/mikro-orm-authz.store.js.map

@@ -1 +1 @@
-{"version":3,"file":"mikro-orm-authz.store.js","sourceRoot":"","sources":["../src/mikro-orm-authz.store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAgC,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAElG,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAMhD;;;;;;;;GAQG;AACH,MAAM,OAAO,kBAAkB;IAIV;IAHnB,2FAA2F;IAC3F,qFAAqF;IACrF,YACmB,EAAiB,EAClC,QAA+B,EAAE;QADhB,OAAE,GAAF,EAAE,CAAe;IAEjC,CAAC;IAEJ,gGAAgG;IAChG,YAAY;QACV,OAAO,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,2DAA2D;IAE3D;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE;YACnC,EAAE,EAAE,UAAU,EAAE;YAChB,IAAI;YACJ,KAAK,EAAE,IAAI;YACX,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,kFAAkF;QACpF,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,IAAI,CAAC,CAAC;QACxE,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,gBAAgB,EAAE;YACzC,EAAE,EAAE,UAAU,EAAE;YAChB,IAAI;YACJ,KAAK,EAAE,IAAI;YACX,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,kFAAkF;QACpF,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,IAAI,CAAC,CAAC;QAC9E,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,IAAY;QACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,OAAO,GAAG,EAAE,EAAE,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,OAAO,GAAG,EAAE,EAAE,CAAC;IACjB,CAAC;IAED,4BAA4B;IAE5B,kFAAkF;IAClF,KAAK,CAAC,oBAAoB,CAAC,QAAgB,EAAE,cAAsB;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAClF,IAAI,QAAQ;YAAE,OAAO;QACrB,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAC1D,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,wBAAwB,CAAC,QAAgB,EAAE,cAAsB;QACrE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY;YAAE,OAAO;QACrC,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,sBAAsB;IAEtB,iFAAiF;IACjF,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB;QAC9C,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1F,IAAI,QAAQ;YAAE,OAAO;QACrB,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAClE,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB;QAC9C,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,kBAAkB;IAElB,mCAAmC;IACnC,KAAK,CAAC,eAAe,CAAC,IAAa;QACjC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAClF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAClE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,qBAAqB,CAAC,IAAa;QACvC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAE1B,wFAAwF;QACxF,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAE/C,6EAA6E;QAC7E,MAAM,GAAG,GAAG,CAAC,CAAc,EAAE,IAAY,EAAU,EAAE;YACnD,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;YAClD,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC;YAClF,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC;QACnC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC;QACnC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAEzC,mFAAmF;QACnF,wFAAwF;QACxF,MAAM,GAAG,GACP,qBAAqB,QAAQ,WAAW;YACxC,QAAQ,SAAS,KAAK;YACtB,cAAc,OAAO,aAAa,QAAQ,QAAQ,MAAM,GAAG;YAC3D,cAAc,OAAO,aAAa,QAAQ,SAAS,QAAQ,GAAG;YAC9D,YAAY,UAAU,eAAe,QAAQ,MAAM,CAAC;QAEtD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAA4B,CAAC;QAC5F,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,YAAY,CAAC,IAAa;QAC9B,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAC1B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC;SACjC,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChC,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,iBAAiB,CAAC,IAAa,EAAE,UAAkB;QACvD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC3D,OAAO,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;CACF"}
+{"version":3,"file":"mikro-orm-authz.store.js","sourceRoot":"","sources":["../src/mikro-orm-authz.store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,mBAAmB,EAMnB,0BAA0B,EAC1B,gBAAgB,EAChB,eAAe,GAChB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAWhD;;;;;;;;GAQG;AACH,MAAM,OAAO,kBAAkB;IAIV;IAHnB,2FAA2F;IAC3F,qFAAqF;IACrF,YACmB,EAAiB,EAClC,QAA+B,EAAE;QADhB,OAAE,GAAF,EAAE,CAAe;IAEjC,CAAC;IAEJ,gGAAgG;IAChG,YAAY;QACV,OAAO,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,2DAA2D;IAE3D;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE;YACnC,EAAE,EAAE,UAAU,EAAE;YAChB,IAAI;YACJ,KAAK,EAAE,IAAI;YACX,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,kFAAkF;QACpF,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,IAAI,CAAC,CAAC;QACxE,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,gBAAgB,EAAE;YACzC,EAAE,EAAE,UAAU,EAAE;YAChB,IAAI;YACJ,KAAK,EAAE,IAAI;YACX,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,kFAAkF;QACpF,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,IAAI,CAAC,CAAC;QAC9E,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,IAAY;QACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,OAAO,GAAG,EAAE,EAAE,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,OAAO,GAAG,EAAE,EAAE,CAAC;IACjB,CAAC;IAED,4BAA4B;IAE5B,kFAAkF;IAClF,KAAK,CAAC,oBAAoB,CAAC,QAAgB,EAAE,cAAsB;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAClF,IAAI,QAAQ;YAAE,OAAO;QACrB,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAC1D,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,wBAAwB,CAAC,QAAgB,EAAE,cAAsB;QACrE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY;YAAE,OAAO;QACrC,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IACpF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,QAAgB;QAC/B,OAAO,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC/C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC9D,IAAI,CAAC,IAAI;gBAAE,OAAO,KAAK,CAAC;YACxB,MAAM,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3D,MAAM,EAAE,CAAC,YAAY,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACjE,MAAM,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,mBAAmB,CAAC,QAAgB,EAAE,eAAkC;QAC5E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,aAAa,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC9C,MAAM,EAAE,CAAC,YAAY,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACxD,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;gBACzC,EAAE,CAAC,MAAM,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YAC5D,CAAC;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,kBAAkB,CAAC,SAA4B;QACnD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QACtC,MAAM,GAAG,GAA6B,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,CAAC,CAAc,EAAE,IAAY,EAAU,EAAE;YACnD,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;YAClD,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC;YAClF,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QACF,oFAAoF;QACpF,MAAM,GAAG,GACP,YAAY,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,eAAe,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,iBAAiB;YAC9E,QAAQ,IAAI,CAAC,SAAS,KAAK;YAC3B,aAAa,QAAQ,CAAC,SAAS,aAAa,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG;YAC7F,aAAa,IAAI,CAAC,SAAS,WAAW,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,GAAG;YAC9F,WAAW,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QACzE,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAGxD,CAAC;QACH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,IAAI,GAAG,EAAE,CAAC;gBACV,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;YACvB,CAAC;YACD,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS;gBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzF,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACnD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,sBAAsB;IAEtB;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB,EAAE,IAAwB;QACxE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,mBAAmB,CAAC;QACnD,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE;YAChD,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,EAAE;YACV,MAAM;YACN,MAAM;SACP,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,OAAO;QACrB,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1E,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB,EAAE,IAAwB;QACxE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE;YAChD,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,EAAE;YACV,MAAM;YACN,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAChB,IAAa,EACb,SAA4B,EAC5B,IAAwB;QAExB,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,mBAAmB,CAAC;QACnD,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACjF,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC9C,MAAM,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACnB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,kBAAkB,CAAC,IAAa;QACpC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAClF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3D,OAAO,WAAW;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;aACrC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAW,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;aAC1F,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACtF,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,mBAAmB,CAAC,SAA+B,EAAE;QACzD,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QACnD,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,KAAK,GAA4B,EAAE,CAAC;QAC1C,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;YACtE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YAClC,KAAK,CAAC,MAAM,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACjD,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnD,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;YACtB,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;QACpB,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9D,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE;YACtC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;SAC5D,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3D,OAAO,WAAW;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;aACrC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAW;YACtC,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;aACF,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACtC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,IAAa;QAC5B,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,kBAAkB;IAElB,mCAAmC;IACnC,KAAK,CAAC,eAAe,CAAC,IAAa;QACjC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAClF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAClE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,qBAAqB,CAAC,IAAa;QACvC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAE1B,wFAAwF;QACxF,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAE/C,6EAA6E;QAC7E,MAAM,GAAG,GAAG,CAAC,CAAc,EAAE,IAAY,EAAU,EAAE;YACnD,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC;YAClD,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC;YAClF,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC;QACnC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC;QACnC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAEzC,mFAAmF;QACnF,wFAAwF;QACxF,MAAM,GAAG,GACP,qBAAqB,QAAQ,WAAW;YACxC,QAAQ,SAAS,KAAK;YACtB,cAAc,OAAO,aAAa,QAAQ,QAAQ,MAAM,GAAG;YAC3D,cAAc,OAAO,aAAa,QAAQ,SAAS,QAAQ,GAAG;YAC9D,YAAY,UAAU,eAAe,QAAQ,MAAM,CAAC;QAEtD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAA4B,CAAC;QAC5F,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,YAAY,CAAC,IAAa;QAC9B,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAC1B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC;SACjC,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChC,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,iBAAiB,CAAC,IAAa,EAAE,UAAkB;QACvD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC3D,OAAO,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dudousxd/nestjs-authz-mikro-orm",
-  "version": "0.5.1",
+  "version": "0.7.0",
   "description": "MikroORM RBAC persistence for @dudousxd/nestjs-authz — roles, permissions, and a Gate seam (zero connection ownership).",
   "license": "MIT",
   "repository": {
@@ -8,6 +8,19 @@
     "url": "git+https://github.com/DavideCarvalho/nestjs-authz.git",
     "directory": "packages/mikro-orm"
   },
+  "homepage": "https://davidecarvalho.github.io/aviary/docs/authz",
+  "bugs": {
+    "url": "https://github.com/DavideCarvalho/nestjs-authz/issues"
+  },
+  "keywords": [
+    "nestjs",
+    "authorization",
+    "authz",
+    "rbac",
+    "roles",
+    "permissions",
+    "mikro-orm"
+  ],
   "author": "Davi Carvalho <davi@goflip.ai>",
   "type": "module",
   "main": "./dist/index.js",
@@ -25,7 +38,7 @@
     "CHANGELOG.md"
   ],
   "peerDependencies": {
-    "@dudousxd/nestjs-authz": ">=0.1.0",
+    "@dudousxd/nestjs-authz": ">=0.8.0",
     "@mikro-orm/core": "^6.0.0 || ^7.0.0",
     "@mikro-orm/nestjs": "^5.0.0 || ^6.0.0 || ^7.0.0",
     "@nestjs/common": ">=10.0.0",
@@ -38,31 +51,22 @@
     }
   },
   "devDependencies": {
-    "@mikro-orm/better-sqlite": "6.6.15",
-    "@mikro-orm/core": "6.6.15",
-    "@mikro-orm/nestjs": "^6.0.0",
-    "@nestjs/common": "^12.0.1",
-    "@nestjs/core": "^12.0.1",
-    "@nestjs/testing": "^12.0.1",
-    "@types/node": "^20.0.0",
-    "reflect-metadata": "^0.2.2",
-    "rxjs": "^7.8.1",
-    "typescript": "^5.4.0",
-    "vitest": "^3.0.0",
-    "@dudousxd/nestjs-authz": "^0.6.5"
+    "@mikro-orm/better-sqlite": "6.6.16",
+    "@mikro-orm/core": "6.6.16",
+    "@mikro-orm/nestjs": "6.1.2",
+    "@nestjs/common": "12.0.1",
+    "@nestjs/core": "12.0.1",
+    "@nestjs/testing": "12.0.1",
+    "@types/node": "20.19.43",
+    "reflect-metadata": "0.2.2",
+    "rxjs": "7.8.2",
+    "typescript": "5.9.3",
+    "vitest": "3.2.7",
+    "@dudousxd/nestjs-authz": "^0.8.0"
   },
   "engines": {
     "node": ">=20"
   },
-  "keywords": [
-    "nestjs",
-    "authorization",
-    "authz",
-    "rbac",
-    "roles",
-    "permissions",
-    "mikro-orm"
-  ],
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "test": "vitest run --passWithNoTests",