@dudousxd/nestjs-authz-mikro-orm 0.7.1 → 0.9.0

package/CHANGELOG.md

@@ -1,5 +1,51 @@
 # @dudousxd/nestjs-authz-mikro-orm
 
+## 0.9.0
+
+### Minor Changes
+
+- Back on the 0.x line. The 1.x and 2.x versions were published by accident: a release-tooling peer cascade bumped this package to a major, not an API decision. 0.9.0 contains everything those versions shipped (console `authorize` support, tenancy, Node 24+ `engines`) with no other change. Upgrade from 1.x/2.x to 0.9.0; those versions are deprecated.
+
+## 2.0.0
+
+### Major Changes
+
+- [#74](https://github.com/DavideCarvalho/nestjs-authz/pull/74) [`35421dc`](https://github.com/DavideCarvalho/nestjs-authz/commit/35421dc5b09bd271d5087d26e8536191ef6ba342) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - **Breaking:** require Node.js 24 or newer (`engines.node` is now `>=24`; it was `>=22`, and `>=20` for `-client` and `-react`). CI tests on Node 24 and 26. No API changes: see the Upgrading page in the docs.
+
+## 1.1.0
+
+### Minor Changes
+
+- [#72](https://github.com/DavideCarvalho/nestjs-authz/pull/72) [`58a5d72`](https://github.com/DavideCarvalho/nestjs-authz/commit/58a5d72d2964a7cfae9cbfe8506526c8518ba30a) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Tenancy for the RBAC modules, following the `@dudousxd/nestjs-context` tenancy switch.
+
+  - New `tenancy` option (`'inherit' | false | { enabled?, kinds?, nullRows?, roles? }`, default `'inherit'`). With context tenancy on, permission and role checks are scoped to the request's tenant from `Context.setTenant`. A request with no tenant, inside `Context.allTenants()`, or outside a request sees global assignments only. `kinds` limits the tenant kinds this module honours. With tenancy off nothing changes.
+  - `tenancy.roles` maps the caller's role inside the tenant (`tenant.role`) to authz roles that apply in that tenant only, e.g. `{ owner: 'org_admin' }`.
+  - New `tenant` resolver option, `(user) => tenantId | null | undefined`: an explicit tenant that wins over the context.
+  - MikroORM and Prisma can now store tenant-scoped role assignments like Drizzle and TypeORM: `assignRole`, `removeRole` and `setUserRoles` take `{ tenantId }`, and the read methods take a tenant scope. MikroORM: build the entities with `createAuthzEntitySchemas({}, { tenantScoped: true })`. Prisma: add `tenantId String @default("")` to `UserRole` and its `@@id`, then pass `tenantScoped: true`. Without that, every assignment stays global.
+
+## 1.0.0
+
+### Patch Changes
+
+- Updated dependencies [[`750a6b3`](https://github.com/DavideCarvalho/nestjs-authz/commit/750a6b3f80deea3803dec8df5f9f8cf67a046ac1)]:
+  - @dudousxd/nestjs-authz@0.10.0
+
+## 0.8.0
+
+### Minor Changes
+
+- [#67](https://github.com/DavideCarvalho/nestjs-authz/pull/67) [`32e967f`](https://github.com/DavideCarvalho/nestjs-authz/commit/32e967ffbcd68a97e8effc77af9c16bbbafdc918) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Run on `@dudousxd/nestjs-authz` 0.9 and `@nestjs/authorization`: persisted roles and
+  permissions now guard routes through the official guard as the core's `RolePolicy` /
+  `PermissionPolicy` (`@Roles('editor')`, `@Permission('posts.publish')`), and the guard and the
+  handler's `Gate` calls share one permission and role fetch per request. The store API
+  (role sources, admin management, tenant-scoped roles where supported) and `AuthzRbacModule`
+  are unchanged. A persisted permission named like a policy ability no longer bypasses that
+  policy (see the core changeset). Requires NestJS 12, `@nestjs/authorization` ^0.1.3 and Node 22+.
+
+### Patch Changes
+
+- [#67](https://github.com/DavideCarvalho/nestjs-authz/pull/67) [`32e967f`](https://github.com/DavideCarvalho/nestjs-authz/commit/32e967ffbcd68a97e8effc77af9c16bbbafdc918) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Fix packages that could be published without files their `exports` point to. `tsc` builds no longer use a `.tsbuildinfo` that can outlive `dist/` and skip emitting files. A new `check:exports` step (also `prepack`) fails the release if any `exports`/`main`/`types` path is missing.
+
 ## 0.7.1
 
 ### Patch Changes

package/README.md

@@ -1,7 +1,7 @@
 # @dudousxd/nestjs-authz-mikro-orm
 
 MikroORM RBAC persistence for [`@dudousxd/nestjs-authz`](https://github.com/DavideCarvalho/nestjs-authz) —
-roles, permissions, and a Gate seam, with **zero connection ownership** (your app owns the
+roles and permissions for the official `@nestjs/authorization` policies, with **zero connection ownership** (your app owns the
 `EntityManager`; this package never opens a connection).
 
 This is the MikroORM sibling of `@dudousxd/nestjs-authz-typeorm`: identical store surface
@@ -15,7 +15,7 @@ separate `@mikro-orm/decorators` package), so no extra peer is required.
 ## Install
 
 ```bash
-pnpm add @dudousxd/nestjs-authz-mikro-orm @dudousxd/nestjs-authz @mikro-orm/core @mikro-orm/nestjs
+pnpm add @dudousxd/nestjs-authz-mikro-orm @dudousxd/nestjs-authz @nestjs/authorization @mikro-orm/core @mikro-orm/nestjs
 ```
 
 ## Entities
@@ -110,16 +110,30 @@ import { EntityManager } from '@mikro-orm/core';
 export class AppModule {}
 ```
 
-Once wired, the Gate consults persisted RBAC:
+Once wired, persisted roles and permissions guard routes through the official
+`@nestjs/authorization` guard, as the core's `RolePolicy` / `PermissionPolicy`:
 
 ```ts
-await store.givePermissionToRole('editor', 'posts.publish');
+await store.givePermissionToRole('editor', 'posts.*');
 await store.assignRole({ type: 'user', id: 7 }, 'editor');
 
-gate.forUser(user).allows('posts.publish'); // true (PERMISSION_PROVIDER seam, wildcards supported)
-gate.forUser(user).hasRole('editor');       // true (ROLE_PROVIDER seam)
+@Permission('posts.publish')                                  // posts.* grants it
+@Can(PermissionPolicy, 'has', permission('posts.publish'))   // the same, spelled out
+@Roles('editor')                                              // @Can(RolePolicy, 'has', roles('editor'))
 ```
 
+and in services, through the `Gate`:
+
+```ts
+gate.forUser(user).allows('posts.publish');               // true (PERMISSION_PROVIDER seam)
+gate.forUser(user).allows(PermissionPolicy, 'has', 'posts.publish');
+gate.forUser(user).hasRole('editor');                     // true (ROLE_PROVIDER seam)
+```
+
+The user is the one the official guard reads (`AuthorizationModule.forRoot({ getUser })`,
+default `request.user`), mapped to a store ref with `userRefFrom` (default `{ type, id }` or
+`{ id }`).
+
 ## Schema
 
 `autoCreateSchema` (default `true`) runs `ensureAuthzSchema` on `onModuleInit` via MikroORM's
@@ -199,9 +213,73 @@ await store.listRoleAssignments({ user: { type: 'user', id: 7 } });
 await store.removeUser({ type: 'user', id: 7 });
 ```
 
-This adapter has no tenant-scoped assignments, so every row has `tenantId: null`:
-`listRoleAssignments({ tenantId: null })` lists everything and a tenant id string matches
-nothing.
+`tenantId` filters: omitted = every tenant, `null` = global assignments only, a string = that
+tenant's scoped assignments only. Without the tenant column (below) every row has
+`tenantId: null`, so a tenant id string matches nothing.
+
+## Tenant-scoped roles
+
+Build the entities with `tenantScoped: true` to assign roles per tenant. The user-role table
+gets a `tenant_id` column (default `''`, a global assignment) in its primary key:
+
+```ts
+import { createAuthzEntitySchemas } from '@dudousxd/nestjs-authz-mikro-orm';
+
+const authz = createAuthzEntitySchemas({}, { tenantScoped: true }); // or your own table names
+MikroOrmModule.forRoot({ entities: [...authz.all /* , your entities */] });
+
+await store.assignRole(user, 'editor', { tenantId: 'acme' }); // only inside acme
+await store.assignRole(user, 'viewer');                        // everywhere
+await store.getRolesForUser(user, { tenantId: 'acme' });      // ['editor', 'viewer']
+await store.getRolesForUser(user);                            // ['viewer']
+```
+
+`removeRole` and `setUserRoles` take the same `{ tenantId }` (omitted = the global
+assignments). Without `tenantScoped`, every assignment is global and reads ignore the tenant.
+`assignRole` and `setUserRoles` with a `tenantId` throw; `removeRole` with one does nothing,
+since there is no tenant assignment to remove.
+
+### Migrating an existing database
+
+`ensureAuthzSchema` / `autoCreateSchema` (or `authzSchemaSql` in a migration) add the `tenant_id`
+column, so existing rows become global assignments. Widen the primary key once, so the same role
+can be assigned in two tenants:
+
+```sql
+-- PostgreSQL (default constraint name; check yours with \d authz_user_role)
+ALTER TABLE authz_user_role DROP CONSTRAINT authz_user_role_pkey,
+  ADD PRIMARY KEY (user_type, user_id, role_id, source, tenant_id);
+-- MySQL
+ALTER TABLE authz_user_role DROP PRIMARY KEY,
+  ADD PRIMARY KEY (user_type, user_id, role_id, source, tenant_id);
+-- SQLite: recreate the table with the 5-column key (SQLite cannot alter a primary key).
+```
+
+## Tenancy
+
+The RBAC module reads the tenant only when tenancy is on: turn it on with
+`ContextModule.forRoot({ tenancy: { enabled: true } })` in `@dudousxd/nestjs-context`. Checks
+are then scoped to the request's tenant from `Context.setTenant(...)`.
+A request with no tenant, or inside `Context.allTenants()`, sees global assignments only.
+
+```ts
+AuthzRbacModule.forRoot({
+  store,
+  tenancy: {
+    kinds: ['organization'],                  // optional: tenant kinds this module honours
+    roles: { owner: 'org_admin', member: 'org_member' }, // optional: tenant.role → authz roles in that tenant
+  },
+  tenant: (user) => (user as { orgId?: string }).orgId, // optional: an explicit tenant wins over the context
+});
+```
+
+`tenancy` defaults to `'inherit'` (follow the context switch); `false` keeps this module out.
+Roles mapped with `roles` apply only inside that tenant and only to the context's current user.
+The `tenant` resolver returns a tenant id, `null` for the global scope, or `undefined` to fall
+back to the context.
+
+With tenancy on and the default entities, every assignment is global, so only `roles` and the
+`tenant` resolver change what a check sees.
 
 ## License
 

package/dist/authz-rbac.module.d.ts

@@ -1,6 +1,7 @@
 import type { UserRef } from '@dudousxd/nestjs-authz/store-kit';
 import { type DynamicModule } from '@nestjs/common';
 import type { MikroOrmAuthzStore } from './mikro-orm-authz.store.js';
+import { type AuthzTenancyOption, type TenantResolver } from './tenancy.js';
 /** Injection token holding the {@link MikroOrmAuthzStore} the RBAC module manages. */
 export declare const AUTHZ_RBAC_STORE: unique symbol;
 /** Injection token holding the resolved {@link AuthzRbacModuleOptions}. */
@@ -23,6 +24,17 @@ export interface AuthzRbacModuleOptions {
      * {@link defaultUserRefMapper} (`{ type, id }` or `{ id }`).
      */
     userRefFrom?: UserRefMapper;
+    /**
+     * Tenancy, from `@dudousxd/nestjs-context`. `'inherit'` (default) follows `ContextModule`'s
+     * `tenancy.enabled`; with it on, checks are scoped to the context tenant. The object form adds
+     * `kinds` and `roles` (map the caller's `tenant.role` to authz roles in that tenant).
+     */
+    tenancy?: AuthzTenancyOption;
+    /**
+     * Explicit tenant for a check, from the user being checked. Wins over the context: return a
+     * tenant id, `null` for the global scope, or `undefined` to fall back to the context.
+     */
+    tenant?: TenantResolver;
 }
 export interface AuthzRbacModuleAsyncOptions {
     imports?: unknown[];

package/dist/authz-rbac.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authz-rbac.module.d.ts","sourceRoot":"","sources":["../src/authz-rbac.module.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EACL,KAAK,aAAa,EAQnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAErE,sFAAsF;AACtF,eAAO,MAAM,gBAAgB,eAAuD,CAAC;AACrF,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,eAAyD,CAAC;AAEzF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,GAAG,SAAS,CAAC;AAEnE,MAAM,WAAW,sBAAsB;IACrC,2EAA2E;IAC3E,KAAK,EAAE,kBAAkB,CAAC;IAC1B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,WAAW,CAAC,EAAE,aAAa,CAAC;CAC7B;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,UAAU,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,sBAAsB,CAAC,GAAG,sBAAsB,CAAC;CAC9F;AAED,qFAAqF;AACrF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAOvE;AAoED;;;;;;GAMG;AACH,qBACa,eAAe;IAC1B,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa;IAa9D,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,2BAA2B,GAAG,aAAa;IAsBxE,OAAO,CAAC,MAAM,CAAC,eAAe;CAS/B"}
+{"version":3,"file":"authz-rbac.module.d.ts","sourceRoot":"","sources":["../src/authz-rbac.module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EACL,KAAK,aAAa,EAQnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EACL,KAAK,kBAAkB,EAIvB,KAAK,cAAc,EAEpB,MAAM,cAAc,CAAC;AAEtB,sFAAsF;AACtF,eAAO,MAAM,gBAAgB,eAAuD,CAAC;AACrF,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,eAAyD,CAAC;AAEzF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,GAAG,SAAS,CAAC;AAEnE,MAAM,WAAW,sBAAsB;IACrC,2EAA2E;IAC3E,KAAK,EAAE,kBAAkB,CAAC;IAC1B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,WAAW,CAAC,EAAE,aAAa,CAAC;IAC5B;;;;OAIG;IACH,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B;;;OAGG;IACH,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,UAAU,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,sBAAsB,CAAC,GAAG,sBAAsB,CAAC;CAC9F;AAED,qFAAqF;AACrF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAOvE;AAqHD;;;;;;GAMG;AACH,qBACa,eAAe;IAC1B,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa;IAa9D,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,2BAA2B,GAAG,aAAa;IAsBxE,OAAO,CAAC,MAAM,CAAC,eAAe;CAS/B"}

package/dist/authz-rbac.module.js

@@ -11,8 +11,10 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 var AuthzRbacModule_1;
-import { PERMISSION_PROVIDER, ROLE_PROVIDER, } from '@dudousxd/nestjs-authz';
+import { CONTEXT_ACCESSOR, PERMISSION_PROVIDER, ROLE_PROVIDER, } from '@dudousxd/nestjs-authz';
 import { Inject, Injectable, Module, Optional, } from '@nestjs/common';
+import { ModuleRef } from '@nestjs/core';
+import { rbacTenant, } from './tenancy.js';
 /** Injection token holding the {@link MikroOrmAuthzStore} the RBAC module manages. */
 export const AUTHZ_RBAC_STORE = Symbol.for('@dudousxd/nestjs-authz-mikro-orm:store');
 /** Injection token holding the resolved {@link AuthzRbacModuleOptions}. */
@@ -36,10 +38,24 @@ export function defaultUserRefMapper(user) {
  */
 let RbacPermissionProvider = class RbacPermissionProvider {
     options;
+    context;
+    moduleRef;
     // `getPermissions` lists every grant `hasPermission` can find, for any resource.
     exhaustivePermissions = true;
-    constructor(options) {
+    contextCache = { resolved: false, value: undefined };
+    constructor(options, context, moduleRef) {
         this.options = options;
+        this.context = context;
+        this.moduleRef = moduleRef;
+    }
+    tenant(user, ref) {
+        return rbacTenant(this.options, user, ref, this.context, this.moduleRef, this.contextCache, false);
+    }
+    /** The permissions `tenancy.roles` grants through the caller's role in the tenant. */
+    async tenantRolePermissions(roles) {
+        if (roles.length === 0)
+            return [];
+        return Object.values(await this.options.store.getRolePermissions(roles)).flat();
     }
     // The core `PermissionProvider` interface passes an optional `resource` (3rd
     // arg); it is intentionally ignored here. RBAC grants are model-less,
@@ -50,7 +66,10 @@ let RbacPermissionProvider = class RbacPermissionProvider {
         const ref = map(user);
         if (ref === undefined)
             return undefined;
-        return this.options.store.userHasPermission(ref, permission);
+        const tenant = this.tenant(user, ref);
+        if (await this.options.store.userHasPermission(ref, permission, tenant.scope))
+            return true;
+        return (await this.tenantRolePermissions(tenant.roles)).includes(permission);
     }
     // Expose the user's full granted permission set so the core can apply
     // Laravel/spatie-style wildcard matching (a granted `posts.*` satisfies a check
@@ -60,13 +79,20 @@ let RbacPermissionProvider = class RbacPermissionProvider {
         const ref = map(user);
         if (ref === undefined)
             return undefined;
-        return this.options.store.getPermissionsForUser(ref);
+        const tenant = this.tenant(user, ref);
+        const own = await this.options.store.getPermissionsForUser(ref, tenant.scope);
+        if (tenant.roles.length === 0)
+            return own;
+        return [...new Set([...own, ...(await this.tenantRolePermissions(tenant.roles))])];
     }
 };
 RbacPermissionProvider = __decorate([
     Injectable(),
     __param(0, Inject(AUTHZ_RBAC_OPTIONS)),
-    __metadata("design:paramtypes", [Object])
+    __param(1, Optional()),
+    __param(1, Inject(CONTEXT_ACCESSOR)),
+    __param(2, Optional()),
+    __metadata("design:paramtypes", [Object, Object, ModuleRef])
 ], RbacPermissionProvider);
 /**
  * The RBAC {@link RoleProvider} the Gate consults (via the shared {@link ROLE_PROVIDER}
@@ -76,21 +102,34 @@ RbacPermissionProvider = __decorate([
  */
 let RbacRoleProvider = class RbacRoleProvider {
     options;
-    constructor(options) {
+    context;
+    moduleRef;
+    contextCache = { resolved: false, value: undefined };
+    constructor(options, context, moduleRef) {
         this.options = options;
+        this.context = context;
+        this.moduleRef = moduleRef;
+    }
+    tenant(user, ref) {
+        return rbacTenant(this.options, user, ref, this.context, this.moduleRef, this.contextCache, false);
     }
     async getRoles(user) {
         const map = this.options.userRefFrom ?? defaultUserRefMapper;
         const ref = map(user);
         if (ref === undefined)
             return undefined;
-        return this.options.store.getRolesForUser(ref);
+        const tenant = this.tenant(user, ref);
+        const own = await this.options.store.getRolesForUser(ref, tenant.scope);
+        return tenant.roles.length === 0 ? own : [...new Set([...own, ...tenant.roles])];
     }
 };
 RbacRoleProvider = __decorate([
     Injectable(),
     __param(0, Inject(AUTHZ_RBAC_OPTIONS)),
-    __metadata("design:paramtypes", [Object])
+    __param(1, Optional()),
+    __param(1, Inject(CONTEXT_ACCESSOR)),
+    __param(2, Optional()),
+    __metadata("design:paramtypes", [Object, Object, ModuleRef])
 ], RbacRoleProvider);
 /** Runs `ensureAuthzSchema` on bootstrap when `autoCreateSchema` is not disabled. */
 let AuthzRbacBootstrap = class AuthzRbacBootstrap {

package/dist/authz-rbac.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"authz-rbac.module.js","sourceRoot":"","sources":["../src/authz-rbac.module.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EACL,mBAAmB,EAEnB,aAAa,GAEd,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAEL,MAAM,EACN,UAAU,EACV,MAAM,EAEN,QAAQ,GAGT,MAAM,gBAAgB,CAAC;AAGxB,sFAAsF;AACtF,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;AACrF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;AA6BzF,qFAAqF;AACrF,MAAM,UAAU,oBAAoB,CAAC,IAAa;IAChD,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACtE,MAAM,CAAC,GAAG,IAAwC,CAAC;IACnD,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAqB,CAAC;IACnC,OAAO,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,IACM,sBAAsB,GAD5B,MACM,sBAAsB;IAI+B;IAHzD,iFAAiF;IACxE,qBAAqB,GAAG,IAAI,CAAC;IAEtC,YAAyD,OAA+B;QAA/B,YAAO,GAAP,OAAO,CAAwB;IAAG,CAAC;IAE5F,6EAA6E;IAC7E,sEAAsE;IACtE,yEAAyE;IACzE,yDAAyD;IACzD,KAAK,CAAC,aAAa,CAAC,IAAa,EAAE,UAAkB;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC/D,CAAC;IAED,sEAAsE;IACtE,gFAAgF;IAChF,6EAA6E;IAC7E,KAAK,CAAC,cAAc,CAAC,IAAa;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;CACF,CAAA;AA1BK,sBAAsB;IAD3B,UAAU,EAAE;IAKE,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;;GAJnC,sBAAsB,CA0B3B;AAED;;;;;GAKG;AACH,IACM,gBAAgB,GADtB,MACM,gBAAgB;IACqC;IAAzD,YAAyD,OAA+B;QAA/B,YAAO,GAAP,OAAO,CAAwB;IAAG,CAAC;IAE5F,KAAK,CAAC,QAAQ,CAAC,IAAa;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC;CACF,CAAA;AATK,gBAAgB;IADrB,UAAU,EAAE;IAEE,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;;GADnC,gBAAgB,CASrB;AAED,qFAAqF;AACrF,IACM,kBAAkB,GADxB,MACM,kBAAkB;IAEqC;IAD3D,YAC2D,OAAgC;QAAhC,YAAO,GAAP,OAAO,CAAyB;IACxF,CAAC;IAEJ,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,KAAK,KAAK;YAAE,OAAO;QACpD,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;IAC1C,CAAC;CACF,CAAA;AAVK,kBAAkB;IADvB,UAAU,EAAE;IAGR,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;;GAFrC,kBAAkB,CAUvB;AAED;;;;;;GAMG;AAEI,IAAM,eAAe,uBAArB,MAAM,eAAe;IAC1B,MAAM,CAAC,OAAO,CAAC,OAA+B;QAC5C,OAAO;YACL,MAAM,EAAE,iBAAe;YACvB,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE;gBACT,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE;gBAClD,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE;gBACtD,GAAG,iBAAe,CAAC,eAAe,EAAE;aACrC;YACD,OAAO,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,OAAoC;QACtD,OAAO;YACL,MAAM,EAAE,iBAAe;YACvB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAoB;YACnD,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,kBAAkB;oBAC3B,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAyB;iBACvD;gBACD;oBACE,OAAO,EAAE,gBAAgB;oBACzB,UAAU,EAAE,CAAC,IAA4B,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK;oBACxD,MAAM,EAAE,CAAC,kBAAkB,CAAC;iBAC7B;gBACD,GAAG,iBAAe,CAAC,eAAe,EAAE;aACrC;YACD,OAAO,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,CAAC;SAChE,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,eAAe;QAC5B,OAAO;YACL,sBAAsB;YACtB,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,sBAAsB,EAAE;YACrE,gBAAgB;YAChB,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,gBAAgB,EAAE;YACzD,kBAAkB;SACnB,CAAC;IACJ,CAAC;CACF,CAAA;AA7CY,eAAe;IAD3B,MAAM,CAAC,EAAE,CAAC;GACE,eAAe,CA6C3B"}
+{"version":3,"file":"authz-rbac.module.js","sourceRoot":"","sources":["../src/authz-rbac.module.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EAEnB,aAAa,GAEd,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAEL,MAAM,EACN,UAAU,EACV,MAAM,EAEN,QAAQ,GAGT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAML,UAAU,GACX,MAAM,cAAc,CAAC;AAEtB,sFAAsF;AACtF,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;AACrF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;AAwCzF,qFAAqF;AACrF,MAAM,UAAU,oBAAoB,CAAC,IAAa;IAChD,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACtE,MAAM,CAAC,GAAG,IAAwC,CAAC;IACnD,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAqB,CAAC;IACnC,OAAO,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,IACM,sBAAsB,GAD5B,MACM,sBAAsB;IAOqB;IACU;IAC1B;IAR/B,iFAAiF;IACxE,qBAAqB,GAAG,IAAI,CAAC;IAErB,YAAY,GAAuB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAE1F,YAC+C,OAA+B,EACrB,OAA+B,EACzD,SAAqB;QAFL,YAAO,GAAP,OAAO,CAAwB;QACrB,YAAO,GAAP,OAAO,CAAwB;QACzD,cAAS,GAAT,SAAS,CAAY;IACjD,CAAC;IAEI,MAAM,CAAC,IAAa,EAAE,GAAY;QACxC,OAAO,UAAU,CACf,IAAI,CAAC,OAAO,EACZ,IAAI,EACJ,GAAG,EACH,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,YAAY,EACjB,KAAK,CACN,CAAC;IACJ,CAAC;IAED,sFAAsF;IAC9E,KAAK,CAAC,qBAAqB,CAAC,KAAe;QACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClF,CAAC;IAED,6EAA6E;IAC7E,sEAAsE;IACtE,yEAAyE;IACzE,yDAAyD;IACzD,KAAK,CAAC,aAAa,CAAC,IAAa,EAAE,UAAkB;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACtC,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3F,OAAO,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/E,CAAC;IAED,sEAAsE;IACtE,gFAAgF;IAChF,6EAA6E;IAC7E,KAAK,CAAC,cAAc,CAAC,IAAa;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9E,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QAC1C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;CACF,CAAA;AAvDK,sBAAsB;IAD3B,UAAU,EAAE;IAQR,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;IAC1B,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,gBAAgB,CAAC,CAAA;IACpC,WAAA,QAAQ,EAAE,CAAA;qDAA8B,SAAS;GAThD,sBAAsB,CAuD3B;AAED;;;;;GAKG;AACH,IACM,gBAAgB,GADtB,MACM,gBAAgB;IAI2B;IACU;IAC1B;IALd,YAAY,GAAuB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAE1F,YAC+C,OAA+B,EACrB,OAA+B,EACzD,SAAqB;QAFL,YAAO,GAAP,OAAO,CAAwB;QACrB,YAAO,GAAP,OAAO,CAAwB;QACzD,cAAS,GAAT,SAAS,CAAY;IACjD,CAAC;IAEI,MAAM,CAAC,IAAa,EAAE,GAAY;QACxC,OAAO,UAAU,CACf,IAAI,CAAC,OAAO,EACZ,IAAI,EACJ,GAAG,EACH,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,YAAY,EACjB,KAAK,CACN,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAa;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACxE,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;CACF,CAAA;AA7BK,gBAAgB;IADrB,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;IAC1B,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,gBAAgB,CAAC,CAAA;IACpC,WAAA,QAAQ,EAAE,CAAA;qDAA8B,SAAS;GANhD,gBAAgB,CA6BrB;AAED,qFAAqF;AACrF,IACM,kBAAkB,GADxB,MACM,kBAAkB;IAEqC;IAD3D,YAC2D,OAAgC;QAAhC,YAAO,GAAP,OAAO,CAAyB;IACxF,CAAC;IAEJ,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,KAAK,KAAK;YAAE,OAAO;QACpD,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;IAC1C,CAAC;CACF,CAAA;AAVK,kBAAkB;IADvB,UAAU,EAAE;IAGR,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;;GAFrC,kBAAkB,CAUvB;AAED;;;;;;GAMG;AAEI,IAAM,eAAe,uBAArB,MAAM,eAAe;IAC1B,MAAM,CAAC,OAAO,CAAC,OAA+B;QAC5C,OAAO;YACL,MAAM,EAAE,iBAAe;YACvB,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE;gBACT,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE;gBAClD,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE;gBACtD,GAAG,iBAAe,CAAC,eAAe,EAAE;aACrC;YACD,OAAO,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,OAAoC;QACtD,OAAO;YACL,MAAM,EAAE,iBAAe;YACvB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAoB;YACnD,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,kBAAkB;oBAC3B,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAyB;iBACvD;gBACD;oBACE,OAAO,EAAE,gBAAgB;oBACzB,UAAU,EAAE,CAAC,IAA4B,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK;oBACxD,MAAM,EAAE,CAAC,kBAAkB,CAAC;iBAC7B;gBACD,GAAG,iBAAe,CAAC,eAAe,EAAE;aACrC;YACD,OAAO,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,CAAC;SAChE,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,eAAe;QAC5B,OAAO;YACL,sBAAsB;YACtB,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,sBAAsB,EAAE;YACrE,gBAAgB;YAChB,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,gBAAgB,EAAE;YACzD,kBAAkB;SACnB,CAAC;IACJ,CAAC;CACF,CAAA;AA7CY,eAAe;IAD3B,MAAM,CAAC,EAAE,CAAC;GACE,eAAe,CA6C3B"}

package/dist/entities.d.ts

@@ -12,6 +12,8 @@ export declare const DEFAULT_TABLE_NAMES: {
     readonly rolePermission: "authz_role_permission";
     readonly userRole: "authz_user_role";
 };
+/** The tenant id of a GLOBAL role assignment (applies in every tenant). */
+export declare const GLOBAL_TENANT = "";
 /** Physical table names for the four authz tables. */
 export interface AuthzTableNames {
     roles: string;
@@ -82,6 +84,15 @@ export declare class UserRoleEntity {
      */
     source: string;
 }
+/** Options for {@link createAuthzEntitySchemas}. */
+export interface AuthzEntitySchemaOptions {
+    /**
+     * Add a `tenantId` column (default `''` = global) to the user-role pivot, in its primary key,
+     * so role assignments can be scoped to a tenant. Default `false`: the tables keep their shape
+     * and every assignment is global.
+     */
+    tenantScoped?: boolean;
+}
 /** The four {@link EntitySchema} definitions produced by {@link createAuthzEntitySchemas}. */
 export interface AuthzEntitySchemas {
     role: EntitySchema<RoleEntity>;
@@ -108,8 +119,11 @@ export interface AuthzEntitySchemas {
  * Going through the factory (rather than hand-writing `new EntitySchema({ tableName })`)
  * keeps the custom repository binding and the index names attached to the renamed tables;
  * a hand-rolled re-declaration silently drops both.
+ *
+ * `{ tenantScoped: true }` adds a `tenantId` column to the user-role pivot (in its primary key),
+ * so a role can be assigned per tenant. Pass `{}` as the names to keep the default table names.
  */
-export declare function createAuthzEntitySchemas(tableNames?: Partial<AuthzTableNames>): AuthzEntitySchemas;
+export declare function createAuthzEntitySchemas(tableNames?: Partial<AuthzTableNames>, options?: AuthzEntitySchemaOptions): AuthzEntitySchemas;
 export declare const RoleEntitySchema: EntitySchema<RoleEntity, never>;
 export declare const PermissionEntitySchema: EntitySchema<PermissionEntity, never>;
 export declare const RolePermissionEntitySchema: EntitySchema<RolePermissionEntity, never>;

package/dist/entities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entities.d.ts","sourceRoot":"","sources":["../src/entities.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,mBAAmB,CAAC;AAE3B;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB;;;;;CAKtB,CAAC;AAEX,sDAAsD;AACtD,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;GAGG;AACH,qBAAa,UAAU;IACb,CAAC,oBAAoB,CAAC,CAAC,EAAE,mBAAmB,CAAC;IACrD,EAAE,EAAG,MAAM,CAAC;IACZ,IAAI,EAAG,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAG,IAAI,CAAC;CAClB;AAED,oGAAoG;AACpG,qBAAa,gBAAgB;IACnB,CAAC,oBAAoB,CAAC,CAAC,EAAE,yBAAyB,CAAC;IAC3D,EAAE,EAAG,MAAM,CAAC;IACZ,IAAI,EAAG,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAG,IAAI,CAAC;CAClB;AAED,uEAAuE;AACvE,qBAAa,oBAAoB;IACvB,CAAC,oBAAoB,CAAC,CAAC,EAAE,6BAA6B,CAAC;IAC/D,MAAM,EAAG,MAAM,CAAC;IAChB,YAAY,EAAG,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,qBAAa,cAAc;IACjB,CAAC,oBAAoB,CAAC,CAAC,EAAE,uBAAuB,CAAC;IACzD,QAAQ,EAAG,MAAM,CAAC;IAClB,MAAM,EAAG,MAAM,CAAC;IAChB,MAAM,EAAG,MAAM,CAAC;IAChB;;;OAGG;IACH,MAAM,EAAG,MAAM,CAAC;CACjB;AAED,8FAA8F;AAC9F,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;IAC/B,UAAU,EAAE,YAAY,CAAC,gBAAgB,CAAC,CAAC;IAC3C,cAAc,EAAE,YAAY,CAAC,oBAAoB,CAAC,CAAC;IACnD,QAAQ,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC;IACvC,qEAAqE;IACrE,GAAG,EAAE;QACH,YAAY,CAAC,UAAU,CAAC;QACxB,YAAY,CAAC,gBAAgB,CAAC;QAC9B,YAAY,CAAC,oBAAoB,CAAC;QAClC,YAAY,CAAC,cAAc,CAAC;KAC7B,CAAC;CACH;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,GAAE,OAAO,CAAC,eAAe,CAAM,GACxC,kBAAkB,CAwEpB;AAID,eAAO,MAAM,gBAAgB,iCAAsB,CAAC;AACpD,eAAO,MAAM,sBAAsB,uCAA4B,CAAC;AAChE,eAAO,MAAM,0BAA0B,2CAAgC,CAAC;AACxE,eAAO,MAAM,oBAAoB,qCAA0B,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,cAAc,0JAAqB,CAAC;AAEjD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,2GAKvB,CAAC"}
+{"version":3,"file":"entities.d.ts","sourceRoot":"","sources":["../src/entities.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,mBAAmB,EACnB,uBAAuB,EACxB,MAAM,mBAAmB,CAAC;AAE3B;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB;;;;;CAKtB,CAAC;AAEX,2EAA2E;AAC3E,eAAO,MAAM,aAAa,KAAK,CAAC;AAEhC,sDAAsD;AACtD,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;GAGG;AACH,qBAAa,UAAU;IACb,CAAC,oBAAoB,CAAC,CAAC,EAAE,mBAAmB,CAAC;IACrD,EAAE,EAAG,MAAM,CAAC;IACZ,IAAI,EAAG,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAG,IAAI,CAAC;CAClB;AAED,oGAAoG;AACpG,qBAAa,gBAAgB;IACnB,CAAC,oBAAoB,CAAC,CAAC,EAAE,yBAAyB,CAAC;IAC3D,EAAE,EAAG,MAAM,CAAC;IACZ,IAAI,EAAG,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAG,IAAI,CAAC;CAClB;AAED,uEAAuE;AACvE,qBAAa,oBAAoB;IACvB,CAAC,oBAAoB,CAAC,CAAC,EAAE,6BAA6B,CAAC;IAC/D,MAAM,EAAG,MAAM,CAAC;IAChB,YAAY,EAAG,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,qBAAa,cAAc;IACjB,CAAC,oBAAoB,CAAC,CAAC,EAAE,uBAAuB,CAAC;IACzD,QAAQ,EAAG,MAAM,CAAC;IAClB,MAAM,EAAG,MAAM,CAAC;IAChB,MAAM,EAAG,MAAM,CAAC;IAChB;;;OAGG;IACH,MAAM,EAAG,MAAM,CAAC;CACjB;AAED,oDAAoD;AACpD,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,8FAA8F;AAC9F,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC;IAC/B,UAAU,EAAE,YAAY,CAAC,gBAAgB,CAAC,CAAC;IAC3C,cAAc,EAAE,YAAY,CAAC,oBAAoB,CAAC,CAAC;IACnD,QAAQ,EAAE,YAAY,CAAC,cAAc,CAAC,CAAC;IACvC,qEAAqE;IACrE,GAAG,EAAE;QACH,YAAY,CAAC,UAAU,CAAC;QACxB,YAAY,CAAC,gBAAgB,CAAC;QAC9B,YAAY,CAAC,oBAAoB,CAAC;QAClC,YAAY,CAAC,cAAc,CAAC;KAC7B,CAAC;CACH;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,GAAE,OAAO,CAAC,eAAe,CAAM,EACzC,OAAO,GAAE,wBAA6B,GACrC,kBAAkB,CAgFpB;AAID,eAAO,MAAM,gBAAgB,iCAAsB,CAAC;AACpD,eAAO,MAAM,sBAAsB,uCAA4B,CAAC;AAChE,eAAO,MAAM,0BAA0B,2CAAgC,CAAC;AACxE,eAAO,MAAM,oBAAoB,qCAA0B,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,cAAc,0JAAqB,CAAC;AAEjD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,2GAKvB,CAAC"}

package/dist/entities.js

@@ -13,6 +13,8 @@ export const DEFAULT_TABLE_NAMES = {
     rolePermission: 'authz_role_permission',
     userRole: 'authz_user_role',
 };
+/** The tenant id of a GLOBAL role assignment (applies in every tenant). */
+export const GLOBAL_TENANT = '';
 /**
  * The entities are described with {@link EntitySchema} (the schema-first definition style)
  * rather than property decorators. This is the ONE definition surface that lives entirely
@@ -84,8 +86,11 @@ export class UserRoleEntity {
  * Going through the factory (rather than hand-writing `new EntitySchema({ tableName })`)
  * keeps the custom repository binding and the index names attached to the renamed tables;
  * a hand-rolled re-declaration silently drops both.
+ *
+ * `{ tenantScoped: true }` adds a `tenantId` column to the user-role pivot (in its primary key),
+ * so a role can be assigned per tenant. Pass `{}` as the names to keep the default table names.
  */
-export function createAuthzEntitySchemas(tableNames = {}) {
+export function createAuthzEntitySchemas(tableNames = {}, options = {}) {
     const names = { ...DEFAULT_TABLE_NAMES, ...tableNames };
     const role = new EntitySchema({
         class: RoleEntity,
@@ -145,6 +150,14 @@ export function createAuthzEntitySchemas(tableNames = {}) {
         },
         indexes: [{ name: `${names.userRole}_user_idx`, properties: ['userType', 'userId'] }],
     });
+    if (options.tenantScoped) {
+        // `tenantId` is not a field of the class (the default schemas don't map it), hence the cast.
+        userRole.addProperty('tenantId', 'string', {
+            length: 191,
+            primary: true,
+            default: GLOBAL_TENANT,
+        });
+    }
     return {
         role,
         permission,

package/dist/entities.js.map

@@ -1 +1 @@
-{"version":3,"file":"entities.js","sourceRoot":"","sources":["../src/entities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAwB,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAE3B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,KAAK,EAAE,aAAa;IACpB,WAAW,EAAE,mBAAmB;IAChC,cAAc,EAAE,uBAAuB;IACvC,QAAQ,EAAE,iBAAiB;CACnB,CAAC;AAUX;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;GAGG;AACH,MAAM,OAAO,UAAU;IAErB,EAAE,CAAU;IACZ,IAAI,CAAU;IACd,KAAK,CAAiB;IACtB,SAAS,CAAQ;CAClB;AAED,oGAAoG;AACpG,MAAM,OAAO,gBAAgB;IAE3B,EAAE,CAAU;IACZ,IAAI,CAAU;IACd,KAAK,CAAiB;IACtB,SAAS,CAAQ;CAClB;AAED,uEAAuE;AACvE,MAAM,OAAO,oBAAoB;IAE/B,MAAM,CAAU;IAChB,YAAY,CAAU;CACvB;AAED;;;;GAIG;AACH,MAAM,OAAO,cAAc;IAEzB,QAAQ,CAAU;IAClB,MAAM,CAAU;IAChB,MAAM,CAAU;IAChB;;;OAGG;IACH,MAAM,CAAU;CACjB;AAiBD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CACtC,aAAuC,EAAE;IAEzC,MAAM,KAAK,GAAoB,EAAE,GAAG,mBAAmB,EAAE,GAAG,UAAU,EAAE,CAAC;IAEzE,MAAM,IAAI,GAAG,IAAI,YAAY,CAAa;QACxC,KAAK,EAAE,UAAU;QACjB,SAAS,EAAE,KAAK,CAAC,KAAK;QACtB,UAAU,EAAE,GAAG,EAAE,CAAC,mBAAmB;QACrC,UAAU,EAAE;YACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;YAClD,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,GAAG;gBACX,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,YAAY;aAClC;YACD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YACzC,SAAS,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;SAChC;KACF,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAI,YAAY,CAAmB;QACpD,KAAK,EAAE,gBAAgB;QACvB,SAAS,EAAE,KAAK,CAAC,WAAW;QAC5B,UAAU,EAAE,GAAG,EAAE,CAAC,yBAAyB;QAC3C,UAAU,EAAE;YACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;YAClD,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,GAAG;gBACX,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,GAAG,KAAK,CAAC,WAAW,YAAY;aACxC;YACD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YACzC,SAAS,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;SAChC;KACF,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,IAAI,YAAY,CAAuB;QAC5D,KAAK,EAAE,oBAAoB;QAC3B,SAAS,EAAE,KAAK,CAAC,cAAc;QAC/B,UAAU,EAAE,GAAG,EAAE,CAAC,6BAA6B;QAC/C,UAAU,EAAE;YACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;YACtD,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;SAC7D;KACF,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,YAAY,CAAiB;QAChD,KAAK,EAAE,cAAc;QACrB,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,UAAU,EAAE,GAAG,EAAE,CAAC,uBAAuB;QACzC,UAAU,EAAE;YACV,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;YACxD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;YACtD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;YACtD,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,EAAE;gBACV,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,mBAAmB;aAC7B;SACF;QACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,QAAQ,WAAW,EAAE,UAAU,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;KACtF,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,UAAU;QACV,cAAc;QACd,QAAQ;QACR,GAAG,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,MAAM,cAAc,GAAG,wBAAwB,EAAE,CAAC;AAElD,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC,IAAI,CAAC;AACpD,MAAM,CAAC,MAAM,sBAAsB,GAAG,cAAc,CAAC,UAAU,CAAC;AAChE,MAAM,CAAC,MAAM,0BAA0B,GAAG,cAAc,CAAC,cAAc,CAAC;AACxE,MAAM,CAAC,MAAM,oBAAoB,GAAG,cAAc,CAAC,QAAQ,CAAC;AAE5D;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,cAAc,CAAC,GAAG,CAAC;AAEjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,UAAU;IACV,gBAAgB;IAChB,oBAAoB;IACpB,cAAc;CACN,CAAC"}
+{"version":3,"file":"entities.js","sourceRoot":"","sources":["../src/entities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAwB,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAE3B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,KAAK,EAAE,aAAa;IACpB,WAAW,EAAE,mBAAmB;IAChC,cAAc,EAAE,uBAAuB;IACvC,QAAQ,EAAE,iBAAiB;CACnB,CAAC;AAEX,2EAA2E;AAC3E,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAUhC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;GAGG;AACH,MAAM,OAAO,UAAU;IAErB,EAAE,CAAU;IACZ,IAAI,CAAU;IACd,KAAK,CAAiB;IACtB,SAAS,CAAQ;CAClB;AAED,oGAAoG;AACpG,MAAM,OAAO,gBAAgB;IAE3B,EAAE,CAAU;IACZ,IAAI,CAAU;IACd,KAAK,CAAiB;IACtB,SAAS,CAAQ;CAClB;AAED,uEAAuE;AACvE,MAAM,OAAO,oBAAoB;IAE/B,MAAM,CAAU;IAChB,YAAY,CAAU;CACvB;AAED;;;;GAIG;AACH,MAAM,OAAO,cAAc;IAEzB,QAAQ,CAAU;IAClB,MAAM,CAAU;IAChB,MAAM,CAAU;IAChB;;;OAGG;IACH,MAAM,CAAU;CACjB;AA2BD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,wBAAwB,CACtC,aAAuC,EAAE,EACzC,UAAoC,EAAE;IAEtC,MAAM,KAAK,GAAoB,EAAE,GAAG,mBAAmB,EAAE,GAAG,UAAU,EAAE,CAAC;IAEzE,MAAM,IAAI,GAAG,IAAI,YAAY,CAAa;QACxC,KAAK,EAAE,UAAU;QACjB,SAAS,EAAE,KAAK,CAAC,KAAK;QACtB,UAAU,EAAE,GAAG,EAAE,CAAC,mBAAmB;QACrC,UAAU,EAAE;YACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;YAClD,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,GAAG;gBACX,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,YAAY;aAClC;YACD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YACzC,SAAS,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;SAChC;KACF,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAI,YAAY,CAAmB;QACpD,KAAK,EAAE,gBAAgB;QACvB,SAAS,EAAE,KAAK,CAAC,WAAW;QAC5B,UAAU,EAAE,GAAG,EAAE,CAAC,yBAAyB;QAC3C,UAAU,EAAE;YACV,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;YAClD,IAAI,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,GAAG;gBACX,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,GAAG,KAAK,CAAC,WAAW,YAAY;aACxC;YACD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YACzC,SAAS,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;SAChC;KACF,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,IAAI,YAAY,CAAuB;QAC5D,KAAK,EAAE,oBAAoB;QAC3B,SAAS,EAAE,KAAK,CAAC,cAAc;QAC/B,UAAU,EAAE,GAAG,EAAE,CAAC,6BAA6B;QAC/C,UAAU,EAAE;YACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;YACtD,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;SAC7D;KACF,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,YAAY,CAAiB;QAChD,KAAK,EAAE,cAAc;QACrB,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,UAAU,EAAE,GAAG,EAAE,CAAC,uBAAuB;QACzC,UAAU,EAAE;YACV,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;YACxD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;YACtD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;YACtD,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,EAAE;gBACV,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,mBAAmB;aAC7B;SACF;QACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,QAAQ,WAAW,EAAE,UAAU,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;KACtF,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,6FAA6F;QAC7F,QAAQ,CAAC,WAAW,CAAC,UAA2C,EAAE,QAAQ,EAAE;YAC1E,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,aAAa;SACvB,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,IAAI;QACJ,UAAU;QACV,cAAc;QACd,QAAQ;QACR,GAAG,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,QAAQ,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,MAAM,cAAc,GAAG,wBAAwB,EAAE,CAAC;AAElD,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC,IAAI,CAAC;AACpD,MAAM,CAAC,MAAM,sBAAsB,GAAG,cAAc,CAAC,UAAU,CAAC;AAChE,MAAM,CAAC,MAAM,0BAA0B,GAAG,cAAc,CAAC,cAAc,CAAC;AACxE,MAAM,CAAC,MAAM,oBAAoB,GAAG,cAAc,CAAC,QAAQ,CAAC;AAE5D;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,cAAc,CAAC,GAAG,CAAC;AAEjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,UAAU;IACV,gBAAgB;IAChB,oBAAoB;IACpB,cAAc;CACN,CAAC"}

package/dist/index.d.ts

@@ -1,12 +1,13 @@
-export { AUTHZ_ENTITIES, AUTHZ_ENTITY_CLASSES, createAuthzEntitySchemas, DEFAULT_TABLE_NAMES, PermissionEntity, PermissionEntitySchema, RoleEntity, RoleEntitySchema, RolePermissionEntity, RolePermissionEntitySchema, UserRoleEntity, UserRoleEntitySchema, } from './entities.js';
-export type { AuthzEntitySchemas, AuthzTableNames } from './entities.js';
+export { AUTHZ_ENTITIES, AUTHZ_ENTITY_CLASSES, createAuthzEntitySchemas, DEFAULT_TABLE_NAMES, GLOBAL_TENANT, PermissionEntity, PermissionEntitySchema, RoleEntity, RoleEntitySchema, RolePermissionEntity, RolePermissionEntitySchema, UserRoleEntity, UserRoleEntitySchema, } from './entities.js';
+export type { AuthzEntitySchemaOptions, AuthzEntitySchemas, AuthzTableNames, } from './entities.js';
 export { AuthzPermissionRepository, AuthzRolePermissionRepository, AuthzRoleRepository, AuthzUserRoleRepository, } from './repositories.js';
 export { authzSchemaSql, ensureAuthzSchema } from './schema.js';
 export { MikroOrmAuthzStore } from './mikro-orm-authz.store.js';
-export type { RoleAssignment, RoleAssignmentFilter, RoleSourceOptions, UserAuthz, UserRoleAssignment, } from './mikro-orm-authz.store.js';
+export type { RoleAssignment, RoleAssignmentFilter, RoleSourceOptions, TenantScope, UserAuthz, UserRoleAssignment, } from './mikro-orm-authz.store.js';
 export { AUTHZ_RBAC_OPTIONS, AUTHZ_RBAC_STORE, AuthzRbacModule, defaultUserRefMapper, } from './authz-rbac.module.js';
 export type { AuthzRbacModuleAsyncOptions, AuthzRbacModuleOptions, UserRefMapper, } from './authz-rbac.module.js';
 export type { AuthzStoreOptions } from './types.js';
+export type { AuthzTenancyOption, TenantResolver } from './tenancy.js';
 export type { UserRef, UserRefInput } from '@dudousxd/nestjs-authz/store-kit';
 export { applyScope, compileScope } from './scope.js';
 export type { ScopeResolver } from './scope.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,cAAc,EACd,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGzE,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,SAAS,EACT,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,2BAA2B,EAC3B,sBAAsB,EACtB,aAAa,GACd,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACtD,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,cAAc,EACd,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,wBAAwB,EACxB,kBAAkB,EAClB,eAAe,GAChB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,WAAW,EACX,SAAS,EACT,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,2BAA2B,EAC3B,sBAAsB,EACtB,aAAa,GACd,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACvE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACtD,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,4 +1,4 @@
-export { AUTHZ_ENTITIES, AUTHZ_ENTITY_CLASSES, createAuthzEntitySchemas, DEFAULT_TABLE_NAMES, PermissionEntity, PermissionEntitySchema, RoleEntity, RoleEntitySchema, RolePermissionEntity, RolePermissionEntitySchema, UserRoleEntity, UserRoleEntitySchema, } from './entities.js';
+export { AUTHZ_ENTITIES, AUTHZ_ENTITY_CLASSES, createAuthzEntitySchemas, DEFAULT_TABLE_NAMES, GLOBAL_TENANT, PermissionEntity, PermissionEntitySchema, RoleEntity, RoleEntitySchema, RolePermissionEntity, RolePermissionEntitySchema, UserRoleEntity, UserRoleEntitySchema, } from './entities.js';
 // VALUE exports on purpose: these classes are the DI tokens `MikroOrmModule.forFeature()`
 // registers, so `export type` would compile green and be `undefined` at runtime.
 export { AuthzPermissionRepository, AuthzRolePermissionRepository, AuthzRoleRepository, AuthzUserRoleRepository, } from './repositories.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,cAAc,EACd,oBAAoB,GACrB,MAAM,eAAe,CAAC;AAEvB,0FAA0F;AAC1F,iFAAiF;AACjF,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAQhE,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,cAAc,EACd,oBAAoB,GACrB,MAAM,eAAe,CAAC;AAMvB,0FAA0F;AAC1F,iFAAiF;AACjF,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAShE,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAShC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC"}

package/dist/mikro-orm-authz.store.d.ts

@@ -1,8 +1,21 @@
 import { type RoleAssignment, type RoleAssignmentFilter, type UserAuthz, type UserRef, type UserRoleAssignment } from '@dudousxd/nestjs-authz/store-kit';
 import type { EntityManager } from '@mikro-orm/core';
 export type { RoleAssignment, RoleAssignmentFilter, UserAuthz, UserRoleAssignment };
-/** Assignment source for role mutations (default `'manual'`) — see `setUserRoles`. */
-export interface RoleSourceOptions {
+/**
+ * Optional tenant scope for a query. Omitted → the GLOBAL scope (only global assignments; a
+ * tenant-scoped role never leaks into an unscoped check). With a `tenantId`, global assignments
+ * AND that tenant's apply. Needs entities built with `tenantScoped: true`; without that column
+ * every assignment is global.
+ */
+export interface TenantScope {
+    tenantId?: string;
+}
+/**
+ * Assignment source (default `'manual'`, see `setUserRoles`) and tenant for role mutations.
+ * `tenantId` scopes the assignment to one tenant; it needs entities built with
+ * `createAuthzEntitySchemas(names, { tenantScoped: true })`.
+ */
+export interface RoleSourceOptions extends TenantScope {
     source?: string;
 }
 /**
@@ -19,6 +32,14 @@ export declare class MikroOrmAuthzStore {
     constructor(em: EntityManager, _opts?: Record<string, never>);
     /** Create/upgrade the RBAC tables (non-destructive, delegates to {@link ensureAuthzSchema}). */
     ensureSchema(): Promise<void>;
+    /** True when the user-role entity maps `tenantId` (built with `tenantScoped: true`). */
+    private tenantScoped;
+    /** The `tenantId` value of a written assignment (`{}` without the column). */
+    private tenantValue;
+    /** Assignments visible in a scope: global ones, plus the tenant's own when one is given. */
+    private tenantWhere;
+    /** The public `tenantId` of a stored row: `null` for a global assignment. */
+    private static rowTenant;
     /**
      * Create the role if absent; returns its id. Idempotent and race-tolerant: it re-reads
      * by the unique `name` after a create so two concurrent creators converge on the same row.
@@ -53,12 +74,15 @@ export declare class MikroOrmAuthzStore {
     getRolePermissions(roleNames: readonly string[]): Promise<Record<string, string[]>>;
     /**
      * Assign a role to a user (creating the role by name if needed). Idempotent. `{ source }`
-     * (default `'manual'`) records where the assignment came from.
+     * (default `'manual'`) records where the assignment came from. `{ tenantId }` scopes it to that
+     * tenant; omitted, the assignment is global (applies in every tenant).
      */
     assignRole(user: UserRef, roleName: string, opts?: RoleSourceOptions): Promise<void>;
     /**
      * Remove a role from a user. No-op if the role or assignment is absent. With `{ source }` only
-     * that source's assignment goes; without it, the role is removed from every source.
+     * that source's assignment goes; without it, the role is removed from every source. With
+     * tenant-scoped entities, `{ tenantId }` removes the assignment in that tenant and omitting it
+     * removes the global one.
      */
     removeRole(user: UserRef, roleName: string, opts?: RoleSourceOptions): Promise<void>;
     /**
@@ -66,17 +90,23 @@ export declare class MikroOrmAuthzStore {
      * `roleNames` — e.g. an SSO/SCIM sync calls `setUserRoles(user, mappedRoles, { source: 'sso' })`
      * on every login. Other sources' assignments are untouched, so a role held both manually and via
      * SSO survives an SSO sync that drops it. Roles are created by name when missing. Transactional.
+     * With tenant-scoped entities it replaces the assignments of one tenant (`{ tenantId }`), or the
+     * global ones when omitted.
      */
     setUserRoles(user: UserRef, roleNames: readonly string[], opts?: RoleSourceOptions): Promise<void>;
-    /** Every role assignment of a user, one entry per `(role, source)`. */
-    getRoleAssignments(user: UserRef): Promise<RoleAssignment[]>;
+    /**
+     * Every role assignment of a user visible in a tenant scope (global ones always; the tenant's
+     * own with `{ tenantId }`), one entry per `(role, source, tenant)`.
+     */
+    getRoleAssignments(user: UserRef, scope?: TenantScope): Promise<RoleAssignment[]>;
     /**
      * Raw role-assignment rows for admin listings — e.g. who holds a role (`{ role: 'admin' }`) or
      * a user's assignments with their sources (`{ user }`). `role` accepts one name or a list;
      * `user` and `source` narrow further. Ordered by `(userType, userId, role, source)`.
      *
-     * This adapter has no tenant-scoped assignments — every row is global (`tenantId: null`). So
-     * `tenantId: undefined` or `null` lists everything, and a tenant id string matches nothing.
+     * `tenantId`: omitted = no tenant filter; `null` = global assignments only; a string = exactly
+     * that tenant's scoped assignments. Without tenant-scoped entities every row is global
+     * (`tenantId: null`), so a tenant id string matches nothing.
      */
     listRoleAssignments(filter?: RoleAssignmentFilter): Promise<UserRoleAssignment[]>;
     /**
@@ -84,8 +114,8 @@ export declare class MikroOrmAuthzStore {
      * Roles and permissions are kept. (This adapter has no direct user permissions.)
      */
     removeUser(user: UserRef): Promise<void>;
-    /** The role names a user holds. */
-    getRolesForUser(user: UserRef): Promise<string[]>;
+    /** The role names a user holds, in a tenant scope (see {@link TenantScope}). */
+    getRolesForUser(user: UserRef, scope?: TenantScope): Promise<string[]>;
     /**
      * The flattened, distinct permission names a user has via their roles.
      *
@@ -95,10 +125,10 @@ export declare class MikroOrmAuthzStore {
      * returned set is the FULL granted permission name set, deduped — callers (incl. the
      * wildcard matcher) rely on getting every granted name (e.g. a granted `posts.*`).
      */
-    getPermissionsForUser(user: UserRef): Promise<string[]>;
-    /** A user's roles + effective permissions in one shot. */
-    getUserAuthz(user: UserRef): Promise<UserAuthz>;
-    /** True when the user holds `permission` through any of their roles. */
-    userHasPermission(user: UserRef, permission: string): Promise<boolean>;
+    getPermissionsForUser(user: UserRef, scope?: TenantScope): Promise<string[]>;
+    /** A user's roles + effective permissions in one shot, in a tenant scope. */
+    getUserAuthz(user: UserRef, scope?: TenantScope): Promise<UserAuthz>;
+    /** True when the user holds `permission` through any of their roles, in a tenant scope. */
+    userHasPermission(user: UserRef, permission: string, scope?: TenantScope): Promise<boolean>;
 }
 //# sourceMappingURL=mikro-orm-authz.store.d.ts.map