@dudousxd/nestjs-authz-prisma 0.2.0 → 0.3.0

package/CHANGELOG.md

@@ -1,5 +1,63 @@
 # @dudousxd/nestjs-authz-prisma
 
+## 0.3.0
+
+### Minor Changes
+
+- [#9](https://github.com/DavideCarvalho/nestjs-authz/pull/9) [`07d01de`](https://github.com/DavideCarvalho/nestjs-authz/commit/07d01de286e7dfcae5fbeb10b7e8d48533214087) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Ecosystem improvements across the authz packages.
+
+  ### Permissions
+
+  - **Wildcard / hierarchical permissions.** Permission strings now support wildcard
+    and hierarchical matching (e.g. `posts:*` or `posts:read:*`), so a single granted
+    permission can authorize a family of related actions instead of enumerating each one.
+
+  ### Authorization decisions
+
+  - **Deny reason / message surfaced on `ForbiddenException`.** When a check fails, the
+    reason for the denial is propagated onto the thrown `ForbiddenException`, making it
+    possible to return a meaningful message to the caller and to debug authorization
+    failures.
+  - **Gate `after` hook.** The Gate now exposes an `after` hook that runs once a decision
+    has been made, enabling cross-cutting concerns such as auditing, logging, and metrics.
+
+  ### Batch authorization
+
+  - **`allowsMany`** for evaluating multiple permission checks in a single call.
+  - **Batch `/authz/can` endpoint** so clients can resolve many checks in one round trip.
+  - **`createCanBatch`** client helper that batches `can` calls transparently.
+
+  ### Performance
+
+  - **Request-scoped permission cache.** Permissions resolved during a request are cached
+    for the lifetime of that request, avoiding repeated lookups on the hot path.
+
+  ### RBAC adapters (TypeORM)
+
+  - **Direct user permissions** granted to a user independent of their roles.
+  - **Tenant-scoped roles** so the same role can be assigned per tenant in multi-tenant
+    deployments.
+
+  ### Query scoping / policy filter (ABAC)
+
+  - **ORM-neutral constraint AST.** Policies can produce a portable constraint
+    representation describing which rows a subject may access.
+  - **Per-ORM application.** The constraint AST is translated and applied for
+    **TypeORM**, **MikroORM**, and **Prisma**, giving ABAC-style query scoping that
+    filters data at the database layer regardless of the ORM in use.
+
+  ### Testing
+
+  - **New `@dudousxd/nestjs-authz-testing` package** with fakes and helpers for testing
+    authorization in consumer applications.
+  - **Postgres / MySQL testcontainers + contract tests** so the ORM stores are verified
+    against real database engines, and a shared contract suite keeps the adapters
+    behaviorally consistent.
+
+  ### Housekeeping
+
+  - **Packaging hygiene** across the published packages.
+
 ## 0.2.0
 
 ### Minor Changes

package/dist/index.d.ts

@@ -4,4 +4,6 @@ export type { UserAuthz } from './prisma-authz.store.js';
 export { AUTHZ_RBAC_OPTIONS, AUTHZ_RBAC_STORE, AuthzRbacModule, defaultUserRefMapper, } from './authz-rbac.module.js';
 export type { AuthzRbacModuleAsyncOptions, AuthzRbacModuleOptions, UserRefMapper, } from './authz-rbac.module.js';
 export type { UserRef, UserRefInput } from './types.js';
+export { applyScope, compileScope } from './scope.js';
+export type { PrismaWhere, ScopeResolver } from './scope.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,YAAY,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,2BAA2B,EAC3B,sBAAsB,EACtB,aAAa,GACd,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,YAAY,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,2BAA2B,EAC3B,sBAAsB,EACtB,aAAa,GACd,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACtD,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,4 +1,5 @@
 export { PRISMA_CLIENT, } from './prisma-client.js';
 export { PrismaAuthzStore } from './prisma-authz.store.js';
 export { AUTHZ_RBAC_OPTIONS, AUTHZ_RBAC_STORE, AuthzRbacModule, defaultUserRefMapper, } from './authz-rbac.module.js';
+export { applyScope, compileScope } from './scope.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,GAGd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,GAGd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC"}

package/dist/prisma-authz.store.d.ts

@@ -42,8 +42,28 @@ export declare class PrismaAuthzStore {
     removeRole(user: UserRef, roleName: string): Promise<void>;
     /** The role names a user holds. */
     getRolesForUser(user: UserRef): Promise<string[]>;
-    /** The flattened, distinct permission names a user has via their roles. */
+    /**
+     * The flattened, distinct permission names a user has via their roles.
+     *
+     * Contract: returns the FULL deduped set of granted permission NAMES — including
+     * wildcard grants such as `posts.*`. This is NOT an existence check; callers
+     * ({@link userHasPermission}, {@link getUserAuthz}) depend on the complete set.
+     *
+     * Fast path: when the injected client exposes `$queryRaw`, assemble the set in a
+     * SINGLE database round-trip via one JOIN (3 round-trips → 1). On ANY failure
+     * (missing `$queryRaw`, custom `@@map` table names, non-Postgres identifier
+     * quoting, etc.) it degrades to {@link getPermissionsViaDelegates}, so correctness
+     * is preserved everywhere and only the common (Postgres + documented schema) case
+     * gets the speedup.
+     */
     getPermissionsForUser(user: UserRef): Promise<string[]>;
+    /**
+     * The original three-query implementation (userRole → rolePermission → permission),
+     * returning the same deduped permission-name set as {@link getPermissionsForUser}.
+     * Used directly when `$queryRaw` is unavailable, and as the fallback when the raw
+     * fast path throws.
+     */
+    private getPermissionsViaDelegates;
     /** A user's roles + effective permissions in one shot. */
     getUserAuthz(user: UserRef): Promise<UserAuthz>;
     /** True when the user holds `permission` through any of their roles. */

package/dist/prisma-authz.store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prisma-authz.store.d.ts","sourceRoot":"","sources":["../src/prisma-authz.store.ts"],"names":[],"mappings":"AACA,OAAO,EAAiB,KAAK,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAe1C;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,qBACa,gBAAgB;IAGzB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,qBAAqB;IAGhD;;;;;OAKG;IACG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAMnC,+EAA+E;IACzE,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgB/C,qFAAqF;IAC/E,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAevC,UAAU;YAKV,gBAAgB;IAO9B,kFAAkF;IAC5E,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUnF,gFAAgF;IAC1E,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASvF,iFAAiF;IAC3E,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUhE,4EAA4E;IACtE,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAShE,mCAAmC;IAC7B,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAWvD,2EAA2E;IACrE,qBAAqB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAkB7D,0DAA0D;IACpD,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;IAQrD,wEAAwE;IAClE,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAI7E"}
+{"version":3,"file":"prisma-authz.store.d.ts","sourceRoot":"","sources":["../src/prisma-authz.store.ts"],"names":[],"mappings":"AACA,OAAO,EAAiB,KAAK,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAe1C;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,qBACa,gBAAgB;IAGzB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,qBAAqB;IAGhD;;;;;OAKG;IACG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAMnC,+EAA+E;IACzE,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgB/C,qFAAqF;IAC/E,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAevC,UAAU;YAKV,gBAAgB;IAO9B,kFAAkF;IAC5E,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUnF,gFAAgF;IAC1E,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASvF,iFAAiF;IAC3E,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUhE,4EAA4E;IACtE,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAShE,mCAAmC;IAC7B,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAWvD;;;;;;;;;;;;;OAaG;IACG,qBAAqB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA0B7D;;;;;OAKG;YACW,0BAA0B;IAiBxC,0DAA0D;IACpD,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;IAQrD,wEAAwE;IAClE,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAI7E"}

package/dist/prisma-authz.store.js

@@ -144,9 +144,51 @@ let PrismaAuthzStore = class PrismaAuthzStore {
         const roles = await this.client.role.findMany({ where: { id: { in: roleIds } } });
         return roles.map((r) => r.name);
     }
-    /** The flattened, distinct permission names a user has via their roles. */
+    /**
+     * The flattened, distinct permission names a user has via their roles.
+     *
+     * Contract: returns the FULL deduped set of granted permission NAMES — including
+     * wildcard grants such as `posts.*`. This is NOT an existence check; callers
+     * ({@link userHasPermission}, {@link getUserAuthz}) depend on the complete set.
+     *
+     * Fast path: when the injected client exposes `$queryRaw`, assemble the set in a
+     * SINGLE database round-trip via one JOIN (3 round-trips → 1). On ANY failure
+     * (missing `$queryRaw`, custom `@@map` table names, non-Postgres identifier
+     * quoting, etc.) it degrades to {@link getPermissionsViaDelegates}, so correctness
+     * is preserved everywhere and only the common (Postgres + documented schema) case
+     * gets the speedup.
+     */
     async getPermissionsForUser(user) {
         const { type, id } = normalizeUserRef(user);
+        const queryRaw = this.client.$queryRaw;
+        if (typeof queryRaw === 'function') {
+            try {
+                // Single JOIN across the three documented `@@map` tables. Identifiers are
+                // literal + double-quoted (Postgres); the user `${type}`/`${id}` VALUES go
+                // through the tagged template as BOUND params — never string-concatenated.
+                const rows = await queryRaw `
+          SELECT DISTINCT p."name" AS name
+          FROM "authz_permissions" p
+          JOIN "authz_role_permission" rp ON rp."permissionId" = p."id"
+          JOIN "authz_user_role" ur ON ur."roleId" = rp."roleId"
+          WHERE ur."userType" = ${type} AND ur."userId" = ${id}
+        `;
+                return [...new Set(rows.map((r) => r.name))];
+            }
+            catch {
+                // Raw path unsupported for this client/schema/dialect — fall back below.
+                return this.getPermissionsViaDelegates(type, id);
+            }
+        }
+        return this.getPermissionsViaDelegates(type, id);
+    }
+    /**
+     * The original three-query implementation (userRole → rolePermission → permission),
+     * returning the same deduped permission-name set as {@link getPermissionsForUser}.
+     * Used directly when `$queryRaw` is unavailable, and as the fallback when the raw
+     * fast path throws.
+     */
+    async getPermissionsViaDelegates(type, id) {
         const assignments = await this.client.userRole.findMany({
             where: { userType: type, userId: id },
         });

package/dist/prisma-authz.store.js.map

@@ -1 +1 @@
-{"version":3,"file":"prisma-authz.store.js","sourceRoot":"","sources":["../src/prisma-authz.store.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAA8B,MAAM,oBAAoB,CAAC;AAG/E,sFAAsF;AACtF,wFAAwF;AACxF,2FAA2F;AAC3F,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEpD,2EAA2E;AAC3E,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACvD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;AAC1D,CAAC;AAWD;;;;;;;GAOG;AAEI,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAGR;IAFnB,YAEmB,MAA6B;QAA7B,WAAM,GAAN,MAAM,CAAuB;IAC7C,CAAC;IAEJ;;;;;OAKG;IACH,KAAK,CAAC,YAAY;QAChB,6CAA6C;IAC/C,CAAC;IAED,2DAA2D;IAE3D,+EAA+E;IAC/E,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;gBACxC,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;aACrE,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,EAAY,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,IAAI,CAAC,CAAC;YACxE,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;gBAC9C,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;aACrE,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,EAAY,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,IAAI,CAAC,CAAC;YAC9E,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,IAAY;QACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAClE,OAAO,GAAG,EAAE,EAAwB,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACxE,OAAO,GAAG,EAAE,EAAwB,CAAC;IACvC,CAAC;IAED,4BAA4B;IAE5B,kFAAkF;IAClF,KAAK,CAAC,oBAAoB,CAAC,QAAgB,EAAE,cAAsB;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC;YAC1D,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;SAChC,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,OAAO;QACrB,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,wBAAwB,CAAC,QAAgB,EAAE,cAAsB;QACrE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY;YAAE,OAAO;QACrC,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,sBAAsB;IAEtB,iFAAiF;IACjF,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB;QAC9C,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YACpD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE;SAC9C,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,OAAO;QACrB,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB;QAC9C,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,kBAAkB;IAElB,mCAAmC;IACnC,KAAK,CAAC,eAAe,CAAC,IAAa;QACjC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;SACtC,CAAC,CAAC;QACH,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAClF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAc,CAAC,CAAC;IAC5C,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,qBAAqB,CAAC,IAAa;QACvC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;SACtC,CAAC,CAAC;QACH,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC;YACtD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE;SACnC,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAsB,CAAC,CAAC,CAAC,CAAC;QAC/E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;YACxD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE;SACrC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,YAAY,CAAC,IAAa;QAC9B,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAC1B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC;SACjC,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChC,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,iBAAiB,CAAC,IAAa,EAAE,UAAkB;QACvD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC3D,OAAO,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;CACF,CAAA;AAtJY,gBAAgB;IAD5B,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,aAAa,CAAC,CAAA;;GAFb,gBAAgB,CAsJ5B"}
+{"version":3,"file":"prisma-authz.store.js","sourceRoot":"","sources":["../src/prisma-authz.store.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAA8B,MAAM,oBAAoB,CAAC;AAG/E,sFAAsF;AACtF,wFAAwF;AACxF,2FAA2F;AAC3F,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEpD,2EAA2E;AAC3E,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACvD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;AAC1D,CAAC;AAWD;;;;;;;GAOG;AAEI,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAGR;IAFnB,YAEmB,MAA6B;QAA7B,WAAM,GAAN,MAAM,CAAuB;IAC7C,CAAC;IAEJ;;;;;OAKG;IACH,KAAK,CAAC,YAAY;QAChB,6CAA6C;IAC/C,CAAC;IAED,2DAA2D;IAE3D,+EAA+E;IAC/E,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;gBACxC,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;aACrE,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,EAAY,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,IAAI,CAAC,CAAC;YACxE,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;gBAC9C,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;aACrE,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,EAAY,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,IAAI,CAAC,CAAC;YAC9E,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,IAAY;QACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAClE,OAAO,GAAG,EAAE,EAAwB,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACxE,OAAO,GAAG,EAAE,EAAwB,CAAC;IACvC,CAAC;IAED,4BAA4B;IAE5B,kFAAkF;IAClF,KAAK,CAAC,oBAAoB,CAAC,QAAgB,EAAE,cAAsB;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC;YAC1D,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;SAChC,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,OAAO;QACrB,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,wBAAwB,CAAC,QAAgB,EAAE,cAAsB;QACrE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY;YAAE,OAAO;QACrC,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,sBAAsB;IAEtB,iFAAiF;IACjF,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB;QAC9C,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YACpD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE;SAC9C,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,OAAO;QACrB,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB;QAC9C,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,kBAAkB;IAElB,mCAAmC;IACnC,KAAK,CAAC,eAAe,CAAC,IAAa;QACjC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;SACtC,CAAC,CAAC;QACH,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAClF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAc,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,qBAAqB,CAAC,IAAa;QACvC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAE5C,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QACvC,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,0EAA0E;gBAC1E,2EAA2E;gBAC3E,2EAA2E;gBAC3E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAyB;;;;;kCAK1B,IAAI,sBAAsB,EAAE;SACrD,CAAC;gBACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,yEAAyE;gBACzE,OAAO,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,0BAA0B,CAAC,IAAY,EAAE,EAAU;QAC/D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;SACtC,CAAC,CAAC;QACH,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC;YACtD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE;SACnC,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAsB,CAAC,CAAC,CAAC,CAAC;QAC/E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;YACxD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE;SACrC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,YAAY,CAAC,IAAa;QAC9B,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAC1B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC;SACjC,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChC,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,iBAAiB,CAAC,IAAa,EAAE,UAAkB;QACvD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC3D,OAAO,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;CACF,CAAA;AAlMY,gBAAgB;IAD5B,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,aAAa,CAAC,CAAA;;GAFb,gBAAgB,CAkM5B"}

package/dist/prisma-client.d.ts

@@ -54,6 +54,30 @@
  *
  * Apply it with `prisma migrate` / `prisma db push` — this adapter is
  * consumer-managed and never runs DDL.
+ *
+ * ## Optional single-round-trip fast path (`$queryRaw`)
+ *
+ * `getPermissionsForUser` can assemble a user's granted-permission set in ONE
+ * database round-trip via a raw JOIN instead of the default three sequential
+ * delegate queries. To allow that, the interface exposes an OPTIONAL `$queryRaw`
+ * tagged-template method (see {@link PrismaAuthzClientLike.$queryRaw}).
+ *
+ * Why raw SQL and not a Prisma relation filter?
+ * - A relation filter (`permission.findMany({ where: { rolePermissions: { some } } })`)
+ *   would force every consumer to declare a full back-relation graph across all four
+ *   models in THEIR `schema.prisma`. That couples this adapter to the consumer's
+ *   schema shape and breaks the package's "minimal structural client, no relations
+ *   required" philosophy. REJECTED.
+ * - A `$queryRaw` JOIN needs NO relation fields in the consumer's schema — it works
+ *   off the existing tables/columns documented above. This preserves the decoupled,
+ *   relation-free design. CHOSEN.
+ *
+ * The trade-off: the raw SQL hard-codes the documented `@@map` table names plus the
+ * (camelCase, unquoted-in-schema → must be double-quoted) column names, so it is NOT
+ * portable to every SQL dialect or custom `@@map`. The store therefore treats the raw
+ * path as an OPTIONAL optimization and gracefully FALLS BACK to the three-query path
+ * on any failure — correctness is preserved everywhere; speed is gained on the common
+ * (Postgres + documented schema) case.
  */
 /**
  * Minimal structural view of a Prisma model delegate (the methods the store calls).
@@ -86,6 +110,20 @@ export interface PrismaAuthzClientLike {
     permission: PrismaModelDelegate;
     rolePermission: PrismaModelDelegate;
     userRole: PrismaModelDelegate;
+    /**
+     * OPTIONAL tagged-template raw query, matching the real `PrismaClient.$queryRaw`
+     * signature. A real `PrismaClient` always provides it (so there is NO extra burden
+     * on consumers injecting one). It is declared OPTIONAL so that purely structural
+     * clients / in-memory fakes that omit it — or setups where the raw path is unsafe
+     * (non-Postgres quoting, custom `@@map` table names) — remain assignable and simply
+     * fall back to the three-query delegate path. See the file-level doc for the full
+     * raw-vs-relation rationale.
+     *
+     * The `any` value type mirrors `PrismaModelDelegate` above: a narrower
+     * `unknown`/`Record` would make a real `PrismaClient` not structurally assignable
+     * (arg/return-position variance), which is exactly what this package avoids.
+     */
+    $queryRaw?<T = unknown>(query: TemplateStringsArray, ...values: any[]): Promise<T>;
 }
 /**
  * DI token for the app-provided Prisma client ({@link PrismaAuthzClientLike})

package/dist/prisma-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prisma-client.d.ts","sourceRoot":"","sources":["../src/prisma-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAElC,MAAM,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAE1C,SAAS,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAE9C,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAE/C,UAAU,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9D;AAED,gFAAgF;AAChF,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,UAAU,EAAE,mBAAmB,CAAC;IAChC,cAAc,EAAE,mBAAmB,CAAC;IACpC,QAAQ,EAAE,mBAAmB,CAAC;CAC/B;AAED;;;GAGG;AACH,eAAO,MAAM,aAAa,eAAqD,CAAC"}
+{"version":3,"file":"prisma-client.d.ts","sourceRoot":"","sources":["../src/prisma-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AAEH;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAElC,MAAM,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAE1C,SAAS,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAE9C,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAE/C,UAAU,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9D;AAED,gFAAgF;AAChF,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,UAAU,EAAE,mBAAmB,CAAC;IAChC,cAAc,EAAE,mBAAmB,CAAC;IACpC,QAAQ,EAAE,mBAAmB,CAAC;IAE9B;;;;;;;;;;;;OAYG;IAEH,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACpF;AAED;;;GAGG;AACH,eAAO,MAAM,aAAa,eAAqD,CAAC"}

package/dist/prisma-client.js

@@ -54,6 +54,30 @@
  *
  * Apply it with `prisma migrate` / `prisma db push` — this adapter is
  * consumer-managed and never runs DDL.
+ *
+ * ## Optional single-round-trip fast path (`$queryRaw`)
+ *
+ * `getPermissionsForUser` can assemble a user's granted-permission set in ONE
+ * database round-trip via a raw JOIN instead of the default three sequential
+ * delegate queries. To allow that, the interface exposes an OPTIONAL `$queryRaw`
+ * tagged-template method (see {@link PrismaAuthzClientLike.$queryRaw}).
+ *
+ * Why raw SQL and not a Prisma relation filter?
+ * - A relation filter (`permission.findMany({ where: { rolePermissions: { some } } })`)
+ *   would force every consumer to declare a full back-relation graph across all four
+ *   models in THEIR `schema.prisma`. That couples this adapter to the consumer's
+ *   schema shape and breaks the package's "minimal structural client, no relations
+ *   required" philosophy. REJECTED.
+ * - A `$queryRaw` JOIN needs NO relation fields in the consumer's schema — it works
+ *   off the existing tables/columns documented above. This preserves the decoupled,
+ *   relation-free design. CHOSEN.
+ *
+ * The trade-off: the raw SQL hard-codes the documented `@@map` table names plus the
+ * (camelCase, unquoted-in-schema → must be double-quoted) column names, so it is NOT
+ * portable to every SQL dialect or custom `@@map`. The store therefore treats the raw
+ * path as an OPTIONAL optimization and gracefully FALLS BACK to the three-query path
+ * on any failure — correctness is preserved everywhere; speed is gained on the common
+ * (Postgres + documented schema) case.
  */
 /**
  * DI token for the app-provided Prisma client ({@link PrismaAuthzClientLike})

package/dist/prisma-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"prisma-client.js","sourceRoot":"","sources":["../src/prisma-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AA8BH;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC"}
+{"version":3,"file":"prisma-client.js","sourceRoot":"","sources":["../src/prisma-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AA8CH;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC"}

package/dist/scope.d.ts

@@ -0,0 +1,54 @@
+import type { ScopeConstraint } from '@dudousxd/nestjs-authz';
+import type { Type } from '@nestjs/common';
+/**
+ * The minimal scope-resolving surface shared by `Gate` and `BoundGate`. Accepting
+ * this (rather than `Gate`) lets the scope helpers take either a Gate (current/context
+ * user) or a `gate.forUser(...)` BoundGate without a cast. Mirrors the TypeORM and
+ * MikroORM adapters' `ScopeResolver` so all ORMs feel identical.
+ */
+export interface ScopeResolver {
+    scope(entity: Type<unknown>, ability?: string): Promise<ScopeConstraint>;
+}
+/** A Prisma `where` object (structurally typed; the consumer's generated input is narrower). */
+export type PrismaWhere = Record<string, unknown>;
+/**
+ * Compile an ORM-neutral {@link ScopeConstraint} into a Prisma `where` object.
+ *
+ * Terminal/empty semantics (matching the core AST and the TypeORM/MikroORM adapters):
+ * - `allow-all` → `{}` (an empty where matches EVERY row);
+ * - `deny-all` → `{ OR: [] }` (an empty OR matches NO row);
+ * - empty `in` → no rows (`{ OR: [] }`); empty `nin` → all rows (`{}`);
+ * - empty `and` group → all rows; empty `or` group → no rows.
+ *
+ * Operator mapping:
+ * - `eq` → `{ field: { equals } }`; `ne` → `{ field: { not } }`;
+ * - `gt/gte/lt/lte` → `{ field: { gt/gte/lt/lte } }`;
+ * - `in/nin` → `{ field: { in/notIn: [...] } }` (a scalar value is wrapped to a single
+ *   element);
+ * - `isNull` → `{ field: { equals: null } }`; `isNotNull` → `{ field: { not: null } }`;
+ * - `and`/`or` → `{ AND: [...] }` / `{ OR: [...] }`.
+ *
+ * SAFE: only VALUES come from the (untrusted) policy result and Prisma binds them as
+ * parameters. Field names become object keys (a column/relation path), so each is
+ * validated against {@link assertSafeIdentifier} — a hostile field throws.
+ */
+export declare function compileScope(constraint: ScopeConstraint): PrismaWhere;
+/**
+ * Ergonomic entry point: resolve the query scope for the current (context) user via
+ * the {@link Gate} and return the Prisma `where` to pass to `model.findMany`.
+ * Equivalent to `compileScope(await gate.scope(entity, ability))`.
+ *
+ * Mirrors the TypeORM/MikroORM adapters' `applyScope` shape (gate + entity), but returns
+ * the `where` instead of mutating a query builder, because Prisma's idiomatic collection
+ * fetch is `prisma.post.findMany({ where })`:
+ *
+ * ```ts
+ * const where = await applyScope(gate, Post);          // current user's accessible posts
+ * const posts = await prisma.post.findMany({ where });
+ * ```
+ *
+ * Combine with extra criteria via Prisma's own `AND`:
+ * `prisma.post.findMany({ where: { AND: [where, { published: true }] } })`.
+ */
+export declare function applyScope(gate: ScopeResolver, entity: Type<unknown>, ability?: string): Promise<PrismaWhere>;
+//# sourceMappingURL=scope.d.ts.map

package/dist/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../src/scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,eAAe,EAGhB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC1E;AAED,gGAAgG;AAChG,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAmClD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,eAAe,GAAG,WAAW,CA+BrE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EACrB,OAAO,SAAY,GAClB,OAAO,CAAC,WAAW,CAAC,CAEtB"}

package/dist/scope.js

@@ -0,0 +1,108 @@
+/**
+ * SQL identifiers (column names) become object KEYS in the emitted `where`. Prisma binds
+ * VALUES as parameters, but a field name is interpreted as a column/relation path on the
+ * model, so a hostile name must never reach the query engine. We restrict field names to
+ * the same conservative allowlist the TypeORM adapter uses (letters/digits/underscore,
+ * not leading-digit) and reject anything else loudly.
+ */
+const SAFE_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function assertSafeIdentifier(value, what) {
+    if (!SAFE_IDENTIFIER.test(value)) {
+        throw new Error(`Unsafe ${what}: ${JSON.stringify(value)}. Identifiers must match /^[A-Za-z_][A-Za-z0-9_]*$/ (letters, digits, underscore; not starting with a digit). This blocks injection via configured names.`);
+    }
+}
+/**
+ * An always-false predicate as a Prisma `where`. Prisma treats an EMPTY `OR` array as
+ * "match nothing" (an OR over zero alternatives can never be satisfied), which is the
+ * documented, portable way to express a deny-all filter — parallel to the core AST's
+ * "empty OR is the zero" rule and the TypeORM adapter's `1 = 0`.
+ */
+const ALWAYS_FALSE = { OR: [] };
+/** Prisma filter-condition keys for the binary comparison operators. */
+const BINARY_OPS = {
+    gt: 'gt',
+    gte: 'gte',
+    lt: 'lt',
+    lte: 'lte',
+};
+/**
+ * Compile an ORM-neutral {@link ScopeConstraint} into a Prisma `where` object.
+ *
+ * Terminal/empty semantics (matching the core AST and the TypeORM/MikroORM adapters):
+ * - `allow-all` → `{}` (an empty where matches EVERY row);
+ * - `deny-all` → `{ OR: [] }` (an empty OR matches NO row);
+ * - empty `in` → no rows (`{ OR: [] }`); empty `nin` → all rows (`{}`);
+ * - empty `and` group → all rows; empty `or` group → no rows.
+ *
+ * Operator mapping:
+ * - `eq` → `{ field: { equals } }`; `ne` → `{ field: { not } }`;
+ * - `gt/gte/lt/lte` → `{ field: { gt/gte/lt/lte } }`;
+ * - `in/nin` → `{ field: { in/notIn: [...] } }` (a scalar value is wrapped to a single
+ *   element);
+ * - `isNull` → `{ field: { equals: null } }`; `isNotNull` → `{ field: { not: null } }`;
+ * - `and`/`or` → `{ AND: [...] }` / `{ OR: [...] }`.
+ *
+ * SAFE: only VALUES come from the (untrusted) policy result and Prisma binds them as
+ * parameters. Field names become object keys (a column/relation path), so each is
+ * validated against {@link assertSafeIdentifier} — a hostile field throws.
+ */
+export function compileScope(constraint) {
+    if (constraint.kind === 'all')
+        return {};
+    if (constraint.kind === 'none')
+        return { ...ALWAYS_FALSE };
+    const compileCondition = (c) => {
+        assertSafeIdentifier(c.field, `scope field "${c.field}"`);
+        if (c.op === 'eq')
+            return { [c.field]: { equals: c.value } };
+        if (c.op === 'ne')
+            return { [c.field]: { not: c.value } };
+        if (c.op === 'isNull')
+            return { [c.field]: { equals: null } };
+        if (c.op === 'isNotNull')
+            return { [c.field]: { not: null } };
+        if (c.op === 'in' || c.op === 'nin') {
+            const values = Array.isArray(c.value) ? c.value : [c.value];
+            // An empty `in` matches nothing; an empty `nin` matches everything.
+            if (values.length === 0)
+                return c.op === 'in' ? { ...ALWAYS_FALSE } : {};
+            const key = c.op === 'in' ? 'in' : 'notIn';
+            return { [c.field]: { [key]: values } };
+        }
+        const token = BINARY_OPS[c.op];
+        if (!token)
+            throw new Error(`Unsupported scope operator: ${c.op}`);
+        return { [c.field]: { [token]: c.value } };
+    };
+    const compileNode = (node) => {
+        if (node.kind === 'condition')
+            return compileCondition(node);
+        // An empty `and` is the identity (all rows); an empty `or` is the zero (no rows).
+        if (node.nodes.length === 0)
+            return node.kind === 'and' ? {} : { ...ALWAYS_FALSE };
+        const children = node.nodes.map(compileNode);
+        return node.kind === 'and' ? { AND: children } : { OR: children };
+    };
+    return compileNode(constraint);
+}
+/**
+ * Ergonomic entry point: resolve the query scope for the current (context) user via
+ * the {@link Gate} and return the Prisma `where` to pass to `model.findMany`.
+ * Equivalent to `compileScope(await gate.scope(entity, ability))`.
+ *
+ * Mirrors the TypeORM/MikroORM adapters' `applyScope` shape (gate + entity), but returns
+ * the `where` instead of mutating a query builder, because Prisma's idiomatic collection
+ * fetch is `prisma.post.findMany({ where })`:
+ *
+ * ```ts
+ * const where = await applyScope(gate, Post);          // current user's accessible posts
+ * const posts = await prisma.post.findMany({ where });
+ * ```
+ *
+ * Combine with extra criteria via Prisma's own `AND`:
+ * `prisma.post.findMany({ where: { AND: [where, { published: true }] } })`.
+ */
+export async function applyScope(gate, entity, ability = 'viewAny') {
+    return compileScope(await gate.scope(entity, ability));
+}
+//# sourceMappingURL=scope.js.map

package/dist/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../src/scope.ts"],"names":[],"mappings":"AAqBA;;;;;;GAMG;AACH,MAAM,eAAe,GAAG,0BAA0B,CAAC;AAEnD,SAAS,oBAAoB,CAAC,KAAa,EAAE,IAAY;IACvD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,UAAU,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,2JAA2J,CACpM,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,YAAY,GAAgB,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;AAE7C,wEAAwE;AACxE,MAAM,UAAU,GAAgE;IAC9E,EAAE,EAAE,IAAI;IACR,GAAG,EAAE,KAAK;IACV,EAAE,EAAE,IAAI;IACR,GAAG,EAAE,KAAK;CACX,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,YAAY,CAAC,UAA2B;IACtD,IAAI,UAAU,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IACzC,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,GAAG,YAAY,EAAE,CAAC;IAE3D,MAAM,gBAAgB,GAAG,CAAC,CAAiB,EAAe,EAAE;QAC1D,oBAAoB,CAAC,CAAC,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;QAC1D,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC7D,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC1D,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;QAC9D,IAAI,CAAC,CAAC,EAAE,KAAK,WAAW;YAAE,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC;QAC9D,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC5D,oEAAoE;YACpE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,MAAM,GAAG,GAAG,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YAC3C,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC;QAC1C,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnE,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IAC7C,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,CAAC,IAAe,EAAe,EAAE;QACnD,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC7D,kFAAkF;QAClF,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,YAAY,EAAE,CAAC;QACnF,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IACpE,CAAC,CAAC;IAEF,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAmB,EACnB,MAAqB,EACrB,OAAO,GAAG,SAAS;IAEnB,OAAO,YAAY,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AACzD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dudousxd/nestjs-authz-prisma",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Prisma RBAC persistence for @dudousxd/nestjs-authz — roles, permissions, and a Gate seam (zero connection ownership, structural client).",
   "license": "MIT",
   "repository": {
@@ -34,12 +34,15 @@
     "@nestjs/common": "^11.0.0",
     "@nestjs/core": "^11.0.0",
     "@nestjs/testing": "^11.0.0",
+    "@testcontainers/postgresql": "^12.0.3",
     "@types/node": "^20.0.0",
+    "@types/pg": "^8.11.0",
+    "pg": "^8.21.0",
     "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.1",
     "typescript": "^5.4.0",
     "vitest": "^3.0.0",
-    "@dudousxd/nestjs-authz": "^0.4.0"
+    "@dudousxd/nestjs-authz": "^0.6.0"
   },
   "engines": {
     "node": ">=20"
@@ -56,6 +59,7 @@
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "test": "vitest run --passWithNoTests",
+    "test:db:pg": "AUTHZ_TEST_DIALECT=postgres vitest run --config vitest.db.config.ts",
     "test:watch": "vitest",
     "typecheck": "tsc -p tsconfig.json --noEmit"
   }