@dudousxd/nestjs-authz-prisma 0.5.1 → 1.0.0

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # @dudousxd/nestjs-authz-prisma
 
+## 1.0.0
+
+### Patch Changes
+
+- Updated dependencies [[`750a6b3`](https://github.com/DavideCarvalho/nestjs-authz/commit/750a6b3f80deea3803dec8df5f9f8cf67a046ac1)]:
+  - @dudousxd/nestjs-authz@0.10.0
+
+## 0.6.0
+
+### Minor Changes
+
+- [#67](https://github.com/DavideCarvalho/nestjs-authz/pull/67) [`32e967f`](https://github.com/DavideCarvalho/nestjs-authz/commit/32e967ffbcd68a97e8effc77af9c16bbbafdc918) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Run on `@dudousxd/nestjs-authz` 0.9 and `@nestjs/authorization`: persisted roles and
+  permissions now guard routes through the official guard as the core's `RolePolicy` /
+  `PermissionPolicy` (`@Roles('editor')`, `@Permission('posts.publish')`), and the guard and the
+  handler's `Gate` calls share one permission and role fetch per request. The store API
+  (role sources, admin management, tenant-scoped roles where supported) and `AuthzRbacModule`
+  are unchanged. A persisted permission named like a policy ability no longer bypasses that
+  policy (see the core changeset). Requires NestJS 12, `@nestjs/authorization` ^0.1.3 and Node 22+.
+
+### Patch Changes
+
+- [#67](https://github.com/DavideCarvalho/nestjs-authz/pull/67) [`32e967f`](https://github.com/DavideCarvalho/nestjs-authz/commit/32e967ffbcd68a97e8effc77af9c16bbbafdc918) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Fix packages that could be published without files their `exports` point to. `tsc` builds no longer use a `.tsbuildinfo` that can outlive `dist/` and skip emitting files. A new `check:exports` step (also `prepack`) fails the release if any `exports`/`main`/`types` path is missing.
+
 ## 0.5.1
 
 ### Patch Changes

package/README.md

@@ -1,7 +1,7 @@
 # @dudousxd/nestjs-authz-prisma
 
 Prisma RBAC persistence for [`@dudousxd/nestjs-authz`](https://github.com/DavideCarvalho/nestjs-authz) —
-roles, permissions, and a Gate seam, with **zero connection ownership** (your app owns the
+roles and permissions for the official `@nestjs/authorization` policies, with **zero connection ownership** (your app owns the
 `PrismaClient`; this package never opens a connection and never imports `@prisma/client`).
 
 This is the Prisma sibling of `@dudousxd/nestjs-authz-typeorm`: identical store surface and
@@ -10,7 +10,7 @@ This is the Prisma sibling of `@dudousxd/nestjs-authz-typeorm`: identical store
 ## Install
 
 ```bash
-pnpm add @dudousxd/nestjs-authz-prisma @dudousxd/nestjs-authz
+pnpm add @dudousxd/nestjs-authz-prisma @dudousxd/nestjs-authz @nestjs/authorization
 ```
 
 No `@prisma/client` is required by this package — it depends only on the structural
@@ -92,16 +92,30 @@ AuthzRbacModule.forRootAsync({
 });
 ```
 
-Once wired, the Gate consults persisted RBAC:
+Once wired, persisted roles and permissions guard routes through the official
+`@nestjs/authorization` guard, as the core's `RolePolicy` / `PermissionPolicy`:
 
 ```ts
-await store.givePermissionToRole('editor', 'posts.publish');
+await store.givePermissionToRole('editor', 'posts.*');
 await store.assignRole({ type: 'user', id: 7 }, 'editor');
 
-gate.forUser(user).allows('posts.publish'); // true (PERMISSION_PROVIDER seam, wildcards supported)
-gate.forUser(user).hasRole('editor');       // true (ROLE_PROVIDER seam)
+@Permission('posts.publish')                                  // posts.* grants it
+@Can(PermissionPolicy, 'has', permission('posts.publish'))   // the same, spelled out
+@Roles('editor')                                              // @Can(RolePolicy, 'has', roles('editor'))
 ```
 
+and in services, through the `Gate`:
+
+```ts
+gate.forUser(user).allows('posts.publish');               // true (PERMISSION_PROVIDER seam)
+gate.forUser(user).allows(PermissionPolicy, 'has', 'posts.publish');
+gate.forUser(user).hasRole('editor');                     // true (ROLE_PROVIDER seam)
+```
+
+The user is the one the official guard reads (`AuthorizationModule.forRoot({ getUser })`,
+default `request.user`), mapped to a store ref with `userRefFrom` (default `{ type, id }` or
+`{ id }`).
+
 ## Role sources (manual vs SSO/SCIM)
 
 Every role assignment records a `source`. It defaults to `'manual'`, so existing calls and existing

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dudousxd/nestjs-authz-prisma",
-  "version": "0.5.1",
+  "version": "1.0.0",
   "description": "Prisma RBAC persistence for @dudousxd/nestjs-authz — roles, permissions, and a Gate seam (zero connection ownership, structural client).",
   "license": "MIT",
   "repository": {
@@ -38,30 +38,32 @@
     "CHANGELOG.md"
   ],
   "peerDependencies": {
-    "@dudousxd/nestjs-authz": ">=0.8.0",
-    "@nestjs/common": ">=10.0.0",
-    "@nestjs/core": ">=10.0.0",
+    "@dudousxd/nestjs-authz": ">=0.10.0",
+    "@nestjs/authorization": "^0.1.3",
+    "@nestjs/common": "^12.0.0",
+    "@nestjs/core": "^12.0.0",
     "reflect-metadata": ">=0.1.13"
   },
   "devDependencies": {
+    "@nestjs/authorization": "0.1.3",
     "@nestjs/common": "12.0.1",
     "@nestjs/core": "12.0.1",
     "@nestjs/testing": "12.0.1",
     "@testcontainers/postgresql": "12.1.0",
-    "@types/node": "20.19.43",
+    "@types/node": "22.20.5",
     "@types/pg": "8.23.1",
     "pg": "8.23.0",
     "reflect-metadata": "0.2.2",
     "rxjs": "7.8.2",
     "typescript": "5.9.3",
     "vitest": "3.2.7",
-    "@dudousxd/nestjs-authz": "^0.8.1"
+    "@dudousxd/nestjs-authz": "^0.10.0"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=22"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.json",
+    "build": "tsc -p tsconfig.json --incremental false",
     "test": "vitest run --passWithNoTests",
     "test:db:pg": "AUTHZ_TEST_DIALECT=postgres vitest run --config vitest.db.config.ts",
     "test:watch": "vitest",