@dudousxd/nestjs-authz-prisma 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # @dudousxd/nestjs-authz-prisma
 
+## 0.7.0
+
+### Minor Changes
+
+- Back on the 0.x line. The 1.x and 2.x versions were published by accident: a release-tooling peer cascade bumped this package to a major, not an API decision. 0.7.0 contains everything those versions shipped (console `authorize` support, tenancy, Node 24+ `engines`) with no other change. Upgrade from 1.x/2.x to 0.7.0; those versions are deprecated.
+
+## 2.0.0
+
+### Major Changes
+
+- [#74](https://github.com/DavideCarvalho/nestjs-authz/pull/74) [`35421dc`](https://github.com/DavideCarvalho/nestjs-authz/commit/35421dc5b09bd271d5087d26e8536191ef6ba342) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - **Breaking:** require Node.js 24 or newer (`engines.node` is now `>=24`; it was `>=22`, and `>=20` for `-client` and `-react`). CI tests on Node 24 and 26. No API changes: see the Upgrading page in the docs.
+
+## 1.1.1
+
+### Patch Changes
+
+- [#73](https://github.com/DavideCarvalho/nestjs-authz/pull/73) [`9fd6787`](https://github.com/DavideCarvalho/nestjs-authz/commit/9fd6787307361b8552236a833d969fa041a46bca) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Fix the `$queryRaw` permission fast path: it is now called on the client instead of detached from it. A real `PrismaClient` threw on the unbound call, so every permission check silently fell back to the three-query path.
+
+## 1.1.0
+
+### Minor Changes
+
+- [#72](https://github.com/DavideCarvalho/nestjs-authz/pull/72) [`58a5d72`](https://github.com/DavideCarvalho/nestjs-authz/commit/58a5d72d2964a7cfae9cbfe8506526c8518ba30a) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Tenancy for the RBAC modules, following the `@dudousxd/nestjs-context` tenancy switch.
+
+  - New `tenancy` option (`'inherit' | false | { enabled?, kinds?, nullRows?, roles? }`, default `'inherit'`). With context tenancy on, permission and role checks are scoped to the request's tenant from `Context.setTenant`. A request with no tenant, inside `Context.allTenants()`, or outside a request sees global assignments only. `kinds` limits the tenant kinds this module honours. With tenancy off nothing changes.
+  - `tenancy.roles` maps the caller's role inside the tenant (`tenant.role`) to authz roles that apply in that tenant only, e.g. `{ owner: 'org_admin' }`.
+  - New `tenant` resolver option, `(user) => tenantId | null | undefined`: an explicit tenant that wins over the context.
+  - MikroORM and Prisma can now store tenant-scoped role assignments like Drizzle and TypeORM: `assignRole`, `removeRole` and `setUserRoles` take `{ tenantId }`, and the read methods take a tenant scope. MikroORM: build the entities with `createAuthzEntitySchemas({}, { tenantScoped: true })`. Prisma: add `tenantId String @default("")` to `UserRole` and its `@@id`, then pass `tenantScoped: true`. Without that, every assignment stays global.
+
+## 1.0.0
+
+### Patch Changes
+
+- Updated dependencies [[`750a6b3`](https://github.com/DavideCarvalho/nestjs-authz/commit/750a6b3f80deea3803dec8df5f9f8cf67a046ac1)]:
+  - @dudousxd/nestjs-authz@0.10.0
+
 ## 0.6.0
 
 ### Minor Changes

package/README.md

@@ -185,10 +185,70 @@ await store.listRoleAssignments({ user: { type: 'user', id: 7 } });
 await store.removeUser({ type: 'user', id: 7 });
 ```
 
-This adapter has no tenant-scoped assignments, so every row has `tenantId: null`:
-`listRoleAssignments({ tenantId: null })` lists everything and a tenant id string matches
-nothing. Without `roleSources: true` every row is `'manual'`, so filtering by another
-`source` matches nothing.
+`tenantId` filters: omitted = every tenant, `null` = global assignments only, a string = that
+tenant's scoped assignments only. Without `tenantScoped: true` (below) every row has
+`tenantId: null`, so a tenant id string matches nothing. Without `roleSources: true` every row
+is `'manual'`, so filtering by another `source` matches nothing.
+
+## Tenant-scoped roles
+
+Tenant-scoped assignments are opt-in. Add the column to `UserRole` and its `@@id`, then run
+`prisma migrate dev` (existing rows get `''`, a global assignment):
+
+```prisma
+model UserRole {
+  userType String
+  userId   String
+  roleId   String
+  tenantId String @default("")
+
+  @@id([userType, userId, roleId, tenantId])
+  @@index([userType, userId])
+  @@map("authz_user_role")
+}
+```
+
+Then turn it on: `new PrismaAuthzStore(prisma, { tenantScoped: true })`, or
+`AuthzRbacModule.forRoot({ client: prisma, tenantScoped: true })`.
+
+```ts
+await store.assignRole(user, 'editor', { tenantId: 'acme' }); // only inside acme
+await store.assignRole(user, 'viewer');                        // everywhere
+await store.getRolesForUser(user, { tenantId: 'acme' });      // ['editor', 'viewer']
+await store.getRolesForUser(user);                            // ['viewer']
+```
+
+`removeRole` and `setUserRoles` take the same `{ tenantId }` (omitted = the global
+assignments). Without `tenantScoped`, every assignment is global and reads ignore the tenant.
+`assignRole` and `setUserRoles` with a `tenantId` throw; `removeRole` with one does nothing,
+since there is no tenant assignment to remove.
+
+## Tenancy
+
+The RBAC module reads the tenant only when tenancy is on: turn it on with
+`ContextModule.forRoot({ tenancy: { enabled: true } })` in `@dudousxd/nestjs-context`. Checks
+are then scoped to the request's tenant from `Context.setTenant(...)`.
+A request with no tenant, or inside `Context.allTenants()`, sees global assignments only.
+
+```ts
+AuthzRbacModule.forRoot({
+  client: prisma,
+  tenantScoped: true,
+  tenancy: {
+    kinds: ['organization'],                  // optional: tenant kinds this module honours
+    roles: { owner: 'org_admin', member: 'org_member' }, // optional: tenant.role → authz roles in that tenant
+  },
+  tenant: (user) => (user as { orgId?: string }).orgId, // optional: an explicit tenant wins over the context
+});
+```
+
+`tenancy` defaults to `'inherit'` (follow the context switch); `false` keeps this module out.
+Roles mapped with `roles` apply only inside that tenant and only to the context's current user.
+The `tenant` resolver returns a tenant id, `null` for the global scope, or `undefined` to fall
+back to the context.
+
+With tenancy on and without `tenantScoped`, every assignment is global, so only `roles` and the
+`tenant` resolver change what a check sees.
 
 ## License
 

package/dist/authz-rbac.module.d.ts

@@ -2,6 +2,7 @@ import type { UserRef } from '@dudousxd/nestjs-authz/store-kit';
 import { type DynamicModule } from '@nestjs/common';
 import { PrismaAuthzStore } from './prisma-authz.store.js';
 import { type PrismaAuthzClientLike } from './prisma-client.js';
+import { type AuthzTenancyOption, type TenantResolver } from './tenancy.js';
 /** Injection token holding the {@link PrismaAuthzStore} the RBAC module manages. */
 export declare const AUTHZ_RBAC_STORE: unique symbol;
 /** Injection token holding the resolved {@link AuthzRbacModuleOptions}. */
@@ -30,11 +31,27 @@ export interface AuthzRbacModuleOptions {
      * `source` column on `UserRole`. Only used when the module builds the store from `client`.
      */
     roleSources?: boolean;
+    /**
+     * Tenant-scoped role assignments (see {@link PrismaAuthzStoreOptions.tenantScoped}); requires
+     * the `tenantId` column on `UserRole`. Only used when the module builds the store from `client`.
+     */
+    tenantScoped?: boolean;
     /**
      * Derive a {@link UserRef} from the Gate's current user. Defaults to
      * {@link defaultUserRefMapper} (`{ type, id }` or `{ id }`).
      */
     userRefFrom?: UserRefMapper;
+    /**
+     * Tenancy, from `@dudousxd/nestjs-context`. `'inherit'` (default) follows `ContextModule`'s
+     * `tenancy.enabled`; with it on, checks are scoped to the context tenant. The object form adds
+     * `kinds` and `roles` (map the caller's `tenant.role` to authz roles in that tenant).
+     */
+    tenancy?: AuthzTenancyOption;
+    /**
+     * Explicit tenant for a check, from the user being checked. Wins over the context: return a
+     * tenant id, `null` for the global scope, or `undefined` to fall back to the context.
+     */
+    tenant?: TenantResolver;
 }
 export interface AuthzRbacModuleAsyncOptions {
     imports?: unknown[];

package/dist/authz-rbac.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authz-rbac.module.d.ts","sourceRoot":"","sources":["../src/authz-rbac.module.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EACL,KAAK,aAAa,EAQnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAiB,KAAK,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE/E,oFAAoF;AACpF,eAAO,MAAM,gBAAgB,eAAoD,CAAC;AAClF,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,eAAsD,CAAC;AAEtF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,GAAG,SAAS,CAAC;AAEnE,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,oFAAoF;IACpF,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,WAAW,CAAC,EAAE,aAAa,CAAC;CAC7B;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,UAAU,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,sBAAsB,CAAC,GAAG,sBAAsB,CAAC;CAC9F;AAED,qFAAqF;AACrF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAOvE;AAsFD;;;;;;GAMG;AACH,qBACa,eAAe;IAC1B,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa;IAa9D,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,2BAA2B,GAAG,aAAa;IAsBxE,OAAO,CAAC,MAAM,CAAC,eAAe;CAS/B"}
+{"version":3,"file":"authz-rbac.module.d.ts","sourceRoot":"","sources":["../src/authz-rbac.module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EACL,KAAK,aAAa,EAQnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAiB,KAAK,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EACL,KAAK,kBAAkB,EAIvB,KAAK,cAAc,EAEpB,MAAM,cAAc,CAAC;AAEtB,oFAAoF;AACpF,eAAO,MAAM,gBAAgB,eAAoD,CAAC;AAClF,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,eAAsD,CAAC;AAEtF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,GAAG,SAAS,CAAC;AAEnE,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,oFAAoF;IACpF,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,WAAW,CAAC,EAAE,aAAa,CAAC;IAC5B;;;;OAIG;IACH,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B;;;OAGG;IACH,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,UAAU,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,sBAAsB,CAAC,GAAG,sBAAsB,CAAC;CAC9F;AAED,qFAAqF;AACrF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAOvE;AA0ID;;;;;;GAMG;AACH,qBACa,eAAe;IAC1B,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa;IAa9D,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,2BAA2B,GAAG,aAAa;IAsBxE,OAAO,CAAC,MAAM,CAAC,eAAe;CAS/B"}

package/dist/authz-rbac.module.js

@@ -11,9 +11,11 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 var AuthzRbacModule_1;
-import { PERMISSION_PROVIDER, ROLE_PROVIDER, } from '@dudousxd/nestjs-authz';
+import { CONTEXT_ACCESSOR, PERMISSION_PROVIDER, ROLE_PROVIDER, } from '@dudousxd/nestjs-authz';
 import { Inject, Injectable, Module, Optional, } from '@nestjs/common';
+import { ModuleRef } from '@nestjs/core';
 import { PrismaAuthzStore } from './prisma-authz.store.js';
+import { rbacTenant, } from './tenancy.js';
 /** Injection token holding the {@link PrismaAuthzStore} the RBAC module manages. */
 export const AUTHZ_RBAC_STORE = Symbol.for('@dudousxd/nestjs-authz-prisma:store');
 /** Injection token holding the resolved {@link AuthzRbacModuleOptions}. */
@@ -35,7 +37,10 @@ function resolveStore(options) {
     if (options.store)
         return options.store;
     if (options.client) {
-        return new PrismaAuthzStore(options.client, options.roleSources ? { roleSources: true } : {});
+        return new PrismaAuthzStore(options.client, {
+            ...(options.roleSources ? { roleSources: true } : {}),
+            ...(options.tenantScoped ? { tenantScoped: true } : {}),
+        });
     }
     throw new Error('AuthzRbacModule (prisma): provide either `store` or `client` in the options.');
 }
@@ -46,13 +51,27 @@ function resolveStore(options) {
  */
 let RbacPermissionProvider = class RbacPermissionProvider {
     options;
+    context;
+    moduleRef;
     // `getPermissions` lists every grant `hasPermission` can find, for any resource.
     exhaustivePermissions = true;
     store;
-    constructor(options) {
+    contextCache = { resolved: false, value: undefined };
+    constructor(options, context, moduleRef) {
         this.options = options;
+        this.context = context;
+        this.moduleRef = moduleRef;
         this.store = resolveStore(options);
     }
+    tenant(user, ref) {
+        return rbacTenant(this.options, user, ref, this.context, this.moduleRef, this.contextCache, false);
+    }
+    /** The permissions `tenancy.roles` grants through the caller's role in the tenant. */
+    async tenantRolePermissions(roles) {
+        if (roles.length === 0)
+            return [];
+        return Object.values(await this.store.getRolePermissions(roles)).flat();
+    }
     // The core `PermissionProvider` interface passes an optional `resource` (3rd
     // arg); it is intentionally ignored here. RBAC grants are model-less,
     // named-ability grants (the Laravel/spatie `Gate::before` grant), so the
@@ -62,7 +81,10 @@ let RbacPermissionProvider = class RbacPermissionProvider {
         const ref = map(user);
         if (ref === undefined)
             return undefined;
-        return this.store.userHasPermission(ref, permission);
+        const tenant = this.tenant(user, ref);
+        if (await this.store.userHasPermission(ref, permission, tenant.scope))
+            return true;
+        return (await this.tenantRolePermissions(tenant.roles)).includes(permission);
     }
     // Expose the user's full granted permission set so the core can apply
     // Laravel/spatie-style wildcard matching (a granted `posts.*` satisfies a check
@@ -72,13 +94,20 @@ let RbacPermissionProvider = class RbacPermissionProvider {
         const ref = map(user);
         if (ref === undefined)
             return undefined;
-        return this.store.getPermissionsForUser(ref);
+        const tenant = this.tenant(user, ref);
+        const own = await this.store.getPermissionsForUser(ref, tenant.scope);
+        if (tenant.roles.length === 0)
+            return own;
+        return [...new Set([...own, ...(await this.tenantRolePermissions(tenant.roles))])];
     }
 };
 RbacPermissionProvider = __decorate([
     Injectable(),
     __param(0, Inject(AUTHZ_RBAC_OPTIONS)),
-    __metadata("design:paramtypes", [Object])
+    __param(1, Optional()),
+    __param(1, Inject(CONTEXT_ACCESSOR)),
+    __param(2, Optional()),
+    __metadata("design:paramtypes", [Object, Object, ModuleRef])
 ], RbacPermissionProvider);
 /**
  * The RBAC {@link RoleProvider} the Gate consults (via the shared {@link ROLE_PROVIDER}
@@ -88,23 +117,36 @@ RbacPermissionProvider = __decorate([
  */
 let RbacRoleProvider = class RbacRoleProvider {
     options;
+    context;
+    moduleRef;
     store;
-    constructor(options) {
+    contextCache = { resolved: false, value: undefined };
+    constructor(options, context, moduleRef) {
         this.options = options;
+        this.context = context;
+        this.moduleRef = moduleRef;
         this.store = resolveStore(options);
     }
+    tenant(user, ref) {
+        return rbacTenant(this.options, user, ref, this.context, this.moduleRef, this.contextCache, false);
+    }
     async getRoles(user) {
         const map = this.options.userRefFrom ?? defaultUserRefMapper;
         const ref = map(user);
         if (ref === undefined)
             return undefined;
-        return this.store.getRolesForUser(ref);
+        const tenant = this.tenant(user, ref);
+        const own = await this.store.getRolesForUser(ref, tenant.scope);
+        return tenant.roles.length === 0 ? own : [...new Set([...own, ...tenant.roles])];
     }
 };
 RbacRoleProvider = __decorate([
     Injectable(),
     __param(0, Inject(AUTHZ_RBAC_OPTIONS)),
-    __metadata("design:paramtypes", [Object])
+    __param(1, Optional()),
+    __param(1, Inject(CONTEXT_ACCESSOR)),
+    __param(2, Optional()),
+    __metadata("design:paramtypes", [Object, Object, ModuleRef])
 ], RbacRoleProvider);
 /**
  * Runs `ensureSchema` on bootstrap when `autoCreateSchema` is enabled. For Prisma this is

package/dist/authz-rbac.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"authz-rbac.module.js","sourceRoot":"","sources":["../src/authz-rbac.module.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EACL,mBAAmB,EAEnB,aAAa,GAEd,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAEL,MAAM,EACN,UAAU,EACV,MAAM,EAEN,QAAQ,GAGT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAG3D,oFAAoF;AACpF,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;AAClF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;AAwCtF,qFAAqF;AACrF,MAAM,UAAU,oBAAoB,CAAC,IAAa;IAChD,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACtE,MAAM,CAAC,GAAG,IAAwC,CAAC;IACnD,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAqB,CAAC;IACnC,OAAO,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;AACpE,CAAC;AAED,0FAA0F;AAC1F,SAAS,YAAY,CAAC,OAA+B;IACnD,IAAI,OAAO,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IACxC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,IAAI,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;AAClG,CAAC;AAED;;;;GAIG;AACH,IACM,sBAAsB,GAD5B,MACM,sBAAsB;IAK+B;IAJzD,iFAAiF;IACxE,qBAAqB,GAAG,IAAI,CAAC;IAErB,KAAK,CAAmB;IACzC,YAAyD,OAA+B;QAA/B,YAAO,GAAP,OAAO,CAAwB;QACtF,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAED,6EAA6E;IAC7E,sEAAsE;IACtE,yEAAyE;IACzE,yDAAyD;IACzD,KAAK,CAAC,aAAa,CAAC,IAAa,EAAE,UAAkB;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACvD,CAAC;IAED,sEAAsE;IACtE,gFAAgF;IAChF,6EAA6E;IAC7E,KAAK,CAAC,cAAc,CAAC,IAAa;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;CACF,CAAA;AA7BK,sBAAsB;IAD3B,UAAU,EAAE;IAME,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;;GALnC,sBAAsB,CA6B3B;AAED;;;;;GAKG;AACH,IACM,gBAAgB,GADtB,MACM,gBAAgB;IAEqC;IADxC,KAAK,CAAmB;IACzC,YAAyD,OAA+B;QAA/B,YAAO,GAAP,OAAO,CAAwB;QACtF,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAa;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;CACF,CAAA;AAZK,gBAAgB;IADrB,UAAU,EAAE;IAGE,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;;GAFnC,gBAAgB,CAYrB;AAED;;;GAGG;AACH,IACM,kBAAkB,GADxB,MACM,kBAAkB;IAEqC;IAD3D,YAC2D,OAAgC;QAAhC,YAAO,GAAP,OAAO,CAAyB;IACxF,CAAC;IAEJ,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,KAAK,IAAI;YAAE,OAAO;QACnD,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,CAAC;IAClD,CAAC;CACF,CAAA;AAVK,kBAAkB;IADvB,UAAU,EAAE;IAGR,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;;GAFrC,kBAAkB,CAUvB;AAED;;;;;;GAMG;AAEI,IAAM,eAAe,uBAArB,MAAM,eAAe;IAC1B,MAAM,CAAC,OAAO,CAAC,OAA+B;QAC5C,OAAO;YACL,MAAM,EAAE,iBAAe;YACvB,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE;gBACT,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE;gBAClD,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE;gBACtE,GAAG,iBAAe,CAAC,eAAe,EAAE;aACrC;YACD,OAAO,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,OAAoC;QACtD,OAAO;YACL,MAAM,EAAE,iBAAe;YACvB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAoB;YACnD,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,kBAAkB;oBAC3B,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAyB;iBACvD;gBACD;oBACE,OAAO,EAAE,gBAAgB;oBACzB,UAAU,EAAE,CAAC,IAA4B,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC;oBAChE,MAAM,EAAE,CAAC,kBAAkB,CAAC;iBAC7B;gBACD,GAAG,iBAAe,CAAC,eAAe,EAAE;aACrC;YACD,OAAO,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,CAAC;SAChE,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,eAAe;QAC5B,OAAO;YACL,sBAAsB;YACtB,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,sBAAsB,EAAE;YACrE,gBAAgB;YAChB,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,gBAAgB,EAAE;YACzD,kBAAkB;SACnB,CAAC;IACJ,CAAC;CACF,CAAA;AA7CY,eAAe;IAD3B,MAAM,CAAC,EAAE,CAAC;GACE,eAAe,CA6C3B"}
+{"version":3,"file":"authz-rbac.module.js","sourceRoot":"","sources":["../src/authz-rbac.module.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EAEnB,aAAa,GAEd,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAEL,MAAM,EACN,UAAU,EACV,MAAM,EAEN,QAAQ,GAGT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EAML,UAAU,GACX,MAAM,cAAc,CAAC;AAEtB,oFAAoF;AACpF,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;AAClF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;AAwDtF,qFAAqF;AACrF,MAAM,UAAU,oBAAoB,CAAC,IAAa;IAChD,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACtE,MAAM,CAAC,GAAG,IAAwC,CAAC;IACnD,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAqB,CAAC;IACnC,OAAO,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;AACpE,CAAC;AAED,0FAA0F;AAC1F,SAAS,YAAY,CAAC,OAA+B;IACnD,IAAI,OAAO,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC;IACxC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,IAAI,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE;YAC1C,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;AAClG,CAAC;AAED;;;;GAIG;AACH,IACM,sBAAsB,GAD5B,MACM,sBAAsB;IAQqB;IACU;IAC1B;IAT/B,iFAAiF;IACxE,qBAAqB,GAAG,IAAI,CAAC;IAErB,KAAK,CAAmB;IACxB,YAAY,GAAuB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAE1F,YAC+C,OAA+B,EACrB,OAA+B,EACzD,SAAqB;QAFL,YAAO,GAAP,OAAO,CAAwB;QACrB,YAAO,GAAP,OAAO,CAAwB;QACzD,cAAS,GAAT,SAAS,CAAY;QAElD,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAEO,MAAM,CAAC,IAAa,EAAE,GAAY;QACxC,OAAO,UAAU,CACf,IAAI,CAAC,OAAO,EACZ,IAAI,EACJ,GAAG,EACH,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,YAAY,EACjB,KAAK,CACN,CAAC;IACJ,CAAC;IAED,sFAAsF;IAC9E,KAAK,CAAC,qBAAqB,CAAC,KAAe;QACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1E,CAAC;IAED,6EAA6E;IAC7E,sEAAsE;IACtE,yEAAyE;IACzE,yDAAyD;IACzD,KAAK,CAAC,aAAa,CAAC,IAAa,EAAE,UAAkB;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACtC,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnF,OAAO,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/E,CAAC;IAED,sEAAsE;IACtE,gFAAgF;IAChF,6EAA6E;IAC7E,KAAK,CAAC,cAAc,CAAC,IAAa;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QAC1C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;CACF,CAAA;AA1DK,sBAAsB;IAD3B,UAAU,EAAE;IASR,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;IAC1B,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,gBAAgB,CAAC,CAAA;IACpC,WAAA,QAAQ,EAAE,CAAA;qDAA8B,SAAS;GAVhD,sBAAsB,CA0D3B;AAED;;;;;GAKG;AACH,IACM,gBAAgB,GADtB,MACM,gBAAgB;IAK2B;IACU;IAC1B;IANd,KAAK,CAAmB;IACxB,YAAY,GAAuB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAE1F,YAC+C,OAA+B,EACrB,OAA+B,EACzD,SAAqB;QAFL,YAAO,GAAP,OAAO,CAAwB;QACrB,YAAO,GAAP,OAAO,CAAwB;QACzD,cAAS,GAAT,SAAS,CAAY;QAElD,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAEO,MAAM,CAAC,IAAa,EAAE,GAAY;QACxC,OAAO,UAAU,CACf,IAAI,CAAC,OAAO,EACZ,IAAI,EACJ,GAAG,EACH,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,YAAY,EACjB,KAAK,CACN,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAa;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAChE,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;CACF,CAAA;AAhCK,gBAAgB;IADrB,UAAU,EAAE;IAMR,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;IAC1B,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,gBAAgB,CAAC,CAAA;IACpC,WAAA,QAAQ,EAAE,CAAA;qDAA8B,SAAS;GAPhD,gBAAgB,CAgCrB;AAED;;;GAGG;AACH,IACM,kBAAkB,GADxB,MACM,kBAAkB;IAEqC;IAD3D,YAC2D,OAAgC;QAAhC,YAAO,GAAP,OAAO,CAAyB;IACxF,CAAC;IAEJ,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,KAAK,IAAI;YAAE,OAAO;QACnD,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,CAAC;IAClD,CAAC;CACF,CAAA;AAVK,kBAAkB;IADvB,UAAU,EAAE;IAGR,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;;GAFrC,kBAAkB,CAUvB;AAED;;;;;;GAMG;AAEI,IAAM,eAAe,uBAArB,MAAM,eAAe;IAC1B,MAAM,CAAC,OAAO,CAAC,OAA+B;QAC5C,OAAO;YACL,MAAM,EAAE,iBAAe;YACvB,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE;gBACT,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE;gBAClD,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE;gBACtE,GAAG,iBAAe,CAAC,eAAe,EAAE;aACrC;YACD,OAAO,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,OAAoC;QACtD,OAAO;YACL,MAAM,EAAE,iBAAe;YACvB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAoB;YACnD,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,kBAAkB;oBAC3B,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAyB;iBACvD;gBACD;oBACE,OAAO,EAAE,gBAAgB;oBACzB,UAAU,EAAE,CAAC,IAA4B,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC;oBAChE,MAAM,EAAE,CAAC,kBAAkB,CAAC;iBAC7B;gBACD,GAAG,iBAAe,CAAC,eAAe,EAAE;aACrC;YACD,OAAO,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,CAAC;SAChE,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,eAAe;QAC5B,OAAO;YACL,sBAAsB;YACtB,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,sBAAsB,EAAE;YACrE,gBAAgB;YAChB,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,gBAAgB,EAAE;YACzD,kBAAkB;SACnB,CAAC;IACJ,CAAC;CACF,CAAA;AA7CY,eAAe;IAD3B,MAAM,CAAC,EAAE,CAAC;GACE,eAAe,CA6C3B"}

package/dist/index.d.ts

@@ -1,8 +1,9 @@
 export { PRISMA_AUTHZ_STORE_OPTIONS, PRISMA_CLIENT, type PrismaAuthzClientLike, type PrismaAuthzStoreOptions, type PrismaModelDelegate, } from './prisma-client.js';
-export { PrismaAuthzStore } from './prisma-authz.store.js';
-export type { RoleAssignment, RoleAssignmentFilter, RoleSourceOptions, UserAuthz, UserRoleAssignment, } from './prisma-authz.store.js';
+export { GLOBAL_TENANT, PrismaAuthzStore } from './prisma-authz.store.js';
+export type { RoleAssignment, RoleAssignmentFilter, RoleSourceOptions, TenantScope, UserAuthz, UserRoleAssignment, } from './prisma-authz.store.js';
 export { AUTHZ_RBAC_OPTIONS, AUTHZ_RBAC_STORE, AuthzRbacModule, defaultUserRefMapper, } from './authz-rbac.module.js';
 export type { AuthzRbacModuleAsyncOptions, AuthzRbacModuleOptions, UserRefMapper, } from './authz-rbac.module.js';
+export type { AuthzTenancyOption, TenantResolver } from './tenancy.js';
 export type { UserRef, UserRefInput } from '@dudousxd/nestjs-authz/store-kit';
 export { applyScope, compileScope } from './scope.js';
 export type { PrismaWhere, ScopeResolver } from './scope.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,aAAa,EACb,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,SAAS,EACT,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,2BAA2B,EAC3B,sBAAsB,EACtB,aAAa,GACd,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACtD,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,aAAa,EACb,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC1E,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,WAAW,EACX,SAAS,EACT,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,2BAA2B,EAC3B,sBAAsB,EACtB,aAAa,GACd,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACvE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACtD,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,5 +1,5 @@
 export { PRISMA_AUTHZ_STORE_OPTIONS, PRISMA_CLIENT, } from './prisma-client.js';
-export { PrismaAuthzStore } from './prisma-authz.store.js';
+export { GLOBAL_TENANT, PrismaAuthzStore } from './prisma-authz.store.js';
 export { AUTHZ_RBAC_OPTIONS, AUTHZ_RBAC_STORE, AuthzRbacModule, defaultUserRefMapper, } from './authz-rbac.module.js';
 export { applyScope, compileScope } from './scope.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,aAAa,GAId,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAQ3D,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAOhC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,aAAa,GAId,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAS1E,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAQhC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC"}

package/dist/prisma-authz.store.d.ts

@@ -1,10 +1,23 @@
 import { type RoleAssignment, type RoleAssignmentFilter, type UserAuthz, type UserRef, type UserRoleAssignment } from '@dudousxd/nestjs-authz/store-kit';
 import { type PrismaAuthzClientLike, type PrismaAuthzStoreOptions } from './prisma-client.js';
 export type { RoleAssignment, RoleAssignmentFilter, UserAuthz, UserRoleAssignment };
-/** Assignment source for role mutations (default `'manual'`) — see `setUserRoles`. */
-export interface RoleSourceOptions {
+/**
+ * Optional tenant scope for a query. Omitted → the GLOBAL scope (only global assignments; a
+ * tenant-scoped role never leaks into an unscoped check). With a `tenantId`, global assignments
+ * AND that tenant's apply. Needs `tenantScoped: true`; without it every assignment is global.
+ */
+export interface TenantScope {
+    tenantId?: string;
+}
+/**
+ * Assignment source (default `'manual'`, needs `roleSources: true`) and tenant (needs
+ * `tenantScoped: true`) for role mutations — see `setUserRoles`.
+ */
+export interface RoleSourceOptions extends TenantScope {
     source?: string;
 }
+/** The tenant id of a GLOBAL role assignment (applies in every tenant). */
+export declare const GLOBAL_TENANT = "";
 /**
  * Prisma-backed RBAC store. Receives the app-owned Prisma client via the
  * {@link PRISMA_CLIENT} DI token — NO internal connection ownership, NO `@prisma/client`
@@ -22,6 +35,12 @@ export declare class PrismaAuthzStore {
      * `{}` otherwise (legacy schema without the column) — where a non-default source is an error.
      */
     private sourceField;
+    /** The `tenantId` value of a written assignment (`{}` without `tenantScoped`). */
+    private tenantField;
+    /** Assignments visible in a scope: global ones, plus the tenant's own when one is given. */
+    private tenantWhere;
+    /** The public `tenantId` of a stored row: `null` for a global assignment. */
+    private static rowTenant;
     /**
      * No-op: Prisma is schema-first / consumer-managed. Declare the RBAC models in your
      * `schema.prisma` (see {@link PrismaAuthzClientLike}) and apply them with
@@ -68,7 +87,9 @@ export declare class PrismaAuthzStore {
     assignRole(user: UserRef, roleName: string, opts?: RoleSourceOptions): Promise<void>;
     /**
      * Remove a role from a user. No-op if the role or assignment is absent. With `{ source }` only
-     * that source's assignment goes; without it, the role is removed from every source.
+     * that source's assignment goes; without it, the role is removed from every source. With
+     * `tenantScoped`, `{ tenantId }` removes the assignment in that tenant and omitting it removes
+     * the global one.
      */
     removeRole(user: UserRef, roleName: string, opts?: RoleSourceOptions): Promise<void>;
     /**
@@ -76,18 +97,23 @@ export declare class PrismaAuthzStore {
      * `roleNames` — e.g. an SSO/SCIM sync calls `setUserRoles(user, mappedRoles, { source: 'sso' })`
      * on every login; other sources' assignments are untouched. Roles are created by name when
      * missing. Atomic when the client has `$transaction`. Without `roleSources: true` there is only
-     * one (implicit manual) source, so this replaces ALL of the user's roles.
+     * one (implicit manual) source, so this replaces ALL of the user's roles. With `tenantScoped` it
+     * replaces the assignments of one tenant (`{ tenantId }`), or the global ones when omitted.
      */
     setUserRoles(user: UserRef, roleNames: readonly string[], opts?: RoleSourceOptions): Promise<void>;
-    /** Every role assignment of a user, one entry per `(role, source)`. */
-    getRoleAssignments(user: UserRef): Promise<RoleAssignment[]>;
+    /**
+     * Every role assignment of a user visible in a tenant scope (global ones always; the tenant's
+     * own with `{ tenantId }`), one entry per `(role, source, tenant)`.
+     */
+    getRoleAssignments(user: UserRef, scope?: TenantScope): Promise<RoleAssignment[]>;
     /**
      * Raw role-assignment rows for admin listings — e.g. who holds a role (`{ role: 'admin' }`) or
      * a user's assignments with their sources (`{ user }`). `role` accepts one name or a list;
      * `user` and `source` narrow further. Ordered by `(userType, userId, role, source)`.
      *
-     * This adapter has no tenant-scoped assignments — every row is global (`tenantId: null`). So
-     * `tenantId: undefined` or `null` lists everything, and a tenant id string matches nothing.
+     * `tenantId`: omitted = no tenant filter; `null` = global assignments only; a string = exactly
+     * that tenant's scoped assignments. Without `tenantScoped: true` every row is global
+     * (`tenantId: null`), so a tenant id string matches nothing.
      * Without `roleSources: true` every row is `'manual'`, so another `source` matches nothing.
      */
     listRoleAssignments(filter?: RoleAssignmentFilter): Promise<UserRoleAssignment[]>;
@@ -96,8 +122,8 @@ export declare class PrismaAuthzStore {
      * Roles and permissions are kept. (This adapter has no direct user permissions.)
      */
     removeUser(user: UserRef): Promise<void>;
-    /** The role names a user holds. */
-    getRolesForUser(user: UserRef): Promise<string[]>;
+    /** The role names a user holds, in a tenant scope (see {@link TenantScope}). */
+    getRolesForUser(user: UserRef, scope?: TenantScope): Promise<string[]>;
     /**
      * The flattened, distinct permission names a user has via their roles.
      *
@@ -107,12 +133,11 @@ export declare class PrismaAuthzStore {
      *
      * Fast path: when the injected client exposes `$queryRaw`, assemble the set in a
      * SINGLE database round-trip via one JOIN (3 round-trips → 1). On ANY failure
-     * (missing `$queryRaw`, custom `@@map` table names, non-Postgres identifier
-     * quoting, etc.) it degrades to {@link getPermissionsViaDelegates}, so correctness
+     * (custom `@@map` table names, non-Postgres identifier quoting, etc.) it degrades to {@link getPermissionsViaDelegates}, so correctness
      * is preserved everywhere and only the common (Postgres + documented schema) case
      * gets the speedup.
      */
-    getPermissionsForUser(user: UserRef): Promise<string[]>;
+    getPermissionsForUser(user: UserRef, scope?: TenantScope): Promise<string[]>;
     /**
      * The original three-query implementation (userRole → rolePermission → permission),
      * returning the same deduped permission-name set as {@link getPermissionsForUser}.
@@ -120,9 +145,9 @@ export declare class PrismaAuthzStore {
      * fast path throws.
      */
     private getPermissionsViaDelegates;
-    /** A user's roles + effective permissions in one shot. */
-    getUserAuthz(user: UserRef): Promise<UserAuthz>;
-    /** True when the user holds `permission` through any of their roles. */
-    userHasPermission(user: UserRef, permission: string): Promise<boolean>;
+    /** A user's roles + effective permissions in one shot, in a tenant scope. */
+    getUserAuthz(user: UserRef, scope?: TenantScope): Promise<UserAuthz>;
+    /** True when the user holds `permission` through any of their roles, in a tenant scope. */
+    userHasPermission(user: UserRef, permission: string, scope?: TenantScope): Promise<boolean>;
 }
 //# sourceMappingURL=prisma-authz.store.d.ts.map

package/dist/prisma-authz.store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prisma-authz.store.d.ts","sourceRoot":"","sources":["../src/prisma-authz.store.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,kBAAkB,EAIxB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC7B,MAAM,oBAAoB,CAAC;AAI5B,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC;AAEpF,sFAAsF;AACtF,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAOD;;;;;;;GAOG;AACH,qBACa,gBAAgB;IAGzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAGvB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAHP,MAAM,EAAE,qBAAqB,EAG7B,OAAO,GAAE,uBAA4B;IAGxD;;;OAGG;IACH,OAAO,CAAC,WAAW;IAUnB;;;;;OAKG;IACG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAMnC,+EAA+E;IACzE,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgB/C,qFAAqF;IAC/E,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAevC,UAAU;YAKV,gBAAgB;IAO9B,kFAAkF;IAC5E,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUnF,gFAAgF;IAC1E,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvF,gGAAgG;YAClF,aAAa;IAO3B;;;;OAIG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYpD;;;;;;OAMG;IACG,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAc9F;;;;OAIG;IACG,kBAAkB,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IA2BzF;;;OAGG;IACG,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAW1F;;;OAGG;IACG,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAU1F;;;;;;OAMG;IACG,YAAY,CAChB,IAAI,EAAE,OAAO,EACb,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,IAAI,CAAC;IAchB,uEAAuE;IACjE,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAoBlE;;;;;;;;OAQG;IACG,mBAAmB,CAAC,MAAM,GAAE,oBAAyB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAqC3F;;;OAGG;IACG,UAAU,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAO9C,mCAAmC;IAC7B,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAWvD;;;;;;;;;;;;;OAaG;IACG,qBAAqB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA0B7D;;;;;OAKG;YACW,0BAA0B;IAiBxC,0DAA0D;IACpD,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;IAQrD,wEAAwE;IAClE,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAI7E"}
+{"version":3,"file":"prisma-authz.store.d.ts","sourceRoot":"","sources":["../src/prisma-authz.store.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,kBAAkB,EAIxB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC7B,MAAM,oBAAoB,CAAC;AAI5B,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC;AAEpF;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,2EAA2E;AAC3E,eAAO,MAAM,aAAa,KAAK,CAAC;AAOhC;;;;;;;GAOG;AACH,qBACa,gBAAgB;IAGzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAGvB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAHP,MAAM,EAAE,qBAAqB,EAG7B,OAAO,GAAE,uBAA4B;IAGxD;;;OAGG;IACH,OAAO,CAAC,WAAW;IAUnB,kFAAkF;IAClF,OAAO,CAAC,WAAW;IAUnB,4FAA4F;IAC5F,OAAO,CAAC,WAAW;IAQnB,6EAA6E;IAC7E,OAAO,CAAC,MAAM,CAAC,SAAS;IAKxB;;;;;OAKG;IACG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAMnC,+EAA+E;IACzE,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgB/C,qFAAqF;IAC/E,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAevC,UAAU;YAKV,gBAAgB;IAO9B,kFAAkF;IAC5E,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUnF,gFAAgF;IAC1E,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvF,gGAAgG;YAClF,aAAa;IAO3B;;;;OAIG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYpD;;;;;;OAMG;IACG,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAc9F;;;;OAIG;IACG,kBAAkB,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IA2BzF;;;OAGG;IACG,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAc1F;;;;;OAKG;IACG,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB1F;;;;;;;OAOG;IACG,YAAY,CAChB,IAAI,EAAE,OAAO,EACb,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,IAAI,CAAC;IAmBhB;;;OAGG;IACG,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAyBvF;;;;;;;;;OASG;IACG,mBAAmB,CAAC,MAAM,GAAE,oBAAyB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAwC3F;;;OAGG;IACG,UAAU,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAO9C,gFAAgF;IAC1E,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAW5E;;;;;;;;;;;;OAYG;IACG,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAsClF;;;;;OAKG;YACW,0BAA0B;IAqBxC,6EAA6E;IACvE,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC;IAQ1E,2FAA2F;IACrF,iBAAiB,CACrB,IAAI,EAAE,OAAO,EACb,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,OAAO,CAAC;CAIpB"}

package/dist/prisma-authz.store.js

@@ -10,9 +10,12 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
+var PrismaAuthzStore_1;
 import { randomUUID } from 'node:crypto';
 import { DEFAULT_ROLE_SOURCE, compareUserRoleAssignments, normalizeUserRef, roleFilterNames, } from '@dudousxd/nestjs-authz/store-kit';
 import { PRISMA_AUTHZ_STORE_OPTIONS, PRISMA_CLIENT, } from './prisma-client.js';
+/** The tenant id of a GLOBAL role assignment (applies in every tenant). */
+export const GLOBAL_TENANT = '';
 // Optional Nest DI decorators — declared structurally so this package does not need a
 // hard runtime dependency on @nestjs/common for the POJO store (the module supplies the
 // real Inject token). The store is usable as a plain POJO: `new PrismaAuthzStore(client)`.
@@ -25,7 +28,7 @@ import { Inject, Injectable, Optional } from '@nestjs/common';
  * Same method surface as the TypeORM/MikroORM adapters. The user is referenced BY ID ONLY
  * — this package never owns a users table.
  */
-let PrismaAuthzStore = class PrismaAuthzStore {
+let PrismaAuthzStore = PrismaAuthzStore_1 = class PrismaAuthzStore {
     client;
     options;
     constructor(client, options = {}) {
@@ -44,6 +47,29 @@ let PrismaAuthzStore = class PrismaAuthzStore {
         }
         return {};
     }
+    /** The `tenantId` value of a written assignment (`{}` without `tenantScoped`). */
+    tenantField(tenantId) {
+        if (this.options?.tenantScoped)
+            return { tenantId: tenantId ?? GLOBAL_TENANT };
+        if (tenantId !== undefined && tenantId !== GLOBAL_TENANT) {
+            throw new Error(`PrismaAuthzStore: a tenant-scoped role assignment needs \`tenantId String @default("")\` on the UserRole model (in its @@id) and the store built with { tenantScoped: true }.`);
+        }
+        return {};
+    }
+    /** Assignments visible in a scope: global ones, plus the tenant's own when one is given. */
+    tenantWhere(scope) {
+        if (!this.options?.tenantScoped)
+            return {};
+        const tenantId = scope?.tenantId ?? GLOBAL_TENANT;
+        return tenantId === GLOBAL_TENANT
+            ? { tenantId: GLOBAL_TENANT }
+            : { tenantId: { in: [GLOBAL_TENANT, tenantId] } };
+    }
+    /** The public `tenantId` of a stored row: `null` for a global assignment. */
+    static rowTenant(row) {
+        const value = row.tenantId;
+        return value === undefined || value === null || value === GLOBAL_TENANT ? null : value;
+    }
     /**
      * No-op: Prisma is schema-first / consumer-managed. Declare the RBAC models in your
      * `schema.prisma` (see {@link PrismaAuthzClientLike}) and apply them with
@@ -206,26 +232,37 @@ let PrismaAuthzStore = class PrismaAuthzStore {
     async assignRole(user, roleName, opts) {
         const { type, id } = normalizeUserRef(user);
         const source = this.sourceField(opts?.source);
+        const tenant = this.tenantField(opts?.tenantId);
         const roleId = await this.createRole(roleName);
         const existing = await this.client.userRole.findFirst({
-            where: { userType: type, userId: id, roleId, ...source },
+            where: { userType: type, userId: id, roleId, ...source, ...tenant },
         });
         if (existing)
             return;
-        await this.client.userRole.create({ data: { userType: type, userId: id, roleId, ...source } });
+        await this.client.userRole.create({
+            data: { userType: type, userId: id, roleId, ...source, ...tenant },
+        });
     }
     /**
      * Remove a role from a user. No-op if the role or assignment is absent. With `{ source }` only
-     * that source's assignment goes; without it, the role is removed from every source.
+     * that source's assignment goes; without it, the role is removed from every source. With
+     * `tenantScoped`, `{ tenantId }` removes the assignment in that tenant and omitting it removes
+     * the global one.
      */
     async removeRole(user, roleName, opts) {
         const { type, id } = normalizeUserRef(user);
         const source = opts?.source === undefined ? {} : this.sourceField(opts.source);
+        if (!this.options?.tenantScoped &&
+            opts?.tenantId !== undefined &&
+            opts.tenantId !== GLOBAL_TENANT) {
+            return; // no tenant column: there is no tenant-scoped assignment to remove
+        }
+        const tenant = this.tenantField(opts?.tenantId);
         const roleId = await this.findRoleId(roleName);
         if (!roleId)
             return;
         await this.client.userRole.deleteMany({
-            where: { userType: type, userId: id, roleId, ...source },
+            where: { userType: type, userId: id, roleId, ...source, ...tenant },
         });
     }
     /**
@@ -233,27 +270,36 @@ let PrismaAuthzStore = class PrismaAuthzStore {
      * `roleNames` — e.g. an SSO/SCIM sync calls `setUserRoles(user, mappedRoles, { source: 'sso' })`
      * on every login; other sources' assignments are untouched. Roles are created by name when
      * missing. Atomic when the client has `$transaction`. Without `roleSources: true` there is only
-     * one (implicit manual) source, so this replaces ALL of the user's roles.
+     * one (implicit manual) source, so this replaces ALL of the user's roles. With `tenantScoped` it
+     * replaces the assignments of one tenant (`{ tenantId }`), or the global ones when omitted.
      */
     async setUserRoles(user, roleNames, opts) {
         const { type, id } = normalizeUserRef(user);
         const source = this.sourceField(opts?.source);
+        const tenant = this.tenantField(opts?.tenantId);
         const roleIds = [];
         for (const name of new Set(roleNames))
             roleIds.push(await this.createRole(name));
         const replace = async (client) => {
-            await client.userRole.deleteMany({ where: { userType: type, userId: id, ...source } });
+            await client.userRole.deleteMany({
+                where: { userType: type, userId: id, ...source, ...tenant },
+            });
             for (const roleId of roleIds) {
-                await client.userRole.create({ data: { userType: type, userId: id, roleId, ...source } });
+                await client.userRole.create({
+                    data: { userType: type, userId: id, roleId, ...source, ...tenant },
+                });
             }
         };
         await this.inTransaction(replace);
     }
-    /** Every role assignment of a user, one entry per `(role, source)`. */
-    async getRoleAssignments(user) {
+    /**
+     * Every role assignment of a user visible in a tenant scope (global ones always; the tenant's
+     * own with `{ tenantId }`), one entry per `(role, source, tenant)`.
+     */
+    async getRoleAssignments(user, scope) {
         const { type, id } = normalizeUserRef(user);
         const assignments = await this.client.userRole.findMany({
-            where: { userType: type, userId: id },
+            where: { userType: type, userId: id, ...this.tenantWhere(scope) },
         });
         if (assignments.length === 0)
             return [];
@@ -266,23 +312,30 @@ let PrismaAuthzStore = class PrismaAuthzStore {
             .map((a) => ({
             role: nameById.get(a.roleId),
             source: a.source ?? DEFAULT_ROLE_SOURCE,
-            tenantId: null,
+            tenantId: PrismaAuthzStore_1.rowTenant(a),
         }))
-            .sort((a, b) => a.role.localeCompare(b.role) || a.source.localeCompare(b.source));
+            .sort((a, b) => a.role.localeCompare(b.role) ||
+            a.source.localeCompare(b.source) ||
+            (a.tenantId ?? '').localeCompare(b.tenantId ?? ''));
     }
     /**
      * Raw role-assignment rows for admin listings — e.g. who holds a role (`{ role: 'admin' }`) or
      * a user's assignments with their sources (`{ user }`). `role` accepts one name or a list;
      * `user` and `source` narrow further. Ordered by `(userType, userId, role, source)`.
      *
-     * This adapter has no tenant-scoped assignments — every row is global (`tenantId: null`). So
-     * `tenantId: undefined` or `null` lists everything, and a tenant id string matches nothing.
+     * `tenantId`: omitted = no tenant filter; `null` = global assignments only; a string = exactly
+     * that tenant's scoped assignments. Without `tenantScoped: true` every row is global
+     * (`tenantId: null`), so a tenant id string matches nothing.
      * Without `roleSources: true` every row is `'manual'`, so another `source` matches nothing.
      */
     async listRoleAssignments(filter = {}) {
-        if (typeof filter.tenantId === 'string')
-            return [];
         const where = {};
+        if (filter.tenantId !== undefined) {
+            if (this.options?.tenantScoped)
+                where.tenantId = filter.tenantId ?? GLOBAL_TENANT;
+            else if (filter.tenantId !== null)
+                return [];
+        }
         if (filter.source !== undefined) {
             if (this.options?.roleSources)
                 where.source = filter.source;
@@ -317,7 +370,7 @@ let PrismaAuthzStore = class PrismaAuthzStore {
             userId: a.userId,
             role: nameById.get(a.roleId),
             source: a.source ?? DEFAULT_ROLE_SOURCE,
-            tenantId: null,
+            tenantId: PrismaAuthzStore_1.rowTenant(a),
         }))
             .sort(compareUserRoleAssignments);
     }
@@ -330,11 +383,11 @@ let PrismaAuthzStore = class PrismaAuthzStore {
         await this.client.userRole.deleteMany({ where: { userType: type, userId: id } });
     }
     // --- queries ---
-    /** The role names a user holds. */
-    async getRolesForUser(user) {
+    /** The role names a user holds, in a tenant scope (see {@link TenantScope}). */
+    async getRolesForUser(user, scope) {
         const { type, id } = normalizeUserRef(user);
         const assignments = await this.client.userRole.findMany({
-            where: { userType: type, userId: id },
+            where: { userType: type, userId: id, ...this.tenantWhere(scope) },
         });
         if (assignments.length === 0)
             return [];
@@ -351,20 +404,31 @@ let PrismaAuthzStore = class PrismaAuthzStore {
      *
      * Fast path: when the injected client exposes `$queryRaw`, assemble the set in a
      * SINGLE database round-trip via one JOIN (3 round-trips → 1). On ANY failure
-     * (missing `$queryRaw`, custom `@@map` table names, non-Postgres identifier
-     * quoting, etc.) it degrades to {@link getPermissionsViaDelegates}, so correctness
+     * (custom `@@map` table names, non-Postgres identifier quoting, etc.) it degrades to {@link getPermissionsViaDelegates}, so correctness
      * is preserved everywhere and only the common (Postgres + documented schema) case
      * gets the speedup.
      */
-    async getPermissionsForUser(user) {
+    async getPermissionsForUser(user, scope) {
         const { type, id } = normalizeUserRef(user);
-        const queryRaw = this.client.$queryRaw;
-        if (typeof queryRaw === 'function') {
+        // Call `$queryRaw` as a method ON the client, never detached: the real
+        // `PrismaClient.$queryRaw` reads `this`, so an unbound reference throws and would
+        // silently send every check down the slow path.
+        const client = this.client;
+        if (typeof client.$queryRaw === 'function') {
             try {
                 // Single JOIN across the three documented `@@map` tables. Identifiers are
                 // literal + double-quoted (Postgres); the user `${type}`/`${id}` VALUES go
                 // through the tagged template as BOUND params — never string-concatenated.
-                const rows = await queryRaw `
+                const rows = this.options?.tenantScoped
+                    ? await client.$queryRaw `
+          SELECT DISTINCT p."name" AS name
+          FROM "authz_permissions" p
+          JOIN "authz_role_permission" rp ON rp."permissionId" = p."id"
+          JOIN "authz_user_role" ur ON ur."roleId" = rp."roleId"
+          WHERE ur."userType" = ${type} AND ur."userId" = ${id}
+            AND ur."tenantId" IN (${GLOBAL_TENANT}, ${scope?.tenantId ?? GLOBAL_TENANT})
+        `
+                    : await client.$queryRaw `
           SELECT DISTINCT p."name" AS name
           FROM "authz_permissions" p
           JOIN "authz_role_permission" rp ON rp."permissionId" = p."id"
@@ -375,10 +439,10 @@ let PrismaAuthzStore = class PrismaAuthzStore {
             }
             catch {
                 // Raw path unsupported for this client/schema/dialect — fall back below.
-                return this.getPermissionsViaDelegates(type, id);
+                return this.getPermissionsViaDelegates(type, id, scope);
             }
         }
-        return this.getPermissionsViaDelegates(type, id);
+        return this.getPermissionsViaDelegates(type, id, scope);
     }
     /**
      * The original three-query implementation (userRole → rolePermission → permission),
@@ -386,9 +450,9 @@ let PrismaAuthzStore = class PrismaAuthzStore {
      * Used directly when `$queryRaw` is unavailable, and as the fallback when the raw
      * fast path throws.
      */
-    async getPermissionsViaDelegates(type, id) {
+    async getPermissionsViaDelegates(type, id, scope) {
         const assignments = await this.client.userRole.findMany({
-            where: { userType: type, userId: id },
+            where: { userType: type, userId: id, ...this.tenantWhere(scope) },
         });
         if (assignments.length === 0)
             return [];
@@ -404,21 +468,21 @@ let PrismaAuthzStore = class PrismaAuthzStore {
         });
         return [...new Set(permissions.map((p) => p.name))];
     }
-    /** A user's roles + effective permissions in one shot. */
-    async getUserAuthz(user) {
+    /** A user's roles + effective permissions in one shot, in a tenant scope. */
+    async getUserAuthz(user, scope) {
         const [roles, permissions] = await Promise.all([
-            this.getRolesForUser(user),
-            this.getPermissionsForUser(user),
+            this.getRolesForUser(user, scope),
+            this.getPermissionsForUser(user, scope),
         ]);
         return { roles, permissions };
     }
-    /** True when the user holds `permission` through any of their roles. */
-    async userHasPermission(user, permission) {
-        const permissions = await this.getPermissionsForUser(user);
+    /** True when the user holds `permission` through any of their roles, in a tenant scope. */
+    async userHasPermission(user, permission, scope) {
+        const permissions = await this.getPermissionsForUser(user, scope);
         return permissions.includes(permission);
     }
 };
-PrismaAuthzStore = __decorate([
+PrismaAuthzStore = PrismaAuthzStore_1 = __decorate([
     Injectable(),
     __param(0, Inject(PRISMA_CLIENT)),
     __param(1, Optional()),

package/dist/prisma-authz.store.js.map

@@ -1 +1 @@
-{"version":3,"file":"prisma-authz.store.js","sourceRoot":"","sources":["../src/prisma-authz.store.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,mBAAmB,EAMnB,0BAA0B,EAC1B,gBAAgB,EAChB,eAAe,GAChB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,0BAA0B,EAC1B,aAAa,GAGd,MAAM,oBAAoB,CAAC;AAW5B,sFAAsF;AACtF,wFAAwF;AACxF,2FAA2F;AAC3F,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE9D;;;;;;;GAOG;AAEI,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAGR;IAGA;IALnB,YAEmB,MAA6B,EAG7B,UAAmC,EAAE;QAHrC,WAAM,GAAN,MAAM,CAAuB;QAG7B,YAAO,GAAP,OAAO,CAA8B;IACrD,CAAC;IAEJ;;;OAGG;IACK,WAAW,CAAC,MAA0B;QAC5C,IAAI,IAAI,CAAC,OAAO,EAAE,WAAW;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC;QAChF,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,mBAAmB,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CACb,kCAAkC,MAAM,mKAAmK,CAC5M,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY;QAChB,6CAA6C;IAC/C,CAAC;IAED,2DAA2D;IAE3D,+EAA+E;IAC/E,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;gBACxC,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;aACrE,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,EAAY,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,IAAI,CAAC,CAAC;YACxE,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;gBAC9C,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;aACrE,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,EAAY,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,IAAI,CAAC,CAAC;YAC9E,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,IAAY;QACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAClE,OAAO,GAAG,EAAE,EAAwB,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACxE,OAAO,GAAG,EAAE,EAAwB,CAAC;IACvC,CAAC;IAED,4BAA4B;IAE5B,kFAAkF;IAClF,KAAK,CAAC,oBAAoB,CAAC,QAAgB,EAAE,cAAsB;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC;YAC1D,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;SAChC,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,OAAO;QACrB,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,wBAAwB,CAAC,QAAgB,EAAE,cAAsB;QACrE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY;YAAE,OAAO;QACrC,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,gGAAgG;IACxF,KAAK,CAAC,aAAa,CAAI,EAAiD;QAC9E,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YACnD,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAyB,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAM,CAAC;QACtF,CAAC;QACD,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,QAAgB;QAC/B,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACzC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YACxE,MAAM,MAAM,GAAG,IAAI,EAAE,EAAwB,CAAC;YAC9C,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YAC1B,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACxD,MAAM,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAC9D,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,mBAAmB,CAAC,QAAgB,EAAE,eAAkC;QAC5E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,aAAa,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACxC,MAAM,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAC9D,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;gBACzC,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;YACzE,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,kBAAkB,CAAC,SAA4B;QACnD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QACtC,MAAM,GAAG,GAA6B,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAClF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QACnC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAY,EAAE,CAAC,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC;QACnF,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,MAAM,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC;YACtD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;SACpD,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QACnC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;YACxD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAsB,CAAC,CAAC,CAAC,EAAE,EAAE;SAChF,CAAC,CAAC;QACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAY,EAAE,CAAC,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC;QAC3F,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAgB,CAAC,CAAC;YACrD,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,YAAsB,CAAC,CAAC;YACnE,IAAI,IAAI,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAClF,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACnD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,sBAAsB;IAEtB;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB,EAAE,IAAwB;QACxE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YACpD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE;SACzD,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,OAAO;QACrB,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;IACjG,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB,EAAE,IAAwB;QACxE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;YACpC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE;SACzD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAChB,IAAa,EACb,SAA4B,EAC5B,IAAwB;QAExB,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACjF,MAAM,OAAO,GAAG,KAAK,EAAE,MAA6B,EAAE,EAAE;YACtD,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;YACvF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;YAC5F,CAAC;QACH,CAAC,CAAC;QACF,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,kBAAkB,CAAC,IAAa;QACpC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;SACtC,CAAC,CAAC;QACH,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC5C,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC,CAAC,EAAE,EAAE;SAChF,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAY,EAAE,CAAC,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC;QAC/E,OAAO,WAAW;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC;aAC/C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAgB,CAAW;YAChD,MAAM,EAAG,CAAC,CAAC,MAA6B,IAAI,mBAAmB;YAC/D,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACtF,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,mBAAmB,CAAC,SAA+B,EAAE;QACzD,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QACnD,MAAM,KAAK,GAA4B,EAAE,CAAC;QAC1C,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,IAAI,CAAC,OAAO,EAAE,WAAW;gBAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;iBACvD,IAAI,MAAM,CAAC,MAAM,KAAK,mBAAmB;gBAAE,OAAO,EAAE,CAAC;QAC5D,CAAC;QACD,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;YACtF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YAClC,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAY,CAAC,EAAE,CAAC;QAC1D,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnD,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;YACtB,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;QACpB,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC5C,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC,CAAC,EAAE,EAAE;SAChF,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAY,EAAE,CAAC,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC;QAC/E,OAAO,WAAW;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC;aAC/C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,QAAQ,EAAE,CAAC,CAAC,QAAkB;YAC9B,MAAM,EAAE,CAAC,CAAC,MAAgB;YAC1B,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAgB,CAAW;YAChD,MAAM,EAAG,CAAC,CAAC,MAA6B,IAAI,mBAAmB;YAC/D,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;aACF,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACtC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,IAAa;QAC5B,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,kBAAkB;IAElB,mCAAmC;IACnC,KAAK,CAAC,eAAe,CAAC,IAAa;QACjC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;SACtC,CAAC,CAAC;QACH,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC,CAAC,CAAC;QACzE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAClF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAc,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,qBAAqB,CAAC,IAAa;QACvC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAE5C,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QACvC,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,0EAA0E;gBAC1E,2EAA2E;gBAC3E,2EAA2E;gBAC3E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAyB;;;;;kCAK1B,IAAI,sBAAsB,EAAE;SACrD,CAAC;gBACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,yEAAyE;gBACzE,OAAO,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,0BAA0B,CAAC,IAAY,EAAE,EAAU;QAC/D,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;SACtC,CAAC,CAAC;QACH,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC;YACtD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE;SACnC,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAsB,CAAC,CAAC,CAAC,CAAC;QAC/E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;YACxD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE;SACrC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,YAAY,CAAC,IAAa;QAC9B,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAC1B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC;SACjC,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChC,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,iBAAiB,CAAC,IAAa,EAAE,UAAkB;QACvD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC3D,OAAO,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;CACF,CAAA;AA9YY,gBAAgB;IAD5B,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,aAAa,CAAC,CAAA;IAErB,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,MAAM,CAAC,0BAA0B,CAAC,CAAA;;GAL1B,gBAAgB,CA8Y5B"}
+{"version":3,"file":"prisma-authz.store.js","sourceRoot":"","sources":["../src/prisma-authz.store.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,mBAAmB,EAMnB,0BAA0B,EAC1B,gBAAgB,EAChB,eAAe,GAChB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,0BAA0B,EAC1B,aAAa,GAGd,MAAM,oBAAoB,CAAC;AAuB5B,2EAA2E;AAC3E,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAEhC,sFAAsF;AACtF,wFAAwF;AACxF,2FAA2F;AAC3F,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE9D;;;;;;;GAOG;AAEI,IAAM,gBAAgB,wBAAtB,MAAM,gBAAgB;IAGR;IAGA;IALnB,YAEmB,MAA6B,EAG7B,UAAmC,EAAE;QAHrC,WAAM,GAAN,MAAM,CAAuB;QAG7B,YAAO,GAAP,OAAO,CAA8B;IACrD,CAAC;IAEJ;;;OAGG;IACK,WAAW,CAAC,MAA0B;QAC5C,IAAI,IAAI,CAAC,OAAO,EAAE,WAAW;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,mBAAmB,EAAE,CAAC;QAChF,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,mBAAmB,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CACb,kCAAkC,MAAM,mKAAmK,CAC5M,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,kFAAkF;IAC1E,WAAW,CAAC,QAA4B;QAC9C,IAAI,IAAI,CAAC,OAAO,EAAE,YAAY;YAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,IAAI,aAAa,EAAE,CAAC;QAC/E,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,+KAA+K,CAChL,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,4FAA4F;IACpF,WAAW,CAAC,KAA8B;QAChD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY;YAAE,OAAO,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAQ,IAAI,aAAa,CAAC;QAClD,OAAO,QAAQ,KAAK,aAAa;YAC/B,CAAC,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE;YAC7B,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;IACtD,CAAC;IAED,6EAA6E;IACrE,MAAM,CAAC,SAAS,CAAC,GAA2B;QAClD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAqC,CAAC;QACxD,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IACzF,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY;QAChB,6CAA6C;IAC/C,CAAC;IAED,2DAA2D;IAE3D,+EAA+E;IAC/E,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;gBACxC,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;aACrE,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,EAAY,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,IAAI,CAAC,CAAC;YACxE,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;gBAC9C,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;aACrE,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,EAAY,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,IAAI,CAAC,CAAC;YAC9E,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,IAAY;QACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAClE,OAAO,GAAG,EAAE,EAAwB,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACxE,OAAO,GAAG,EAAE,EAAwB,CAAC;IACvC,CAAC;IAED,4BAA4B;IAE5B,kFAAkF;IAClF,KAAK,CAAC,oBAAoB,CAAC,QAAgB,EAAE,cAAsB;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC;YAC1D,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;SAChC,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,OAAO;QACrB,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,wBAAwB,CAAC,QAAgB,EAAE,cAAsB;QACrE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY;YAAE,OAAO;QACrC,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,gGAAgG;IACxF,KAAK,CAAC,aAAa,CAAI,EAAiD;QAC9E,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YACnD,OAAO,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAyB,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAM,CAAC;QACtF,CAAC;QACD,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,QAAgB;QAC/B,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACzC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YACxE,MAAM,MAAM,GAAG,IAAI,EAAE,EAAwB,CAAC;YAC9C,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YAC1B,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACxD,MAAM,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAC9D,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,mBAAmB,CAAC,QAAgB,EAAE,eAAkC;QAC5E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,aAAa,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACxC,MAAM,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAC9D,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;gBACzC,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;YACzE,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,kBAAkB,CAAC,SAA4B;QACnD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QACtC,MAAM,GAAG,GAA6B,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QACnC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAClF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QACnC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAY,EAAE,CAAC,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC;QACnF,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,MAAM,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC;YACtD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;SACpD,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QACnC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;YACxD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAsB,CAAC,CAAC,CAAC,EAAE,EAAE;SAChF,CAAC,CAAC;QACH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAY,EAAE,CAAC,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC;QAC3F,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAgB,CAAC,CAAC;YACrD,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,YAAsB,CAAC,CAAC;YACnE,IAAI,IAAI,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAClF,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACnD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,sBAAsB;IAEtB;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB,EAAE,IAAwB;QACxE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YACpD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE;SACpE,CAAC,CAAC;QACH,IAAI,QAAQ;YAAE,OAAO;QACrB,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAChC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE;SACnE,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB,EAAE,IAAwB;QACxE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/E,IACE,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY;YAC3B,IAAI,EAAE,QAAQ,KAAK,SAAS;YAC5B,IAAI,CAAC,QAAQ,KAAK,aAAa,EAC/B,CAAC;YACD,OAAO,CAAC,mEAAmE;QAC7E,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;YACpC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE;SACpE,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,YAAY,CAChB,IAAa,EACb,SAA4B,EAC5B,IAAwB;QAExB,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChD,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACjF,MAAM,OAAO,GAAG,KAAK,EAAE,MAA6B,EAAE,EAAE;YACtD,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAC/B,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE;aAC5D,CAAC,CAAC;YACH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAC3B,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE;iBACnE,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;QACF,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,kBAAkB,CAAC,IAAa,EAAE,KAAmB;QACzD,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE;SAClE,CAAC,CAAC;QACH,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC5C,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC,CAAC,EAAE,EAAE;SAChF,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAY,EAAE,CAAC,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC;QAC/E,OAAO,WAAW;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC;aAC/C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAgB,CAAW;YAChD,MAAM,EAAG,CAAC,CAAC,MAA6B,IAAI,mBAAmB;YAC/D,QAAQ,EAAE,kBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;SACxC,CAAC,CAAC;aACF,IAAI,CACH,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACP,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5B,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC;YAChC,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CACrD,CAAC;IACN,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,mBAAmB,CAAC,SAA+B,EAAE;QACzD,MAAM,KAAK,GAA4B,EAAE,CAAC;QAC1C,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,IAAI,CAAC,OAAO,EAAE,YAAY;gBAAE,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,aAAa,CAAC;iBAC7E,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;gBAAE,OAAO,EAAE,CAAC;QAC/C,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,IAAI,CAAC,OAAO,EAAE,WAAW;gBAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;iBACvD,IAAI,MAAM,CAAC,MAAM,KAAK,mBAAmB;gBAAE,OAAO,EAAE,CAAC;QAC5D,CAAC;QACD,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;YACtF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YAClC,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAY,CAAC,EAAE,CAAC;QAC1D,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnD,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;YACtB,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC;QACpB,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC5C,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC,CAAC,EAAE,EAAE;SAChF,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAY,EAAE,CAAC,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC;QAC/E,OAAO,WAAW;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC;aAC/C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,QAAQ,EAAE,CAAC,CAAC,QAAkB;YAC9B,MAAM,EAAE,CAAC,CAAC,MAAgB;YAC1B,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAgB,CAAW;YAChD,MAAM,EAAG,CAAC,CAAC,MAA6B,IAAI,mBAAmB;YAC/D,QAAQ,EAAE,kBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;SACxC,CAAC,CAAC;aACF,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACtC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,IAAa;QAC5B,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,kBAAkB;IAElB,gFAAgF;IAChF,KAAK,CAAC,eAAe,CAAC,IAAa,EAAE,KAAmB;QACtD,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE;SAClE,CAAC,CAAC;QACH,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC,CAAC,CAAC;QACzE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAClF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAc,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,qBAAqB,CAAC,IAAa,EAAE,KAAmB;QAC5D,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAE5C,uEAAuE;QACvE,kFAAkF;QAClF,gDAAgD;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,0EAA0E;gBAC1E,2EAA2E;gBAC3E,2EAA2E;gBAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY;oBACrC,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,CAAyB;;;;;kCAKzB,IAAI,sBAAsB,EAAE;oCAC1B,aAAa,KAAK,KAAK,EAAE,QAAQ,IAAI,aAAa;SAC7E;oBACC,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,CAAyB;;;;;kCAKzB,IAAI,sBAAsB,EAAE;SACrD,CAAC;gBACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,yEAAyE;gBACzE,OAAO,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC,0BAA0B,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,0BAA0B,CACtC,IAAY,EACZ,EAAU,EACV,KAA8B;QAE9B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE;SAClE,CAAC,CAAC;QACH,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAgB,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC;YACtD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE;SACnC,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAsB,CAAC,CAAC,CAAC,CAAC;QAC/E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;YACxD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE;SACrC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAc,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,YAAY,CAAC,IAAa,EAAE,KAAmB;QACnD,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC;YACjC,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC;SACxC,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChC,CAAC;IAED,2FAA2F;IAC3F,KAAK,CAAC,iBAAiB,CACrB,IAAa,EACb,UAAkB,EAClB,KAAmB;QAEnB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClE,OAAO,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;CACF,CAAA;AA1dY,gBAAgB;IAD5B,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,aAAa,CAAC,CAAA;IAErB,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,MAAM,CAAC,0BAA0B,CAAC,CAAA;;GAL1B,gBAAgB,CA0d5B"}

package/dist/prisma-client.d.ts

@@ -47,8 +47,10 @@
  *   roleId   String
  *   // Only with `roleSources: true` (per-source assignments — see PrismaAuthzStore.setUserRoles):
  *   // source String @default("manual")
+ *   // Only with `tenantScoped: true` (tenant-scoped assignments, '' = global):
+ *   // tenantId String @default("")
  *
- *   @@id([userType, userId, roleId])          // with roleSources: @@id([userType, userId, roleId, source])
+ *   @@id([userType, userId, roleId])          // add `tenantId` and/or `source` to the @@id when enabled
  *   @@index([userType, userId])
  *   @@map("authz_user_role")
  * }
@@ -142,6 +144,13 @@ export interface PrismaAuthzStoreOptions {
      * `setUserRoles(…, { source })` for a non-default source throw.
      */
     roleSources?: boolean;
+    /**
+     * Tenant-scoped role assignments. Requires a `tenantId String @default("")` column on the
+     * `UserRole` model, included in its `@@id` (`''` = a global assignment). Default `false`: the
+     * schema keeps working unchanged, every assignment is global, and a `tenantId` on a write
+     * throws.
+     */
+    tenantScoped?: boolean;
 }
 /** DI token for optional {@link PrismaAuthzStoreOptions}. */
 export declare const PRISMA_AUTHZ_STORE_OPTIONS: unique symbol;

package/dist/prisma-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prisma-client.d.ts","sourceRoot":"","sources":["../src/prisma-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkFG;AAEH;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAElC,MAAM,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAE1C,SAAS,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAE9C,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAE/C,UAAU,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9D;AAED,gFAAgF;AAChF,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,UAAU,EAAE,mBAAmB,CAAC;IAChC,cAAc,EAAE,mBAAmB,CAAC;IACpC,QAAQ,EAAE,mBAAmB,CAAC;IAE9B;;;;;;;;;;;;OAYG;IAEH,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAEnF;;;;OAIG;IAEH,YAAY,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACpE;AAED,4CAA4C;AAC5C,MAAM,WAAW,uBAAuB;IACtC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,6DAA6D;AAC7D,eAAO,MAAM,0BAA0B,eAA4D,CAAC;AAEpG;;;GAGG;AACH,eAAO,MAAM,aAAa,eAAqD,CAAC"}
+{"version":3,"file":"prisma-client.d.ts","sourceRoot":"","sources":["../src/prisma-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AAEH;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAElC,MAAM,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAE1C,SAAS,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAE9C,QAAQ,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAE/C,UAAU,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9D;AAED,gFAAgF;AAChF,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,UAAU,EAAE,mBAAmB,CAAC;IAChC,cAAc,EAAE,mBAAmB,CAAC;IACpC,QAAQ,EAAE,mBAAmB,CAAC;IAE9B;;;;;;;;;;;;OAYG;IAEH,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAEnF;;;;OAIG;IAEH,YAAY,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACpE;AAED,4CAA4C;AAC5C,MAAM,WAAW,uBAAuB;IACtC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,6DAA6D;AAC7D,eAAO,MAAM,0BAA0B,eAA4D,CAAC;AAEpG;;;GAGG;AACH,eAAO,MAAM,aAAa,eAAqD,CAAC"}

package/dist/prisma-client.js

@@ -47,8 +47,10 @@
  *   roleId   String
  *   // Only with `roleSources: true` (per-source assignments — see PrismaAuthzStore.setUserRoles):
  *   // source String @default("manual")
+ *   // Only with `tenantScoped: true` (tenant-scoped assignments, '' = global):
+ *   // tenantId String @default("")
  *
- *   @@id([userType, userId, roleId])          // with roleSources: @@id([userType, userId, roleId, source])
+ *   @@id([userType, userId, roleId])          // add `tenantId` and/or `source` to the @@id when enabled
  *   @@index([userType, userId])
  *   @@map("authz_user_role")
  * }

package/dist/prisma-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"prisma-client.js","sourceRoot":"","sources":["../src/prisma-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkFG;AAiEH,6DAA6D;AAC7D,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;AAEpG;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC"}
+{"version":3,"file":"prisma-client.js","sourceRoot":"","sources":["../src/prisma-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AAwEH,6DAA6D;AAC7D,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;AAEpG;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC"}

package/dist/tenancy.d.ts

@@ -0,0 +1,100 @@
+import { type UserRef } from '@dudousxd/nestjs-authz/store-kit';
+import type { ModuleRef } from '@nestjs/core';
+/** A tenant as published by `@dudousxd/nestjs-context` (`Context.tenant()`). */
+export interface TenantRef {
+    id: string;
+    kind: string;
+    source: string;
+    slug?: string;
+    role?: string;
+}
+/** How the context says a lib must scope data right now (`Context.tenantFilter()`). */
+export type TenantFilter = {
+    mode: 'system';
+} | {
+    mode: 'all';
+} | {
+    mode: 'tenantless';
+} | {
+    mode: 'tenant';
+    tenant: TenantRef;
+};
+/**
+ * The RBAC module's `tenancy` option. `'inherit'` (default) follows `ContextModule`'s
+ * `tenancy.enabled`; `false` keeps this module out of tenancy.
+ */
+export type AuthzTenancyOption = 'inherit' | false | {
+    /** `'inherit'` (default) follows the context switch; a boolean overrides it. */
+    enabled?: 'inherit' | boolean;
+    /** Tenant kinds this module honours, instead of the context's `kinds`. */
+    kinds?: string[];
+    /**
+     * Accepted for the shared shape. It changes nothing here: a GLOBAL role assignment
+     * always applies, in every tenant.
+     */
+    nullRows?: 'tenantless' | 'shared';
+    /**
+     * Map the caller's role inside the context tenant (`tenant.role`) to authz roles that
+     * apply in that tenant's scope only, e.g. `{ owner: 'org_admin', member: 'org_member' }`.
+     * Unmapped roles grant nothing.
+     */
+    roles?: Record<string, string | readonly string[]>;
+};
+/**
+ * An explicit tenant for a check, from the user being checked. Return a tenant id to scope the
+ * check to it, `null` for the global scope, or `undefined` to fall back to the context.
+ */
+export type TenantResolver = (user: unknown) => string | null | undefined;
+/** The structural slice of nestjs-context's accessor this module reads. */
+export interface TenantContextAccessor {
+    tenantId?(): string | undefined;
+    userRef?(): {
+        type?: string;
+        id: string | number;
+    } | undefined;
+    tenancy?(): {
+        enabled: boolean;
+        kinds?: string[];
+    };
+    tenantFilter?(options?: {
+        kinds?: string[];
+    }): TenantFilter;
+}
+/** The tenant scope of one check, plus the roles `tenancy.roles` adds in that scope. */
+export interface RbacTenant {
+    scope: {
+        tenantId?: string;
+    };
+    roles: string[];
+}
+export interface ResolveRbacTenantInput {
+    /** The user as the Gate passed it. */
+    user: unknown;
+    /** The same user mapped to a store ref. */
+    ref: UserRef;
+    /** The module's explicit `tenant` resolver, if any. */
+    resolver?: TenantResolver | undefined;
+    /** The module's `tenancy` option. */
+    tenancy?: AuthzTenancyOption | undefined;
+    /** The context accessor found through DI, if any (else the global slot is read). */
+    accessor?: TenantContextAccessor | undefined;
+    /** With tenancy off, scope by the context's plain `tenantId()` (drizzle/typeorm behaviour). */
+    legacyContextTenant: boolean;
+}
+/**
+ * Precedence: the explicit `tenant` resolver, then (tenancy on) the context tenant filter, then
+ * (tenancy off) the adapter's behaviour without tenancy. `tenant` mode scopes to that tenant;
+ * `tenantless`, `all` and `system` use the global scope.
+ */
+export declare function resolveRbacTenant(input: ResolveRbacTenantInput): RbacTenant;
+/** A provider's per-instance cache for {@link rbacTenant}'s accessor lookup. */
+export interface TenantContextCache {
+    resolved: boolean;
+    value: TenantContextAccessor | undefined;
+}
+/** The tenant scope (and `tenancy.roles` roles) of one check for `user`. */
+export declare function rbacTenant(options: {
+    tenant?: TenantResolver | undefined;
+    tenancy?: AuthzTenancyOption | undefined;
+}, user: unknown, ref: UserRef, injected: TenantContextAccessor | undefined, moduleRef: ModuleRef | undefined, cache: TenantContextCache, legacyContextTenant: boolean): RbacTenant;
+//# sourceMappingURL=tenancy.d.ts.map

package/dist/tenancy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenancy.d.ts","sourceRoot":"","sources":["../src/tenancy.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,OAAO,EAAoB,MAAM,kCAAkC,CAAC;AAClF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,gFAAgF;AAChF,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,uFAAuF;AACvF,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GACf;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,GACtB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAE1C;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAC1B,SAAS,GACT,KAAK,GACL;IACE,gFAAgF;IAChF,OAAO,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC;IAC9B,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,YAAY,GAAG,QAAQ,CAAC;IACnC;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC,CAAC;CACpD,CAAC;AAEN;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;AAE1E,2EAA2E;AAC3E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,MAAM,GAAG,SAAS,CAAC;IAChC,OAAO,CAAC,IAAI;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAC/D,OAAO,CAAC,IAAI;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACnD,YAAY,CAAC,CAAC,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,YAAY,CAAC;CAC7D;AAyDD,wFAAwF;AACxF,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,sCAAsC;IACtC,IAAI,EAAE,OAAO,CAAC;IACd,2CAA2C;IAC3C,GAAG,EAAE,OAAO,CAAC;IACb,uDAAuD;IACvD,QAAQ,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IACtC,qCAAqC;IACrC,OAAO,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IACzC,oFAAoF;IACpF,QAAQ,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC7C,+FAA+F;IAC/F,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,UAAU,CAgC3E;AA0BD,gFAAgF;AAChF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC1C;AAED,4EAA4E;AAC5E,wBAAgB,UAAU,CACxB,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAA;CAAE,EAC1F,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,qBAAqB,GAAG,SAAS,EAC3C,SAAS,EAAE,SAAS,GAAG,SAAS,EAChC,KAAK,EAAE,kBAAkB,EACzB,mBAAmB,EAAE,OAAO,GAC3B,UAAU,CASZ"}

package/dist/tenancy.js

@@ -0,0 +1,128 @@
+// Tenancy for the RBAC module: which tenant scope a permission/role check runs in, and which
+// roles the caller's role inside the context tenant maps to. The same file ships in every
+// store adapter. It reads the @dudousxd/nestjs-context tenancy contract STRUCTURALLY (no import),
+// so it works with any context version, and with none: a missing or older context reads as
+// tenancy off.
+import { CONTEXT_ACCESSOR } from '@dudousxd/nestjs-authz';
+import { normalizeUserRef } from '@dudousxd/nestjs-authz/store-kit';
+const SLOT = Symbol.for('@dudousxd/nestjs-diagnostics:accessor');
+/** Is tenancy on for this module? Call per check: the context can change between requests. */
+function readTenancy(option, a) {
+    if (option === false)
+        return { enabled: false };
+    if (typeof a?.tenancy !== 'function' || typeof a.tenantFilter !== 'function') {
+        return { enabled: false };
+    }
+    const own = typeof option === 'object' ? option : {};
+    const inherit = own.enabled === undefined || own.enabled === 'inherit';
+    if (!(inherit ? a.tenancy().enabled : own.enabled))
+        return { enabled: false };
+    const kinds = own.kinds;
+    const tenantFilter = a.tenantFilter.bind(a);
+    return { enabled: true, filter: () => tenantFilter(kinds ? { kinds } : undefined) };
+}
+/** The accessor found through DI, else the global slot `ContextModule` publishes. */
+function effectiveAccessor(injected) {
+    if (injected)
+        return injected;
+    const slot = globalThis[SLOT];
+    const current = slot?.current;
+    return current && typeof current === 'object' ? current : undefined;
+}
+/** Today's behaviour without tenancy: the context's plain `tenantId()`, read defensively. */
+function legacyTenantId(accessor) {
+    if (!accessor || typeof accessor.tenantId !== 'function')
+        return undefined;
+    try {
+        return accessor.tenantId() ?? undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Is `ref` the context's current user? Tenant roles belong to the caller, nobody else. */
+function isContextUser(ref, accessor) {
+    let current;
+    try {
+        current = accessor?.userRef?.();
+    }
+    catch {
+        current = undefined;
+    }
+    if (!current || current.id === undefined || current.id === null)
+        return false;
+    const a = normalizeUserRef(ref);
+    const b = normalizeUserRef(current);
+    return a.type === b.type && a.id === b.id;
+}
+/**
+ * Precedence: the explicit `tenant` resolver, then (tenancy on) the context tenant filter, then
+ * (tenancy off) the adapter's behaviour without tenancy. `tenant` mode scopes to that tenant;
+ * `tenantless`, `all` and `system` use the global scope.
+ */
+export function resolveRbacTenant(input) {
+    const explicit = input.resolver ? input.resolver(input.user) : undefined;
+    const accessor = effectiveAccessor(input.accessor);
+    const tenancy = readTenancy(input.tenancy, accessor);
+    const filter = tenancy.enabled ? tenancy.filter() : undefined;
+    let scope;
+    if (explicit !== undefined) {
+        scope = explicit === null ? {} : { tenantId: explicit };
+    }
+    else if (filter) {
+        scope = filter.mode === 'tenant' ? { tenantId: filter.tenant.id } : {};
+    }
+    else if (input.legacyContextTenant) {
+        const id = legacyTenantId(input.accessor);
+        scope = id === undefined ? {} : { tenantId: id };
+    }
+    else {
+        scope = {};
+    }
+    const map = typeof input.tenancy === 'object' ? input.tenancy.roles : undefined;
+    let roles = [];
+    if (map &&
+        filter?.mode === 'tenant' &&
+        filter.tenant.role !== undefined &&
+        scope.tenantId === filter.tenant.id &&
+        Object.prototype.hasOwnProperty.call(map, filter.tenant.role) &&
+        isContextUser(input.ref, accessor)) {
+        const mapped = map[filter.tenant.role];
+        roles = typeof mapped === 'string' ? [mapped] : [...(mapped ?? [])];
+    }
+    return { scope, roles };
+}
+/**
+ * Locate the context accessor. Prefers a value injected into the module; falls back to a
+ * non-strict {@link ModuleRef} lookup so an accessor provided by ANY module (the app root, a
+ * global ContextModule) is still found: the RBAC module is global and its providers don't import
+ * the app's modules, so a plain `@Inject` would miss a root-provided accessor.
+ */
+function resolveTenantContext(injected, moduleRef, cache) {
+    if (injected)
+        return injected;
+    if (cache.resolved)
+        return cache.value;
+    cache.resolved = true;
+    if (moduleRef) {
+        try {
+            cache.value = moduleRef.get(CONTEXT_ACCESSOR, { strict: false });
+        }
+        catch {
+            cache.value = undefined;
+        }
+    }
+    return cache.value;
+}
+/** The tenant scope (and `tenancy.roles` roles) of one check for `user`. */
+export function rbacTenant(options, user, ref, injected, moduleRef, cache, legacyContextTenant) {
+    return resolveRbacTenant({
+        user,
+        ref,
+        resolver: options.tenant,
+        tenancy: options.tenancy,
+        accessor: resolveTenantContext(injected, moduleRef, cache),
+        legacyContextTenant,
+    });
+}
+//# sourceMappingURL=tenancy.js.map

package/dist/tenancy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenancy.js","sourceRoot":"","sources":["../src/tenancy.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,0FAA0F;AAC1F,kGAAkG;AAClG,2FAA2F;AAC3F,eAAe;AACf,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAgB,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AA0DlF,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;AAIjE,8FAA8F;AAC9F,SAAS,WAAW,CAClB,MAAsC,EACtC,CAAoC;IAEpC,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAChD,IAAI,OAAO,CAAC,EAAE,OAAO,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;QAC7E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC;IACvE,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9E,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACxB,MAAM,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;AACtF,CAAC;AAED,qFAAqF;AACrF,SAAS,iBAAiB,CACxB,QAA2C;IAE3C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,IAAI,GAAI,UAA2E,CAAC,IAAI,CAAC,CAAC;IAChG,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC;IAC9B,OAAO,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAE,OAAiC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjG,CAAC;AAED,6FAA6F;AAC7F,SAAS,cAAc,CAAC,QAA2C;IACjE,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,CAAC,QAAQ,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IAC3E,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,EAAE,IAAI,SAAS,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,SAAS,aAAa,CAAC,GAAY,EAAE,QAA2C;IAC9E,IAAI,OAA2D,CAAC;IAChE,IAAI,CAAC;QACH,OAAO,GAAG,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,SAAS,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,IAAI,OAAO,CAAC,EAAE,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAuBD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAA6B;IAC7D,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAE9D,IAAI,KAA4B,CAAC;IACjC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,KAAK,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC1D,CAAC;SAAM,IAAI,MAAM,EAAE,CAAC;QAClB,KAAK,GAAG,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,CAAC;SAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1C,KAAK,GAAG,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACnD,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,EAAE,CAAC;IACb,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,IAAI,KAAK,GAAa,EAAE,CAAC;IACzB,IACE,GAAG;QACH,MAAM,EAAE,IAAI,KAAK,QAAQ;QACzB,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;QAChC,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,MAAM,CAAC,EAAE;QACnC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QAC7D,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,EAClC,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,KAAK,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,QAA2C,EAC3C,SAAgC,EAChC,KAAsE;IAEtE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC;IACvC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;IACtB,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC;YACH,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC,GAAG,CAAwB,gBAAgB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1F,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC;AACrB,CAAC;AAQD,4EAA4E;AAC5E,MAAM,UAAU,UAAU,CACxB,OAA0F,EAC1F,IAAa,EACb,GAAY,EACZ,QAA2C,EAC3C,SAAgC,EAChC,KAAyB,EACzB,mBAA4B;IAE5B,OAAO,iBAAiB,CAAC;QACvB,IAAI;QACJ,GAAG;QACH,QAAQ,EAAE,OAAO,CAAC,MAAM;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;QAC1D,mBAAmB;KACpB,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dudousxd/nestjs-authz-prisma",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Prisma RBAC persistence for @dudousxd/nestjs-authz — roles, permissions, and a Gate seam (zero connection ownership, structural client).",
   "license": "MIT",
   "repository": {
@@ -38,29 +38,30 @@
     "CHANGELOG.md"
   ],
   "peerDependencies": {
-    "@dudousxd/nestjs-authz": ">=0.9.0 <0.10.0",
+    "@dudousxd/nestjs-authz": ">=0.10.0",
     "@nestjs/authorization": "^0.1.3",
     "@nestjs/common": "^12.0.0",
     "@nestjs/core": "^12.0.0",
     "reflect-metadata": ">=0.1.13"
   },
   "devDependencies": {
+    "@electric-sql/pglite": "0.4.6",
     "@nestjs/authorization": "0.1.3",
     "@nestjs/common": "12.0.1",
     "@nestjs/core": "12.0.1",
     "@nestjs/testing": "12.0.1",
     "@testcontainers/postgresql": "12.1.0",
-    "@types/node": "22.20.5",
+    "@types/node": "24.19.2",
     "@types/pg": "8.23.1",
     "pg": "8.23.0",
     "reflect-metadata": "0.2.2",
     "rxjs": "7.8.2",
     "typescript": "5.9.3",
     "vitest": "3.2.7",
-    "@dudousxd/nestjs-authz": "^0.9.0"
+    "@dudousxd/nestjs-authz": "^0.11.0"
   },
   "engines": {
-    "node": ">=22"
+    "node": ">=24"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json --incremental false",