@dudousxd/nestjs-authz-testing 0.1.1 → 0.2.0

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @dudousxd/nestjs-authz-testing
 
+## 0.2.0
+
+### Minor Changes
+
+- [#67](https://github.com/DavideCarvalho/nestjs-authz/pull/67) [`32e967f`](https://github.com/DavideCarvalho/nestjs-authz/commit/32e967ffbcd68a97e8effc77af9c16bbbafdc918) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - `buildGate` / `buildBoundGate` are async and compile a Nest testing module with the official
+  `AuthorizationModule` and `AuthzModule`, so decisions run through `AuthorizationService`.
+  `policies` takes classes (or providers) instead of instances; the `after` option is gone. New:
+  `createAuthzTestingModule()`, official-style `expectCan(gate, user, Policy, 'ability', ...args)`,
+  and `requirementsOf(Controller, 'method')`. Peers on `@nestjs/authorization`,
+  `@nestjs/common`/`core`/`testing` 12.
+
+### Patch Changes
+
+- [#67](https://github.com/DavideCarvalho/nestjs-authz/pull/67) [`32e967f`](https://github.com/DavideCarvalho/nestjs-authz/commit/32e967ffbcd68a97e8effc77af9c16bbbafdc918) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Fix packages that could be published without files their `exports` point to. `tsc` builds no longer use a `.tsbuildinfo` that can outlive `dist/` and skip emitting files. A new `check:exports` step (also `prepack`) fails the release if any `exports`/`main`/`types` path is missing.
+
 ## 0.1.1
 
 ### Patch Changes

package/README.md

@@ -1,34 +1,54 @@
 # `@dudousxd/nestjs-authz-testing`
 
-Test helpers for [`@dudousxd/nestjs-authz`](../core). Build a real `Gate`/`BoundGate`
-from fixture users, policies, gates, and an in-memory permission/role provider — no
-Nest module, no database — then assert verdicts with `expectCan` / `expectCannot`.
+Test helpers for [`@dudousxd/nestjs-authz`](../core) on
+[`@nestjs/authorization`](https://docs.nestjs.com/security/authorization). `buildGate` compiles
+a real Nest testing module with the official `AuthorizationModule` and `AuthzModule`, so every
+policy decision goes through the official `AuthorizationService`, exactly as in the app.
 
 ```ts
 import 'reflect-metadata';
-import { Policy } from '@dudousxd/nestjs-authz';
+import { Policy } from '@nestjs/authorization';
+import { PolicyFor } from '@dudousxd/nestjs-authz';
 import { buildGate, expectCan, expectCannot, FakePermissionProvider } from '@dudousxd/nestjs-authz-testing';
 
-@Policy(Post)
+@Policy()
+@PolicyFor(Post)
 class PostPolicy {
-  update(user, post) { return user?.id === post.authorId; }
+  update(user: User | null, post: Post) { return user?.id === post.authorId; }
 }
 
-const gate = buildGate({ policies: [new PostPolicy()] });
-await expectCan(gate, { id: 1 }, 'update', new Post(10, 1));
+const gate = await buildGate({ policies: [PostPolicy] });
+await expectCan(gate, { id: 1 }, PostPolicy, 'update', new Post(10, 1)); // official style
+await expectCan(gate, { id: 1 }, 'update', new Post(10, 1));             // via @PolicyFor(Post)
 await expectCannot(gate, { id: 2 }, 'update', new Post(10, 1));
 
-// RBAC seam, zero DB — wildcard grants work via the core matcher:
-const gate2 = buildGate({ permissionProvider: new FakePermissionProvider({ '1': ['posts.*'] }) });
+// RBAC seam, zero DB; wildcard grants work through the core matcher:
+const gate2 = await buildGate({ permissionProvider: new FakePermissionProvider({ '1': ['posts.*'] }) });
 await expectCan(gate2, { id: 1 }, 'posts.update');
 ```
 
+Assert what a route requires without booting HTTP:
+
+```ts
+expect(requirementsOf(PostController, 'publish')).toEqual([
+  { policy: PermissionPolicy, ability: 'has', staticArgs: ['posts.publish'], dynamic: false },
+]);
+```
+
 ## API
 
-- `buildGate(options?)` → `Gate` from `{ policies, gates, superAdmin, after, resolveRoles, permissionProvider, roleProvider }`.
-- `buildBoundGate(user, options?)` → `BoundGate` bound to a fixture user.
-- `expectCan(gate, user, ability, resource?)` / `expectCannot(...)` — assert the verdict
-  (accept a `Gate` + user, or a `BoundGate` with `undefined` user). `expectCannot`
-  treats an unresolved ability as "cannot".
+- `buildGate(options?)` → `Promise<Gate>`; `createAuthzTestingModule(options?)` →
+  `{ module, gate }` (close `module` when done). Options: `{ policies, providers, controllers,
+  gates, superAdmin, resolveRoles, resourceResolver, getUser, permissionProvider, roleProvider }`.
+  `policies` are classes (or providers, e.g. `{ provide: PostPolicy, useValue }`).
+- `buildBoundGate(user, options?)` → `Promise<BoundGate>`.
+- `expectCan(gate, user, ability, resource?)` / `expectCan(gate, user, Policy, ability, ...args)`,
+  and `expectCannot(...)`. Accept a `Gate` + user, or a `BoundGate` with `undefined` user.
+  `expectCannot` treats an unresolved ability as "cannot".
+- `requirementsOf(Controller, 'method')` — the official `@Can()` requirements the guard
+  enforces there, class-level first, with the arguments of static resolvers.
 - `FakePermissionProvider` / `FakeRoleProvider` — in-memory RBAC seams keyed by user id.
 - `AuthzAssertionError` — thrown on assertion failure.
+
+Migrating from 0.1: `buildGate` / `buildBoundGate` are now async, take policy classes instead of
+instances, and the `after` option is gone.

package/dist/index.d.ts

@@ -1,84 +1,99 @@
 /**
- * Test helpers for `@dudousxd/nestjs-authz`.
+ * Test helpers for `@dudousxd/nestjs-authz` on `@nestjs/authorization`.
  *
- * Build a real {@link Gate} (no Nest module, no DB) from fixture policies, ad-hoc
- * gates, hooks, and an optional in-memory permission/role provider — then assert
- * verdicts with {@link expectCan}/{@link expectCannot}. The helpers exercise the
- * SAME resolution path the production Gate uses, so a policy that passes here passes
- * in the app.
+ * {@link buildGate} compiles a real Nest testing module with the official
+ * `AuthorizationModule` and `AuthzModule`, so every policy decision goes through the
+ * official `AuthorizationService`, exactly as in the app. Assert with
+ * {@link expectCan} / {@link expectCannot}, and read what a route requires with
+ * {@link requirementsOf}.
  *
  * @example
  * ```ts
- * const gate = buildGate({ policies: [new PostPolicy()] });
- * await expectCan(gate, { id: 1 }, 'update', new Post(1, 1));
- * await expectCannot(gate, { id: 2 }, 'update', new Post(1, 1));
+ * const gate = await buildGate({ policies: [PostPolicy] });
+ * await expectCan(gate, { id: 1 }, 'update', new Post(10, 1));       // linked with @PolicyFor(Post)
+ * await expectCan(gate, { id: 1 }, PostPolicy, 'update', new Post(10, 1)); // official style
  * ```
  *
  * @module
  */
-import { type AfterHook, BoundGate, Gate, type GateFn, type PermissionProvider, type PolicyInstance, type Resource, type RoleProvider, type SuperAdminHook, type User } from '@dudousxd/nestjs-authz';
-export { FakePermissionProvider, FakeRoleProvider, } from './fakes.js';
+import { BoundGate, Gate, type GateFn, type PermissionProvider, type Resource, type ResourceResolver, type RoleProvider, type SuperAdminHook, type User } from '@dudousxd/nestjs-authz';
+import type { ExecutionContext, Provider, Type } from '@nestjs/common';
+import { type TestingModule } from '@nestjs/testing';
+export { FakePermissionProvider, FakeRoleProvider } from './fakes.js';
 export type { FakePermissionGrants } from './fakes.js';
 /** Fixture configuration for {@link buildGate}. Every field is optional. */
 export interface BuildGateOptions {
-    /**
-     * Policy INSTANCES to register (e.g. `new PostPolicy()`). Unlike the Nest module,
-     * the test helper does not run DI — pass already-constructed instances. Each MUST be
-     * `@Policy(Resource)`-decorated (the registry resolves by resource constructor and
-     * throws on an undecorated class, same as production).
-     */
-    policies?: PolicyInstance[];
-    /** Ad-hoc, model-less gates keyed by ability name (same as `gate.define(name, fn)`). */
+    /** Official `@Policy()` classes (or providers, e.g. `{ provide: PostPolicy, useValue }`). */
+    policies?: Provider[];
+    /** More providers the policies depend on. */
+    providers?: Provider[];
+    /** Controllers, when the test also boots routes. */
+    controllers?: Type<unknown>[];
+    /** Ad-hoc gates keyed by ability name (`gate.define(name, fn)`). */
     gates?: Record<string, GateFn>;
-    /** Global super-admin before-hook (Laravel `Gate::before`). */
+    /** The global super-admin hook. */
     superAdmin?: SuperAdminHook;
-    /** Global `after` hook (Laravel `Gate::after`). */
-    after?: AfterHook;
-    /** Override how a user's roles are derived (default reads `user.roles`/`user.role`). */
+    /** How roles are read off the user (default `user.roles` / `user.role`). */
     resolveRoles?: (user: User) => string[] | undefined | Promise<string[] | undefined>;
-    /**
-     * An in-memory {@link PermissionProvider} (the RBAC seam) — grants named abilities
-     * when the fixture user holds the permission. Use {@link FakePermissionProvider} for
-     * a zero-DB stand-in.
-     */
+    /** The resolver `byId()` uses. */
+    resourceResolver?: ResourceResolver;
+    /** The official `getUser`, for routes. */
+    getUser?: (context: ExecutionContext) => unknown;
+    /** An in-memory permission seam. See {@link FakePermissionProvider}. */
     permissionProvider?: PermissionProvider;
-    /** An in-memory {@link RoleProvider} for coarse role checks. Use {@link FakeRoleProvider}. */
+    /** An in-memory role seam. See {@link FakeRoleProvider}. */
     roleProvider?: RoleProvider;
 }
+/** The compiled testing module, initialized, and its {@link Gate}. */
+export interface AuthzTestingModule {
+    module: TestingModule;
+    gate: Gate;
+}
 /**
- * Build a real {@link Gate} from fixtures — no Nest container, no database. The
- * returned Gate behaves exactly like the production one (same hooks, same RBAC seam,
- * same resolution order); only the wiring is in-memory.
- */
-export declare function buildGate(options?: BuildGateOptions): Gate;
-/**
- * Build a {@link BoundGate} for a fixture `user` directly — sugar over
- * `buildGate(options).forUser(user)` for tests that focus on a single principal.
- */
-export declare function buildBoundGate(user: User, options?: BuildGateOptions): BoundGate;
-/**
- * Accept either a {@link Gate} (then `user` is required) or an already-bound
- * {@link BoundGate}. Lets the assertion helpers serve both styles.
+ * Compile and initialize a Nest testing module with the official `AuthorizationModule`,
+ * `AuthzModule` and the fixtures. Close `module` when done (or let the test process end).
  */
+export declare function createAuthzTestingModule(options?: BuildGateOptions): Promise<AuthzTestingModule>;
+/** A real {@link Gate} from fixtures. See {@link createAuthzTestingModule}. */
+export declare function buildGate(options?: BuildGateOptions): Promise<Gate>;
+/** A {@link BoundGate} for a fixture `user`: `(await buildGate(options)).forUser(user)`. */
+export declare function buildBoundGate(user: User, options?: BuildGateOptions): Promise<BoundGate>;
+/** A {@link Gate} (then `user` is required) or an already-bound {@link BoundGate}. */
 export type GateLike = Gate | BoundGate;
 /** A thrown assertion failure from {@link expectCan}/{@link expectCannot}. */
 export declare class AuthzAssertionError extends Error {
     constructor(message: string);
 }
+/** What a check names: a string ability (+ resource), or an official policy + ability (+ args). */
+type Check = [ability: string, resource?: Resource] | [policy: Type<unknown>, ability: string, ...args: unknown[]];
 /**
- * Assert the user CAN perform `ability` (optionally on `resource`). Resolves when
- * allowed; throws {@link AuthzAssertionError} when denied. Works with either a
- * {@link Gate} (+ `user`) or a {@link BoundGate} (pass `undefined` for `user`).
- *
- * @example await expectCan(gate, { id: 1 }, 'update', post);
- * @example await expectCan(boundGate, undefined, 'create');
+ * Assert the user CAN: `expectCan(gate, user, 'update', post)` or
+ * `expectCan(gate, user, PostPolicy, 'update', post)`. Throws {@link AuthzAssertionError}.
  */
-export declare function expectCan(gate: GateLike, user: User, ability: string, resource?: Resource): Promise<void>;
+export declare function expectCan(gate: GateLike, user: User, ...check: Check): Promise<void>;
 /**
- * Assert the user CANNOT perform `ability` (optionally on `resource`). Resolves when
- * denied; throws {@link AuthzAssertionError} when allowed. An unresolved ability
- * (no policy/gate) counts as "cannot" — the deny-by-default outcome a caller wants
- * to assert — so this never leaks the underlying `AbilityNotResolvedException`.
+ * Assert the user CANNOT. An unresolved ability (no policy, gate or permission answers
+ * it) counts as "cannot", the deny-by-default outcome.
+ */
+export declare function expectCannot(gate: GateLike, user: User, ...check: Check): Promise<void>;
+/** One official `@Can()` requirement of a route, with its static arguments when it has some. */
+export interface RouteRequirement {
+    policy: Type<unknown>;
+    ability: string;
+    /** The arguments of a static resolver (`roles('admin')`, `permission(...)`), else `undefined`. */
+    staticArgs: readonly unknown[] | undefined;
+    /** True when the resolver depends on the call (`byId(Post)`, a custom function). */
+    dynamic: boolean;
+}
+/**
+ * What the official guard requires on `controller.method`, class-level first. Lets a test
+ * assert a route's protection without booting HTTP:
+ *
+ * ```ts
+ * expect(requirementsOf(PostController, 'publish')).toEqual([
+ *   { policy: PermissionPolicy, ability: 'has', staticArgs: ['posts.publish'], dynamic: false },
+ * ]);
+ * ```
  */
-export declare function expectCannot(gate: GateLike, user: User, ability: string, resource?: Resource): Promise<void>;
+export declare function requirementsOf(controller: Type<unknown>, method: string): RouteRequirement[];
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACL,KAAK,SAAS,EACd,SAAS,EACT,IAAI,EACJ,KAAK,MAAM,EACX,KAAK,kBAAkB,EACvB,KAAK,cAAc,EAEnB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,IAAI,EACV,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,4EAA4E;AAC5E,MAAM,WAAW,gBAAgB;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5B,wFAAwF;IACxF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,+DAA+D;IAC/D,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,mDAAmD;IACnD,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,wFAAwF;IACxF,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM,EAAE,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACpF;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,8FAA8F;IAC9F,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,OAAO,GAAE,gBAAqB,GAAG,IAAI,CAwB9D;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,GAAE,gBAAqB,GAAG,SAAS,CAEpF;AAED;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG,IAAI,GAAG,SAAS,CAAC;AAMxC,8EAA8E;AAC9E,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,QAAQ,EACd,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,QAAQ,GAClB,OAAO,CAAC,IAAI,CAAC,CAOf;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,QAAQ,EACd,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,QAAQ,GAClB,OAAO,CAAC,IAAI,CAAC,CAaf"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAEL,SAAS,EACT,IAAI,EACJ,KAAK,MAAM,EAEX,KAAK,kBAAkB,EAEvB,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,IAAI,EAGV,MAAM,wBAAwB,CAAC;AAEhC,OAAO,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAQ,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAE3D,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACtE,YAAY,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,4EAA4E;AAC5E,MAAM,WAAW,gBAAgB;IAC/B,6FAA6F;IAC7F,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC;IACtB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;IACvB,oDAAoD;IACpD,WAAW,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9B,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,mCAAmC;IACnC,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,4EAA4E;IAC5E,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM,EAAE,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACpF,kCAAkC;IAClC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,0CAA0C;IAC1C,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC;IACjD,wEAAwE;IACxE,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,4DAA4D;IAC5D,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED,sEAAsE;AACtE,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,aAAa,CAAC;IACtB,IAAI,EAAE,IAAI,CAAC;CACZ;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAyB7B;AAED,+EAA+E;AAC/E,wBAAsB,SAAS,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7E;AAED,4FAA4F;AAC5F,wBAAsB,cAAc,CAClC,IAAI,EAAE,IAAI,EACV,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,SAAS,CAAC,CAEpB;AAED,sFAAsF;AACtF,MAAM,MAAM,QAAQ,GAAG,IAAI,GAAG,SAAS,CAAC;AAMxC,8EAA8E;AAC9E,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED,mGAAmG;AACnG,KAAK,KAAK,GACN,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,GACtC,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAYjE;;;GAGG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAM1F;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAY7F;AAED,gGAAgG;AAChG,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,kGAAkG;IAClG,UAAU,EAAE,SAAS,OAAO,EAAE,GAAG,SAAS,CAAC;IAC3C,oFAAoF;IACpF,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAO5F"}

package/dist/index.js

@@ -1,50 +1,63 @@
 /**
- * Test helpers for `@dudousxd/nestjs-authz`.
+ * Test helpers for `@dudousxd/nestjs-authz` on `@nestjs/authorization`.
  *
- * Build a real {@link Gate} (no Nest module, no DB) from fixture policies, ad-hoc
- * gates, hooks, and an optional in-memory permission/role provider — then assert
- * verdicts with {@link expectCan}/{@link expectCannot}. The helpers exercise the
- * SAME resolution path the production Gate uses, so a policy that passes here passes
- * in the app.
+ * {@link buildGate} compiles a real Nest testing module with the official
+ * `AuthorizationModule` and `AuthzModule`, so every policy decision goes through the
+ * official `AuthorizationService`, exactly as in the app. Assert with
+ * {@link expectCan} / {@link expectCannot}, and read what a route requires with
+ * {@link requirementsOf}.
  *
  * @example
  * ```ts
- * const gate = buildGate({ policies: [new PostPolicy()] });
- * await expectCan(gate, { id: 1 }, 'update', new Post(1, 1));
- * await expectCannot(gate, { id: 2 }, 'update', new Post(1, 1));
+ * const gate = await buildGate({ policies: [PostPolicy] });
+ * await expectCan(gate, { id: 1 }, 'update', new Post(10, 1));       // linked with @PolicyFor(Post)
+ * await expectCan(gate, { id: 1 }, PostPolicy, 'update', new Post(10, 1)); // official style
  * ```
  *
  * @module
  */
-import { BoundGate, Gate, PolicyRegistry, } from '@dudousxd/nestjs-authz';
-export { FakePermissionProvider, FakeRoleProvider, } from './fakes.js';
+import { AuthzModule, BoundGate, Gate, PERMISSION_PROVIDER, ROLE_PROVIDER, getStaticCanArgs, routeRequirements, } from '@dudousxd/nestjs-authz';
+import { AuthorizationModule } from '@nestjs/authorization';
+import { Test } from '@nestjs/testing';
+export { FakePermissionProvider, FakeRoleProvider } from './fakes.js';
 /**
- * Build a real {@link Gate} from fixtures — no Nest container, no database. The
- * returned Gate behaves exactly like the production one (same hooks, same RBAC seam,
- * same resolution order); only the wiring is in-memory.
+ * Compile and initialize a Nest testing module with the official `AuthorizationModule`,
+ * `AuthzModule` and the fixtures. Close `module` when done (or let the test process end).
  */
-export function buildGate(options = {}) {
-    const registry = new PolicyRegistry();
-    for (const policy of options.policies ?? [])
-        registry.register(policy);
-    const moduleOptions = {
-        ...(options.superAdmin ? { superAdmin: options.superAdmin } : {}),
-        ...(options.after ? { after: options.after } : {}),
-        ...(options.resolveRoles ? { resolveRoles: options.resolveRoles } : {}),
-    };
-    // Ctor: (policies, options, context?, moduleRef?, permissionProvider?, roleProvider?).
-    const gate = new Gate(registry, moduleOptions, undefined, undefined, options.permissionProvider, options.roleProvider);
-    for (const [ability, fn] of Object.entries(options.gates ?? {})) {
+export async function createAuthzTestingModule(options = {}) {
+    const module = await Test.createTestingModule({
+        imports: [
+            AuthorizationModule.forRoot(options.getUser ? { getUser: options.getUser } : {}),
+            AuthzModule.forRoot({
+                ...(options.superAdmin ? { superAdmin: options.superAdmin } : {}),
+                ...(options.resolveRoles ? { resolveRoles: options.resolveRoles } : {}),
+                ...(options.resourceResolver ? { resourceResolver: options.resourceResolver } : {}),
+            }),
+        ],
+        controllers: options.controllers ?? [],
+        providers: [
+            ...(options.policies ?? []),
+            ...(options.providers ?? []),
+            ...(options.permissionProvider
+                ? [{ provide: PERMISSION_PROVIDER, useValue: options.permissionProvider }]
+                : []),
+            ...(options.roleProvider ? [{ provide: ROLE_PROVIDER, useValue: options.roleProvider }] : []),
+        ],
+    }).compile();
+    module.useLogger(false);
+    await module.init();
+    const gate = module.get(Gate);
+    for (const [ability, fn] of Object.entries(options.gates ?? {}))
         gate.define(ability, fn);
-    }
-    return gate;
+    return { module, gate };
 }
-/**
- * Build a {@link BoundGate} for a fixture `user` directly — sugar over
- * `buildGate(options).forUser(user)` for tests that focus on a single principal.
- */
-export function buildBoundGate(user, options = {}) {
-    return buildGate(options).forUser(user);
+/** A real {@link Gate} from fixtures. See {@link createAuthzTestingModule}. */
+export async function buildGate(options = {}) {
+    return (await createAuthzTestingModule(options)).gate;
+}
+/** A {@link BoundGate} for a fixture `user`: `(await buildGate(options)).forUser(user)`. */
+export async function buildBoundGate(user, options = {}) {
+    return (await buildGate(options)).forUser(user);
 }
 function bind(gate, user) {
     return gate instanceof BoundGate ? gate : gate.forUser(user);
@@ -56,39 +69,59 @@ export class AuthzAssertionError extends Error {
         this.name = 'AuthzAssertionError';
     }
 }
+function allows(gate, check) {
+    return gate.allows.apply(gate, check);
+}
+function describeCheck(check) {
+    if (typeof check[0] === 'function')
+        return `${check[0].name}.${String(check[1])}`;
+    const [ability, resource] = check;
+    return `"${ability}"${describeResource(resource)}`;
+}
 /**
- * Assert the user CAN perform `ability` (optionally on `resource`). Resolves when
- * allowed; throws {@link AuthzAssertionError} when denied. Works with either a
- * {@link Gate} (+ `user`) or a {@link BoundGate} (pass `undefined` for `user`).
- *
- * @example await expectCan(gate, { id: 1 }, 'update', post);
- * @example await expectCan(boundGate, undefined, 'create');
+ * Assert the user CAN: `expectCan(gate, user, 'update', post)` or
+ * `expectCan(gate, user, PostPolicy, 'update', post)`. Throws {@link AuthzAssertionError}.
  */
-export async function expectCan(gate, user, ability, resource) {
-    const allowed = await bind(gate, user).allows(ability, resource);
-    if (!allowed) {
-        throw new AuthzAssertionError(`Expected user to be able to "${ability}"${describeResource(resource)}, but it was DENIED.`);
+export async function expectCan(gate, user, ...check) {
+    if (!(await allows(bind(gate, user), check))) {
+        throw new AuthzAssertionError(`Expected user to be able to ${describeCheck(check)}, but it was DENIED.`);
     }
 }
 /**
- * Assert the user CANNOT perform `ability` (optionally on `resource`). Resolves when
- * denied; throws {@link AuthzAssertionError} when allowed. An unresolved ability
- * (no policy/gate) counts as "cannot" — the deny-by-default outcome a caller wants
- * to assert — so this never leaks the underlying `AbilityNotResolvedException`.
+ * Assert the user CANNOT. An unresolved ability (no policy, gate or permission answers
+ * it) counts as "cannot", the deny-by-default outcome.
  */
-export async function expectCannot(gate, user, ability, resource) {
+export async function expectCannot(gate, user, ...check) {
     let allowed;
     try {
-        allowed = await bind(gate, user).allows(ability, resource);
+        allowed = await allows(bind(gate, user), check);
     }
     catch {
-        // Unresolved/ambiguous ability → effectively "cannot" (deny by default).
         return;
     }
     if (allowed) {
-        throw new AuthzAssertionError(`Expected user to be UNABLE to "${ability}"${describeResource(resource)}, but it was ALLOWED.`);
+        throw new AuthzAssertionError(`Expected user to be UNABLE to ${describeCheck(check)}, but it was ALLOWED.`);
     }
 }
+/**
+ * What the official guard requires on `controller.method`, class-level first. Lets a test
+ * assert a route's protection without booting HTTP:
+ *
+ * ```ts
+ * expect(requirementsOf(PostController, 'publish')).toEqual([
+ *   { policy: PermissionPolicy, ability: 'has', staticArgs: ['posts.publish'], dynamic: false },
+ * ]);
+ * ```
+ */
+export function requirementsOf(controller, method) {
+    const handler = controller.prototype[method];
+    if (!handler)
+        throw new Error(`${controller.name} has no method '${method}'.`);
+    return routeRequirements(controller, handler).map(({ policy, ability, args }) => {
+        const staticArgs = getStaticCanArgs(args);
+        return { policy, ability, staticArgs, dynamic: args !== undefined && staticArgs === undefined };
+    });
+}
 function describeResource(resource) {
     if (resource === undefined)
         return '';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAEL,SAAS,EACT,IAAI,EAIJ,cAAc,GAKf,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AA8BpB;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,UAA4B,EAAE;IACtD,MAAM,QAAQ,GAAG,IAAI,cAAc,EAAE,CAAC;IACtC,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEvE,MAAM,aAAa,GAAG;QACpB,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxE,CAAC;IAEF,uFAAuF;IACvF,MAAM,IAAI,GAAG,IAAI,IAAI,CACnB,QAAQ,EACR,aAAa,EACb,SAAS,EACT,SAAS,EACT,OAAO,CAAC,kBAAkB,EAC1B,OAAO,CAAC,YAAY,CACrB,CAAC;IAEF,KAAK,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAU,EAAE,UAA4B,EAAE;IACvE,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC;AAQD,SAAS,IAAI,CAAC,IAAc,EAAE,IAAU;IACtC,OAAO,IAAI,YAAY,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED,8EAA8E;AAC9E,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAc,EACd,IAAU,EACV,OAAe,EACf,QAAmB;IAEnB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAC3B,gCAAgC,OAAO,IAAI,gBAAgB,CAAC,QAAQ,CAAC,sBAAsB,CAC5F,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAc,EACd,IAAU,EACV,OAAe,EACf,QAAmB;IAEnB,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,OAAO;IACT,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,mBAAmB,CAC3B,kCAAkC,OAAO,IAAI,gBAAgB,CAAC,QAAQ,CAAC,uBAAuB,CAC/F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,QAA8B;IACtD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,IAAI,GAAI,QAAgD,CAAC,WAAW,EAAE,IAAI,CAAC;IACjF,OAAO,IAAI,IAAI,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC;AAC1E,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EACL,WAAW,EACX,SAAS,EACT,IAAI,EAEJ,mBAAmB,EAEnB,aAAa,EAMb,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,EAAE,IAAI,EAAsB,MAAM,iBAAiB,CAAC;AAE3D,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAiCtE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,UAA4B,EAAE;IAE9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC;QAC5C,OAAO,EAAE;YACP,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,WAAW,CAAC,OAAO,CAAC;gBAClB,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpF,CAAC;SACH;QACD,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE;QACtC,SAAS,EAAE;YACT,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;YAC3B,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;YAC5B,GAAG,CAAC,OAAO,CAAC,kBAAkB;gBAC5B,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,OAAO,CAAC,kBAAkB,EAAE,CAAC;gBAC1E,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9F;KACF,CAAC,CAAC,OAAO,EAAE,CAAC;IACb,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACxB,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACpB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,KAAK,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC1F,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,UAA4B,EAAE;IAC5D,OAAO,CAAC,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAU,EACV,UAA4B,EAAE;IAE9B,OAAO,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAClD,CAAC;AAKD,SAAS,IAAI,CAAC,IAAc,EAAE,IAAU;IACtC,OAAO,IAAI,YAAY,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED,8EAA8E;AAC9E,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAOD,SAAS,MAAM,CAAC,IAAe,EAAE,KAAY;IAC3C,OAAQ,IAAI,CAAC,MAAgD,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,aAAa,CAAC,KAAY;IACjC,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU;QAAE,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,KAAuC,CAAC;IACpE,OAAO,IAAI,OAAO,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAc,EAAE,IAAU,EAAE,GAAG,KAAY;IACzE,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,mBAAmB,CAC3B,+BAA+B,aAAa,CAAC,KAAK,CAAC,sBAAsB,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAc,EAAE,IAAU,EAAE,GAAG,KAAY;IAC5E,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,mBAAmB,CAC3B,iCAAiC,aAAa,CAAC,KAAK,CAAC,uBAAuB,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC;AAYD;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,UAAyB,EAAE,MAAc;IACtE,MAAM,OAAO,GAAI,UAAU,CAAC,SAAoC,CAAC,MAAM,CAAC,CAAC;IACzE,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,CAAC,IAAI,mBAAmB,MAAM,IAAI,CAAC,CAAC;IAC/E,OAAO,iBAAiB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;QAC9E,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC1C,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;IAClG,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,QAA8B;IACtD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,IAAI,GAAI,QAAgD,CAAC,WAAW,EAAE,IAAI,CAAC;IACjF,OAAO,IAAI,IAAI,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC;AAC1E,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@dudousxd/nestjs-authz-testing",
-  "version": "0.1.1",
-  "description": "Test helpers for @dudousxd/nestjs-authz — build a Gate/BoundGate from fixture users & policies and assert with expectCan/expectCannot.",
+  "version": "0.2.0",
+  "description": "Test helpers for @dudousxd/nestjs-authz on @nestjs/authorization: a real Gate on a Nest testing module, expectCan/expectCannot, in-memory RBAC fakes, route requirement inspection.",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -38,21 +38,30 @@
     "CHANGELOG.md"
   ],
   "peerDependencies": {
-    "@dudousxd/nestjs-authz": ">=0.5.0",
+    "@dudousxd/nestjs-authz": ">=0.9.0 <0.10.0",
+    "@nestjs/authorization": "^0.1.3",
+    "@nestjs/common": "^12.0.0",
+    "@nestjs/core": "^12.0.0",
+    "@nestjs/testing": "^12.0.0",
     "reflect-metadata": ">=0.1.13"
   },
   "devDependencies": {
-    "@types/node": "20.19.43",
+    "@nestjs/authorization": "0.1.3",
+    "@nestjs/common": "12.0.1",
+    "@nestjs/core": "12.0.1",
+    "@nestjs/testing": "12.0.1",
+    "@types/node": "22.20.5",
     "reflect-metadata": "0.2.2",
+    "rxjs": "7.8.2",
     "typescript": "5.9.3",
     "vitest": "3.2.7",
-    "@dudousxd/nestjs-authz": "^0.8.1"
+    "@dudousxd/nestjs-authz": "^0.9.1"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=22"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.json",
+    "build": "tsc -p tsconfig.json --incremental false",
     "test": "vitest run --passWithNoTests",
     "test:watch": "vitest",
     "typecheck": "tsc -p tsconfig.json --noEmit"