@dudousxd/nestjs-authz-typeorm 0.2.0

package/CHANGELOG.md

@@ -0,0 +1,7 @@
+# @dudousxd/nestjs-authz-typeorm
+
+## 0.2.0
+
+### Minor Changes
+
+- [`51d2fbc`](https://github.com/DavideCarvalho/nestjs-authz/commit/51d2fbc6b966c101a6ff0675c42843f040e02703) - Initial release: Laravel-style authorization for NestJS — gates, `@Policy`/`@Can`, the `Gate` service, a default `:id` resource resolver, `before`/`superAdmin` hooks, optional `nestjs-context` current-user with `resolveUser` hydration, and a `PERMISSION_PROVIDER` seam. The `@dudousxd/nestjs-authz-typeorm` adapter adds opt-in RBAC persistence (roles/permissions store, dialect-correct SQL, identifier allowlist, non-destructive schema auto-manage).

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Davi Carvalho
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/authz-rbac.module.d.ts

@@ -0,0 +1,46 @@
+import { type DynamicModule } from '@nestjs/common';
+import type { TypeOrmAuthzStore } from './typeorm-authz.store.js';
+import type { UserRef } from './types.js';
+/** Injection token holding the {@link TypeOrmAuthzStore} the RBAC module manages. */
+export declare const AUTHZ_RBAC_STORE: unique symbol;
+/** Injection token holding the resolved {@link AuthzRbacModuleOptions}. */
+export declare const AUTHZ_RBAC_OPTIONS: unique symbol;
+/**
+ * Map the Gate's current user (whatever the app's auth layer produced) to a
+ * {@link UserRef} the store can key on. Defaults to reading `{ type, id }` / `{ id }`.
+ */
+export type UserRefMapper = (user: unknown) => UserRef | undefined;
+export interface AuthzRbacModuleOptions {
+    /** The TypeORM RBAC store (built with the app-provided DataSource). */
+    store: TypeOrmAuthzStore;
+    /**
+     * Run `ensureAuthzSchema` on bootstrap (default `true`, non-destructive). Set `false`
+     * to manage the schema via your ORM's migrations (`createAuthzTables` helper).
+     */
+    autoCreateSchema?: boolean;
+    /**
+     * Derive a {@link UserRef} from the Gate's current user. Defaults to
+     * {@link defaultUserRefMapper} (`{ type, id }` or `{ id }`).
+     */
+    userRefFrom?: UserRefMapper;
+}
+export interface AuthzRbacModuleAsyncOptions {
+    imports?: unknown[];
+    inject?: unknown[];
+    useFactory: (...args: unknown[]) => Promise<AuthzRbacModuleOptions> | AuthzRbacModuleOptions;
+}
+/** Default mapping: accept a `{ type, id }` ref, a `{ id }` object, or a bare id. */
+export declare function defaultUserRefMapper(user: unknown): UserRef | undefined;
+/**
+ * Wires persisted RBAC into the core authz Gate. The app provides the `DataSource`
+ * (via `inject`/`useFactory`) and constructs the {@link TypeOrmAuthzStore} — this module
+ * NEVER hardcodes a connection token. On init it registers the RBAC permission check into
+ * the Gate via the {@link PERMISSION_PROVIDER} seam, so `gate.allows('some.permission')`
+ * consults persisted permissions, and (by default) ensures the schema exists.
+ */
+export declare class AuthzRbacModule {
+    static forRoot(options: AuthzRbacModuleOptions): DynamicModule;
+    static forRootAsync(options: AuthzRbacModuleAsyncOptions): DynamicModule;
+    private static commonProviders;
+}
+//# sourceMappingURL=authz-rbac.module.d.ts.map

package/dist/authz-rbac.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-rbac.module.d.ts","sourceRoot":"","sources":["../src/authz-rbac.module.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,aAAa,EAQnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C,qFAAqF;AACrF,eAAO,MAAM,gBAAgB,eAAqD,CAAC;AACnF,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,eAAuD,CAAC;AAEvF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,GAAG,SAAS,CAAC;AAEnE,MAAM,WAAW,sBAAsB;IACrC,uEAAuE;IACvE,KAAK,EAAE,iBAAiB,CAAC;IACzB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,WAAW,CAAC,EAAE,aAAa,CAAC;CAC7B;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,UAAU,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,sBAAsB,CAAC,GAAG,sBAAsB,CAAC;CAC9F;AAED,qFAAqF;AACrF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAOvE;AAiCD;;;;;;GAMG;AACH,qBACa,eAAe;IAC1B,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa;IAa9D,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,2BAA2B,GAAG,aAAa;IAsBxE,OAAO,CAAC,MAAM,CAAC,eAAe;CAO/B"}

package/dist/authz-rbac.module.js

@@ -0,0 +1,128 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var AuthzRbacModule_1;
+import { PERMISSION_PROVIDER } from '@dudousxd/nestjs-authz';
+import { Inject, Injectable, Module, Optional, } from '@nestjs/common';
+/** Injection token holding the {@link TypeOrmAuthzStore} the RBAC module manages. */
+export const AUTHZ_RBAC_STORE = Symbol.for('@dudousxd/nestjs-authz-typeorm:store');
+/** Injection token holding the resolved {@link AuthzRbacModuleOptions}. */
+export const AUTHZ_RBAC_OPTIONS = Symbol.for('@dudousxd/nestjs-authz-typeorm:options');
+/** Default mapping: accept a `{ type, id }` ref, a `{ id }` object, or a bare id. */
+export function defaultUserRefMapper(user) {
+    if (user == null)
+        return undefined;
+    if (typeof user === 'string' || typeof user === 'number')
+        return user;
+    const u = user;
+    if (u.id == null)
+        return undefined;
+    const id = u.id;
+    return typeof u.type === 'string' ? { type: u.type, id } : { id };
+}
+/**
+ * The RBAC {@link PermissionProvider} the Gate consults (via the shared
+ * {@link PERMISSION_PROVIDER} token). Grants a named ability when the current user holds
+ * the matching persisted permission — the Laravel/spatie `Gate::before` grant.
+ */
+let RbacPermissionProvider = class RbacPermissionProvider {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async hasPermission(user, permission) {
+        const map = this.options.userRefFrom ?? defaultUserRefMapper;
+        const ref = map(user);
+        if (ref === undefined)
+            return undefined;
+        return this.options.store.userHasPermission(ref, permission);
+    }
+};
+RbacPermissionProvider = __decorate([
+    Injectable(),
+    __param(0, Inject(AUTHZ_RBAC_OPTIONS)),
+    __metadata("design:paramtypes", [Object])
+], RbacPermissionProvider);
+/** Runs `ensureAuthzSchema` on bootstrap when `autoCreateSchema` is not disabled. */
+let AuthzRbacBootstrap = class AuthzRbacBootstrap {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async onModuleInit() {
+        if (!this.options)
+            return;
+        if (this.options.autoCreateSchema === false)
+            return;
+        await this.options.store.ensureSchema();
+    }
+};
+AuthzRbacBootstrap = __decorate([
+    Injectable(),
+    __param(0, Optional()),
+    __param(0, Inject(AUTHZ_RBAC_OPTIONS)),
+    __metadata("design:paramtypes", [Object])
+], AuthzRbacBootstrap);
+/**
+ * Wires persisted RBAC into the core authz Gate. The app provides the `DataSource`
+ * (via `inject`/`useFactory`) and constructs the {@link TypeOrmAuthzStore} — this module
+ * NEVER hardcodes a connection token. On init it registers the RBAC permission check into
+ * the Gate via the {@link PERMISSION_PROVIDER} seam, so `gate.allows('some.permission')`
+ * consults persisted permissions, and (by default) ensures the schema exists.
+ */
+let AuthzRbacModule = AuthzRbacModule_1 = class AuthzRbacModule {
+    static forRoot(options) {
+        return {
+            module: AuthzRbacModule_1,
+            global: true,
+            providers: [
+                { provide: AUTHZ_RBAC_OPTIONS, useValue: options },
+                { provide: AUTHZ_RBAC_STORE, useValue: options.store },
+                ...AuthzRbacModule_1.commonProviders(),
+            ],
+            exports: [AUTHZ_RBAC_STORE, PERMISSION_PROVIDER],
+        };
+    }
+    static forRootAsync(options) {
+        return {
+            module: AuthzRbacModule_1,
+            global: true,
+            imports: (options.imports ?? []),
+            providers: [
+                {
+                    provide: AUTHZ_RBAC_OPTIONS,
+                    useFactory: options.useFactory,
+                    inject: (options.inject ?? []),
+                },
+                {
+                    provide: AUTHZ_RBAC_STORE,
+                    useFactory: (opts) => opts.store,
+                    inject: [AUTHZ_RBAC_OPTIONS],
+                },
+                ...AuthzRbacModule_1.commonProviders(),
+            ],
+            exports: [AUTHZ_RBAC_STORE, PERMISSION_PROVIDER],
+        };
+    }
+    static commonProviders() {
+        return [
+            RbacPermissionProvider,
+            { provide: PERMISSION_PROVIDER, useExisting: RbacPermissionProvider },
+            AuthzRbacBootstrap,
+        ];
+    }
+};
+AuthzRbacModule = AuthzRbacModule_1 = __decorate([
+    Module({})
+], AuthzRbacModule);
+export { AuthzRbacModule };
+//# sourceMappingURL=authz-rbac.module.js.map

package/dist/authz-rbac.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-rbac.module.js","sourceRoot":"","sources":["../src/authz-rbac.module.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EAAE,mBAAmB,EAA2B,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAEL,MAAM,EACN,UAAU,EACV,MAAM,EAEN,QAAQ,GAGT,MAAM,gBAAgB,CAAC;AAIxB,qFAAqF;AACrF,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;AACnF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;AA6BvF,qFAAqF;AACrF,MAAM,UAAU,oBAAoB,CAAC,IAAa;IAChD,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACtE,MAAM,CAAC,GAAG,IAAwC,CAAC;IACnD,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAqB,CAAC;IACnC,OAAO,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,IACM,sBAAsB,GAD5B,MACM,sBAAsB;IAC+B;IAAzD,YAAyD,OAA+B;QAA/B,YAAO,GAAP,OAAO,CAAwB;IAAG,CAAC;IAE5F,KAAK,CAAC,aAAa,CAAC,IAAa,EAAE,UAAkB;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC/D,CAAC;CACF,CAAA;AATK,sBAAsB;IAD3B,UAAU,EAAE;IAEE,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;;GADnC,sBAAsB,CAS3B;AAED,qFAAqF;AACrF,IACM,kBAAkB,GADxB,MACM,kBAAkB;IAEqC;IAD3D,YAC2D,OAAgC;QAAhC,YAAO,GAAP,OAAO,CAAyB;IACxF,CAAC;IAEJ,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,KAAK,KAAK;YAAE,OAAO;QACpD,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;IAC1C,CAAC;CACF,CAAA;AAVK,kBAAkB;IADvB,UAAU,EAAE;IAGR,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;;GAFrC,kBAAkB,CAUvB;AAED;;;;;;GAMG;AAEI,IAAM,eAAe,uBAArB,MAAM,eAAe;IAC1B,MAAM,CAAC,OAAO,CAAC,OAA+B;QAC5C,OAAO;YACL,MAAM,EAAE,iBAAe;YACvB,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE;gBACT,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE;gBAClD,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE;gBACtD,GAAG,iBAAe,CAAC,eAAe,EAAE;aACrC;YACD,OAAO,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;SACjD,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,OAAoC;QACtD,OAAO;YACL,MAAM,EAAE,iBAAe;YACvB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAoB;YACnD,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,kBAAkB;oBAC3B,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAyB;iBACvD;gBACD;oBACE,OAAO,EAAE,gBAAgB;oBACzB,UAAU,EAAE,CAAC,IAA4B,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK;oBACxD,MAAM,EAAE,CAAC,kBAAkB,CAAC;iBAC7B;gBACD,GAAG,iBAAe,CAAC,eAAe,EAAE;aACrC;YACD,OAAO,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;SACjD,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,eAAe;QAC5B,OAAO;YACL,sBAAsB;YACtB,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,sBAAsB,EAAE;YACrE,kBAAkB;SACnB,CAAC;IACJ,CAAC;CACF,CAAA;AA3CY,eAAe;IAD3B,MAAM,CAAC,EAAE,CAAC;GACE,eAAe,CA2C3B"}

package/dist/entities.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Default table names. Override per-deployment via {@link AuthzStoreOptions.tableNames}
+ * — the entities below carry these as their decorator defaults so an app that manages
+ * the schema through its own ORM gets sane names out of the box, while BYO names flow
+ * through the store/schema helpers at runtime.
+ */
+export declare const DEFAULT_TABLE_NAMES: {
+    readonly roles: "authz_roles";
+    readonly permissions: "authz_permissions";
+    readonly rolePermission: "authz_role_permission";
+    readonly userRole: "authz_user_role";
+};
+/**
+ * A named role (e.g. `editor`). Permissions are attached via {@link RolePermissionEntity};
+ * users are attached via {@link UserRoleEntity}.
+ *
+ * Forward-compat rule: any column added to these entities AFTER v1 MUST be nullable or
+ * carry a default — `ADD COLUMN NOT NULL` without a default fails on a populated table,
+ * and {@link ensureAuthzSchema} only ever ADDs columns.
+ */
+export declare class RoleEntity {
+    id: string;
+    name: string;
+    guard: string | null;
+    createdAt: Date;
+}
+/** A named permission (e.g. `posts.publish`). Granted to roles via {@link RolePermissionEntity}. */
+export declare class PermissionEntity {
+    id: string;
+    name: string;
+    guard: string | null;
+    createdAt: Date;
+}
+/** Pivot: role ↔ permission. Composite PK `(roleId, permissionId)`. */
+export declare class RolePermissionEntity {
+    roleId: string;
+    permissionId: string;
+}
+/**
+ * Pivot: user ↔ role. References the user BY ID ONLY — this package NEVER defines or
+ * owns a users table. `userType` lets the same table key polymorphic principals
+ * (mirrors nestjs-context's `UserRef` shape).
+ */
+export declare class UserRoleEntity {
+    userType: string;
+    userId: string;
+    roleId: string;
+}
+/** All entities, in dependency order — convenient for `entities: [...]` registration. */
+export declare const AUTHZ_ENTITIES: readonly [typeof RoleEntity, typeof PermissionEntity, typeof RolePermissionEntity, typeof UserRoleEntity];
+//# sourceMappingURL=entities.d.ts.map

package/dist/entities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entities.d.ts","sourceRoot":"","sources":["../src/entities.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB;;;;;CAKtB,CAAC;AAEX;;;;;;;GAOG;AACH,qBACa,UAAU;IAErB,EAAE,EAAG,MAAM,CAAC;IAIZ,IAAI,EAAG,MAAM,CAAC;IAGd,KAAK,EAAG,MAAM,GAAG,IAAI,CAAC;IAGtB,SAAS,EAAG,IAAI,CAAC;CAClB;AAED,oGAAoG;AACpG,qBACa,gBAAgB;IAE3B,EAAE,EAAG,MAAM,CAAC;IAIZ,IAAI,EAAG,MAAM,CAAC;IAGd,KAAK,EAAG,MAAM,GAAG,IAAI,CAAC;IAGtB,SAAS,EAAG,IAAI,CAAC;CAClB;AAED,uEAAuE;AACvE,qBACa,oBAAoB;IAE/B,MAAM,EAAG,MAAM,CAAC;IAGhB,YAAY,EAAG,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,qBAEa,cAAc;IAEzB,QAAQ,EAAG,MAAM,CAAC;IAGlB,MAAM,EAAG,MAAM,CAAC;IAGhB,MAAM,EAAG,MAAM,CAAC;CACjB;AAED,yFAAyF;AACzF,eAAO,MAAM,cAAc,2GAKjB,CAAC"}

package/dist/entities.js

@@ -0,0 +1,137 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Column, Entity, Index, PrimaryColumn } from 'typeorm';
+/**
+ * Default table names. Override per-deployment via {@link AuthzStoreOptions.tableNames}
+ * — the entities below carry these as their decorator defaults so an app that manages
+ * the schema through its own ORM gets sane names out of the box, while BYO names flow
+ * through the store/schema helpers at runtime.
+ */
+export const DEFAULT_TABLE_NAMES = {
+    roles: 'authz_roles',
+    permissions: 'authz_permissions',
+    rolePermission: 'authz_role_permission',
+    userRole: 'authz_user_role',
+};
+/**
+ * A named role (e.g. `editor`). Permissions are attached via {@link RolePermissionEntity};
+ * users are attached via {@link UserRoleEntity}.
+ *
+ * Forward-compat rule: any column added to these entities AFTER v1 MUST be nullable or
+ * carry a default — `ADD COLUMN NOT NULL` without a default fails on a populated table,
+ * and {@link ensureAuthzSchema} only ever ADDs columns.
+ */
+let RoleEntity = class RoleEntity {
+    id;
+    name;
+    guard;
+    createdAt;
+};
+__decorate([
+    PrimaryColumn({ type: 'varchar', length: 191 }),
+    __metadata("design:type", String)
+], RoleEntity.prototype, "id", void 0);
+__decorate([
+    Index({ unique: true }),
+    Column({ type: 'varchar', length: 191 }),
+    __metadata("design:type", String)
+], RoleEntity.prototype, "name", void 0);
+__decorate([
+    Column({ type: 'varchar', nullable: true }),
+    __metadata("design:type", Object)
+], RoleEntity.prototype, "guard", void 0);
+__decorate([
+    Column({ type: Date }),
+    __metadata("design:type", Date)
+], RoleEntity.prototype, "createdAt", void 0);
+RoleEntity = __decorate([
+    Entity({ name: DEFAULT_TABLE_NAMES.roles })
+], RoleEntity);
+export { RoleEntity };
+/** A named permission (e.g. `posts.publish`). Granted to roles via {@link RolePermissionEntity}. */
+let PermissionEntity = class PermissionEntity {
+    id;
+    name;
+    guard;
+    createdAt;
+};
+__decorate([
+    PrimaryColumn({ type: 'varchar', length: 191 }),
+    __metadata("design:type", String)
+], PermissionEntity.prototype, "id", void 0);
+__decorate([
+    Index({ unique: true }),
+    Column({ type: 'varchar', length: 191 }),
+    __metadata("design:type", String)
+], PermissionEntity.prototype, "name", void 0);
+__decorate([
+    Column({ type: 'varchar', nullable: true }),
+    __metadata("design:type", Object)
+], PermissionEntity.prototype, "guard", void 0);
+__decorate([
+    Column({ type: Date }),
+    __metadata("design:type", Date)
+], PermissionEntity.prototype, "createdAt", void 0);
+PermissionEntity = __decorate([
+    Entity({ name: DEFAULT_TABLE_NAMES.permissions })
+], PermissionEntity);
+export { PermissionEntity };
+/** Pivot: role ↔ permission. Composite PK `(roleId, permissionId)`. */
+let RolePermissionEntity = class RolePermissionEntity {
+    roleId;
+    permissionId;
+};
+__decorate([
+    PrimaryColumn({ type: 'varchar', length: 191 }),
+    __metadata("design:type", String)
+], RolePermissionEntity.prototype, "roleId", void 0);
+__decorate([
+    PrimaryColumn({ type: 'varchar', length: 191 }),
+    __metadata("design:type", String)
+], RolePermissionEntity.prototype, "permissionId", void 0);
+RolePermissionEntity = __decorate([
+    Entity({ name: DEFAULT_TABLE_NAMES.rolePermission })
+], RolePermissionEntity);
+export { RolePermissionEntity };
+/**
+ * Pivot: user ↔ role. References the user BY ID ONLY — this package NEVER defines or
+ * owns a users table. `userType` lets the same table key polymorphic principals
+ * (mirrors nestjs-context's `UserRef` shape).
+ */
+let UserRoleEntity = class UserRoleEntity {
+    userType;
+    userId;
+    roleId;
+};
+__decorate([
+    PrimaryColumn({ type: 'varchar', length: 191 }),
+    __metadata("design:type", String)
+], UserRoleEntity.prototype, "userType", void 0);
+__decorate([
+    PrimaryColumn({ type: 'varchar', length: 191 }),
+    __metadata("design:type", String)
+], UserRoleEntity.prototype, "userId", void 0);
+__decorate([
+    PrimaryColumn({ type: 'varchar', length: 191 }),
+    __metadata("design:type", String)
+], UserRoleEntity.prototype, "roleId", void 0);
+UserRoleEntity = __decorate([
+    Entity({ name: DEFAULT_TABLE_NAMES.userRole }),
+    Index(['userType', 'userId'])
+], UserRoleEntity);
+export { UserRoleEntity };
+/** All entities, in dependency order — convenient for `entities: [...]` registration. */
+export const AUTHZ_ENTITIES = [
+    RoleEntity,
+    PermissionEntity,
+    RolePermissionEntity,
+    UserRoleEntity,
+];
+//# sourceMappingURL=entities.js.map

package/dist/entities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entities.js","sourceRoot":"","sources":["../src/entities.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,KAAK,EAAE,aAAa;IACpB,WAAW,EAAE,mBAAmB;IAChC,cAAc,EAAE,uBAAuB;IACvC,QAAQ,EAAE,iBAAiB;CACnB,CAAC;AAEX;;;;;;;GAOG;AAEI,IAAM,UAAU,GAAhB,MAAM,UAAU;IAErB,EAAE,CAAU;IAIZ,IAAI,CAAU;IAGd,KAAK,CAAiB;IAGtB,SAAS,CAAQ;CAClB,CAAA;AAXC;IADC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;sCACpC;AAIZ;IAFC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACvB,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;wCAC3B;AAGd;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;yCACtB;AAGtB;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;8BACX,IAAI;6CAAC;AAZN,UAAU;IADtB,MAAM,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC,KAAK,EAAE,CAAC;GAC/B,UAAU,CAatB;;AAED,oGAAoG;AAE7F,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAE3B,EAAE,CAAU;IAIZ,IAAI,CAAU;IAGd,KAAK,CAAiB;IAGtB,SAAS,CAAQ;CAClB,CAAA;AAXC;IADC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;4CACpC;AAIZ;IAFC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACvB,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;8CAC3B;AAGd;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;+CACtB;AAGtB;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;8BACX,IAAI;mDAAC;AAZN,gBAAgB;IAD5B,MAAM,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC,WAAW,EAAE,CAAC;GACrC,gBAAgB,CAa5B;;AAED,uEAAuE;AAEhE,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAE/B,MAAM,CAAU;IAGhB,YAAY,CAAU;CACvB,CAAA;AAJC;IADC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;oDAChC;AAGhB;IADC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;0DAC1B;AALX,oBAAoB;IADhC,MAAM,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC,cAAc,EAAE,CAAC;GACxC,oBAAoB,CAMhC;;AAED;;;;GAIG;AAGI,IAAM,cAAc,GAApB,MAAM,cAAc;IAEzB,QAAQ,CAAU;IAGlB,MAAM,CAAU;IAGhB,MAAM,CAAU;CACjB,CAAA;AAPC;IADC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;gDAC9B;AAGlB;IADC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;8CAChC;AAGhB;IADC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;8CAChC;AARL,cAAc;IAF1B,MAAM,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC;IAC9C,KAAK,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;GACjB,cAAc,CAS1B;;AAED,yFAAyF;AACzF,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,UAAU;IACV,gBAAgB;IAChB,oBAAoB;IACpB,cAAc;CACN,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export { AUTHZ_ENTITIES, DEFAULT_TABLE_NAMES, PermissionEntity, RoleEntity, RolePermissionEntity, UserRoleEntity, } from './entities.js';
+export { createAuthzTables, ensureAuthzSchema } from './schema.js';
+export { TypeOrmAuthzStore } from './typeorm-authz.store.js';
+export type { UserAuthz } from './typeorm-authz.store.js';
+export { AUTHZ_RBAC_OPTIONS, AUTHZ_RBAC_STORE, AuthzRbacModule, defaultUserRefMapper, } from './authz-rbac.module.js';
+export type { AuthzRbacModuleAsyncOptions, AuthzRbacModuleOptions, UserRefMapper, } from './authz-rbac.module.js';
+export type { AuthzStoreOptions, TableNames, UserRef, UserRefInput } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,YAAY,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,2BAA2B,EAC3B,sBAAsB,EACtB,aAAa,GACd,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,5 @@
+export { AUTHZ_ENTITIES, DEFAULT_TABLE_NAMES, PermissionEntity, RoleEntity, RolePermissionEntity, UserRoleEntity, } from './entities.js';
+export { createAuthzTables, ensureAuthzSchema } from './schema.js';
+export { TypeOrmAuthzStore } from './typeorm-authz.store.js';
+export { AUTHZ_RBAC_OPTIONS, AUTHZ_RBAC_STORE, AuthzRbacModule, defaultUserRefMapper, } from './authz-rbac.module.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC"}

package/dist/schema.d.ts

@@ -0,0 +1,24 @@
+import { type DataSource, type QueryRunner } from 'typeorm';
+import type { AuthzStoreOptions } from './types.js';
+/**
+ * Create the RBAC tables (roles, permissions, and the two pivots) if they don't exist.
+ * Strictly non-destructive — `CREATE TABLE` only runs for a table that is absent. Call it
+ * from a TypeORM migration when `autoCreateSchema: false`:
+ *
+ * ```ts
+ * import { createAuthzTables } from '@dudousxd/nestjs-authz-typeorm';
+ * export class AddAuthz1700000000000 implements MigrationInterface {
+ *   async up(qr: QueryRunner) { await createAuthzTables(qr); }
+ *   async down(qr: QueryRunner) { ... }
+ * }
+ * ```
+ */
+export declare function createAuthzTables(queryRunner: QueryRunner, opts?: AuthzStoreOptions): Promise<void>;
+/**
+ * Ensure the RBAC schema is up to date via a DataSource (used by the store's `ensureSchema`
+ * on bootstrap). For each table: creates it if missing, otherwise non-destructively adds any
+ * columns that exist in the entity metadata but not yet in the live table (see
+ * {@link addMissingColumns}). Never drops/alters/renames — safe to run on every boot.
+ */
+export declare function ensureAuthzSchema(dataSource: DataSource, opts?: AuthzStoreOptions): Promise<void>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,UAAU,EAEf,KAAK,WAAW,EAGjB,MAAM,SAAS,CAAC;AAUjB,OAAO,KAAK,EAAE,iBAAiB,EAAc,MAAM,YAAY,CAAC;AAuDhE;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,WAAW,EACxB,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,IAAI,CAAC,CAOf;AA4BD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,UAAU,EACtB,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,IAAI,CAAC,CAef"}

package/dist/schema.js

@@ -0,0 +1,116 @@
+import { Table, TableColumn, } from 'typeorm';
+import { TableUtils } from 'typeorm/schema-builder/util/TableUtils.js';
+import { DEFAULT_TABLE_NAMES, PermissionEntity, RoleEntity, RolePermissionEntity, UserRoleEntity, } from './entities.js';
+import { assertSafeIdentifier } from './sql.js';
+/** Resolve the (schema-qualified) table name for an entity, applying BYO overrides. */
+function tableName(base, schema) {
+    return schema ? `${schema}.${base}` : base;
+}
+function resolveNames(tableNames) {
+    return {
+        roles: tableNames?.roles ?? DEFAULT_TABLE_NAMES.roles,
+        permissions: tableNames?.permissions ?? DEFAULT_TABLE_NAMES.permissions,
+        rolePermission: tableNames?.rolePermission ?? DEFAULT_TABLE_NAMES.rolePermission,
+        userRole: tableNames?.userRole ?? DEFAULT_TABLE_NAMES.userRole,
+    };
+}
+/** The four table plans (entity + resolved name) for a given options set. */
+function plans(opts) {
+    const names = resolveNames(opts?.tableNames);
+    const schema = opts?.schema;
+    // P4: reject hostile BYO identifiers before they reach DDL.
+    for (const [key, name] of Object.entries(names)) {
+        assertSafeIdentifier(name, `table name (${key})`);
+    }
+    if (schema !== undefined)
+        assertSafeIdentifier(schema, 'schema name');
+    return [
+        { entity: RoleEntity, name: tableName(names.roles, schema) },
+        { entity: PermissionEntity, name: tableName(names.permissions, schema) },
+        { entity: RolePermissionEntity, name: tableName(names.rolePermission, schema) },
+        { entity: UserRoleEntity, name: tableName(names.userRole, schema) },
+    ];
+}
+/**
+ * Build a driver-portable {@link Table} from entity metadata, overriding the table name
+ * so BYO names + an optional Postgres schema are honored (the metadata's own name is the
+ * entity-decorator default).
+ */
+function tableFromMetadata(metadata, driver, name) {
+    const table = Table.create(metadata, driver);
+    table.name = name;
+    return table;
+}
+/**
+ * Create the RBAC tables (roles, permissions, and the two pivots) if they don't exist.
+ * Strictly non-destructive — `CREATE TABLE` only runs for a table that is absent. Call it
+ * from a TypeORM migration when `autoCreateSchema: false`:
+ *
+ * ```ts
+ * import { createAuthzTables } from '@dudousxd/nestjs-authz-typeorm';
+ * export class AddAuthz1700000000000 implements MigrationInterface {
+ *   async up(qr: QueryRunner) { await createAuthzTables(qr); }
+ *   async down(qr: QueryRunner) { ... }
+ * }
+ * ```
+ */
+export async function createAuthzTables(queryRunner, opts) {
+    const driver = queryRunner.connection.driver;
+    for (const plan of plans(opts)) {
+        if (await queryRunner.hasTable(plan.name))
+            continue;
+        const metadata = queryRunner.connection.getMetadata(plan.entity);
+        await queryRunner.createTable(tableFromMetadata(metadata, driver, plan.name), true);
+    }
+}
+/**
+ * Add any columns present in the entity metadata but missing from the live table.
+ *
+ * Strictly non-destructive: it only ever ADDs columns — never drops, alters the type of,
+ * renames, or otherwise touches existing columns, and is order-independent. Each missing
+ * column is built from the entity's `ColumnMetadata` the same way `Table.create` derives a
+ * table (via `TableUtils.createTableColumnOptions`), so the resulting `TableColumn` is
+ * driver-portable across SQLite, MySQL and Postgres.
+ *
+ * Forward-compat rule: any column added to an authz entity after v1 MUST be nullable or have
+ * a default. `ADD COLUMN` of a NOT NULL column without a default fails on a populated table.
+ */
+async function addMissingColumns(queryRunner, plan) {
+    const metadata = queryRunner.connection.getMetadata(plan.entity);
+    const driver = queryRunner.connection.driver;
+    const table = await queryRunner.getTable(plan.name);
+    if (!table)
+        return;
+    const existing = new Set(table.columns.map((column) => column.name));
+    for (const column of metadata.columns) {
+        if (column.isVirtualProperty || existing.has(column.databaseName))
+            continue;
+        const tableColumn = new TableColumn(TableUtils.createTableColumnOptions(column, driver));
+        await queryRunner.addColumn(plan.name, tableColumn);
+    }
+}
+/**
+ * Ensure the RBAC schema is up to date via a DataSource (used by the store's `ensureSchema`
+ * on bootstrap). For each table: creates it if missing, otherwise non-destructively adds any
+ * columns that exist in the entity metadata but not yet in the live table (see
+ * {@link addMissingColumns}). Never drops/alters/renames — safe to run on every boot.
+ */
+export async function ensureAuthzSchema(dataSource, opts) {
+    const queryRunner = dataSource.createQueryRunner();
+    try {
+        const driver = dataSource.driver;
+        for (const plan of plans(opts)) {
+            if (await queryRunner.hasTable(plan.name)) {
+                await addMissingColumns(queryRunner, plan);
+            }
+            else {
+                const metadata = queryRunner.connection.getMetadata(plan.entity);
+                await queryRunner.createTable(tableFromMetadata(metadata, driver, plan.name), true);
+            }
+        }
+    }
+    finally {
+        await queryRunner.release();
+    }
+}
+//# sourceMappingURL=schema.js.map

package/dist/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,EACL,WAAW,GACZ,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,UAAU,EAAE,MAAM,2CAA2C,CAAC;AACvE,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAShD,uFAAuF;AACvF,SAAS,SAAS,CAAC,IAAY,EAAE,MAA0B;IACzD,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED,SAAS,YAAY,CAAC,UAAkC;IAMtD,OAAO;QACL,KAAK,EAAE,UAAU,EAAE,KAAK,IAAI,mBAAmB,CAAC,KAAK;QACrD,WAAW,EAAE,UAAU,EAAE,WAAW,IAAI,mBAAmB,CAAC,WAAW;QACvE,cAAc,EAAE,UAAU,EAAE,cAAc,IAAI,mBAAmB,CAAC,cAAc;QAChF,QAAQ,EAAE,UAAU,EAAE,QAAQ,IAAI,mBAAmB,CAAC,QAAQ;KAC/D,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,KAAK,CAAC,IAAmC;IAChD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC;IAC5B,4DAA4D;IAC5D,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,GAAG,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,MAAM,KAAK,SAAS;QAAE,oBAAoB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACtE,OAAO;QACL,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE;QAC5D,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE;QACxE,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC,EAAE;QAC/E,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE;KACpE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,QAAwB,EAAE,MAA4B,EAAE,IAAY;IAC7F,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,WAAwB,EACxB,IAAwB;IAExB,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,IAAI,MAAM,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACpD,MAAM,QAAQ,GAAG,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjE,MAAM,WAAW,CAAC,WAAW,CAAC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IACtF,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,iBAAiB,CAAC,WAAwB,EAAE,IAAe;IACxE,MAAM,QAAQ,GAAG,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC;IAC7C,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtC,IAAI,MAAM,CAAC,iBAAiB,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC;YAAE,SAAS;QAC5E,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,UAAU,CAAC,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACzF,MAAM,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,UAAsB,EACtB,IAAwB;IAExB,MAAM,WAAW,GAAG,UAAU,CAAC,iBAAiB,EAAE,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,IAAI,MAAM,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,MAAM,iBAAiB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACN,MAAM,QAAQ,GAAG,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACjE,MAAM,WAAW,CAAC,WAAW,CAAC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC;IAC9B,CAAC;AACH,CAAC"}

package/dist/sql.d.ts

@@ -0,0 +1,30 @@
+import type { DataSource } from 'typeorm';
+/** True when the DataSource's driver expects `$n` positional placeholders. */
+export declare function isPostgresFamily(dataSource: DataSource): boolean;
+/**
+ * Build the placeholder token for the parameter at 0-based `index`, dialect-correct
+ * for the given DataSource: `$1, $2, …` on Postgres-family drivers, `?` elsewhere.
+ */
+export declare function placeholder(dataSource: DataSource, index: number): string;
+/**
+ * A tiny helper that hands out dialect-correct, sequentially-numbered placeholders.
+ * Each call to {@link Placeholders.next} returns the next token (`?` or `$n`), so a
+ * single query can interleave them in parameter order regardless of dialect.
+ */
+export declare class Placeholders {
+    private readonly postgres;
+    private index;
+    constructor(postgres: boolean);
+    static for(dataSource: DataSource): Placeholders;
+    /** The next placeholder token, advancing the positional counter. */
+    next(): string;
+}
+/**
+ * Validate an identifier (table/schema name) against {@link SAFE_IDENTIFIER}.
+ * Throws on anything containing quotes, dots, whitespace, or other unsafe chars.
+ *
+ * @param value the identifier to check
+ * @param what  a label for the error message (e.g. `table name "roles"`)
+ */
+export declare function assertSafeIdentifier(value: string, what: string): void;
+//# sourceMappingURL=sql.d.ts.map

package/dist/sql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql.d.ts","sourceRoot":"","sources":["../src/sql.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAS1C,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAEhE;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED;;;;GAIG;AACH,qBAAa,YAAY;IAEX,OAAO,CAAC,QAAQ,CAAC,QAAQ;IADrC,OAAO,CAAC,KAAK,CAAK;gBACW,QAAQ,EAAE,OAAO;IAE9C,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,GAAG,YAAY;IAIhD,oEAAoE;IACpE,IAAI,IAAI,MAAM;CAKf;AAUD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAMtE"}

package/dist/sql.js

@@ -0,0 +1,58 @@
+/**
+ * Database types whose driver binds parameters with positional `$1, $2, …`
+ * placeholders instead of `?`. Postgres (and its aurora/cockroach kin) reject the
+ * `?` style that MySQL/SQLite accept, so the store must emit the right one.
+ */
+const POSTGRES_FAMILY = new Set(['postgres', 'aurora-postgres', 'cockroachdb', 'spanner']);
+/** True when the DataSource's driver expects `$n` positional placeholders. */
+export function isPostgresFamily(dataSource) {
+    return POSTGRES_FAMILY.has(dataSource.options.type);
+}
+/**
+ * Build the placeholder token for the parameter at 0-based `index`, dialect-correct
+ * for the given DataSource: `$1, $2, …` on Postgres-family drivers, `?` elsewhere.
+ */
+export function placeholder(dataSource, index) {
+    return isPostgresFamily(dataSource) ? `$${index + 1}` : '?';
+}
+/**
+ * A tiny helper that hands out dialect-correct, sequentially-numbered placeholders.
+ * Each call to {@link Placeholders.next} returns the next token (`?` or `$n`), so a
+ * single query can interleave them in parameter order regardless of dialect.
+ */
+export class Placeholders {
+    postgres;
+    index = 0;
+    constructor(postgres) {
+        this.postgres = postgres;
+    }
+    static for(dataSource) {
+        return new Placeholders(isPostgresFamily(dataSource));
+    }
+    /** The next placeholder token, advancing the positional counter. */
+    next() {
+        const token = this.postgres ? `$${this.index + 1}` : '?';
+        this.index += 1;
+        return token;
+    }
+}
+/**
+ * SQL identifiers (table / schema names) are interpolated into query text, NOT
+ * passed as bound parameters — `driver.escape()` only wraps them in quotes, it does
+ * NOT neutralize an embedded quote. To keep BYO `tableNames`/`schema` safe, restrict
+ * them to a conservative allowlist and reject anything else loudly.
+ */
+const SAFE_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/**
+ * Validate an identifier (table/schema name) against {@link SAFE_IDENTIFIER}.
+ * Throws on anything containing quotes, dots, whitespace, or other unsafe chars.
+ *
+ * @param value the identifier to check
+ * @param what  a label for the error message (e.g. `table name "roles"`)
+ */
+export function assertSafeIdentifier(value, what) {
+    if (!SAFE_IDENTIFIER.test(value)) {
+        throw new Error(`Unsafe ${what}: ${JSON.stringify(value)}. Identifiers must match /^[A-Za-z_][A-Za-z0-9_]*$/ (letters, digits, underscore; not starting with a digit). This blocks SQL injection via configured names.`);
+    }
+}
+//# sourceMappingURL=sql.js.map

package/dist/sql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql.js","sourceRoot":"","sources":["../src/sql.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,iBAAiB,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;AAE3F,8EAA8E;AAC9E,MAAM,UAAU,gBAAgB,CAAC,UAAsB;IACrD,OAAO,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,UAAsB,EAAE,KAAa;IAC/D,OAAO,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,YAAY;IAEM;IADrB,KAAK,GAAG,CAAC,CAAC;IAClB,YAA6B,QAAiB;QAAjB,aAAQ,GAAR,QAAQ,CAAS;IAAG,CAAC;IAElD,MAAM,CAAC,GAAG,CAAC,UAAsB;QAC/B,OAAO,IAAI,YAAY,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,oEAAoE;IACpE,IAAI;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QACzD,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QAChB,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,eAAe,GAAG,0BAA0B,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa,EAAE,IAAY;IAC9D,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,UAAU,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,+JAA+J,CACxM,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/typeorm-authz.store.d.ts

@@ -0,0 +1,64 @@
+import type { DataSource } from 'typeorm';
+import type { AuthzStoreOptions, UserRef } from './types.js';
+/**
+ * A user's effective permissions: the role names they hold and the flattened set of
+ * permission names granted by those roles.
+ */
+export interface UserAuthz {
+    roles: string[];
+    permissions: string[];
+}
+/**
+ * TypeORM-backed RBAC store. A plain POJO that receives the `DataSource` in its
+ * constructor — NOT `@Injectable`, no internal connection token (the app owns the
+ * connection and plugs it via DI; see the persistence contract).
+ *
+ * BYO table names + an optional Postgres schema flow from {@link AuthzStoreOptions};
+ * the store qualifies every table reference accordingly so it never assumes a name.
+ */
+export declare class TypeOrmAuthzStore {
+    private readonly dataSource;
+    private readonly opts;
+    private readonly names;
+    private readonly schema;
+    constructor(dataSource: DataSource, opts?: AuthzStoreOptions);
+    /** Create/upgrade the RBAC tables (delegates to {@link ensureAuthzSchema}). */
+    ensureSchema(): Promise<void>;
+    /** A fresh, dialect-correct positional-placeholder generator for one query. */
+    private params;
+    /** Schema-qualified, driver-escaped table reference. */
+    private table;
+    private col;
+    /** Dialect-correct `INSERT ... <conflict-ignore>` clause for a unique-key upsert. */
+    private insertIgnoreSuffix;
+    /** Dialect-correct INSERT verb (`INSERT` vs MySQL's `INSERT IGNORE`). */
+    private insertIgnoreVerb;
+    /**
+     * Create the role if absent; returns its id. Idempotent and race-tolerant: the
+     * INSERT is dialect-aware conflict-ignoring (`ON CONFLICT DO NOTHING` /
+     * `INSERT IGNORE`) on the unique `name`, and the id is re-read afterwards so two
+     * concurrent creators converge on the same row.
+     */
+    createRole(name: string): Promise<string>;
+    /** Create the permission if absent; returns its id. Idempotent and race-tolerant. */
+    createPermission(name: string): Promise<string>;
+    private findRoleId;
+    private findPermissionId;
+    /** Grant a permission to a role (creating both by name if needed). Idempotent. */
+    givePermissionToRole(roleName: string, permissionName: string): Promise<void>;
+    /** Revoke a permission from a role. No-op if either is absent or not linked. */
+    revokePermissionFromRole(roleName: string, permissionName: string): Promise<void>;
+    /** Assign a role to a user (creating the role by name if needed). Idempotent. */
+    assignRole(user: UserRef, roleName: string): Promise<void>;
+    /** Remove a role from a user. No-op if the role or assignment is absent. */
+    removeRole(user: UserRef, roleName: string): Promise<void>;
+    /** The role names a user holds. */
+    getRolesForUser(user: UserRef): Promise<string[]>;
+    /** The flattened, distinct permission names a user has via their roles. */
+    getPermissionsForUser(user: UserRef): Promise<string[]>;
+    /** A user's roles + effective permissions in one shot. */
+    getUserAuthz(user: UserRef): Promise<UserAuthz>;
+    /** True when the user holds `permission` through any of their roles. */
+    userHasPermission(user: UserRef, permission: string): Promise<boolean>;
+}
+//# sourceMappingURL=typeorm-authz.store.d.ts.map

package/dist/typeorm-authz.store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"typeorm-authz.store.d.ts","sourceRoot":"","sources":["../src/typeorm-authz.store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAI1C,OAAO,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAU7D;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,qBAAa,iBAAiB;IAK1B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI;IALvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0E;IAChG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;gBAGzB,UAAU,EAAE,UAAU,EACtB,IAAI,GAAE,iBAAsB;IAoB/C,+EAA+E;IAC/E,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7B,+EAA+E;IAC/E,OAAO,CAAC,MAAM;IAId,wDAAwD;IACxD,OAAO,CAAC,KAAK;IAMb,OAAO,CAAC,GAAG;IAMX,qFAAqF;IACrF,OAAO,CAAC,kBAAkB;IAS1B,yEAAyE;IACzE,OAAO,CAAC,gBAAgB;IAMxB;;;;;OAKG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgB/C,qFAAqF;IAC/E,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAevC,UAAU;YAWV,gBAAgB;IAa9B,kFAAkF;IAC5E,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYnF,gFAAgF;IAC1E,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAevF,iFAAiF;IAC3E,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYhE,4EAA4E;IACtE,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAehE,mCAAmC;IAC7B,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAavD,2EAA2E;IACrE,qBAAqB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAgB7D,0DAA0D;IACpD,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;IAQrD,wEAAwE;IAClE,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAkB7E"}

package/dist/typeorm-authz.store.js

@@ -0,0 +1,196 @@
+import { randomUUID } from 'node:crypto';
+import { DEFAULT_TABLE_NAMES } from './entities.js';
+import { ensureAuthzSchema } from './schema.js';
+import { Placeholders, assertSafeIdentifier } from './sql.js';
+/** Normalize a {@link UserRef} to `{ type, id }` with `id` stringified. */
+function normalizeUserRef(ref) {
+    if (typeof ref === 'string' || typeof ref === 'number') {
+        return { type: 'user', id: String(ref) };
+    }
+    return { type: ref.type ?? 'user', id: String(ref.id) };
+}
+/**
+ * TypeORM-backed RBAC store. A plain POJO that receives the `DataSource` in its
+ * constructor — NOT `@Injectable`, no internal connection token (the app owns the
+ * connection and plugs it via DI; see the persistence contract).
+ *
+ * BYO table names + an optional Postgres schema flow from {@link AuthzStoreOptions};
+ * the store qualifies every table reference accordingly so it never assumes a name.
+ */
+export class TypeOrmAuthzStore {
+    dataSource;
+    opts;
+    names;
+    schema;
+    constructor(dataSource, opts = {}) {
+        this.dataSource = dataSource;
+        this.opts = opts;
+        this.names = {
+            roles: opts.tableNames?.roles ?? DEFAULT_TABLE_NAMES.roles,
+            permissions: opts.tableNames?.permissions ?? DEFAULT_TABLE_NAMES.permissions,
+            rolePermission: opts.tableNames?.rolePermission ?? DEFAULT_TABLE_NAMES.rolePermission,
+            userRole: opts.tableNames?.userRole ?? DEFAULT_TABLE_NAMES.userRole,
+        };
+        this.schema = opts.schema;
+        // P4: identifiers are interpolated into SQL — validate BYO names/schema up
+        // front so a hostile value (e.g. one with a `"`) can never reach a query.
+        for (const [key, name] of Object.entries(this.names)) {
+            assertSafeIdentifier(name, `table name (${key})`);
+        }
+        if (this.schema !== undefined) {
+            assertSafeIdentifier(this.schema, 'schema name');
+        }
+    }
+    /** Create/upgrade the RBAC tables (delegates to {@link ensureAuthzSchema}). */
+    ensureSchema() {
+        return ensureAuthzSchema(this.dataSource, this.opts);
+    }
+    /** A fresh, dialect-correct positional-placeholder generator for one query. */
+    params() {
+        return Placeholders.for(this.dataSource);
+    }
+    /** Schema-qualified, driver-escaped table reference. */
+    table(key) {
+        const quote = (id) => this.dataSource.driver.escape(id);
+        const name = quote(this.names[key]);
+        return this.schema ? `${quote(this.schema)}.${name}` : name;
+    }
+    col(id) {
+        return this.dataSource.driver.escape(id);
+    }
+    // --- roles & permissions (idempotent upserts by name) ---
+    /** Dialect-correct `INSERT ... <conflict-ignore>` clause for a unique-key upsert. */
+    insertIgnoreSuffix() {
+        // Postgres/SQLite speak `ON CONFLICT DO NOTHING`; MySQL/MariaDB use `INSERT IGNORE`
+        // (handled at the verb in `insertIgnoreVerb`). Returning a trailing clause keeps
+        // the call sites uniform.
+        const type = this.dataSource.options.type;
+        if (type === 'mysql' || type === 'mariadb' || type === 'aurora-mysql')
+            return '';
+        return ' ON CONFLICT DO NOTHING';
+    }
+    /** Dialect-correct INSERT verb (`INSERT` vs MySQL's `INSERT IGNORE`). */
+    insertIgnoreVerb() {
+        const type = this.dataSource.options.type;
+        if (type === 'mysql' || type === 'mariadb' || type === 'aurora-mysql')
+            return 'INSERT IGNORE';
+        return 'INSERT';
+    }
+    /**
+     * Create the role if absent; returns its id. Idempotent and race-tolerant: the
+     * INSERT is dialect-aware conflict-ignoring (`ON CONFLICT DO NOTHING` /
+     * `INSERT IGNORE`) on the unique `name`, and the id is re-read afterwards so two
+     * concurrent creators converge on the same row.
+     */
+    async createRole(name) {
+        const existing = await this.findRoleId(name);
+        if (existing)
+            return existing;
+        const p = this.params();
+        await this.dataSource.query(`${this.insertIgnoreVerb()} INTO ${this.table('roles')} (${this.col('id')}, ${this.col('name')}, ${this.col('guard')}, ${this.col('createdAt')}) VALUES (${p.next()}, ${p.next()}, NULL, ${p.next()})${this.insertIgnoreSuffix()}`, [randomUUID(), name, new Date().toISOString()]);
+        // Re-read: handles a concurrent insert that won the race (ours was ignored).
+        const id = await this.findRoleId(name);
+        if (!id)
+            throw new Error(`Failed to create or resolve role "${name}".`);
+        return id;
+    }
+    /** Create the permission if absent; returns its id. Idempotent and race-tolerant. */
+    async createPermission(name) {
+        const existing = await this.findPermissionId(name);
+        if (existing)
+            return existing;
+        const p = this.params();
+        await this.dataSource.query(`${this.insertIgnoreVerb()} INTO ${this.table('permissions')} (${this.col('id')}, ${this.col('name')}, ${this.col('guard')}, ${this.col('createdAt')}) VALUES (${p.next()}, ${p.next()}, NULL, ${p.next()})${this.insertIgnoreSuffix()}`, [randomUUID(), name, new Date().toISOString()]);
+        const id = await this.findPermissionId(name);
+        if (!id)
+            throw new Error(`Failed to create or resolve permission "${name}".`);
+        return id;
+    }
+    async findRoleId(name) {
+        const p = this.params();
+        const rows = (await this.dataSource.query(`SELECT ${this.col('id')} AS id FROM ${this.table('roles')} WHERE ${this.col('name')} = ${p.next()}`, [name]));
+        return rows[0]?.id;
+    }
+    async findPermissionId(name) {
+        const p = this.params();
+        const rows = (await this.dataSource.query(`SELECT ${this.col('id')} AS id FROM ${this.table('permissions')} WHERE ${this.col('name')} = ${p.next()}`, [name]));
+        return rows[0]?.id;
+    }
+    // --- role ↔ permission ---
+    /** Grant a permission to a role (creating both by name if needed). Idempotent. */
+    async givePermissionToRole(roleName, permissionName) {
+        const roleId = await this.createRole(roleName);
+        const permissionId = await this.createPermission(permissionName);
+        const p = this.params();
+        await this.dataSource.query(`${this.insertIgnoreVerb()} INTO ${this.table('rolePermission')} (${this.col('roleId')}, ${this.col('permissionId')}) VALUES (${p.next()}, ${p.next()})${this.insertIgnoreSuffix()}`, [roleId, permissionId]);
+    }
+    /** Revoke a permission from a role. No-op if either is absent or not linked. */
+    async revokePermissionFromRole(roleName, permissionName) {
+        const roleId = await this.findRoleId(roleName);
+        const permissionId = await this.findPermissionId(permissionName);
+        if (!roleId || !permissionId)
+            return;
+        const p = this.params();
+        await this.dataSource.query(`DELETE FROM ${this.table('rolePermission')} WHERE ${this.col('roleId')} = ${p.next()} AND ${this.col('permissionId')} = ${p.next()}`, [roleId, permissionId]);
+    }
+    // --- user ↔ role ---
+    /** Assign a role to a user (creating the role by name if needed). Idempotent. */
+    async assignRole(user, roleName) {
+        const { type, id } = normalizeUserRef(user);
+        const roleId = await this.createRole(roleName);
+        const p = this.params();
+        await this.dataSource.query(`${this.insertIgnoreVerb()} INTO ${this.table('userRole')} (${this.col('userType')}, ${this.col('userId')}, ${this.col('roleId')}) VALUES (${p.next()}, ${p.next()}, ${p.next()})${this.insertIgnoreSuffix()}`, [type, id, roleId]);
+    }
+    /** Remove a role from a user. No-op if the role or assignment is absent. */
+    async removeRole(user, roleName) {
+        const { type, id } = normalizeUserRef(user);
+        const roleId = await this.findRoleId(roleName);
+        if (!roleId)
+            return;
+        const p = this.params();
+        await this.dataSource.query(`DELETE FROM ${this.table('userRole')} WHERE ${this.col('userType')} = ${p.next()} AND ${this.col('userId')} = ${p.next()} AND ${this.col('roleId')} = ${p.next()}`, [type, id, roleId]);
+    }
+    // --- queries ---
+    /** The role names a user holds. */
+    async getRolesForUser(user) {
+        const { type, id } = normalizeUserRef(user);
+        const p = this.params();
+        const rows = (await this.dataSource.query(`SELECT r.${this.col('name')} AS name
+       FROM ${this.table('userRole')} ur
+       JOIN ${this.table('roles')} r ON r.${this.col('id')} = ur.${this.col('roleId')}
+       WHERE ur.${this.col('userType')} = ${p.next()} AND ur.${this.col('userId')} = ${p.next()}`, [type, id]));
+        return rows.map((row) => row.name);
+    }
+    /** The flattened, distinct permission names a user has via their roles. */
+    async getPermissionsForUser(user) {
+        const { type, id } = normalizeUserRef(user);
+        const p = this.params();
+        const rows = (await this.dataSource.query(`SELECT DISTINCT p.${this.col('name')} AS name
+       FROM ${this.table('userRole')} ur
+       JOIN ${this.table('rolePermission')} rp ON rp.${this.col('roleId')} = ur.${this.col('roleId')}
+       JOIN ${this.table('permissions')} p ON p.${this.col('id')} = rp.${this.col('permissionId')}
+       WHERE ur.${this.col('userType')} = ${p.next()} AND ur.${this.col('userId')} = ${p.next()}`, [type, id]));
+        return rows.map((row) => row.name);
+    }
+    /** A user's roles + effective permissions in one shot. */
+    async getUserAuthz(user) {
+        const [roles, permissions] = await Promise.all([
+            this.getRolesForUser(user),
+            this.getPermissionsForUser(user),
+        ]);
+        return { roles, permissions };
+    }
+    /** True when the user holds `permission` through any of their roles. */
+    async userHasPermission(user, permission) {
+        const { type, id } = normalizeUserRef(user);
+        const p = this.params();
+        const rows = (await this.dataSource.query(`SELECT 1 AS x
+       FROM ${this.table('userRole')} ur
+       JOIN ${this.table('rolePermission')} rp ON rp.${this.col('roleId')} = ur.${this.col('roleId')}
+       JOIN ${this.table('permissions')} p ON p.${this.col('id')} = rp.${this.col('permissionId')}
+       WHERE ur.${this.col('userType')} = ${p.next()} AND ur.${this.col('userId')} = ${p.next()} AND p.${this.col('name')} = ${p.next()}
+       LIMIT 1`, [type, id, permission]));
+        return rows.length > 0;
+    }
+}
+//# sourceMappingURL=typeorm-authz.store.js.map

package/dist/typeorm-authz.store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"typeorm-authz.store.js","sourceRoot":"","sources":["../src/typeorm-authz.store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAG9D,2EAA2E;AAC3E,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACvD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;AAC1D,CAAC;AAWD;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IAKT;IACA;IALF,KAAK,CAA0E;IAC/E,MAAM,CAAqB;IAE5C,YACmB,UAAsB,EACtB,OAA0B,EAAE;QAD5B,eAAU,GAAV,UAAU,CAAY;QACtB,SAAI,GAAJ,IAAI,CAAwB;QAE7C,IAAI,CAAC,KAAK,GAAG;YACX,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,IAAI,mBAAmB,CAAC,KAAK;YAC1D,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,IAAI,mBAAmB,CAAC,WAAW;YAC5E,cAAc,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,IAAI,mBAAmB,CAAC,cAAc;YACrF,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,IAAI,mBAAmB,CAAC,QAAQ;SACpE,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAE1B,2EAA2E;QAC3E,0EAA0E;QAC1E,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,GAAG,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,YAAY;QACV,OAAO,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,+EAA+E;IACvE,MAAM;QACZ,OAAO,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED,wDAAwD;IAChD,KAAK,CAAC,GAA4B;QACxC,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;IAEO,GAAG,CAAC,EAAU;QACpB,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,2DAA2D;IAE3D,qFAAqF;IAC7E,kBAAkB;QACxB,oFAAoF;QACpF,iFAAiF;QACjF,0BAA0B;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,cAAc;YAAE,OAAO,EAAE,CAAC;QACjF,OAAO,yBAAyB,CAAC;IACnC,CAAC;IAED,yEAAyE;IACjE,gBAAgB;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,cAAc;YAAE,OAAO,eAAe,CAAC;QAC9F,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,GAAG,IAAI,CAAC,gBAAgB,EAAE,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,CACpF,MAAM,CACP,KAAK,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,kBAAkB,EAAE,EAAE,EACrI,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAC/C,CAAC;QACF,6EAA6E;QAC7E,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,IAAI,CAAC,CAAC;QACxE,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,GAAG,IAAI,CAAC,gBAAgB,EAAE,SAAS,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,IAAI,CAAC,GAAG,CACvE,IAAI,CACL,KAAK,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,kBAAkB,EAAE,EAAE,EAC1J,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAC/C,CAAC;QACF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,IAAI,CAAC,CAAC;QAC9E,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,IAAY;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACvC,UAAU,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,GAAG,CAC1E,MAAM,CACP,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EACjB,CAAC,IAAI,CAAC,CACP,CAA0B,CAAC;QAC5B,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACzC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACvC,UAAU,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU,IAAI,CAAC,GAAG,CAChF,MAAM,CACP,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EACjB,CAAC,IAAI,CAAC,CACP,CAA0B,CAAC;QAC5B,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACrB,CAAC;IAED,4BAA4B;IAE5B,kFAAkF;IAClF,KAAK,CAAC,oBAAoB,CAAC,QAAgB,EAAE,cAAsB;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,GAAG,IAAI,CAAC,gBAAgB,EAAE,SAAS,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,IAAI,CAAC,GAAG,CAC1E,QAAQ,CACT,KAAK,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,kBAAkB,EAAE,EAAE,EAC/F,CAAC,MAAM,EAAE,YAAY,CAAC,CACvB,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,wBAAwB,CAAC,QAAgB,EAAE,cAAsB;QACrE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY;YAAE,OAAO;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,eAAe,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,UAAU,IAAI,CAAC,GAAG,CAC3D,QAAQ,CACT,MAAM,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAC/D,CAAC,MAAM,EAAE,YAAY,CAAC,CACvB,CAAC;IACJ,CAAC;IAED,sBAAsB;IAEtB,iFAAiF;IACjF,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB;QAC9C,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,GAAG,IAAI,CAAC,gBAAgB,EAAE,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,CACpE,UAAU,CACX,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,kBAAkB,EAAE,EAAE,EAC7H,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CACnB,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB;QAC9C,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,eAAe,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,GAAG,CAC/F,QAAQ,CACT,MAAM,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EACzD,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CACnB,CAAC;IACJ,CAAC;IAED,kBAAkB;IAElB,mCAAmC;IACnC,KAAK,CAAC,eAAe,CAAC,IAAa;QACjC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACvC,YAAY,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;cACpB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;cACtB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;kBACnE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,WAAW,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAC3F,CAAC,IAAI,EAAE,EAAE,CAAC,CACX,CAA4B,CAAC;QAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,qBAAqB,CAAC,IAAa;QACvC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACvC,qBAAqB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;cAC7B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;cACtB,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,GAAG,CACjF,QAAQ,CACT;cACM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;kBAC/E,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,WAAW,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAC3F,CAAC,IAAI,EAAE,EAAE,CAAC,CACX,CAA4B,CAAC;QAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,YAAY,CAAC,IAAa;QAC9B,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAC1B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC;SACjC,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChC,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,iBAAiB,CAAC,IAAa,EAAE,UAAkB;QACvD,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACvC;cACQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;cACtB,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,GAAG,CACjF,QAAQ,CACT;cACM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;kBAC/E,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,WAAW,IAAI,CAAC,GAAG,CAC9D,QAAQ,CACT,MAAM,CAAC,CAAC,IAAI,EAAE,UAAU,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE;eAC/C,EACT,CAAC,IAAI,EAAE,EAAE,EAAE,UAAU,CAAC,CACvB,CAAc,CAAC;QAChB,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;CACF"}

package/dist/types.d.ts

@@ -0,0 +1,27 @@
+/** BYO table names. Any omitted name falls back to {@link DEFAULT_TABLE_NAMES}. */
+export interface TableNames {
+    roles?: string;
+    permissions?: string;
+    rolePermission?: string;
+    userRole?: string;
+}
+/**
+ * A reference to a user. Matches nestjs-context's `UserRef` shape (`{ type, id }`),
+ * but the store accepts either a full ref or a bare id (defaulting `type` to `'user'`).
+ */
+export interface UserRefInput {
+    type?: string;
+    id: string | number;
+}
+/** A user reference, or just its id (treated as `{ type: 'user', id }`). */
+export type UserRef = UserRefInput | string | number;
+export interface AuthzStoreOptions {
+    /** BYO table names; each defaults to the matching {@link DEFAULT_TABLE_NAMES} entry. */
+    tableNames?: TableNames;
+    /**
+     * Optional Postgres schema (NOT a connection — the connection comes from the app's
+     * DI per the persistence contract). Tables are created/queried as `"schema"."table"`.
+     */
+    schema?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;CACrB;AAED,4EAA4E;AAC5E,MAAM,MAAM,OAAO,GAAG,YAAY,GAAG,MAAM,GAAG,MAAM,CAAC;AAErD,MAAM,WAAW,iBAAiB;IAChC,wFAAwF;IACxF,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,65 @@
+{
+  "name": "@dudousxd/nestjs-authz-typeorm",
+  "version": "0.2.0",
+  "description": "TypeORM RBAC persistence for @dudousxd/nestjs-authz — roles, permissions, and a Gate seam (zero connection ownership).",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/DavideCarvalho/nestjs-authz.git",
+    "directory": "packages/typeorm"
+  },
+  "author": "Davi Carvalho <davi@goflip.ai>",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist/",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "peerDependencies": {
+    "@dudousxd/nestjs-authz": ">=0.1.0",
+    "@nestjs/common": ">=10.0.0",
+    "@nestjs/core": ">=10.0.0",
+    "reflect-metadata": ">=0.1.13",
+    "typeorm": "^0.3.0"
+  },
+  "devDependencies": {
+    "@nestjs/common": "^11.0.0",
+    "@nestjs/core": "^11.0.0",
+    "@nestjs/testing": "^11.0.0",
+    "@types/node": "^20.0.0",
+    "reflect-metadata": "^0.2.2",
+    "rxjs": "^7.8.1",
+    "sqlite3": "^5.1.7",
+    "typeorm": "^0.3.20",
+    "typescript": "^5.4.0",
+    "vitest": "^3.0.0",
+    "@dudousxd/nestjs-authz": "^0.2.0"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "keywords": [
+    "nestjs",
+    "authorization",
+    "authz",
+    "rbac",
+    "roles",
+    "permissions",
+    "typeorm"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "vitest run --passWithNoTests",
+    "test:watch": "vitest",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  }
+}