@dudousxd/nestjs-authz-typeorm 0.2.0 → 0.3.0

package/CHANGELOG.md

@@ -1,5 +1,73 @@
 # @dudousxd/nestjs-authz-typeorm
 
+## 0.3.0
+
+### Minor Changes
+
+- [#9](https://github.com/DavideCarvalho/nestjs-authz/pull/9) [`07d01de`](https://github.com/DavideCarvalho/nestjs-authz/commit/07d01de286e7dfcae5fbeb10b7e8d48533214087) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Ecosystem improvements across the authz packages.
+
+  ### Permissions
+
+  - **Wildcard / hierarchical permissions.** Permission strings now support wildcard
+    and hierarchical matching (e.g. `posts:*` or `posts:read:*`), so a single granted
+    permission can authorize a family of related actions instead of enumerating each one.
+
+  ### Authorization decisions
+
+  - **Deny reason / message surfaced on `ForbiddenException`.** When a check fails, the
+    reason for the denial is propagated onto the thrown `ForbiddenException`, making it
+    possible to return a meaningful message to the caller and to debug authorization
+    failures.
+  - **Gate `after` hook.** The Gate now exposes an `after` hook that runs once a decision
+    has been made, enabling cross-cutting concerns such as auditing, logging, and metrics.
+
+  ### Batch authorization
+
+  - **`allowsMany`** for evaluating multiple permission checks in a single call.
+  - **Batch `/authz/can` endpoint** so clients can resolve many checks in one round trip.
+  - **`createCanBatch`** client helper that batches `can` calls transparently.
+
+  ### Performance
+
+  - **Request-scoped permission cache.** Permissions resolved during a request are cached
+    for the lifetime of that request, avoiding repeated lookups on the hot path.
+
+  ### RBAC adapters (TypeORM)
+
+  - **Direct user permissions** granted to a user independent of their roles.
+  - **Tenant-scoped roles** so the same role can be assigned per tenant in multi-tenant
+    deployments.
+
+  ### Query scoping / policy filter (ABAC)
+
+  - **ORM-neutral constraint AST.** Policies can produce a portable constraint
+    representation describing which rows a subject may access.
+  - **Per-ORM application.** The constraint AST is translated and applied for
+    **TypeORM**, **MikroORM**, and **Prisma**, giving ABAC-style query scoping that
+    filters data at the database layer regardless of the ORM in use.
+
+  ### Testing
+
+  - **New `@dudousxd/nestjs-authz-testing` package** with fakes and helpers for testing
+    authorization in consumer applications.
+  - **Postgres / MySQL testcontainers + contract tests** so the ORM stores are verified
+    against real database engines, and a shared contract suite keeps the adapters
+    behaviorally consistent.
+
+  ### Housekeeping
+
+  - **Packaging hygiene** across the published packages.
+
+## 0.2.1
+
+### Patch Changes
+
+- [#2](https://github.com/DavideCarvalho/nestjs-authz/pull/2) [`2ecb0f4`](https://github.com/DavideCarvalho/nestjs-authz/commit/2ecb0f46342fa4527fc01f1097720f2e7bcf9aa7) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - `AuthzRbacModule` now registers a `RoleProvider` under the core `ROLE_PROVIDER` token
+  that returns `store.getRolesForUser(...)`, so coarse role checks (`gate.hasRole('teacher')`,
+  `@Roles('admin')`) consult the persisted RBAC store too — mirroring the existing
+  `PERMISSION_PROVIDER` wiring. Roles from the store are unioned with any read off the user
+  object by core's default resolver.
+
 ## 0.2.0
 
 ### Minor Changes

package/dist/authz-rbac.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authz-rbac.module.d.ts","sourceRoot":"","sources":["../src/authz-rbac.module.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,aAAa,EAQnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C,qFAAqF;AACrF,eAAO,MAAM,gBAAgB,eAAqD,CAAC;AACnF,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,eAAuD,CAAC;AAEvF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,GAAG,SAAS,CAAC;AAEnE,MAAM,WAAW,sBAAsB;IACrC,uEAAuE;IACvE,KAAK,EAAE,iBAAiB,CAAC;IACzB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,WAAW,CAAC,EAAE,aAAa,CAAC;CAC7B;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,UAAU,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,sBAAsB,CAAC,GAAG,sBAAsB,CAAC;CAC9F;AAED,qFAAqF;AACrF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAOvE;AAiCD;;;;;;GAMG;AACH,qBACa,eAAe;IAC1B,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa;IAa9D,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,2BAA2B,GAAG,aAAa;IAsBxE,OAAO,CAAC,MAAM,CAAC,eAAe;CAO/B"}
+{"version":3,"file":"authz-rbac.module.d.ts","sourceRoot":"","sources":["../src/authz-rbac.module.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,KAAK,aAAa,EAQnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C,qFAAqF;AACrF,eAAO,MAAM,gBAAgB,eAAqD,CAAC;AACnF,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,eAAuD,CAAC;AAEvF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,GAAG,SAAS,CAAC;AAEnE,MAAM,WAAW,sBAAsB;IACrC,uEAAuE;IACvE,KAAK,EAAE,iBAAiB,CAAC;IACzB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,WAAW,CAAC,EAAE,aAAa,CAAC;CAC7B;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,UAAU,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,sBAAsB,CAAC,GAAG,sBAAsB,CAAC;CAC9F;AAgDD,qFAAqF;AACrF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAOvE;AA+FD;;;;;;GAMG;AACH,qBACa,eAAe;IAC1B,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa;IAa9D,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,2BAA2B,GAAG,aAAa;IAsBxE,OAAO,CAAC,MAAM,CAAC,eAAe;CAS/B"}

package/dist/authz-rbac.module.js

@@ -11,12 +11,49 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 var AuthzRbacModule_1;
-import { PERMISSION_PROVIDER } from '@dudousxd/nestjs-authz';
+import { CONTEXT_ACCESSOR, PERMISSION_PROVIDER, ROLE_PROVIDER, } from '@dudousxd/nestjs-authz';
 import { Inject, Injectable, Module, Optional, } from '@nestjs/common';
+import { ModuleRef } from '@nestjs/core';
 /** Injection token holding the {@link TypeOrmAuthzStore} the RBAC module manages. */
 export const AUTHZ_RBAC_STORE = Symbol.for('@dudousxd/nestjs-authz-typeorm:store');
 /** Injection token holding the resolved {@link AuthzRbacModuleOptions}. */
 export const AUTHZ_RBAC_OPTIONS = Symbol.for('@dudousxd/nestjs-authz-typeorm:options');
+/** Read the current tenant from the (optional) context accessor, defensively. */
+function tenantScopeFrom(context) {
+    if (!context || typeof context.tenantId !== 'function')
+        return {};
+    let tenantId;
+    try {
+        tenantId = context.tenantId();
+    }
+    catch {
+        tenantId = undefined;
+    }
+    return tenantId == null ? {} : { tenantId };
+}
+/**
+ * Locate the context accessor for tenant scoping. Prefers a value injected into
+ * this module; falls back to a non-strict {@link ModuleRef} lookup so an accessor
+ * provided by ANY module (the app root, a global ContextModule) is still found —
+ * the RBAC module is global and its providers don't import the app's modules, so a
+ * plain `@Inject` would miss a root-provided accessor. Mirrors the Gate's seam.
+ */
+function resolveTenantContext(injected, moduleRef, cache) {
+    if (injected)
+        return injected;
+    if (cache.resolved)
+        return cache.value;
+    cache.resolved = true;
+    if (moduleRef) {
+        try {
+            cache.value = moduleRef.get(CONTEXT_ACCESSOR, { strict: false });
+        }
+        catch {
+            cache.value = undefined;
+        }
+    }
+    return cache.value;
+}
 /** Default mapping: accept a `{ type, id }` ref, a `{ id }` object, or a bare id. */
 export function defaultUserRefMapper(user) {
     if (user == null)
@@ -36,22 +73,91 @@ export function defaultUserRefMapper(user) {
  */
 let RbacPermissionProvider = class RbacPermissionProvider {
     options;
-    constructor(options) {
+    context;
+    moduleRef;
+    contextCache = {
+        resolved: false,
+        value: undefined,
+    };
+    constructor(options, context, moduleRef) {
         this.options = options;
+        this.context = context;
+        this.moduleRef = moduleRef;
+    }
+    scope() {
+        return tenantScopeFrom(resolveTenantContext(this.context, this.moduleRef, this.contextCache));
     }
+    // The core `PermissionProvider` interface passes an optional `resource` (3rd
+    // arg); it is intentionally ignored here. RBAC grants are model-less,
+    // named-ability grants (the Laravel/spatie `Gate::before` grant), so the
+    // verdict never depends on a specific resource instance. Permissions are scoped
+    // by the current tenant (from nestjs-context, when present) — a tenant-scoped
+    // role only grants within its tenant; direct user grants always apply.
     async hasPermission(user, permission) {
         const map = this.options.userRefFrom ?? defaultUserRefMapper;
         const ref = map(user);
         if (ref === undefined)
             return undefined;
-        return this.options.store.userHasPermission(ref, permission);
+        return this.options.store.userHasPermission(ref, permission, this.scope());
+    }
+    // Expose the user's full granted permission set so the core can apply
+    // Laravel/spatie-style wildcard matching (a granted `posts.*` satisfies a check
+    // for `posts.update`, `*` satisfies anything). The matching itself lives in core,
+    // so every adapter that lists grants gets wildcard semantics for free.
+    async getPermissions(user) {
+        const map = this.options.userRefFrom ?? defaultUserRefMapper;
+        const ref = map(user);
+        if (ref === undefined)
+            return undefined;
+        return this.options.store.getPermissionsForUser(ref, this.scope());
     }
 };
 RbacPermissionProvider = __decorate([
     Injectable(),
     __param(0, Inject(AUTHZ_RBAC_OPTIONS)),
-    __metadata("design:paramtypes", [Object])
+    __param(1, Optional()),
+    __param(1, Inject(CONTEXT_ACCESSOR)),
+    __param(2, Optional()),
+    __metadata("design:paramtypes", [Object, Object, ModuleRef])
 ], RbacPermissionProvider);
+/**
+ * The RBAC {@link RoleProvider} the Gate consults (via the shared {@link ROLE_PROVIDER}
+ * token) for coarse role-checks (`gate.hasRole('teacher')`, `@Roles('admin')`). Returns
+ * the role names the current user holds in the persisted store. Core unions these with
+ * any roles read off the user object by the default `RoleResolver`.
+ */
+let RbacRoleProvider = class RbacRoleProvider {
+    options;
+    context;
+    moduleRef;
+    contextCache = {
+        resolved: false,
+        value: undefined,
+    };
+    constructor(options, context, moduleRef) {
+        this.options = options;
+        this.context = context;
+        this.moduleRef = moduleRef;
+    }
+    async getRoles(user) {
+        const map = this.options.userRefFrom ?? defaultUserRefMapper;
+        const ref = map(user);
+        if (ref === undefined)
+            return undefined;
+        // Scope roles by the current tenant (when nestjs-context is present): a
+        // tenant-scoped role only counts within its tenant; global roles always count.
+        const scope = tenantScopeFrom(resolveTenantContext(this.context, this.moduleRef, this.contextCache));
+        return this.options.store.getRolesForUser(ref, scope);
+    }
+};
+RbacRoleProvider = __decorate([
+    Injectable(),
+    __param(0, Inject(AUTHZ_RBAC_OPTIONS)),
+    __param(1, Optional()),
+    __param(1, Inject(CONTEXT_ACCESSOR)),
+    __param(2, Optional()),
+    __metadata("design:paramtypes", [Object, Object, ModuleRef])
+], RbacRoleProvider);
 /** Runs `ensureAuthzSchema` on bootstrap when `autoCreateSchema` is not disabled. */
 let AuthzRbacBootstrap = class AuthzRbacBootstrap {
     options;
@@ -89,7 +195,7 @@ let AuthzRbacModule = AuthzRbacModule_1 = class AuthzRbacModule {
                 { provide: AUTHZ_RBAC_STORE, useValue: options.store },
                 ...AuthzRbacModule_1.commonProviders(),
             ],
-            exports: [AUTHZ_RBAC_STORE, PERMISSION_PROVIDER],
+            exports: [AUTHZ_RBAC_STORE, PERMISSION_PROVIDER, ROLE_PROVIDER],
         };
     }
     static forRootAsync(options) {
@@ -110,13 +216,15 @@ let AuthzRbacModule = AuthzRbacModule_1 = class AuthzRbacModule {
                 },
                 ...AuthzRbacModule_1.commonProviders(),
             ],
-            exports: [AUTHZ_RBAC_STORE, PERMISSION_PROVIDER],
+            exports: [AUTHZ_RBAC_STORE, PERMISSION_PROVIDER, ROLE_PROVIDER],
         };
     }
     static commonProviders() {
         return [
             RbacPermissionProvider,
             { provide: PERMISSION_PROVIDER, useExisting: RbacPermissionProvider },
+            RbacRoleProvider,
+            { provide: ROLE_PROVIDER, useExisting: RbacRoleProvider },
             AuthzRbacBootstrap,
         ];
     }

package/dist/authz-rbac.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"authz-rbac.module.js","sourceRoot":"","sources":["../src/authz-rbac.module.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EAAE,mBAAmB,EAA2B,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAEL,MAAM,EACN,UAAU,EACV,MAAM,EAEN,QAAQ,GAGT,MAAM,gBAAgB,CAAC;AAIxB,qFAAqF;AACrF,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;AACnF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;AA6BvF,qFAAqF;AACrF,MAAM,UAAU,oBAAoB,CAAC,IAAa;IAChD,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACtE,MAAM,CAAC,GAAG,IAAwC,CAAC;IACnD,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAqB,CAAC;IACnC,OAAO,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,IACM,sBAAsB,GAD5B,MACM,sBAAsB;IAC+B;IAAzD,YAAyD,OAA+B;QAA/B,YAAO,GAAP,OAAO,CAAwB;IAAG,CAAC;IAE5F,KAAK,CAAC,aAAa,CAAC,IAAa,EAAE,UAAkB;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC/D,CAAC;CACF,CAAA;AATK,sBAAsB;IAD3B,UAAU,EAAE;IAEE,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;;GADnC,sBAAsB,CAS3B;AAED,qFAAqF;AACrF,IACM,kBAAkB,GADxB,MACM,kBAAkB;IAEqC;IAD3D,YAC2D,OAAgC;QAAhC,YAAO,GAAP,OAAO,CAAyB;IACxF,CAAC;IAEJ,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,KAAK,KAAK;YAAE,OAAO;QACpD,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;IAC1C,CAAC;CACF,CAAA;AAVK,kBAAkB;IADvB,UAAU,EAAE;IAGR,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;;GAFrC,kBAAkB,CAUvB;AAED;;;;;;GAMG;AAEI,IAAM,eAAe,uBAArB,MAAM,eAAe;IAC1B,MAAM,CAAC,OAAO,CAAC,OAA+B;QAC5C,OAAO;YACL,MAAM,EAAE,iBAAe;YACvB,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE;gBACT,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE;gBAClD,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE;gBACtD,GAAG,iBAAe,CAAC,eAAe,EAAE;aACrC;YACD,OAAO,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;SACjD,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,OAAoC;QACtD,OAAO;YACL,MAAM,EAAE,iBAAe;YACvB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAoB;YACnD,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,kBAAkB;oBAC3B,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAyB;iBACvD;gBACD;oBACE,OAAO,EAAE,gBAAgB;oBACzB,UAAU,EAAE,CAAC,IAA4B,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK;oBACxD,MAAM,EAAE,CAAC,kBAAkB,CAAC;iBAC7B;gBACD,GAAG,iBAAe,CAAC,eAAe,EAAE;aACrC;YACD,OAAO,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;SACjD,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,eAAe;QAC5B,OAAO;YACL,sBAAsB;YACtB,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,sBAAsB,EAAE;YACrE,kBAAkB;SACnB,CAAC;IACJ,CAAC;CACF,CAAA;AA3CY,eAAe;IAD3B,MAAM,CAAC,EAAE,CAAC;GACE,eAAe,CA2C3B"}
+{"version":3,"file":"authz-rbac.module.js","sourceRoot":"","sources":["../src/authz-rbac.module.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EAEnB,aAAa,GAEd,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAEL,MAAM,EACN,UAAU,EACV,MAAM,EAEN,QAAQ,GAGT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAIzC,qFAAqF;AACrF,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;AACnF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;AAsCvF,iFAAiF;AACjF,SAAS,eAAe,CAAC,OAA0C;IACjE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,UAAU;QAAE,OAAO,EAAE,CAAC;IAClE,IAAI,QAA4B,CAAC;IACjC,IAAI,CAAC;QACH,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,SAAS,CAAC;IACvB,CAAC;IACD,OAAO,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAC3B,QAA2C,EAC3C,SAAgC,EAChC,KAAsE;IAEtE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC;IACvC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;IACtB,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC;YACH,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC,GAAG,CAAwB,gBAAgB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1F,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC;AACrB,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,oBAAoB,CAAC,IAAa;IAChD,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACtE,MAAM,CAAC,GAAG,IAAwC,CAAC;IACnD,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAqB,CAAC;IACnC,OAAO,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,IACM,sBAAsB,GAD5B,MACM,sBAAsB;IAOqB;IACU;IAC1B;IARd,YAAY,GAAG;QAC9B,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,SAA8C;KACtD,CAAC;IAEF,YAC+C,OAA+B,EACrB,OAA+B,EACzD,SAAqB;QAFL,YAAO,GAAP,OAAO,CAAwB;QACrB,YAAO,GAAP,OAAO,CAAwB;QACzD,cAAS,GAAT,SAAS,CAAY;IACjD,CAAC;IAEI,KAAK;QACX,OAAO,eAAe,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAChG,CAAC;IAED,6EAA6E;IAC7E,sEAAsE;IACtE,yEAAyE;IACzE,gFAAgF;IAChF,8EAA8E;IAC9E,uEAAuE;IACvE,KAAK,CAAC,aAAa,CAAC,IAAa,EAAE,UAAkB;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,sEAAsE;IACtE,gFAAgF;IAChF,kFAAkF;IAClF,uEAAuE;IACvE,KAAK,CAAC,cAAc,CAAC,IAAa;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACrE,CAAC;CACF,CAAA;AAvCK,sBAAsB;IAD3B,UAAU,EAAE;IAQR,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;IAC1B,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,gBAAgB,CAAC,CAAA;IACpC,WAAA,QAAQ,EAAE,CAAA;qDAA8B,SAAS;GAThD,sBAAsB,CAuC3B;AAED;;;;;GAKG;AACH,IACM,gBAAgB,GADtB,MACM,gBAAgB;IAO2B;IACU;IAC1B;IARd,YAAY,GAAG;QAC9B,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,SAA8C;KACtD,CAAC;IAEF,YAC+C,OAA+B,EACrB,OAA+B,EACzD,SAAqB;QAFL,YAAO,GAAP,OAAO,CAAwB;QACrB,YAAO,GAAP,OAAO,CAAwB;QACzD,cAAS,GAAT,SAAS,CAAY;IACjD,CAAC;IAEJ,KAAK,CAAC,QAAQ,CAAC,IAAa;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,wEAAwE;QACxE,+EAA+E;QAC/E,MAAM,KAAK,GAAG,eAAe,CAC3B,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CACtE,CAAC;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxD,CAAC;CACF,CAAA;AAvBK,gBAAgB;IADrB,UAAU,EAAE;IAQR,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;IAC1B,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,gBAAgB,CAAC,CAAA;IACpC,WAAA,QAAQ,EAAE,CAAA;qDAA8B,SAAS;GAThD,gBAAgB,CAuBrB;AAED,qFAAqF;AACrF,IACM,kBAAkB,GADxB,MACM,kBAAkB;IAEqC;IAD3D,YAC2D,OAAgC;QAAhC,YAAO,GAAP,OAAO,CAAyB;IACxF,CAAC;IAEJ,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,KAAK,KAAK;YAAE,OAAO;QACpD,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;IAC1C,CAAC;CACF,CAAA;AAVK,kBAAkB;IADvB,UAAU,EAAE;IAGR,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;;GAFrC,kBAAkB,CAUvB;AAED;;;;;;GAMG;AAEI,IAAM,eAAe,uBAArB,MAAM,eAAe;IAC1B,MAAM,CAAC,OAAO,CAAC,OAA+B;QAC5C,OAAO;YACL,MAAM,EAAE,iBAAe;YACvB,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE;gBACT,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,OAAO,EAAE;gBAClD,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE;gBACtD,GAAG,iBAAe,CAAC,eAAe,EAAE;aACrC;YACD,OAAO,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,OAAoC;QACtD,OAAO;YACL,MAAM,EAAE,iBAAe;YACvB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAoB;YACnD,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,kBAAkB;oBAC3B,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAyB;iBACvD;gBACD;oBACE,OAAO,EAAE,gBAAgB;oBACzB,UAAU,EAAE,CAAC,IAA4B,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK;oBACxD,MAAM,EAAE,CAAC,kBAAkB,CAAC;iBAC7B;gBACD,GAAG,iBAAe,CAAC,eAAe,EAAE;aACrC;YACD,OAAO,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,CAAC;SAChE,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,eAAe;QAC5B,OAAO;YACL,sBAAsB;YACtB,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,sBAAsB,EAAE;YACrE,gBAAgB;YAChB,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,gBAAgB,EAAE;YACzD,kBAAkB;SACnB,CAAC;IACJ,CAAC;CACF,CAAA;AA7CY,eAAe;IAD3B,MAAM,CAAC,EAAE,CAAC;GACE,eAAe,CA6C3B"}

package/dist/entities.d.ts

@@ -9,7 +9,17 @@ export declare const DEFAULT_TABLE_NAMES: {
     readonly permissions: "authz_permissions";
     readonly rolePermission: "authz_role_permission";
     readonly userRole: "authz_user_role";
+    readonly userPermission: "authz_user_permission";
 };
+/**
+ * The "no tenant" sentinel for the user-role pivot's `tenantId`. A GLOBAL (unscoped)
+ * assignment stores this empty string rather than `NULL` so the column stays part of
+ * the composite primary key with portable, dialect-correct uniqueness (SQL treats
+ * `NULL`s as distinct, which would break idempotency of a global grant and silently
+ * permit duplicates). The column is added post-v1 with a default of this value, so an
+ * older populated table self-heals via `ensureAuthzSchema` (`ADD COLUMN ... DEFAULT ''`).
+ */
+export declare const GLOBAL_TENANT = "";
 /**
  * A named role (e.g. `editor`). Permissions are attached via {@link RolePermissionEntity};
  * users are attached via {@link UserRoleEntity}.
@@ -40,12 +50,31 @@ export declare class RolePermissionEntity {
  * Pivot: user ↔ role. References the user BY ID ONLY — this package NEVER defines or
  * owns a users table. `userType` lets the same table key polymorphic principals
  * (mirrors nestjs-context's `UserRef` shape).
+ *
+ * `tenantId` (post-v1, defaulted to {@link GLOBAL_TENANT} = `''`) scopes the
+ * assignment to a tenant: an empty value = global (applies in every tenant), a
+ * non-empty value = only within that tenant. It is part of the composite PK so the
+ * same `(user, role)` can be granted independently in multiple tenants while staying
+ * idempotent per tenant. Defaulted (not nullable) so the column belongs to the PK
+ * with portable uniqueness — see {@link GLOBAL_TENANT}.
  */
 export declare class UserRoleEntity {
     userType: string;
     userId: string;
     roleId: string;
+    tenantId: string;
+}
+/**
+ * Pivot: user ↔ permission (a DIRECT grant, no role needed — Laravel/spatie's
+ * `$user->givePermissionTo(...)`). Mirrors {@link UserRoleEntity}: the user is
+ * referenced BY ID ONLY and `userType` keys polymorphic principals. Composite PK
+ * `(userType, userId, permissionId)`.
+ */
+export declare class UserPermissionEntity {
+    userType: string;
+    userId: string;
+    permissionId: string;
 }
 /** All entities, in dependency order — convenient for `entities: [...]` registration. */
-export declare const AUTHZ_ENTITIES: readonly [typeof RoleEntity, typeof PermissionEntity, typeof RolePermissionEntity, typeof UserRoleEntity];
+export declare const AUTHZ_ENTITIES: readonly [typeof RoleEntity, typeof PermissionEntity, typeof RolePermissionEntity, typeof UserRoleEntity, typeof UserPermissionEntity];
 //# sourceMappingURL=entities.d.ts.map

package/dist/entities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entities.d.ts","sourceRoot":"","sources":["../src/entities.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB;;;;;CAKtB,CAAC;AAEX;;;;;;;GAOG;AACH,qBACa,UAAU;IAErB,EAAE,EAAG,MAAM,CAAC;IAIZ,IAAI,EAAG,MAAM,CAAC;IAGd,KAAK,EAAG,MAAM,GAAG,IAAI,CAAC;IAGtB,SAAS,EAAG,IAAI,CAAC;CAClB;AAED,oGAAoG;AACpG,qBACa,gBAAgB;IAE3B,EAAE,EAAG,MAAM,CAAC;IAIZ,IAAI,EAAG,MAAM,CAAC;IAGd,KAAK,EAAG,MAAM,GAAG,IAAI,CAAC;IAGtB,SAAS,EAAG,IAAI,CAAC;CAClB;AAED,uEAAuE;AACvE,qBACa,oBAAoB;IAE/B,MAAM,EAAG,MAAM,CAAC;IAGhB,YAAY,EAAG,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,qBAEa,cAAc;IAEzB,QAAQ,EAAG,MAAM,CAAC;IAGlB,MAAM,EAAG,MAAM,CAAC;IAGhB,MAAM,EAAG,MAAM,CAAC;CACjB;AAED,yFAAyF;AACzF,eAAO,MAAM,cAAc,2GAKjB,CAAC"}
+{"version":3,"file":"entities.d.ts","sourceRoot":"","sources":["../src/entities.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB;;;;;;CAMtB,CAAC;AAEX;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,KAAK,CAAC;AAEhC;;;;;;;GAOG;AACH,qBACa,UAAU;IAErB,EAAE,EAAG,MAAM,CAAC;IAIZ,IAAI,EAAG,MAAM,CAAC;IAGd,KAAK,EAAG,MAAM,GAAG,IAAI,CAAC;IAGtB,SAAS,EAAG,IAAI,CAAC;CAClB;AAED,oGAAoG;AACpG,qBACa,gBAAgB;IAE3B,EAAE,EAAG,MAAM,CAAC;IAIZ,IAAI,EAAG,MAAM,CAAC;IAGd,KAAK,EAAG,MAAM,GAAG,IAAI,CAAC;IAGtB,SAAS,EAAG,IAAI,CAAC;CAClB;AAED,uEAAuE;AACvE,qBACa,oBAAoB;IAE/B,MAAM,EAAG,MAAM,CAAC;IAGhB,YAAY,EAAG,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;GAWG;AACH,qBAEa,cAAc;IAEzB,QAAQ,EAAG,MAAM,CAAC;IAGlB,MAAM,EAAG,MAAM,CAAC;IAGhB,MAAM,EAAG,MAAM,CAAC;IAGhB,QAAQ,EAAG,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,qBAEa,oBAAoB;IAE/B,QAAQ,EAAG,MAAM,CAAC;IAGlB,MAAM,EAAG,MAAM,CAAC;IAGhB,YAAY,EAAG,MAAM,CAAC;CACvB;AAED,yFAAyF;AACzF,eAAO,MAAM,cAAc,wIAMjB,CAAC"}

package/dist/entities.js

@@ -19,7 +19,17 @@ export const DEFAULT_TABLE_NAMES = {
     permissions: 'authz_permissions',
     rolePermission: 'authz_role_permission',
     userRole: 'authz_user_role',
+    userPermission: 'authz_user_permission',
 };
+/**
+ * The "no tenant" sentinel for the user-role pivot's `tenantId`. A GLOBAL (unscoped)
+ * assignment stores this empty string rather than `NULL` so the column stays part of
+ * the composite primary key with portable, dialect-correct uniqueness (SQL treats
+ * `NULL`s as distinct, which would break idempotency of a global grant and silently
+ * permit duplicates). The column is added post-v1 with a default of this value, so an
+ * older populated table self-heals via `ensureAuthzSchema` (`ADD COLUMN ... DEFAULT ''`).
+ */
+export const GLOBAL_TENANT = '';
 /**
  * A named role (e.g. `editor`). Permissions are attached via {@link RolePermissionEntity};
  * users are attached via {@link UserRoleEntity}.
@@ -104,11 +114,19 @@ export { RolePermissionEntity };
  * Pivot: user ↔ role. References the user BY ID ONLY — this package NEVER defines or
  * owns a users table. `userType` lets the same table key polymorphic principals
  * (mirrors nestjs-context's `UserRef` shape).
+ *
+ * `tenantId` (post-v1, defaulted to {@link GLOBAL_TENANT} = `''`) scopes the
+ * assignment to a tenant: an empty value = global (applies in every tenant), a
+ * non-empty value = only within that tenant. It is part of the composite PK so the
+ * same `(user, role)` can be granted independently in multiple tenants while staying
+ * idempotent per tenant. Defaulted (not nullable) so the column belongs to the PK
+ * with portable uniqueness — see {@link GLOBAL_TENANT}.
  */
 let UserRoleEntity = class UserRoleEntity {
     userType;
     userId;
     roleId;
+    tenantId;
 };
 __decorate([
     PrimaryColumn({ type: 'varchar', length: 191 }),
@@ -122,16 +140,49 @@ __decorate([
     PrimaryColumn({ type: 'varchar', length: 191 }),
     __metadata("design:type", String)
 ], UserRoleEntity.prototype, "roleId", void 0);
+__decorate([
+    PrimaryColumn({ type: 'varchar', length: 191, default: GLOBAL_TENANT }),
+    __metadata("design:type", String)
+], UserRoleEntity.prototype, "tenantId", void 0);
 UserRoleEntity = __decorate([
     Entity({ name: DEFAULT_TABLE_NAMES.userRole }),
     Index(['userType', 'userId'])
 ], UserRoleEntity);
 export { UserRoleEntity };
+/**
+ * Pivot: user ↔ permission (a DIRECT grant, no role needed — Laravel/spatie's
+ * `$user->givePermissionTo(...)`). Mirrors {@link UserRoleEntity}: the user is
+ * referenced BY ID ONLY and `userType` keys polymorphic principals. Composite PK
+ * `(userType, userId, permissionId)`.
+ */
+let UserPermissionEntity = class UserPermissionEntity {
+    userType;
+    userId;
+    permissionId;
+};
+__decorate([
+    PrimaryColumn({ type: 'varchar', length: 191 }),
+    __metadata("design:type", String)
+], UserPermissionEntity.prototype, "userType", void 0);
+__decorate([
+    PrimaryColumn({ type: 'varchar', length: 191 }),
+    __metadata("design:type", String)
+], UserPermissionEntity.prototype, "userId", void 0);
+__decorate([
+    PrimaryColumn({ type: 'varchar', length: 191 }),
+    __metadata("design:type", String)
+], UserPermissionEntity.prototype, "permissionId", void 0);
+UserPermissionEntity = __decorate([
+    Entity({ name: DEFAULT_TABLE_NAMES.userPermission }),
+    Index(['userType', 'userId'])
+], UserPermissionEntity);
+export { UserPermissionEntity };
 /** All entities, in dependency order — convenient for `entities: [...]` registration. */
 export const AUTHZ_ENTITIES = [
     RoleEntity,
     PermissionEntity,
     RolePermissionEntity,
     UserRoleEntity,
+    UserPermissionEntity,
 ];
 //# sourceMappingURL=entities.js.map

package/dist/entities.js.map

@@ -1 +1 @@
-{"version":3,"file":"entities.js","sourceRoot":"","sources":["../src/entities.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,KAAK,EAAE,aAAa;IACpB,WAAW,EAAE,mBAAmB;IAChC,cAAc,EAAE,uBAAuB;IACvC,QAAQ,EAAE,iBAAiB;CACnB,CAAC;AAEX;;;;;;;GAOG;AAEI,IAAM,UAAU,GAAhB,MAAM,UAAU;IAErB,EAAE,CAAU;IAIZ,IAAI,CAAU;IAGd,KAAK,CAAiB;IAGtB,SAAS,CAAQ;CAClB,CAAA;AAXC;IADC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;sCACpC;AAIZ;IAFC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACvB,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;wCAC3B;AAGd;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;yCACtB;AAGtB;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;8BACX,IAAI;6CAAC;AAZN,UAAU;IADtB,MAAM,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC,KAAK,EAAE,CAAC;GAC/B,UAAU,CAatB;;AAED,oGAAoG;AAE7F,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAE3B,EAAE,CAAU;IAIZ,IAAI,CAAU;IAGd,KAAK,CAAiB;IAGtB,SAAS,CAAQ;CAClB,CAAA;AAXC;IADC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;4CACpC;AAIZ;IAFC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACvB,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;8CAC3B;AAGd;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;+CACtB;AAGtB;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;8BACX,IAAI;mDAAC;AAZN,gBAAgB;IAD5B,MAAM,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC,WAAW,EAAE,CAAC;GACrC,gBAAgB,CAa5B;;AAED,uEAAuE;AAEhE,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAE/B,MAAM,CAAU;IAGhB,YAAY,CAAU;CACvB,CAAA;AAJC;IADC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;oDAChC;AAGhB;IADC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;0DAC1B;AALX,oBAAoB;IADhC,MAAM,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC,cAAc,EAAE,CAAC;GACxC,oBAAoB,CAMhC;;AAED;;;;GAIG;AAGI,IAAM,cAAc,GAApB,MAAM,cAAc;IAEzB,QAAQ,CAAU;IAGlB,MAAM,CAAU;IAGhB,MAAM,CAAU;CACjB,CAAA;AAPC;IADC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;gDAC9B;AAGlB;IADC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;8CAChC;AAGhB;IADC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;8CAChC;AARL,cAAc;IAF1B,MAAM,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC;IAC9C,KAAK,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;GACjB,cAAc,CAS1B;;AAED,yFAAyF;AACzF,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,UAAU;IACV,gBAAgB;IAChB,oBAAoB;IACpB,cAAc;CACN,CAAC"}
+{"version":3,"file":"entities.js","sourceRoot":"","sources":["../src/entities.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,KAAK,EAAE,aAAa;IACpB,WAAW,EAAE,mBAAmB;IAChC,cAAc,EAAE,uBAAuB;IACvC,QAAQ,EAAE,iBAAiB;IAC3B,cAAc,EAAE,uBAAuB;CAC/B,CAAC;AAEX;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAEhC;;;;;;;GAOG;AAEI,IAAM,UAAU,GAAhB,MAAM,UAAU;IAErB,EAAE,CAAU;IAIZ,IAAI,CAAU;IAGd,KAAK,CAAiB;IAGtB,SAAS,CAAQ;CAClB,CAAA;AAXC;IADC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;sCACpC;AAIZ;IAFC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACvB,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;wCAC3B;AAGd;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;yCACtB;AAGtB;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;8BACX,IAAI;6CAAC;AAZN,UAAU;IADtB,MAAM,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC,KAAK,EAAE,CAAC;GAC/B,UAAU,CAatB;;AAED,oGAAoG;AAE7F,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAE3B,EAAE,CAAU;IAIZ,IAAI,CAAU;IAGd,KAAK,CAAiB;IAGtB,SAAS,CAAQ;CAClB,CAAA;AAXC;IADC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;4CACpC;AAIZ;IAFC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACvB,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;8CAC3B;AAGd;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;+CACtB;AAGtB;IADC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;8BACX,IAAI;mDAAC;AAZN,gBAAgB;IAD5B,MAAM,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC,WAAW,EAAE,CAAC;GACrC,gBAAgB,CAa5B;;AAED,uEAAuE;AAEhE,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAE/B,MAAM,CAAU;IAGhB,YAAY,CAAU;CACvB,CAAA;AAJC;IADC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;oDAChC;AAGhB;IADC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;0DAC1B;AALX,oBAAoB;IADhC,MAAM,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC,cAAc,EAAE,CAAC;GACxC,oBAAoB,CAMhC;;AAED;;;;;;;;;;;GAWG;AAGI,IAAM,cAAc,GAApB,MAAM,cAAc;IAEzB,QAAQ,CAAU;IAGlB,MAAM,CAAU;IAGhB,MAAM,CAAU;IAGhB,QAAQ,CAAU;CACnB,CAAA;AAVC;IADC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;gDAC9B;AAGlB;IADC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;8CAChC;AAGhB;IADC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;8CAChC;AAGhB;IADC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;;gDACtD;AAXP,cAAc;IAF1B,MAAM,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC,QAAQ,EAAE,CAAC;IAC9C,KAAK,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;GACjB,cAAc,CAY1B;;AAED;;;;;GAKG;AAGI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAE/B,QAAQ,CAAU;IAGlB,MAAM,CAAU;IAGhB,YAAY,CAAU;CACvB,CAAA;AAPC;IADC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;sDAC9B;AAGlB;IADC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;oDAChC;AAGhB;IADC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;;0DAC1B;AARX,oBAAoB;IAFhC,MAAM,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC,cAAc,EAAE,CAAC;IACpD,KAAK,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;GACjB,oBAAoB,CAShC;;AAED,yFAAyF;AACzF,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,UAAU;IACV,gBAAgB;IAChB,oBAAoB;IACpB,cAAc;IACd,oBAAoB;CACZ,CAAC"}

package/dist/index.d.ts

@@ -1,8 +1,10 @@
-export { AUTHZ_ENTITIES, DEFAULT_TABLE_NAMES, PermissionEntity, RoleEntity, RolePermissionEntity, UserRoleEntity, } from './entities.js';
+export { AUTHZ_ENTITIES, DEFAULT_TABLE_NAMES, GLOBAL_TENANT, PermissionEntity, RoleEntity, RolePermissionEntity, UserPermissionEntity, UserRoleEntity, } from './entities.js';
 export { createAuthzTables, ensureAuthzSchema } from './schema.js';
 export { TypeOrmAuthzStore } from './typeorm-authz.store.js';
 export type { UserAuthz } from './typeorm-authz.store.js';
 export { AUTHZ_RBAC_OPTIONS, AUTHZ_RBAC_STORE, AuthzRbacModule, defaultUserRefMapper, } from './authz-rbac.module.js';
 export type { AuthzRbacModuleAsyncOptions, AuthzRbacModuleOptions, UserRefMapper, } from './authz-rbac.module.js';
-export type { AuthzStoreOptions, TableNames, UserRef, UserRefInput } from './types.js';
+export type { AuthzStoreOptions, TableNames, TenantScope, UserRef, UserRefInput, } from './types.js';
+export { applyScope, applyScopeConstraint, compileScope } from './scope.js';
+export type { CompiledScope, ScopeResolver } from './scope.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,YAAY,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,2BAA2B,EAC3B,sBAAsB,EACtB,aAAa,GACd,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,YAAY,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,2BAA2B,EAC3B,sBAAsB,EACtB,aAAa,GACd,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,iBAAiB,EACjB,UAAU,EACV,WAAW,EACX,OAAO,EACP,YAAY,GACb,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC5E,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,5 +1,6 @@
-export { AUTHZ_ENTITIES, DEFAULT_TABLE_NAMES, PermissionEntity, RoleEntity, RolePermissionEntity, UserRoleEntity, } from './entities.js';
+export { AUTHZ_ENTITIES, DEFAULT_TABLE_NAMES, GLOBAL_TENANT, PermissionEntity, RoleEntity, RolePermissionEntity, UserPermissionEntity, UserRoleEntity, } from './entities.js';
 export { createAuthzTables, ensureAuthzSchema } from './schema.js';
 export { TypeOrmAuthzStore } from './typeorm-authz.store.js';
 export { AUTHZ_RBAC_OPTIONS, AUTHZ_RBAC_STORE, AuthzRbacModule, defaultUserRefMapper, } from './authz-rbac.module.js';
+export { applyScope, applyScopeConstraint, compileScope } from './scope.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAahC,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC"}

package/dist/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,UAAU,EAEf,KAAK,WAAW,EAGjB,MAAM,SAAS,CAAC;AAUjB,OAAO,KAAK,EAAE,iBAAiB,EAAc,MAAM,YAAY,CAAC;AAuDhE;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,WAAW,EACxB,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,IAAI,CAAC,CAOf;AA4BD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,UAAU,EACtB,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,IAAI,CAAC,CAef"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,UAAU,EAEf,KAAK,WAAW,EAGjB,MAAM,SAAS,CAAC;AAWjB,OAAO,KAAK,EAAE,iBAAiB,EAAc,MAAM,YAAY,CAAC;AAqFhE;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,WAAW,EACxB,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,IAAI,CAAC,CAUf;AA4BD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,UAAU,EACtB,IAAI,CAAC,EAAE,iBAAiB,GACvB,OAAO,CAAC,IAAI,CAAC,CAkBf"}

package/dist/schema.js

@@ -1,6 +1,6 @@
 import { Table, TableColumn, } from 'typeorm';
 import { TableUtils } from 'typeorm/schema-builder/util/TableUtils.js';
-import { DEFAULT_TABLE_NAMES, PermissionEntity, RoleEntity, RolePermissionEntity, UserRoleEntity, } from './entities.js';
+import { DEFAULT_TABLE_NAMES, PermissionEntity, RoleEntity, RolePermissionEntity, UserPermissionEntity, UserRoleEntity, } from './entities.js';
 import { assertSafeIdentifier } from './sql.js';
 /** Resolve the (schema-qualified) table name for an entity, applying BYO overrides. */
 function tableName(base, schema) {
@@ -12,6 +12,7 @@ function resolveNames(tableNames) {
         permissions: tableNames?.permissions ?? DEFAULT_TABLE_NAMES.permissions,
         rolePermission: tableNames?.rolePermission ?? DEFAULT_TABLE_NAMES.rolePermission,
         userRole: tableNames?.userRole ?? DEFAULT_TABLE_NAMES.userRole,
+        userPermission: tableNames?.userPermission ?? DEFAULT_TABLE_NAMES.userPermission,
     };
 }
 /** The four table plans (entity + resolved name) for a given options set. */
@@ -29,16 +30,39 @@ function plans(opts) {
         { entity: PermissionEntity, name: tableName(names.permissions, schema) },
         { entity: RolePermissionEntity, name: tableName(names.rolePermission, schema) },
         { entity: UserRoleEntity, name: tableName(names.userRole, schema) },
+        { entity: UserPermissionEntity, name: tableName(names.userPermission, schema) },
     ];
 }
 /**
  * Build a driver-portable {@link Table} from entity metadata, overriding the table name
  * so BYO names + an optional Postgres schema are honored (the metadata's own name is the
  * entity-decorator default).
+ *
+ * Constraint-name rewrite (Postgres-critical): TypeORM derives index / unique / primary-key
+ * names by hashing the table name + columns (see `DefaultNamingStrategy.indexName` et al.).
+ * `Table.create` computes those from the entity's DEFAULT name, so simply reassigning
+ * `table.name` leaves the constraints carrying the OLD name's hash. Two tables created from
+ * the SAME entity metadata under DIFFERENT runtime names (BYO table names, or a per-test
+ * unique prefix) then emit IDENTICAL constraint names. SQLite scopes index names per-table
+ * and tolerates this; Postgres treats index/constraint names as schema-global and rejects
+ * the second `CREATE TABLE` with `relation "IDX_..." already exists`. So after renaming we
+ * regenerate every constraint name from the NEW table name via the connection's naming
+ * strategy, keeping each created table's constraints globally unique.
  */
-function tableFromMetadata(metadata, driver, name) {
+function tableFromMetadata(connection, metadata, driver, name) {
     const table = Table.create(metadata, driver);
     table.name = name;
+    const naming = connection.namingStrategy;
+    for (const index of table.indices) {
+        index.name = naming.indexName(name, index.columnNames, index.where);
+    }
+    for (const unique of table.uniques) {
+        unique.name = naming.uniqueConstraintName(name, unique.columnNames);
+    }
+    for (const check of table.checks) {
+        if (check.expression)
+            check.name = naming.checkConstraintName(name, check.expression);
+    }
     return table;
 }
 /**
@@ -60,7 +84,7 @@ export async function createAuthzTables(queryRunner, opts) {
         if (await queryRunner.hasTable(plan.name))
             continue;
         const metadata = queryRunner.connection.getMetadata(plan.entity);
-        await queryRunner.createTable(tableFromMetadata(metadata, driver, plan.name), true);
+        await queryRunner.createTable(tableFromMetadata(queryRunner.connection, metadata, driver, plan.name), true);
     }
 }
 /**
@@ -105,7 +129,7 @@ export async function ensureAuthzSchema(dataSource, opts) {
             }
             else {
                 const metadata = queryRunner.connection.getMetadata(plan.entity);
-                await queryRunner.createTable(tableFromMetadata(metadata, driver, plan.name), true);
+                await queryRunner.createTable(tableFromMetadata(queryRunner.connection, metadata, driver, plan.name), true);
             }
         }
     }

package/dist/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,EACL,WAAW,GACZ,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,UAAU,EAAE,MAAM,2CAA2C,CAAC;AACvE,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAShD,uFAAuF;AACvF,SAAS,SAAS,CAAC,IAAY,EAAE,MAA0B;IACzD,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED,SAAS,YAAY,CAAC,UAAkC;IAMtD,OAAO;QACL,KAAK,EAAE,UAAU,EAAE,KAAK,IAAI,mBAAmB,CAAC,KAAK;QACrD,WAAW,EAAE,UAAU,EAAE,WAAW,IAAI,mBAAmB,CAAC,WAAW;QACvE,cAAc,EAAE,UAAU,EAAE,cAAc,IAAI,mBAAmB,CAAC,cAAc;QAChF,QAAQ,EAAE,UAAU,EAAE,QAAQ,IAAI,mBAAmB,CAAC,QAAQ;KAC/D,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,KAAK,CAAC,IAAmC;IAChD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC;IAC5B,4DAA4D;IAC5D,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,GAAG,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,MAAM,KAAK,SAAS;QAAE,oBAAoB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACtE,OAAO;QACL,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE;QAC5D,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE;QACxE,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC,EAAE;QAC/E,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE;KACpE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,QAAwB,EAAE,MAA4B,EAAE,IAAY;IAC7F,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,WAAwB,EACxB,IAAwB;IAExB,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,IAAI,MAAM,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACpD,MAAM,QAAQ,GAAG,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjE,MAAM,WAAW,CAAC,WAAW,CAAC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IACtF,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,iBAAiB,CAAC,WAAwB,EAAE,IAAe;IACxE,MAAM,QAAQ,GAAG,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC;IAC7C,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtC,IAAI,MAAM,CAAC,iBAAiB,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC;YAAE,SAAS;QAC5E,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,UAAU,CAAC,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACzF,MAAM,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,UAAsB,EACtB,IAAwB;IAExB,MAAM,WAAW,GAAG,UAAU,CAAC,iBAAiB,EAAE,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,IAAI,MAAM,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,MAAM,iBAAiB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACN,MAAM,QAAQ,GAAG,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACjE,MAAM,WAAW,CAAC,WAAW,CAAC,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC;IAC9B,CAAC;AACH,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,EACL,WAAW,GACZ,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,UAAU,EAAE,MAAM,2CAA2C,CAAC;AACvE,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAShD,uFAAuF;AACvF,SAAS,SAAS,CAAC,IAAY,EAAE,MAA0B;IACzD,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED,SAAS,YAAY,CAAC,UAAkC;IAOtD,OAAO;QACL,KAAK,EAAE,UAAU,EAAE,KAAK,IAAI,mBAAmB,CAAC,KAAK;QACrD,WAAW,EAAE,UAAU,EAAE,WAAW,IAAI,mBAAmB,CAAC,WAAW;QACvE,cAAc,EAAE,UAAU,EAAE,cAAc,IAAI,mBAAmB,CAAC,cAAc;QAChF,QAAQ,EAAE,UAAU,EAAE,QAAQ,IAAI,mBAAmB,CAAC,QAAQ;QAC9D,cAAc,EAAE,UAAU,EAAE,cAAc,IAAI,mBAAmB,CAAC,cAAc;KACjF,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,KAAK,CAAC,IAAmC;IAChD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC;IAC5B,4DAA4D;IAC5D,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,GAAG,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,MAAM,KAAK,SAAS;QAAE,oBAAoB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACtE,OAAO;QACL,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE;QAC5D,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE;QACxE,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC,EAAE;QAC/E,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnE,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,CAAC,EAAE;KAChF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,iBAAiB,CACxB,UAAsB,EACtB,QAAwB,EACxB,MAA4B,EAC5B,IAAY;IAEZ,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;IAElB,MAAM,MAAM,GAAG,UAAU,CAAC,cAAc,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IACtE,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,UAAU;YAAE,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,WAAwB,EACxB,IAAwB;IAExB,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,IAAI,MAAM,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACpD,MAAM,QAAQ,GAAG,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjE,MAAM,WAAW,CAAC,WAAW,CAC3B,iBAAiB,CAAC,WAAW,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EACtE,IAAI,CACL,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,iBAAiB,CAAC,WAAwB,EAAE,IAAe;IACxE,MAAM,QAAQ,GAAG,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC;IAC7C,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtC,IAAI,MAAM,CAAC,iBAAiB,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC;YAAE,SAAS;QAC5E,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,UAAU,CAAC,wBAAwB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACzF,MAAM,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,UAAsB,EACtB,IAAwB;IAExB,MAAM,WAAW,GAAG,UAAU,CAAC,iBAAiB,EAAE,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,IAAI,MAAM,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,MAAM,iBAAiB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACN,MAAM,QAAQ,GAAG,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACjE,MAAM,WAAW,CAAC,WAAW,CAC3B,iBAAiB,CAAC,WAAW,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EACtE,IAAI,CACL,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC;IAC9B,CAAC;AACH,CAAC"}

package/dist/scope.d.ts

@@ -0,0 +1,75 @@
+import type { ScopeConstraint } from '@dudousxd/nestjs-authz';
+import type { Type } from '@nestjs/common';
+import type { ObjectLiteral, SelectQueryBuilder } from 'typeorm';
+/**
+ * The minimal scope-resolving surface shared by `Gate` and `BoundGate`. Accepting
+ * this (rather than `Gate`) lets {@link applyScope} take either a Gate (current/context
+ * user) or a `gate.forUser(...)` BoundGate without a cast.
+ */
+export interface ScopeResolver {
+    scope(entity: Type<unknown>, ability?: string): Promise<ScopeConstraint>;
+}
+/**
+ * A compiled scope predicate: a SQL fragment using TypeORM named placeholders
+ * (`:name`, `:...name` for `IN`) plus the parameter map to bind. TypeORM binds the
+ * values itself (dialect-correct), so we never interpolate values — only identifiers,
+ * which are validated by {@link assertSafeIdentifier}.
+ */
+export interface CompiledScope {
+    sql: string;
+    params: ObjectLiteral;
+}
+/**
+ * Quote a SQL identifier. Defaults to ANSI double-quotes (Postgres / SQLite), but a
+ * dialect-correct escaper can be injected — MySQL/MariaDB quote with backticks and
+ * REJECT `"..."` as an identifier, so `applyScopeConstraint` passes the DataSource's
+ * `driver.escape` to make the compiled predicate portable across engines.
+ */
+export type EscapeIdentifier = (identifier: string) => string;
+/**
+ * Compile an ORM-neutral {@link ScopeConstraint} into a parameterized SQL predicate
+ * for TypeORM. Returns:
+ * - `undefined` for `allow-all` — the caller adds NO `WHERE` (every row is visible);
+ * - `{ sql: '1 = 0', params: {} }` for `deny-all` — an always-false predicate;
+ * - otherwise the compiled condition tree.
+ *
+ * `paramPrefix` namespaces the generated placeholders so multiple `applyScope` calls
+ * (or other `andWhere`s) on one query never collide. `alias` (the entity's query
+ * alias) prefixes every column as `"alias"."field"`; omit it to emit bare `"field"`.
+ *
+ * SAFE: column names and the alias are interpolated into SQL, so each is validated
+ * against the package's `assertSafeIdentifier` allowlist (letters/digits/underscore,
+ * not leading-digit) — a hostile field/alias throws. Values are NEVER interpolated;
+ * they are returned in `params` for TypeORM to bind.
+ *
+ * `escapeId` controls identifier quoting; it defaults to ANSI double-quotes (Postgres /
+ * SQLite). `applyScopeConstraint` injects the DataSource's `driver.escape` so the
+ * predicate is also valid on MySQL/MariaDB (backtick-quoted), which rejects `"..."`.
+ */
+export declare function compileScope(constraint: ScopeConstraint, paramPrefix: string, alias?: string, escapeId?: EscapeIdentifier): CompiledScope | undefined;
+/**
+ * Apply a {@link ScopeConstraint} to a TypeORM {@link SelectQueryBuilder} as an
+ * `andWhere`, parameterized and identifier-safe. `allow-all` adds nothing; `deny-all`
+ * adds an always-false predicate so the query returns no rows.
+ *
+ * The query's primary alias is used to qualify columns (so the predicate is correct
+ * across joins). Each call uses a fresh parameter prefix, so repeated calls never
+ * clash. Returns the same builder for chaining.
+ */
+export declare function applyScopeConstraint<T extends ObjectLiteral>(qb: SelectQueryBuilder<T>, constraint: ScopeConstraint): SelectQueryBuilder<T>;
+/**
+ * Ergonomic entry point: resolve the query scope for the current (context) user via
+ * the {@link Gate} and apply it to `qb` in one call. Equivalent to
+ * `applyScopeConstraint(qb, await gate.scope(entity, ability))`.
+ *
+ * The manual path (`gate.scope(...)` + `applyScopeConstraint(...)`) remains primary;
+ * this just folds the two steps together for the common list-endpoint case.
+ *
+ * ```ts
+ * const qb = repo.createQueryBuilder('post');
+ * await applyScope(qb, gate, Post);          // current user's accessible posts
+ * const posts = await qb.getMany();
+ * ```
+ */
+export declare function applyScope<T extends ObjectLiteral>(qb: SelectQueryBuilder<T>, gate: ScopeResolver, entity: Type<unknown>, ability?: string): Promise<SelectQueryBuilder<T>>;
+//# sourceMappingURL=scope.d.ts.map

package/dist/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../src/scope.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,eAAe,EAGhB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAGjE;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CAC1E;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,aAAa,CAAC;CACvB;AAKD;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,CAAC;AAa9D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAC1B,UAAU,EAAE,eAAe,EAC3B,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,EACd,QAAQ,GAAE,gBAA4B,GACrC,aAAa,GAAG,SAAS,CA+C3B;AAID;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,SAAS,aAAa,EAC1D,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC,EACzB,UAAU,EAAE,eAAe,GAC1B,kBAAkB,CAAC,CAAC,CAAC,CAQvB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,UAAU,CAAC,CAAC,SAAS,aAAa,EACtD,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC,EACzB,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EACrB,OAAO,SAAY,GAClB,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAEhC"}

package/dist/scope.js

@@ -0,0 +1,124 @@
+import { assertSafeIdentifier } from './sql.js';
+/** An always-false predicate (deny-all / empty `IN`). Binds no parameters. */
+const ALWAYS_FALSE = { sql: '1 = 0', params: {} };
+const ansiQuote = (id) => `"${id}"`;
+/** TypeORM/SQL operator tokens for the binary comparison operators. */
+const BINARY_OPS = {
+    eq: '=',
+    ne: '!=',
+    gt: '>',
+    gte: '>=',
+    lt: '<',
+    lte: '<=',
+};
+/**
+ * Compile an ORM-neutral {@link ScopeConstraint} into a parameterized SQL predicate
+ * for TypeORM. Returns:
+ * - `undefined` for `allow-all` — the caller adds NO `WHERE` (every row is visible);
+ * - `{ sql: '1 = 0', params: {} }` for `deny-all` — an always-false predicate;
+ * - otherwise the compiled condition tree.
+ *
+ * `paramPrefix` namespaces the generated placeholders so multiple `applyScope` calls
+ * (or other `andWhere`s) on one query never collide. `alias` (the entity's query
+ * alias) prefixes every column as `"alias"."field"`; omit it to emit bare `"field"`.
+ *
+ * SAFE: column names and the alias are interpolated into SQL, so each is validated
+ * against the package's `assertSafeIdentifier` allowlist (letters/digits/underscore,
+ * not leading-digit) — a hostile field/alias throws. Values are NEVER interpolated;
+ * they are returned in `params` for TypeORM to bind.
+ *
+ * `escapeId` controls identifier quoting; it defaults to ANSI double-quotes (Postgres /
+ * SQLite). `applyScopeConstraint` injects the DataSource's `driver.escape` so the
+ * predicate is also valid on MySQL/MariaDB (backtick-quoted), which rejects `"..."`.
+ */
+export function compileScope(constraint, paramPrefix, alias, escapeId = ansiQuote) {
+    if (constraint.kind === 'all')
+        return undefined;
+    if (constraint.kind === 'none')
+        return ALWAYS_FALSE;
+    if (alias !== undefined)
+        assertSafeIdentifier(alias, `scope alias "${alias}"`);
+    const params = {};
+    let counter = 0;
+    const nextParam = () => `${paramPrefix}_${counter++}`;
+    const column = (field) => {
+        assertSafeIdentifier(field, `scope field "${field}"`);
+        return alias === undefined ? escapeId(field) : `${escapeId(alias)}.${escapeId(field)}`;
+    };
+    const compileCondition = (c) => {
+        const col = column(c.field);
+        if (c.op === 'isNull')
+            return `${col} IS NULL`;
+        if (c.op === 'isNotNull')
+            return `${col} IS NOT NULL`;
+        if (c.op === 'in' || c.op === 'nin') {
+            const values = Array.isArray(c.value) ? c.value : [c.value];
+            // An empty `IN ()` is invalid SQL and matches nothing; an empty `NOT IN ()`
+            // matches everything. Encode both with constant predicates.
+            if (values.length === 0)
+                return c.op === 'in' ? '1 = 0' : '1 = 1';
+            const name = nextParam();
+            params[name] = values;
+            const not = c.op === 'nin' ? 'NOT ' : '';
+            return `${col} ${not}IN (:...${name})`;
+        }
+        const token = BINARY_OPS[c.op];
+        if (!token)
+            throw new Error(`Unsupported scope operator: ${c.op}`);
+        const name = nextParam();
+        params[name] = c.value;
+        return `${col} ${token} :${name}`;
+    };
+    const compileNode = (node) => {
+        if (node.kind === 'condition')
+            return compileCondition(node);
+        const joiner = node.kind === 'and' ? ' AND ' : ' OR ';
+        // An empty AND is the identity (true); an empty OR is the zero (false).
+        if (node.nodes.length === 0)
+            return node.kind === 'and' ? '1 = 1' : '1 = 0';
+        return `(${node.nodes.map(compileNode).join(joiner)})`;
+    };
+    const sql = compileNode(constraint);
+    // A top-level empty `IN` collapses to the always-false constant with no params.
+    if (sql === '1 = 0' && Object.keys(params).length === 0)
+        return ALWAYS_FALSE;
+    return { sql, params };
+}
+let scopeApplyCounter = 0;
+/**
+ * Apply a {@link ScopeConstraint} to a TypeORM {@link SelectQueryBuilder} as an
+ * `andWhere`, parameterized and identifier-safe. `allow-all` adds nothing; `deny-all`
+ * adds an always-false predicate so the query returns no rows.
+ *
+ * The query's primary alias is used to qualify columns (so the predicate is correct
+ * across joins). Each call uses a fresh parameter prefix, so repeated calls never
+ * clash. Returns the same builder for chaining.
+ */
+export function applyScopeConstraint(qb, constraint) {
+    const prefix = `authz_scope_${scopeApplyCounter++}`;
+    // Quote identifiers with the DataSource's own dialect-correct escaper so the predicate
+    // is valid on MySQL/MariaDB (backticks) as well as Postgres/SQLite (double-quotes).
+    const escapeId = (id) => qb.connection.driver.escape(id);
+    const compiled = compileScope(constraint, prefix, qb.alias, escapeId);
+    if (compiled)
+        qb.andWhere(compiled.sql, compiled.params);
+    return qb;
+}
+/**
+ * Ergonomic entry point: resolve the query scope for the current (context) user via
+ * the {@link Gate} and apply it to `qb` in one call. Equivalent to
+ * `applyScopeConstraint(qb, await gate.scope(entity, ability))`.
+ *
+ * The manual path (`gate.scope(...)` + `applyScopeConstraint(...)`) remains primary;
+ * this just folds the two steps together for the common list-endpoint case.
+ *
+ * ```ts
+ * const qb = repo.createQueryBuilder('post');
+ * await applyScope(qb, gate, Post);          // current user's accessible posts
+ * const posts = await qb.getMany();
+ * ```
+ */
+export async function applyScope(qb, gate, entity, ability = 'viewAny') {
+    return applyScopeConstraint(qb, await gate.scope(entity, ability));
+}
+//# sourceMappingURL=scope.js.map

package/dist/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../src/scope.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAsBhD,8EAA8E;AAC9E,MAAM,YAAY,GAAkB,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AASjE,MAAM,SAAS,GAAqB,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC;AAEtD,uEAAuE;AACvE,MAAM,UAAU,GAA2C;IACzD,EAAE,EAAE,GAAG;IACP,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,GAAG;IACP,GAAG,EAAE,IAAI;IACT,EAAE,EAAE,GAAG;IACP,GAAG,EAAE,IAAI;CACV,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,YAAY,CAC1B,UAA2B,EAC3B,WAAmB,EACnB,KAAc,EACd,WAA6B,SAAS;IAEtC,IAAI,UAAU,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IAChD,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,YAAY,CAAC;IACpD,IAAI,KAAK,KAAK,SAAS;QAAE,oBAAoB,CAAC,KAAK,EAAE,gBAAgB,KAAK,GAAG,CAAC,CAAC;IAE/E,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,SAAS,GAAG,GAAW,EAAE,CAAC,GAAG,WAAW,IAAI,OAAO,EAAE,EAAE,CAAC;IAE9D,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE;QACvC,oBAAoB,CAAC,KAAK,EAAE,gBAAgB,KAAK,GAAG,CAAC,CAAC;QACtD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACzF,CAAC,CAAC;IAEF,MAAM,gBAAgB,GAAG,CAAC,CAAiB,EAAU,EAAE;QACrD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ;YAAE,OAAO,GAAG,GAAG,UAAU,CAAC;QAC/C,IAAI,CAAC,CAAC,EAAE,KAAK,WAAW;YAAE,OAAO,GAAG,GAAG,cAAc,CAAC;QACtD,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC5D,4EAA4E;YAC5E,4DAA4D;YAC5D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YAClE,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;YACtB,MAAM,GAAG,GAAG,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,OAAO,GAAG,GAAG,IAAI,GAAG,WAAW,IAAI,GAAG,CAAC;QACzC,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;QACvB,OAAO,GAAG,GAAG,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;IACpC,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,CAAC,IAAe,EAAU,EAAE;QAC9C,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QACtD,wEAAwE;QACxE,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAC5E,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;IACzD,CAAC,CAAC;IAEF,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACpC,gFAAgF;IAChF,IAAI,GAAG,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IAC7E,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACzB,CAAC;AAED,IAAI,iBAAiB,GAAG,CAAC,CAAC;AAE1B;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,EAAyB,EACzB,UAA2B;IAE3B,MAAM,MAAM,GAAG,eAAe,iBAAiB,EAAE,EAAE,CAAC;IACpD,uFAAuF;IACvF,oFAAoF;IACpF,MAAM,QAAQ,GAAqB,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACtE,IAAI,QAAQ;QAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAyB,EACzB,IAAmB,EACnB,MAAqB,EACrB,OAAO,GAAG,SAAS;IAEnB,OAAO,oBAAoB,CAAC,EAAE,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AACrE,CAAC"}

package/dist/typeorm-authz.store.d.ts

@@ -1,5 +1,5 @@
 import type { DataSource } from 'typeorm';
-import type { AuthzStoreOptions, UserRef } from './types.js';
+import type { AuthzStoreOptions, TenantScope, UserRef } from './types.js';
 /**
  * A user's effective permissions: the role names they hold and the flattened set of
  * permission names granted by those roles.
@@ -48,17 +48,61 @@ export declare class TypeOrmAuthzStore {
     givePermissionToRole(roleName: string, permissionName: string): Promise<void>;
     /** Revoke a permission from a role. No-op if either is absent or not linked. */
     revokePermissionFromRole(roleName: string, permissionName: string): Promise<void>;
-    /** Assign a role to a user (creating the role by name if needed). Idempotent. */
-    assignRole(user: UserRef, roleName: string): Promise<void>;
-    /** Remove a role from a user. No-op if the role or assignment is absent. */
-    removeRole(user: UserRef, roleName: string): Promise<void>;
-    /** The role names a user holds. */
-    getRolesForUser(user: UserRef): Promise<string[]>;
-    /** The flattened, distinct permission names a user has via their roles. */
-    getPermissionsForUser(user: UserRef): Promise<string[]>;
-    /** A user's roles + effective permissions in one shot. */
-    getUserAuthz(user: UserRef): Promise<UserAuthz>;
-    /** True when the user holds `permission` through any of their roles. */
-    userHasPermission(user: UserRef, permission: string): Promise<boolean>;
+    /**
+     * Assign a role to a user (creating the role by name if needed). Idempotent.
+     *
+     * Pass `{ tenantId }` to scope the assignment to a tenant — it then applies ONLY
+     * within that tenant. Omitting it (the default) makes a GLOBAL assignment that
+     * applies in every tenant (and in an unscoped check). The same `(user, role)` can
+     * be assigned in multiple tenants independently.
+     */
+    assignRole(user: UserRef, roleName: string, scope?: TenantScope): Promise<void>;
+    /**
+     * Remove a role from a user. No-op if the role or assignment is absent. When
+     * `{ tenantId }` is given, only the assignment in THAT tenant is removed; omitting
+     * it removes the GLOBAL assignment (tenant `''`).
+     */
+    removeRole(user: UserRef, roleName: string, scope?: TenantScope): Promise<void>;
+    /**
+     * Grant a permission DIRECTLY to a user (creating the permission by name if
+     * needed) — no role required. Mirrors Laravel/spatie's `$user->givePermissionTo`.
+     * Idempotent.
+     */
+    giveUserPermission(user: UserRef, permissionName: string): Promise<void>;
+    /**
+     * Revoke a DIRECT user permission. No-op if the permission or grant is absent.
+     * Only the direct grant is removed — a permission the user ALSO has via a role
+     * survives.
+     */
+    revokeUserPermission(user: UserRef, permissionName: string): Promise<void>;
+    /**
+     * SQL fragment + params matching role assignments visible for a tenant scope: a
+     * GLOBAL assignment (tenant `''`) always applies; a tenant-scoped one applies only
+     * when its tenant matches the requested one. With no requested tenant, only global
+     * assignments are visible (a tenant-scoped role never leaks into an unscoped check).
+     */
+    private tenantFilter;
+    /** Bind values for {@link tenantFilter}, in the same order it emits placeholders. */
+    private tenantParams;
+    /**
+     * The role names a user holds, optionally restricted to a tenant scope (see
+     * {@link assignRole}). With no scope, only global roles are returned.
+     */
+    getRolesForUser(user: UserRef, scope?: TenantScope): Promise<string[]>;
+    /**
+     * The flattened, distinct permission names a user has — the UNION of role-derived
+     * permissions (honoring the tenant scope) and DIRECT user permissions (which are
+     * not tenant-scoped). With no scope, role-derived permissions come from global
+     * roles only.
+     */
+    getPermissionsForUser(user: UserRef, scope?: TenantScope): Promise<string[]>;
+    /** A user's roles + effective permissions in one shot (tenant-aware). */
+    getUserAuthz(user: UserRef, scope?: TenantScope): Promise<UserAuthz>;
+    /**
+     * True when the user holds `permission` — via a (tenant-scoped) role OR a direct
+     * grant. With no scope, only global role assignments count toward the role path;
+     * direct grants always count.
+     */
+    userHasPermission(user: UserRef, permission: string, scope?: TenantScope): Promise<boolean>;
 }
 //# sourceMappingURL=typeorm-authz.store.d.ts.map

package/dist/typeorm-authz.store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"typeorm-authz.store.d.ts","sourceRoot":"","sources":["../src/typeorm-authz.store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAI1C,OAAO,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAU7D;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,qBAAa,iBAAiB;IAK1B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI;IALvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0E;IAChG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;gBAGzB,UAAU,EAAE,UAAU,EACtB,IAAI,GAAE,iBAAsB;IAoB/C,+EAA+E;IAC/E,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7B,+EAA+E;IAC/E,OAAO,CAAC,MAAM;IAId,wDAAwD;IACxD,OAAO,CAAC,KAAK;IAMb,OAAO,CAAC,GAAG;IAMX,qFAAqF;IACrF,OAAO,CAAC,kBAAkB;IAS1B,yEAAyE;IACzE,OAAO,CAAC,gBAAgB;IAMxB;;;;;OAKG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgB/C,qFAAqF;IAC/E,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAevC,UAAU;YAWV,gBAAgB;IAa9B,kFAAkF;IAC5E,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYnF,gFAAgF;IAC1E,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAevF,iFAAiF;IAC3E,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYhE,4EAA4E;IACtE,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAehE,mCAAmC;IAC7B,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAavD,2EAA2E;IACrE,qBAAqB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAgB7D,0DAA0D;IACpD,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;IAQrD,wEAAwE;IAClE,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAkB7E"}
+{"version":3,"file":"typeorm-authz.store.d.ts","sourceRoot":"","sources":["../src/typeorm-authz.store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAI1C,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAU1E;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,qBAAa,iBAAiB;IAQ1B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI;IARvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAGpB;IACF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;gBAGzB,UAAU,EAAE,UAAU,EACtB,IAAI,GAAE,iBAAsB;IAqB/C,+EAA+E;IAC/E,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7B,+EAA+E;IAC/E,OAAO,CAAC,MAAM;IAId,wDAAwD;IACxD,OAAO,CAAC,KAAK;IAMb,OAAO,CAAC,GAAG;IAMX,qFAAqF;IACrF,OAAO,CAAC,kBAAkB;IAS1B,yEAAyE;IACzE,OAAO,CAAC,gBAAgB;IAMxB;;;;;OAKG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgB/C,qFAAqF;IAC/E,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAevC,UAAU;YAWV,gBAAgB;IAa9B,kFAAkF;IAC5E,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYnF,gFAAgF;IAC1E,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAevF;;;;;;;OAOG;IACG,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAarF;;;;OAIG;IACG,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBrF;;;;OAIG;IACG,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAY9E;;;;OAIG;IACG,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAehF;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IAWpB,qFAAqF;IACrF,OAAO,CAAC,YAAY;IAKpB;;;OAGG;IACG,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAgB5E;;;;;OAKG;IACG,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAqClF,yEAAyE;IACnE,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC;IAQ1E;;;;OAIG;IACG,iBAAiB,CACrB,IAAI,EAAE,OAAO,EACb,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,OAAO,CAAC;CAsCpB"}

package/dist/typeorm-authz.store.js

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto';
-import { DEFAULT_TABLE_NAMES } from './entities.js';
+import { DEFAULT_TABLE_NAMES, GLOBAL_TENANT } from './entities.js';
 import { ensureAuthzSchema } from './schema.js';
 import { Placeholders, assertSafeIdentifier } from './sql.js';
 /** Normalize a {@link UserRef} to `{ type, id }` with `id` stringified. */
@@ -30,6 +30,7 @@ export class TypeOrmAuthzStore {
             permissions: opts.tableNames?.permissions ?? DEFAULT_TABLE_NAMES.permissions,
             rolePermission: opts.tableNames?.rolePermission ?? DEFAULT_TABLE_NAMES.rolePermission,
             userRole: opts.tableNames?.userRole ?? DEFAULT_TABLE_NAMES.userRole,
+            userPermission: opts.tableNames?.userPermission ?? DEFAULT_TABLE_NAMES.userPermission,
         };
         this.schema = opts.schema;
         // P4: identifiers are interpolated into SQL — validate BYO names/schema up
@@ -134,63 +135,164 @@ export class TypeOrmAuthzStore {
         await this.dataSource.query(`DELETE FROM ${this.table('rolePermission')} WHERE ${this.col('roleId')} = ${p.next()} AND ${this.col('permissionId')} = ${p.next()}`, [roleId, permissionId]);
     }
     // --- user ↔ role ---
-    /** Assign a role to a user (creating the role by name if needed). Idempotent. */
-    async assignRole(user, roleName) {
+    /**
+     * Assign a role to a user (creating the role by name if needed). Idempotent.
+     *
+     * Pass `{ tenantId }` to scope the assignment to a tenant — it then applies ONLY
+     * within that tenant. Omitting it (the default) makes a GLOBAL assignment that
+     * applies in every tenant (and in an unscoped check). The same `(user, role)` can
+     * be assigned in multiple tenants independently.
+     */
+    async assignRole(user, roleName, scope) {
         const { type, id } = normalizeUserRef(user);
         const roleId = await this.createRole(roleName);
+        const tenantId = scope?.tenantId ?? GLOBAL_TENANT;
         const p = this.params();
-        await this.dataSource.query(`${this.insertIgnoreVerb()} INTO ${this.table('userRole')} (${this.col('userType')}, ${this.col('userId')}, ${this.col('roleId')}) VALUES (${p.next()}, ${p.next()}, ${p.next()})${this.insertIgnoreSuffix()}`, [type, id, roleId]);
+        await this.dataSource.query(`${this.insertIgnoreVerb()} INTO ${this.table('userRole')} (${this.col('userType')}, ${this.col('userId')}, ${this.col('roleId')}, ${this.col('tenantId')}) VALUES (${p.next()}, ${p.next()}, ${p.next()}, ${p.next()})${this.insertIgnoreSuffix()}`, [type, id, roleId, tenantId]);
     }
-    /** Remove a role from a user. No-op if the role or assignment is absent. */
-    async removeRole(user, roleName) {
+    /**
+     * Remove a role from a user. No-op if the role or assignment is absent. When
+     * `{ tenantId }` is given, only the assignment in THAT tenant is removed; omitting
+     * it removes the GLOBAL assignment (tenant `''`).
+     */
+    async removeRole(user, roleName, scope) {
         const { type, id } = normalizeUserRef(user);
         const roleId = await this.findRoleId(roleName);
         if (!roleId)
             return;
+        const tenantId = scope?.tenantId ?? GLOBAL_TENANT;
+        const p = this.params();
+        await this.dataSource.query(`DELETE FROM ${this.table('userRole')} WHERE ${this.col('userType')} = ${p.next()} AND ${this.col('userId')} = ${p.next()} AND ${this.col('roleId')} = ${p.next()} AND ${this.col('tenantId')} = ${p.next()}`, [type, id, roleId, tenantId]);
+    }
+    // --- user ↔ permission (DIRECT grant, no role) ---
+    /**
+     * Grant a permission DIRECTLY to a user (creating the permission by name if
+     * needed) — no role required. Mirrors Laravel/spatie's `$user->givePermissionTo`.
+     * Idempotent.
+     */
+    async giveUserPermission(user, permissionName) {
+        const { type, id } = normalizeUserRef(user);
+        const permissionId = await this.createPermission(permissionName);
         const p = this.params();
-        await this.dataSource.query(`DELETE FROM ${this.table('userRole')} WHERE ${this.col('userType')} = ${p.next()} AND ${this.col('userId')} = ${p.next()} AND ${this.col('roleId')} = ${p.next()}`, [type, id, roleId]);
+        await this.dataSource.query(`${this.insertIgnoreVerb()} INTO ${this.table('userPermission')} (${this.col('userType')}, ${this.col('userId')}, ${this.col('permissionId')}) VALUES (${p.next()}, ${p.next()}, ${p.next()})${this.insertIgnoreSuffix()}`, [type, id, permissionId]);
+    }
+    /**
+     * Revoke a DIRECT user permission. No-op if the permission or grant is absent.
+     * Only the direct grant is removed — a permission the user ALSO has via a role
+     * survives.
+     */
+    async revokeUserPermission(user, permissionName) {
+        const { type, id } = normalizeUserRef(user);
+        const permissionId = await this.findPermissionId(permissionName);
+        if (!permissionId)
+            return;
+        const p = this.params();
+        await this.dataSource.query(`DELETE FROM ${this.table('userPermission')} WHERE ${this.col('userType')} = ${p.next()} AND ${this.col('userId')} = ${p.next()} AND ${this.col('permissionId')} = ${p.next()}`, [type, id, permissionId]);
     }
     // --- queries ---
-    /** The role names a user holds. */
-    async getRolesForUser(user) {
+    /**
+     * SQL fragment + params matching role assignments visible for a tenant scope: a
+     * GLOBAL assignment (tenant `''`) always applies; a tenant-scoped one applies only
+     * when its tenant matches the requested one. With no requested tenant, only global
+     * assignments are visible (a tenant-scoped role never leaks into an unscoped check).
+     */
+    tenantFilter(alias, scope, p) {
+        const tenantId = scope?.tenantId ?? GLOBAL_TENANT;
+        if (tenantId === GLOBAL_TENANT) {
+            return ` AND ${alias}.${this.col('tenantId')} = ${p.next()}`;
+        }
+        // Visible = global OR exactly this tenant.
+        return ` AND (${alias}.${this.col('tenantId')} = ${p.next()} OR ${alias}.${this.col('tenantId')} = ${p.next()})`;
+    }
+    /** Bind values for {@link tenantFilter}, in the same order it emits placeholders. */
+    tenantParams(scope) {
+        const tenantId = scope?.tenantId ?? GLOBAL_TENANT;
+        return tenantId === GLOBAL_TENANT ? [GLOBAL_TENANT] : [GLOBAL_TENANT, tenantId];
+    }
+    /**
+     * The role names a user holds, optionally restricted to a tenant scope (see
+     * {@link assignRole}). With no scope, only global roles are returned.
+     */
+    async getRolesForUser(user, scope) {
         const { type, id } = normalizeUserRef(user);
         const p = this.params();
+        const userType = p.next();
+        const userId = p.next();
+        const filter = this.tenantFilter('ur', scope, p);
         const rows = (await this.dataSource.query(`SELECT r.${this.col('name')} AS name
        FROM ${this.table('userRole')} ur
        JOIN ${this.table('roles')} r ON r.${this.col('id')} = ur.${this.col('roleId')}
-       WHERE ur.${this.col('userType')} = ${p.next()} AND ur.${this.col('userId')} = ${p.next()}`, [type, id]));
+       WHERE ur.${this.col('userType')} = ${userType} AND ur.${this.col('userId')} = ${userId}${filter}`, [type, id, ...this.tenantParams(scope)]));
         return rows.map((row) => row.name);
     }
-    /** The flattened, distinct permission names a user has via their roles. */
-    async getPermissionsForUser(user) {
+    /**
+     * The flattened, distinct permission names a user has — the UNION of role-derived
+     * permissions (honoring the tenant scope) and DIRECT user permissions (which are
+     * not tenant-scoped). With no scope, role-derived permissions come from global
+     * roles only.
+     */
+    async getPermissionsForUser(user, scope) {
         const { type, id } = normalizeUserRef(user);
-        const p = this.params();
-        const rows = (await this.dataSource.query(`SELECT DISTINCT p.${this.col('name')} AS name
+        // Role-derived (tenant-aware).
+        const pr = this.params();
+        const rUserType = pr.next();
+        const rUserId = pr.next();
+        const rFilter = this.tenantFilter('ur', scope, pr);
+        const roleRows = (await this.dataSource.query(`SELECT DISTINCT p.${this.col('name')} AS name
        FROM ${this.table('userRole')} ur
        JOIN ${this.table('rolePermission')} rp ON rp.${this.col('roleId')} = ur.${this.col('roleId')}
        JOIN ${this.table('permissions')} p ON p.${this.col('id')} = rp.${this.col('permissionId')}
-       WHERE ur.${this.col('userType')} = ${p.next()} AND ur.${this.col('userId')} = ${p.next()}`, [type, id]));
-        return rows.map((row) => row.name);
+       WHERE ur.${this.col('userType')} = ${rUserType} AND ur.${this.col('userId')} = ${rUserId}${rFilter}`, [type, id, ...this.tenantParams(scope)]));
+        // Direct grants (not tenant-scoped).
+        const pd = this.params();
+        const directRows = (await this.dataSource.query(`SELECT DISTINCT p.${this.col('name')} AS name
+       FROM ${this.table('userPermission')} up
+       JOIN ${this.table('permissions')} p ON p.${this.col('id')} = up.${this.col('permissionId')}
+       WHERE up.${this.col('userType')} = ${pd.next()} AND up.${this.col('userId')} = ${pd.next()}`, [type, id]));
+        const out = new Set();
+        for (const row of roleRows)
+            out.add(row.name);
+        for (const row of directRows)
+            out.add(row.name);
+        return [...out];
     }
-    /** A user's roles + effective permissions in one shot. */
-    async getUserAuthz(user) {
+    /** A user's roles + effective permissions in one shot (tenant-aware). */
+    async getUserAuthz(user, scope) {
         const [roles, permissions] = await Promise.all([
-            this.getRolesForUser(user),
-            this.getPermissionsForUser(user),
+            this.getRolesForUser(user, scope),
+            this.getPermissionsForUser(user, scope),
         ]);
         return { roles, permissions };
     }
-    /** True when the user holds `permission` through any of their roles. */
-    async userHasPermission(user, permission) {
+    /**
+     * True when the user holds `permission` — via a (tenant-scoped) role OR a direct
+     * grant. With no scope, only global role assignments count toward the role path;
+     * direct grants always count.
+     */
+    async userHasPermission(user, permission, scope) {
         const { type, id } = normalizeUserRef(user);
-        const p = this.params();
-        const rows = (await this.dataSource.query(`SELECT 1 AS x
+        // Role path (tenant-aware).
+        const pr = this.params();
+        const rUserType = pr.next();
+        const rUserId = pr.next();
+        const rName = pr.next();
+        const rFilter = this.tenantFilter('ur', scope, pr);
+        const roleRows = (await this.dataSource.query(`SELECT 1 AS x
        FROM ${this.table('userRole')} ur
        JOIN ${this.table('rolePermission')} rp ON rp.${this.col('roleId')} = ur.${this.col('roleId')}
        JOIN ${this.table('permissions')} p ON p.${this.col('id')} = rp.${this.col('permissionId')}
-       WHERE ur.${this.col('userType')} = ${p.next()} AND ur.${this.col('userId')} = ${p.next()} AND p.${this.col('name')} = ${p.next()}
+       WHERE ur.${this.col('userType')} = ${rUserType} AND ur.${this.col('userId')} = ${rUserId} AND p.${this.col('name')} = ${rName}${rFilter}
+       LIMIT 1`, [type, id, permission, ...this.tenantParams(scope)]));
+        if (roleRows.length > 0)
+            return true;
+        // Direct path.
+        const pd = this.params();
+        const directRows = (await this.dataSource.query(`SELECT 1 AS x
+       FROM ${this.table('userPermission')} up
+       JOIN ${this.table('permissions')} p ON p.${this.col('id')} = up.${this.col('permissionId')}
+       WHERE up.${this.col('userType')} = ${pd.next()} AND up.${this.col('userId')} = ${pd.next()} AND p.${this.col('name')} = ${pd.next()}
        LIMIT 1`, [type, id, permission]));
-        return rows.length > 0;
+        return directRows.length > 0;
     }
 }
 //# sourceMappingURL=typeorm-authz.store.js.map

package/dist/typeorm-authz.store.js.map

@@ -1 +1 @@
-{"version":3,"file":"typeorm-authz.store.js","sourceRoot":"","sources":["../src/typeorm-authz.store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAG9D,2EAA2E;AAC3E,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACvD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;AAC1D,CAAC;AAWD;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IAKT;IACA;IALF,KAAK,CAA0E;IAC/E,MAAM,CAAqB;IAE5C,YACmB,UAAsB,EACtB,OAA0B,EAAE;QAD5B,eAAU,GAAV,UAAU,CAAY;QACtB,SAAI,GAAJ,IAAI,CAAwB;QAE7C,IAAI,CAAC,KAAK,GAAG;YACX,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,IAAI,mBAAmB,CAAC,KAAK;YAC1D,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,IAAI,mBAAmB,CAAC,WAAW;YAC5E,cAAc,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,IAAI,mBAAmB,CAAC,cAAc;YACrF,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,IAAI,mBAAmB,CAAC,QAAQ;SACpE,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAE1B,2EAA2E;QAC3E,0EAA0E;QAC1E,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,GAAG,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,YAAY;QACV,OAAO,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,+EAA+E;IACvE,MAAM;QACZ,OAAO,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED,wDAAwD;IAChD,KAAK,CAAC,GAA4B;QACxC,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;IAEO,GAAG,CAAC,EAAU;QACpB,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,2DAA2D;IAE3D,qFAAqF;IAC7E,kBAAkB;QACxB,oFAAoF;QACpF,iFAAiF;QACjF,0BAA0B;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,cAAc;YAAE,OAAO,EAAE,CAAC;QACjF,OAAO,yBAAyB,CAAC;IACnC,CAAC;IAED,yEAAyE;IACjE,gBAAgB;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,cAAc;YAAE,OAAO,eAAe,CAAC;QAC9F,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,GAAG,IAAI,CAAC,gBAAgB,EAAE,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,CACpF,MAAM,CACP,KAAK,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,kBAAkB,EAAE,EAAE,EACrI,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAC/C,CAAC;QACF,6EAA6E;QAC7E,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,IAAI,CAAC,CAAC;QACxE,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,GAAG,IAAI,CAAC,gBAAgB,EAAE,SAAS,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,IAAI,CAAC,GAAG,CACvE,IAAI,CACL,KAAK,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,kBAAkB,EAAE,EAAE,EAC1J,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAC/C,CAAC;QACF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,IAAI,CAAC,CAAC;QAC9E,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,IAAY;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACvC,UAAU,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,GAAG,CAC1E,MAAM,CACP,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EACjB,CAAC,IAAI,CAAC,CACP,CAA0B,CAAC;QAC5B,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACzC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACvC,UAAU,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU,IAAI,CAAC,GAAG,CAChF,MAAM,CACP,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EACjB,CAAC,IAAI,CAAC,CACP,CAA0B,CAAC;QAC5B,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACrB,CAAC;IAED,4BAA4B;IAE5B,kFAAkF;IAClF,KAAK,CAAC,oBAAoB,CAAC,QAAgB,EAAE,cAAsB;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,GAAG,IAAI,CAAC,gBAAgB,EAAE,SAAS,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,IAAI,CAAC,GAAG,CAC1E,QAAQ,CACT,KAAK,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,kBAAkB,EAAE,EAAE,EAC/F,CAAC,MAAM,EAAE,YAAY,CAAC,CACvB,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,wBAAwB,CAAC,QAAgB,EAAE,cAAsB;QACrE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY;YAAE,OAAO;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,eAAe,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,UAAU,IAAI,CAAC,GAAG,CAC3D,QAAQ,CACT,MAAM,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAC/D,CAAC,MAAM,EAAE,YAAY,CAAC,CACvB,CAAC;IACJ,CAAC;IAED,sBAAsB;IAEtB,iFAAiF;IACjF,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB;QAC9C,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,GAAG,IAAI,CAAC,gBAAgB,EAAE,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,CACpE,UAAU,CACX,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,kBAAkB,EAAE,EAAE,EAC7H,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CACnB,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB;QAC9C,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,eAAe,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,GAAG,CAC/F,QAAQ,CACT,MAAM,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EACzD,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CACnB,CAAC;IACJ,CAAC;IAED,kBAAkB;IAElB,mCAAmC;IACnC,KAAK,CAAC,eAAe,CAAC,IAAa;QACjC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACvC,YAAY,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;cACpB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;cACtB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;kBACnE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,WAAW,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAC3F,CAAC,IAAI,EAAE,EAAE,CAAC,CACX,CAA4B,CAAC;QAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,qBAAqB,CAAC,IAAa;QACvC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACvC,qBAAqB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;cAC7B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;cACtB,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,GAAG,CACjF,QAAQ,CACT;cACM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;kBAC/E,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,WAAW,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAC3F,CAAC,IAAI,EAAE,EAAE,CAAC,CACX,CAA4B,CAAC;QAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,YAAY,CAAC,IAAa;QAC9B,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAC1B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC;SACjC,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChC,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,iBAAiB,CAAC,IAAa,EAAE,UAAkB;QACvD,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACvC;cACQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;cACtB,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,GAAG,CACjF,QAAQ,CACT;cACM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;kBAC/E,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,WAAW,IAAI,CAAC,GAAG,CAC9D,QAAQ,CACT,MAAM,CAAC,CAAC,IAAI,EAAE,UAAU,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE;eAC/C,EACT,CAAC,IAAI,EAAE,EAAE,EAAE,UAAU,CAAC,CACvB,CAAc,CAAC;QAChB,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;CACF"}
+{"version":3,"file":"typeorm-authz.store.js","sourceRoot":"","sources":["../src/typeorm-authz.store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAG9D,2EAA2E;AAC3E,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACvD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;AAC1D,CAAC;AAWD;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IAQT;IACA;IARF,KAAK,CAGpB;IACe,MAAM,CAAqB;IAE5C,YACmB,UAAsB,EACtB,OAA0B,EAAE;QAD5B,eAAU,GAAV,UAAU,CAAY;QACtB,SAAI,GAAJ,IAAI,CAAwB;QAE7C,IAAI,CAAC,KAAK,GAAG;YACX,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,IAAI,mBAAmB,CAAC,KAAK;YAC1D,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,IAAI,mBAAmB,CAAC,WAAW;YAC5E,cAAc,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,IAAI,mBAAmB,CAAC,cAAc;YACrF,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,IAAI,mBAAmB,CAAC,QAAQ;YACnE,cAAc,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,IAAI,mBAAmB,CAAC,cAAc;SACtF,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAE1B,2EAA2E;QAC3E,0EAA0E;QAC1E,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,GAAG,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,YAAY;QACV,OAAO,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,+EAA+E;IACvE,MAAM;QACZ,OAAO,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED,wDAAwD;IAChD,KAAK,CAAC,GAA4B;QACxC,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;IAEO,GAAG,CAAC,EAAU;QACpB,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,2DAA2D;IAE3D,qFAAqF;IAC7E,kBAAkB;QACxB,oFAAoF;QACpF,iFAAiF;QACjF,0BAA0B;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,cAAc;YAAE,OAAO,EAAE,CAAC;QACjF,OAAO,yBAAyB,CAAC;IACnC,CAAC;IAED,yEAAyE;IACjE,gBAAgB;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,cAAc;YAAE,OAAO,eAAe,CAAC;QAC9F,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,GAAG,IAAI,CAAC,gBAAgB,EAAE,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,CACpF,MAAM,CACP,KAAK,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,kBAAkB,EAAE,EAAE,EACrI,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAC/C,CAAC;QACF,6EAA6E;QAC7E,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,IAAI,CAAC,CAAC;QACxE,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,GAAG,IAAI,CAAC,gBAAgB,EAAE,SAAS,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,IAAI,CAAC,GAAG,CACvE,IAAI,CACL,KAAK,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,kBAAkB,EAAE,EAAE,EAC1J,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAC/C,CAAC;QACF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,IAAI,CAAC,CAAC;QAC9E,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,IAAY;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACvC,UAAU,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,GAAG,CAC1E,MAAM,CACP,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EACjB,CAAC,IAAI,CAAC,CACP,CAA0B,CAAC;QAC5B,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACzC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACvC,UAAU,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU,IAAI,CAAC,GAAG,CAChF,MAAM,CACP,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EACjB,CAAC,IAAI,CAAC,CACP,CAA0B,CAAC;QAC5B,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACrB,CAAC;IAED,4BAA4B;IAE5B,kFAAkF;IAClF,KAAK,CAAC,oBAAoB,CAAC,QAAgB,EAAE,cAAsB;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,GAAG,IAAI,CAAC,gBAAgB,EAAE,SAAS,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,IAAI,CAAC,GAAG,CAC1E,QAAQ,CACT,KAAK,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,kBAAkB,EAAE,EAAE,EAC/F,CAAC,MAAM,EAAE,YAAY,CAAC,CACvB,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,wBAAwB,CAAC,QAAgB,EAAE,cAAsB;QACrE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY;YAAE,OAAO;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,eAAe,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,UAAU,IAAI,CAAC,GAAG,CAC3D,QAAQ,CACT,MAAM,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAC/D,CAAC,MAAM,EAAE,YAAY,CAAC,CACvB,CAAC;IACJ,CAAC;IAED,sBAAsB;IAEtB;;;;;;;OAOG;IACH,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB,EAAE,KAAmB;QACnE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAQ,IAAI,aAAa,CAAC;QAClD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,GAAG,IAAI,CAAC,gBAAgB,EAAE,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,CACpE,UAAU,CACX,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,kBAAkB,EAAE,EAAE,EACnK,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAC7B,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB,EAAE,KAAmB;QACnE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAQ,IAAI,aAAa,CAAC;QAClD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,eAAe,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,GAAG,CAC/F,QAAQ,CACT,MAAM,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EACnG,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAC7B,CAAC;IACJ,CAAC;IAED,oDAAoD;IAEpD;;;;OAIG;IACH,KAAK,CAAC,kBAAkB,CAAC,IAAa,EAAE,cAAsB;QAC5D,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,GAAG,IAAI,CAAC,gBAAgB,EAAE,SAAS,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,IAAI,CAAC,GAAG,CAC1E,UAAU,CACX,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,kBAAkB,EAAE,EAAE,EACnI,CAAC,IAAI,EAAE,EAAE,EAAE,YAAY,CAAC,CACzB,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,oBAAoB,CAAC,IAAa,EAAE,cAAsB;QAC9D,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,IAAI,CAAC,YAAY;YAAE,OAAO;QAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,eAAe,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,UAAU,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,GAAG,CACrG,QAAQ,CACT,MAAM,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAC/D,CAAC,IAAI,EAAE,EAAE,EAAE,YAAY,CAAC,CACzB,CAAC;IACJ,CAAC;IAED,kBAAkB;IAElB;;;;;OAKG;IACK,YAAY,CAAC,KAAa,EAAE,KAA8B,EAAE,CAAe;QACjF,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAQ,IAAI,aAAa,CAAC;QAClD,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;YAC/B,OAAO,QAAQ,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/D,CAAC;QACD,2CAA2C;QAC3C,OAAO,SAAS,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,IAAI,CAAC,GAAG,CACjF,UAAU,CACX,MAAM,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC;IACrB,CAAC;IAED,qFAAqF;IAC7E,YAAY,CAAC,KAA8B;QACjD,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAQ,IAAI,aAAa,CAAC;QAClD,OAAO,QAAQ,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAClF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,IAAa,EAAE,KAAmB;QACtD,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACvC,YAAY,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;cACpB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;cACtB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;kBACnE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,QAAQ,WAAW,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,MAAM,GAAG,MAAM,EAAE,EAClG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CACxC,CAA4B,CAAC;QAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,qBAAqB,CAAC,IAAa,EAAE,KAAmB;QAC5D,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAE5C,+BAA+B;QAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAC3C,qBAAqB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;cAC7B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;cACtB,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,GAAG,CACjF,QAAQ,CACT;cACM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;kBAC/E,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,SAAS,WAAW,IAAI,CAAC,GAAG,CAC/D,QAAQ,CACT,MAAM,OAAO,GAAG,OAAO,EAAE,EAC3B,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CACxC,CAA4B,CAAC;QAE9B,qCAAqC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAC7C,qBAAqB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;cAC7B,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;cAC5B,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;kBAC/E,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,WAAW,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,EAC7F,CAAC,IAAI,EAAE,EAAE,CAAC,CACX,CAA4B,CAAC;QAE9B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,QAAQ;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,KAAK,MAAM,GAAG,IAAI,UAAU;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;IAClB,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,YAAY,CAAC,IAAa,EAAE,KAAmB;QACnD,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC;YACjC,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC;SACxC,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB,CACrB,IAAa,EACb,UAAkB,EAClB,KAAmB;QAEnB,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAE5C,4BAA4B;QAC5B,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAC3C;cACQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;cACtB,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,GAAG,CACjF,QAAQ,CACT;cACM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;kBAC/E,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,SAAS,WAAW,IAAI,CAAC,GAAG,CAC/D,QAAQ,CACT,MAAM,OAAO,UAAU,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG,OAAO;eACrD,EACT,CAAC,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CACpD,CAAc,CAAC;QAChB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAErC,eAAe;QACf,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAC7C;cACQ,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;cAC5B,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;kBAC/E,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,WAAW,IAAI,CAAC,GAAG,CAC/D,QAAQ,CACT,MAAM,EAAE,CAAC,IAAI,EAAE,UAAU,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;eACjD,EACT,CAAC,IAAI,EAAE,EAAE,EAAE,UAAU,CAAC,CACvB,CAAc,CAAC;QAChB,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/B,CAAC;CACF"}

package/dist/types.d.ts

@@ -4,6 +4,17 @@ export interface TableNames {
     permissions?: string;
     rolePermission?: string;
     userRole?: string;
+    /** Direct user→permission pivot (post-v1). Defaults to `authz_user_permission`. */
+    userPermission?: string;
+}
+/** Optional tenant scope for a user-role assignment / role-or-permission query. */
+export interface TenantScope {
+    /**
+     * Restrict a role assignment (or a query) to this tenant. Omitted/undefined →
+     * the GLOBAL scope (an assignment applies in every tenant; a query sees global
+     * assignments only — a tenant-scoped role does NOT leak into an unscoped check).
+     */
+    tenantId?: string;
 }
 /**
  * A reference to a user. Matches nestjs-context's `UserRef` shape (`{ type, id }`),

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;CACrB;AAED,4EAA4E;AAC5E,MAAM,MAAM,OAAO,GAAG,YAAY,GAAG,MAAM,GAAG,MAAM,CAAC;AAErD,MAAM,WAAW,iBAAiB;IAChC,wFAAwF;IACxF,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;CACrB;AAED,4EAA4E;AAC5E,MAAM,MAAM,OAAO,GAAG,YAAY,GAAG,MAAM,GAAG,MAAM,CAAC;AAErD,MAAM,WAAW,iBAAiB;IAChC,wFAAwF;IACxF,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dudousxd/nestjs-authz-typeorm",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "TypeORM RBAC persistence for @dudousxd/nestjs-authz — roles, permissions, and a Gate seam (zero connection ownership).",
   "license": "MIT",
   "repository": {
@@ -35,14 +35,18 @@
     "@nestjs/common": "^11.0.0",
     "@nestjs/core": "^11.0.0",
     "@nestjs/testing": "^11.0.0",
+    "@testcontainers/mysql": "^12.0.3",
+    "@testcontainers/postgresql": "^12.0.3",
     "@types/node": "^20.0.0",
+    "mysql2": "^3.22.5",
+    "pg": "^8.21.0",
     "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.1",
     "sqlite3": "^5.1.7",
     "typeorm": "^0.3.20",
     "typescript": "^5.4.0",
     "vitest": "^3.0.0",
-    "@dudousxd/nestjs-authz": "^0.2.0"
+    "@dudousxd/nestjs-authz": "^0.6.0"
   },
   "engines": {
     "node": ">=20"
@@ -59,6 +63,9 @@
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "test": "vitest run --passWithNoTests",
+    "test:db": "pnpm test:db:pg && pnpm test:db:mysql",
+    "test:db:pg": "AUTHZ_TEST_DIALECT=postgres vitest run --config vitest.db.config.ts",
+    "test:db:mysql": "AUTHZ_TEST_DIALECT=mysql vitest run --config vitest.db.config.ts",
     "test:watch": "vitest",
     "typecheck": "tsc -p tsconfig.json --noEmit"
   }