@dudousxd/nestjs-authz-typeorm 0.2.1 → 0.3.1

package/dist/scope.js

@@ -0,0 +1,124 @@
+import { assertSafeIdentifier } from './sql.js';
+/** An always-false predicate (deny-all / empty `IN`). Binds no parameters. */
+const ALWAYS_FALSE = { sql: '1 = 0', params: {} };
+const ansiQuote = (id) => `"${id}"`;
+/** TypeORM/SQL operator tokens for the binary comparison operators. */
+const BINARY_OPS = {
+    eq: '=',
+    ne: '!=',
+    gt: '>',
+    gte: '>=',
+    lt: '<',
+    lte: '<=',
+};
+/**
+ * Compile an ORM-neutral {@link ScopeConstraint} into a parameterized SQL predicate
+ * for TypeORM. Returns:
+ * - `undefined` for `allow-all` — the caller adds NO `WHERE` (every row is visible);
+ * - `{ sql: '1 = 0', params: {} }` for `deny-all` — an always-false predicate;
+ * - otherwise the compiled condition tree.
+ *
+ * `paramPrefix` namespaces the generated placeholders so multiple `applyScope` calls
+ * (or other `andWhere`s) on one query never collide. `alias` (the entity's query
+ * alias) prefixes every column as `"alias"."field"`; omit it to emit bare `"field"`.
+ *
+ * SAFE: column names and the alias are interpolated into SQL, so each is validated
+ * against the package's `assertSafeIdentifier` allowlist (letters/digits/underscore,
+ * not leading-digit) — a hostile field/alias throws. Values are NEVER interpolated;
+ * they are returned in `params` for TypeORM to bind.
+ *
+ * `escapeId` controls identifier quoting; it defaults to ANSI double-quotes (Postgres /
+ * SQLite). `applyScopeConstraint` injects the DataSource's `driver.escape` so the
+ * predicate is also valid on MySQL/MariaDB (backtick-quoted), which rejects `"..."`.
+ */
+export function compileScope(constraint, paramPrefix, alias, escapeId = ansiQuote) {
+    if (constraint.kind === 'all')
+        return undefined;
+    if (constraint.kind === 'none')
+        return ALWAYS_FALSE;
+    if (alias !== undefined)
+        assertSafeIdentifier(alias, `scope alias "${alias}"`);
+    const params = {};
+    let counter = 0;
+    const nextParam = () => `${paramPrefix}_${counter++}`;
+    const column = (field) => {
+        assertSafeIdentifier(field, `scope field "${field}"`);
+        return alias === undefined ? escapeId(field) : `${escapeId(alias)}.${escapeId(field)}`;
+    };
+    const compileCondition = (c) => {
+        const col = column(c.field);
+        if (c.op === 'isNull')
+            return `${col} IS NULL`;
+        if (c.op === 'isNotNull')
+            return `${col} IS NOT NULL`;
+        if (c.op === 'in' || c.op === 'nin') {
+            const values = Array.isArray(c.value) ? c.value : [c.value];
+            // An empty `IN ()` is invalid SQL and matches nothing; an empty `NOT IN ()`
+            // matches everything. Encode both with constant predicates.
+            if (values.length === 0)
+                return c.op === 'in' ? '1 = 0' : '1 = 1';
+            const name = nextParam();
+            params[name] = values;
+            const not = c.op === 'nin' ? 'NOT ' : '';
+            return `${col} ${not}IN (:...${name})`;
+        }
+        const token = BINARY_OPS[c.op];
+        if (!token)
+            throw new Error(`Unsupported scope operator: ${c.op}`);
+        const name = nextParam();
+        params[name] = c.value;
+        return `${col} ${token} :${name}`;
+    };
+    const compileNode = (node) => {
+        if (node.kind === 'condition')
+            return compileCondition(node);
+        const joiner = node.kind === 'and' ? ' AND ' : ' OR ';
+        // An empty AND is the identity (true); an empty OR is the zero (false).
+        if (node.nodes.length === 0)
+            return node.kind === 'and' ? '1 = 1' : '1 = 0';
+        return `(${node.nodes.map(compileNode).join(joiner)})`;
+    };
+    const sql = compileNode(constraint);
+    // A top-level empty `IN` collapses to the always-false constant with no params.
+    if (sql === '1 = 0' && Object.keys(params).length === 0)
+        return ALWAYS_FALSE;
+    return { sql, params };
+}
+let scopeApplyCounter = 0;
+/**
+ * Apply a {@link ScopeConstraint} to a TypeORM {@link SelectQueryBuilder} as an
+ * `andWhere`, parameterized and identifier-safe. `allow-all` adds nothing; `deny-all`
+ * adds an always-false predicate so the query returns no rows.
+ *
+ * The query's primary alias is used to qualify columns (so the predicate is correct
+ * across joins). Each call uses a fresh parameter prefix, so repeated calls never
+ * clash. Returns the same builder for chaining.
+ */
+export function applyScopeConstraint(qb, constraint) {
+    const prefix = `authz_scope_${scopeApplyCounter++}`;
+    // Quote identifiers with the DataSource's own dialect-correct escaper so the predicate
+    // is valid on MySQL/MariaDB (backticks) as well as Postgres/SQLite (double-quotes).
+    const escapeId = (id) => qb.connection.driver.escape(id);
+    const compiled = compileScope(constraint, prefix, qb.alias, escapeId);
+    if (compiled)
+        qb.andWhere(compiled.sql, compiled.params);
+    return qb;
+}
+/**
+ * Ergonomic entry point: resolve the query scope for the current (context) user via
+ * the {@link Gate} and apply it to `qb` in one call. Equivalent to
+ * `applyScopeConstraint(qb, await gate.scope(entity, ability))`.
+ *
+ * The manual path (`gate.scope(...)` + `applyScopeConstraint(...)`) remains primary;
+ * this just folds the two steps together for the common list-endpoint case.
+ *
+ * ```ts
+ * const qb = repo.createQueryBuilder('post');
+ * await applyScope(qb, gate, Post);          // current user's accessible posts
+ * const posts = await qb.getMany();
+ * ```
+ */
+export async function applyScope(qb, gate, entity, ability = 'viewAny') {
+    return applyScopeConstraint(qb, await gate.scope(entity, ability));
+}
+//# sourceMappingURL=scope.js.map

package/dist/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../src/scope.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAsBhD,8EAA8E;AAC9E,MAAM,YAAY,GAAkB,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AASjE,MAAM,SAAS,GAAqB,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC;AAEtD,uEAAuE;AACvE,MAAM,UAAU,GAA2C;IACzD,EAAE,EAAE,GAAG;IACP,EAAE,EAAE,IAAI;IACR,EAAE,EAAE,GAAG;IACP,GAAG,EAAE,IAAI;IACT,EAAE,EAAE,GAAG;IACP,GAAG,EAAE,IAAI;CACV,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,YAAY,CAC1B,UAA2B,EAC3B,WAAmB,EACnB,KAAc,EACd,WAA6B,SAAS;IAEtC,IAAI,UAAU,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IAChD,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,YAAY,CAAC;IACpD,IAAI,KAAK,KAAK,SAAS;QAAE,oBAAoB,CAAC,KAAK,EAAE,gBAAgB,KAAK,GAAG,CAAC,CAAC;IAE/E,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,SAAS,GAAG,GAAW,EAAE,CAAC,GAAG,WAAW,IAAI,OAAO,EAAE,EAAE,CAAC;IAE9D,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE;QACvC,oBAAoB,CAAC,KAAK,EAAE,gBAAgB,KAAK,GAAG,CAAC,CAAC;QACtD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACzF,CAAC,CAAC;IAEF,MAAM,gBAAgB,GAAG,CAAC,CAAiB,EAAU,EAAE;QACrD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,CAAC,EAAE,KAAK,QAAQ;YAAE,OAAO,GAAG,GAAG,UAAU,CAAC;QAC/C,IAAI,CAAC,CAAC,EAAE,KAAK,WAAW;YAAE,OAAO,GAAG,GAAG,cAAc,CAAC;QACtD,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC5D,4EAA4E;YAC5E,4DAA4D;YAC5D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;YAClE,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;YACtB,MAAM,GAAG,GAAG,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,OAAO,GAAG,GAAG,IAAI,GAAG,WAAW,IAAI,GAAG,CAAC;QACzC,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;QACvB,OAAO,GAAG,GAAG,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;IACpC,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,CAAC,IAAe,EAAU,EAAE;QAC9C,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QACtD,wEAAwE;QACxE,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAC5E,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;IACzD,CAAC,CAAC;IAEF,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACpC,gFAAgF;IAChF,IAAI,GAAG,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IAC7E,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACzB,CAAC;AAED,IAAI,iBAAiB,GAAG,CAAC,CAAC;AAE1B;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,EAAyB,EACzB,UAA2B;IAE3B,MAAM,MAAM,GAAG,eAAe,iBAAiB,EAAE,EAAE,CAAC;IACpD,uFAAuF;IACvF,oFAAoF;IACpF,MAAM,QAAQ,GAAqB,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACtE,IAAI,QAAQ;QAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAyB,EACzB,IAAmB,EACnB,MAAqB,EACrB,OAAO,GAAG,SAAS;IAEnB,OAAO,oBAAoB,CAAC,EAAE,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AACrE,CAAC"}

package/dist/sql.d.ts

@@ -1,4 +1,5 @@
 import type { DataSource } from 'typeorm';
+export { assertSafeIdentifier } from '@dudousxd/nestjs-authz';
 /** True when the DataSource's driver expects `$n` positional placeholders. */
 export declare function isPostgresFamily(dataSource: DataSource): boolean;
 /**
@@ -19,12 +20,4 @@ export declare class Placeholders {
     /** The next placeholder token, advancing the positional counter. */
     next(): string;
 }
-/**
- * Validate an identifier (table/schema name) against {@link SAFE_IDENTIFIER}.
- * Throws on anything containing quotes, dots, whitespace, or other unsafe chars.
- *
- * @param value the identifier to check
- * @param what  a label for the error message (e.g. `table name "roles"`)
- */
-export declare function assertSafeIdentifier(value: string, what: string): void;
 //# sourceMappingURL=sql.d.ts.map

package/dist/sql.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sql.d.ts","sourceRoot":"","sources":["../src/sql.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAS1C,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAEhE;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED;;;;GAIG;AACH,qBAAa,YAAY;IAEX,OAAO,CAAC,QAAQ,CAAC,QAAQ;IADrC,OAAO,CAAC,KAAK,CAAK;gBACW,QAAQ,EAAE,OAAO;IAE9C,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,GAAG,YAAY;IAIhD,oEAAoE;IACpE,IAAI,IAAI,MAAM;CAKf;AAUD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAMtE"}
+{"version":3,"file":"sql.d.ts","sourceRoot":"","sources":["../src/sql.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAI1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAS9D,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAEhE;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED;;;;GAIG;AACH,qBAAa,YAAY;IAEX,OAAO,CAAC,QAAQ,CAAC,QAAQ;IADrC,OAAO,CAAC,KAAK,CAAK;gBACW,QAAQ,EAAE,OAAO;IAE9C,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,GAAG,YAAY;IAIhD,oEAAoE;IACpE,IAAI,IAAI,MAAM;CAKf"}

package/dist/sql.js

@@ -1,3 +1,6 @@
+// Re-exported so the package's existing `./sql.js` import sites (and tests) keep working while the
+// guard itself is single-sourced in core.
+export { assertSafeIdentifier } from '@dudousxd/nestjs-authz';
 /**
  * Database types whose driver binds parameters with positional `$1, $2, …`
  * placeholders instead of `?`. Postgres (and its aurora/cockroach kin) reject the
@@ -36,23 +39,4 @@ export class Placeholders {
         return token;
     }
 }
-/**
- * SQL identifiers (table / schema names) are interpolated into query text, NOT
- * passed as bound parameters — `driver.escape()` only wraps them in quotes, it does
- * NOT neutralize an embedded quote. To keep BYO `tableNames`/`schema` safe, restrict
- * them to a conservative allowlist and reject anything else loudly.
- */
-const SAFE_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
-/**
- * Validate an identifier (table/schema name) against {@link SAFE_IDENTIFIER}.
- * Throws on anything containing quotes, dots, whitespace, or other unsafe chars.
- *
- * @param value the identifier to check
- * @param what  a label for the error message (e.g. `table name "roles"`)
- */
-export function assertSafeIdentifier(value, what) {
-    if (!SAFE_IDENTIFIER.test(value)) {
-        throw new Error(`Unsafe ${what}: ${JSON.stringify(value)}. Identifiers must match /^[A-Za-z_][A-Za-z0-9_]*$/ (letters, digits, underscore; not starting with a digit). This blocks SQL injection via configured names.`);
-    }
-}
 //# sourceMappingURL=sql.js.map

package/dist/sql.js.map

@@ -1 +1 @@
-{"version":3,"file":"sql.js","sourceRoot":"","sources":["../src/sql.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,iBAAiB,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;AAE3F,8EAA8E;AAC9E,MAAM,UAAU,gBAAgB,CAAC,UAAsB;IACrD,OAAO,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,UAAsB,EAAE,KAAa;IAC/D,OAAO,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,YAAY;IAEM;IADrB,KAAK,GAAG,CAAC,CAAC;IAClB,YAA6B,QAAiB;QAAjB,aAAQ,GAAR,QAAQ,CAAS;IAAG,CAAC;IAElD,MAAM,CAAC,GAAG,CAAC,UAAsB;QAC/B,OAAO,IAAI,YAAY,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,oEAAoE;IACpE,IAAI;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QACzD,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QAChB,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,eAAe,GAAG,0BAA0B,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa,EAAE,IAAY;IAC9D,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,UAAU,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,+JAA+J,CACxM,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"sql.js","sourceRoot":"","sources":["../src/sql.ts"],"names":[],"mappings":"AAEA,mGAAmG;AACnG,0CAA0C;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE9D;;;;GAIG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,iBAAiB,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;AAE3F,8EAA8E;AAC9E,MAAM,UAAU,gBAAgB,CAAC,UAAsB;IACrD,OAAO,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,UAAsB,EAAE,KAAa;IAC/D,OAAO,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,YAAY;IAEM;IADrB,KAAK,GAAG,CAAC,CAAC;IAClB,YAA6B,QAAiB;QAAjB,aAAQ,GAAR,QAAQ,CAAS;IAAG,CAAC;IAElD,MAAM,CAAC,GAAG,CAAC,UAAsB;QAC/B,OAAO,IAAI,YAAY,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,oEAAoE;IACpE,IAAI;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QACzD,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QAChB,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/typeorm-authz.store.d.ts

@@ -1,13 +1,7 @@
+import { type UserAuthz, type UserRef } from '@dudousxd/nestjs-authz/store-kit';
 import type { DataSource } from 'typeorm';
-import type { AuthzStoreOptions, UserRef } from './types.js';
-/**
- * A user's effective permissions: the role names they hold and the flattened set of
- * permission names granted by those roles.
- */
-export interface UserAuthz {
-    roles: string[];
-    permissions: string[];
-}
+import type { AuthzStoreOptions, TenantScope } from './types.js';
+export type { UserAuthz };
 /**
  * TypeORM-backed RBAC store. A plain POJO that receives the `DataSource` in its
  * constructor — NOT `@Injectable`, no internal connection token (the app owns the
@@ -48,17 +42,61 @@ export declare class TypeOrmAuthzStore {
     givePermissionToRole(roleName: string, permissionName: string): Promise<void>;
     /** Revoke a permission from a role. No-op if either is absent or not linked. */
     revokePermissionFromRole(roleName: string, permissionName: string): Promise<void>;
-    /** Assign a role to a user (creating the role by name if needed). Idempotent. */
-    assignRole(user: UserRef, roleName: string): Promise<void>;
-    /** Remove a role from a user. No-op if the role or assignment is absent. */
-    removeRole(user: UserRef, roleName: string): Promise<void>;
-    /** The role names a user holds. */
-    getRolesForUser(user: UserRef): Promise<string[]>;
-    /** The flattened, distinct permission names a user has via their roles. */
-    getPermissionsForUser(user: UserRef): Promise<string[]>;
-    /** A user's roles + effective permissions in one shot. */
-    getUserAuthz(user: UserRef): Promise<UserAuthz>;
-    /** True when the user holds `permission` through any of their roles. */
-    userHasPermission(user: UserRef, permission: string): Promise<boolean>;
+    /**
+     * Assign a role to a user (creating the role by name if needed). Idempotent.
+     *
+     * Pass `{ tenantId }` to scope the assignment to a tenant — it then applies ONLY
+     * within that tenant. Omitting it (the default) makes a GLOBAL assignment that
+     * applies in every tenant (and in an unscoped check). The same `(user, role)` can
+     * be assigned in multiple tenants independently.
+     */
+    assignRole(user: UserRef, roleName: string, scope?: TenantScope): Promise<void>;
+    /**
+     * Remove a role from a user. No-op if the role or assignment is absent. When
+     * `{ tenantId }` is given, only the assignment in THAT tenant is removed; omitting
+     * it removes the GLOBAL assignment (tenant `''`).
+     */
+    removeRole(user: UserRef, roleName: string, scope?: TenantScope): Promise<void>;
+    /**
+     * Grant a permission DIRECTLY to a user (creating the permission by name if
+     * needed) — no role required. Mirrors Laravel/spatie's `$user->givePermissionTo`.
+     * Idempotent.
+     */
+    giveUserPermission(user: UserRef, permissionName: string): Promise<void>;
+    /**
+     * Revoke a DIRECT user permission. No-op if the permission or grant is absent.
+     * Only the direct grant is removed — a permission the user ALSO has via a role
+     * survives.
+     */
+    revokeUserPermission(user: UserRef, permissionName: string): Promise<void>;
+    /**
+     * SQL fragment + params matching role assignments visible for a tenant scope: a
+     * GLOBAL assignment (tenant `''`) always applies; a tenant-scoped one applies only
+     * when its tenant matches the requested one. With no requested tenant, only global
+     * assignments are visible (a tenant-scoped role never leaks into an unscoped check).
+     */
+    private tenantFilter;
+    /** Bind values for {@link tenantFilter}, in the same order it emits placeholders. */
+    private tenantParams;
+    /**
+     * The role names a user holds, optionally restricted to a tenant scope (see
+     * {@link assignRole}). With no scope, only global roles are returned.
+     */
+    getRolesForUser(user: UserRef, scope?: TenantScope): Promise<string[]>;
+    /**
+     * The flattened, distinct permission names a user has — the UNION of role-derived
+     * permissions (honoring the tenant scope) and DIRECT user permissions (which are
+     * not tenant-scoped). With no scope, role-derived permissions come from global
+     * roles only.
+     */
+    getPermissionsForUser(user: UserRef, scope?: TenantScope): Promise<string[]>;
+    /** A user's roles + effective permissions in one shot (tenant-aware). */
+    getUserAuthz(user: UserRef, scope?: TenantScope): Promise<UserAuthz>;
+    /**
+     * True when the user holds `permission` — via a (tenant-scoped) role OR a direct
+     * grant. With no scope, only global role assignments count toward the role path;
+     * direct grants always count.
+     */
+    userHasPermission(user: UserRef, permission: string, scope?: TenantScope): Promise<boolean>;
 }
 //# sourceMappingURL=typeorm-authz.store.d.ts.map

package/dist/typeorm-authz.store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"typeorm-authz.store.d.ts","sourceRoot":"","sources":["../src/typeorm-authz.store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAI1C,OAAO,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAU7D;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,qBAAa,iBAAiB;IAK1B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI;IALvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA0E;IAChG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;gBAGzB,UAAU,EAAE,UAAU,EACtB,IAAI,GAAE,iBAAsB;IAoB/C,+EAA+E;IAC/E,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7B,+EAA+E;IAC/E,OAAO,CAAC,MAAM;IAId,wDAAwD;IACxD,OAAO,CAAC,KAAK;IAMb,OAAO,CAAC,GAAG;IAMX,qFAAqF;IACrF,OAAO,CAAC,kBAAkB;IAS1B,yEAAyE;IACzE,OAAO,CAAC,gBAAgB;IAMxB;;;;;OAKG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgB/C,qFAAqF;IAC/E,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAevC,UAAU;YAWV,gBAAgB;IAa9B,kFAAkF;IAC5E,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYnF,gFAAgF;IAC1E,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAevF,iFAAiF;IAC3E,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYhE,4EAA4E;IACtE,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAehE,mCAAmC;IAC7B,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAavD,2EAA2E;IACrE,qBAAqB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAgB7D,0DAA0D;IACpD,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;IAQrD,wEAAwE;IAClE,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAkB7E"}
+{"version":3,"file":"typeorm-authz.store.d.ts","sourceRoot":"","sources":["../src/typeorm-authz.store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,OAAO,EAAoB,MAAM,kCAAkC,CAAC;AAClG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAI1C,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAIjE,YAAY,EAAE,SAAS,EAAE,CAAC;AAE1B;;;;;;;GAOG;AACH,qBAAa,iBAAiB;IAQ1B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI;IARvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAGpB;IACF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;gBAGzB,UAAU,EAAE,UAAU,EACtB,IAAI,GAAE,iBAAsB;IAqB/C,+EAA+E;IAC/E,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7B,+EAA+E;IAC/E,OAAO,CAAC,MAAM;IAId,wDAAwD;IACxD,OAAO,CAAC,KAAK;IAMb,OAAO,CAAC,GAAG;IAMX,qFAAqF;IACrF,OAAO,CAAC,kBAAkB;IAS1B,yEAAyE;IACzE,OAAO,CAAC,gBAAgB;IAMxB;;;;;OAKG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgB/C,qFAAqF;IAC/E,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAevC,UAAU;YAWV,gBAAgB;IAa9B,kFAAkF;IAC5E,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYnF,gFAAgF;IAC1E,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAevF;;;;;;;OAOG;IACG,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAarF;;;;OAIG;IACG,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBrF;;;;OAIG;IACG,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAY9E;;;;OAIG;IACG,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAehF;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IAWpB,qFAAqF;IACrF,OAAO,CAAC,YAAY;IAKpB;;;OAGG;IACG,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAgB5E;;;;;OAKG;IACG,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAqClF,yEAAyE;IACnE,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC;IAQ1E;;;;OAIG;IACG,iBAAiB,CACrB,IAAI,EAAE,OAAO,EACb,UAAU,EAAE,MAAM,EAClB,KAAK,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,OAAO,CAAC;CAsCpB"}

package/dist/typeorm-authz.store.js

@@ -1,14 +1,8 @@
 import { randomUUID } from 'node:crypto';
-import { DEFAULT_TABLE_NAMES } from './entities.js';
+import { normalizeUserRef } from '@dudousxd/nestjs-authz/store-kit';
+import { DEFAULT_TABLE_NAMES, GLOBAL_TENANT } from './entities.js';
 import { ensureAuthzSchema } from './schema.js';
 import { Placeholders, assertSafeIdentifier } from './sql.js';
-/** Normalize a {@link UserRef} to `{ type, id }` with `id` stringified. */
-function normalizeUserRef(ref) {
-    if (typeof ref === 'string' || typeof ref === 'number') {
-        return { type: 'user', id: String(ref) };
-    }
-    return { type: ref.type ?? 'user', id: String(ref.id) };
-}
 /**
  * TypeORM-backed RBAC store. A plain POJO that receives the `DataSource` in its
  * constructor — NOT `@Injectable`, no internal connection token (the app owns the
@@ -30,6 +24,7 @@ export class TypeOrmAuthzStore {
             permissions: opts.tableNames?.permissions ?? DEFAULT_TABLE_NAMES.permissions,
             rolePermission: opts.tableNames?.rolePermission ?? DEFAULT_TABLE_NAMES.rolePermission,
             userRole: opts.tableNames?.userRole ?? DEFAULT_TABLE_NAMES.userRole,
+            userPermission: opts.tableNames?.userPermission ?? DEFAULT_TABLE_NAMES.userPermission,
         };
         this.schema = opts.schema;
         // P4: identifiers are interpolated into SQL — validate BYO names/schema up
@@ -134,63 +129,164 @@ export class TypeOrmAuthzStore {
         await this.dataSource.query(`DELETE FROM ${this.table('rolePermission')} WHERE ${this.col('roleId')} = ${p.next()} AND ${this.col('permissionId')} = ${p.next()}`, [roleId, permissionId]);
     }
     // --- user ↔ role ---
-    /** Assign a role to a user (creating the role by name if needed). Idempotent. */
-    async assignRole(user, roleName) {
+    /**
+     * Assign a role to a user (creating the role by name if needed). Idempotent.
+     *
+     * Pass `{ tenantId }` to scope the assignment to a tenant — it then applies ONLY
+     * within that tenant. Omitting it (the default) makes a GLOBAL assignment that
+     * applies in every tenant (and in an unscoped check). The same `(user, role)` can
+     * be assigned in multiple tenants independently.
+     */
+    async assignRole(user, roleName, scope) {
         const { type, id } = normalizeUserRef(user);
         const roleId = await this.createRole(roleName);
+        const tenantId = scope?.tenantId ?? GLOBAL_TENANT;
         const p = this.params();
-        await this.dataSource.query(`${this.insertIgnoreVerb()} INTO ${this.table('userRole')} (${this.col('userType')}, ${this.col('userId')}, ${this.col('roleId')}) VALUES (${p.next()}, ${p.next()}, ${p.next()})${this.insertIgnoreSuffix()}`, [type, id, roleId]);
+        await this.dataSource.query(`${this.insertIgnoreVerb()} INTO ${this.table('userRole')} (${this.col('userType')}, ${this.col('userId')}, ${this.col('roleId')}, ${this.col('tenantId')}) VALUES (${p.next()}, ${p.next()}, ${p.next()}, ${p.next()})${this.insertIgnoreSuffix()}`, [type, id, roleId, tenantId]);
     }
-    /** Remove a role from a user. No-op if the role or assignment is absent. */
-    async removeRole(user, roleName) {
+    /**
+     * Remove a role from a user. No-op if the role or assignment is absent. When
+     * `{ tenantId }` is given, only the assignment in THAT tenant is removed; omitting
+     * it removes the GLOBAL assignment (tenant `''`).
+     */
+    async removeRole(user, roleName, scope) {
         const { type, id } = normalizeUserRef(user);
         const roleId = await this.findRoleId(roleName);
         if (!roleId)
             return;
+        const tenantId = scope?.tenantId ?? GLOBAL_TENANT;
         const p = this.params();
-        await this.dataSource.query(`DELETE FROM ${this.table('userRole')} WHERE ${this.col('userType')} = ${p.next()} AND ${this.col('userId')} = ${p.next()} AND ${this.col('roleId')} = ${p.next()}`, [type, id, roleId]);
+        await this.dataSource.query(`DELETE FROM ${this.table('userRole')} WHERE ${this.col('userType')} = ${p.next()} AND ${this.col('userId')} = ${p.next()} AND ${this.col('roleId')} = ${p.next()} AND ${this.col('tenantId')} = ${p.next()}`, [type, id, roleId, tenantId]);
+    }
+    // --- user ↔ permission (DIRECT grant, no role) ---
+    /**
+     * Grant a permission DIRECTLY to a user (creating the permission by name if
+     * needed) — no role required. Mirrors Laravel/spatie's `$user->givePermissionTo`.
+     * Idempotent.
+     */
+    async giveUserPermission(user, permissionName) {
+        const { type, id } = normalizeUserRef(user);
+        const permissionId = await this.createPermission(permissionName);
+        const p = this.params();
+        await this.dataSource.query(`${this.insertIgnoreVerb()} INTO ${this.table('userPermission')} (${this.col('userType')}, ${this.col('userId')}, ${this.col('permissionId')}) VALUES (${p.next()}, ${p.next()}, ${p.next()})${this.insertIgnoreSuffix()}`, [type, id, permissionId]);
+    }
+    /**
+     * Revoke a DIRECT user permission. No-op if the permission or grant is absent.
+     * Only the direct grant is removed — a permission the user ALSO has via a role
+     * survives.
+     */
+    async revokeUserPermission(user, permissionName) {
+        const { type, id } = normalizeUserRef(user);
+        const permissionId = await this.findPermissionId(permissionName);
+        if (!permissionId)
+            return;
+        const p = this.params();
+        await this.dataSource.query(`DELETE FROM ${this.table('userPermission')} WHERE ${this.col('userType')} = ${p.next()} AND ${this.col('userId')} = ${p.next()} AND ${this.col('permissionId')} = ${p.next()}`, [type, id, permissionId]);
     }
     // --- queries ---
-    /** The role names a user holds. */
-    async getRolesForUser(user) {
+    /**
+     * SQL fragment + params matching role assignments visible for a tenant scope: a
+     * GLOBAL assignment (tenant `''`) always applies; a tenant-scoped one applies only
+     * when its tenant matches the requested one. With no requested tenant, only global
+     * assignments are visible (a tenant-scoped role never leaks into an unscoped check).
+     */
+    tenantFilter(alias, scope, p) {
+        const tenantId = scope?.tenantId ?? GLOBAL_TENANT;
+        if (tenantId === GLOBAL_TENANT) {
+            return ` AND ${alias}.${this.col('tenantId')} = ${p.next()}`;
+        }
+        // Visible = global OR exactly this tenant.
+        return ` AND (${alias}.${this.col('tenantId')} = ${p.next()} OR ${alias}.${this.col('tenantId')} = ${p.next()})`;
+    }
+    /** Bind values for {@link tenantFilter}, in the same order it emits placeholders. */
+    tenantParams(scope) {
+        const tenantId = scope?.tenantId ?? GLOBAL_TENANT;
+        return tenantId === GLOBAL_TENANT ? [GLOBAL_TENANT] : [GLOBAL_TENANT, tenantId];
+    }
+    /**
+     * The role names a user holds, optionally restricted to a tenant scope (see
+     * {@link assignRole}). With no scope, only global roles are returned.
+     */
+    async getRolesForUser(user, scope) {
         const { type, id } = normalizeUserRef(user);
         const p = this.params();
+        const userType = p.next();
+        const userId = p.next();
+        const filter = this.tenantFilter('ur', scope, p);
         const rows = (await this.dataSource.query(`SELECT r.${this.col('name')} AS name
        FROM ${this.table('userRole')} ur
        JOIN ${this.table('roles')} r ON r.${this.col('id')} = ur.${this.col('roleId')}
-       WHERE ur.${this.col('userType')} = ${p.next()} AND ur.${this.col('userId')} = ${p.next()}`, [type, id]));
+       WHERE ur.${this.col('userType')} = ${userType} AND ur.${this.col('userId')} = ${userId}${filter}`, [type, id, ...this.tenantParams(scope)]));
         return rows.map((row) => row.name);
     }
-    /** The flattened, distinct permission names a user has via their roles. */
-    async getPermissionsForUser(user) {
+    /**
+     * The flattened, distinct permission names a user has — the UNION of role-derived
+     * permissions (honoring the tenant scope) and DIRECT user permissions (which are
+     * not tenant-scoped). With no scope, role-derived permissions come from global
+     * roles only.
+     */
+    async getPermissionsForUser(user, scope) {
         const { type, id } = normalizeUserRef(user);
-        const p = this.params();
-        const rows = (await this.dataSource.query(`SELECT DISTINCT p.${this.col('name')} AS name
+        // Role-derived (tenant-aware).
+        const pr = this.params();
+        const rUserType = pr.next();
+        const rUserId = pr.next();
+        const rFilter = this.tenantFilter('ur', scope, pr);
+        const roleRows = (await this.dataSource.query(`SELECT DISTINCT p.${this.col('name')} AS name
        FROM ${this.table('userRole')} ur
        JOIN ${this.table('rolePermission')} rp ON rp.${this.col('roleId')} = ur.${this.col('roleId')}
        JOIN ${this.table('permissions')} p ON p.${this.col('id')} = rp.${this.col('permissionId')}
-       WHERE ur.${this.col('userType')} = ${p.next()} AND ur.${this.col('userId')} = ${p.next()}`, [type, id]));
-        return rows.map((row) => row.name);
+       WHERE ur.${this.col('userType')} = ${rUserType} AND ur.${this.col('userId')} = ${rUserId}${rFilter}`, [type, id, ...this.tenantParams(scope)]));
+        // Direct grants (not tenant-scoped).
+        const pd = this.params();
+        const directRows = (await this.dataSource.query(`SELECT DISTINCT p.${this.col('name')} AS name
+       FROM ${this.table('userPermission')} up
+       JOIN ${this.table('permissions')} p ON p.${this.col('id')} = up.${this.col('permissionId')}
+       WHERE up.${this.col('userType')} = ${pd.next()} AND up.${this.col('userId')} = ${pd.next()}`, [type, id]));
+        const out = new Set();
+        for (const row of roleRows)
+            out.add(row.name);
+        for (const row of directRows)
+            out.add(row.name);
+        return [...out];
     }
-    /** A user's roles + effective permissions in one shot. */
-    async getUserAuthz(user) {
+    /** A user's roles + effective permissions in one shot (tenant-aware). */
+    async getUserAuthz(user, scope) {
         const [roles, permissions] = await Promise.all([
-            this.getRolesForUser(user),
-            this.getPermissionsForUser(user),
+            this.getRolesForUser(user, scope),
+            this.getPermissionsForUser(user, scope),
         ]);
         return { roles, permissions };
     }
-    /** True when the user holds `permission` through any of their roles. */
-    async userHasPermission(user, permission) {
+    /**
+     * True when the user holds `permission` — via a (tenant-scoped) role OR a direct
+     * grant. With no scope, only global role assignments count toward the role path;
+     * direct grants always count.
+     */
+    async userHasPermission(user, permission, scope) {
         const { type, id } = normalizeUserRef(user);
-        const p = this.params();
-        const rows = (await this.dataSource.query(`SELECT 1 AS x
+        // Role path (tenant-aware).
+        const pr = this.params();
+        const rUserType = pr.next();
+        const rUserId = pr.next();
+        const rName = pr.next();
+        const rFilter = this.tenantFilter('ur', scope, pr);
+        const roleRows = (await this.dataSource.query(`SELECT 1 AS x
        FROM ${this.table('userRole')} ur
        JOIN ${this.table('rolePermission')} rp ON rp.${this.col('roleId')} = ur.${this.col('roleId')}
        JOIN ${this.table('permissions')} p ON p.${this.col('id')} = rp.${this.col('permissionId')}
-       WHERE ur.${this.col('userType')} = ${p.next()} AND ur.${this.col('userId')} = ${p.next()} AND p.${this.col('name')} = ${p.next()}
+       WHERE ur.${this.col('userType')} = ${rUserType} AND ur.${this.col('userId')} = ${rUserId} AND p.${this.col('name')} = ${rName}${rFilter}
+       LIMIT 1`, [type, id, permission, ...this.tenantParams(scope)]));
+        if (roleRows.length > 0)
+            return true;
+        // Direct path.
+        const pd = this.params();
+        const directRows = (await this.dataSource.query(`SELECT 1 AS x
+       FROM ${this.table('userPermission')} up
+       JOIN ${this.table('permissions')} p ON p.${this.col('id')} = up.${this.col('permissionId')}
+       WHERE up.${this.col('userType')} = ${pd.next()} AND up.${this.col('userId')} = ${pd.next()} AND p.${this.col('name')} = ${pd.next()}
        LIMIT 1`, [type, id, permission]));
-        return rows.length > 0;
+        return directRows.length > 0;
     }
 }
 //# sourceMappingURL=typeorm-authz.store.js.map

package/dist/typeorm-authz.store.js.map

@@ -1 +1 @@
-{"version":3,"file":"typeorm-authz.store.js","sourceRoot":"","sources":["../src/typeorm-authz.store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAG9D,2EAA2E;AAC3E,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACvD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;AAC1D,CAAC;AAWD;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IAKT;IACA;IALF,KAAK,CAA0E;IAC/E,MAAM,CAAqB;IAE5C,YACmB,UAAsB,EACtB,OAA0B,EAAE;QAD5B,eAAU,GAAV,UAAU,CAAY;QACtB,SAAI,GAAJ,IAAI,CAAwB;QAE7C,IAAI,CAAC,KAAK,GAAG;YACX,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,IAAI,mBAAmB,CAAC,KAAK;YAC1D,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,IAAI,mBAAmB,CAAC,WAAW;YAC5E,cAAc,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,IAAI,mBAAmB,CAAC,cAAc;YACrF,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,IAAI,mBAAmB,CAAC,QAAQ;SACpE,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAE1B,2EAA2E;QAC3E,0EAA0E;QAC1E,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,GAAG,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,YAAY;QACV,OAAO,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,+EAA+E;IACvE,MAAM;QACZ,OAAO,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED,wDAAwD;IAChD,KAAK,CAAC,GAA4B;QACxC,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;IAEO,GAAG,CAAC,EAAU;QACpB,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,2DAA2D;IAE3D,qFAAqF;IAC7E,kBAAkB;QACxB,oFAAoF;QACpF,iFAAiF;QACjF,0BAA0B;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,cAAc;YAAE,OAAO,EAAE,CAAC;QACjF,OAAO,yBAAyB,CAAC;IACnC,CAAC;IAED,yEAAyE;IACjE,gBAAgB;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,cAAc;YAAE,OAAO,eAAe,CAAC;QAC9F,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,GAAG,IAAI,CAAC,gBAAgB,EAAE,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,CACpF,MAAM,CACP,KAAK,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,kBAAkB,EAAE,EAAE,EACrI,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAC/C,CAAC;QACF,6EAA6E;QAC7E,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,IAAI,CAAC,CAAC;QACxE,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,GAAG,IAAI,CAAC,gBAAgB,EAAE,SAAS,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,IAAI,CAAC,GAAG,CACvE,IAAI,CACL,KAAK,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,kBAAkB,EAAE,EAAE,EAC1J,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAC/C,CAAC;QACF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,IAAI,CAAC,CAAC;QAC9E,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,IAAY;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACvC,UAAU,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,GAAG,CAC1E,MAAM,CACP,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EACjB,CAAC,IAAI,CAAC,CACP,CAA0B,CAAC;QAC5B,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACzC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACvC,UAAU,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU,IAAI,CAAC,GAAG,CAChF,MAAM,CACP,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EACjB,CAAC,IAAI,CAAC,CACP,CAA0B,CAAC;QAC5B,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACrB,CAAC;IAED,4BAA4B;IAE5B,kFAAkF;IAClF,KAAK,CAAC,oBAAoB,CAAC,QAAgB,EAAE,cAAsB;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,GAAG,IAAI,CAAC,gBAAgB,EAAE,SAAS,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,IAAI,CAAC,GAAG,CAC1E,QAAQ,CACT,KAAK,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,kBAAkB,EAAE,EAAE,EAC/F,CAAC,MAAM,EAAE,YAAY,CAAC,CACvB,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,wBAAwB,CAAC,QAAgB,EAAE,cAAsB;QACrE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY;YAAE,OAAO;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,eAAe,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,UAAU,IAAI,CAAC,GAAG,CAC3D,QAAQ,CACT,MAAM,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAC/D,CAAC,MAAM,EAAE,YAAY,CAAC,CACvB,CAAC;IACJ,CAAC;IAED,sBAAsB;IAEtB,iFAAiF;IACjF,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB;QAC9C,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,GAAG,IAAI,CAAC,gBAAgB,EAAE,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,CACpE,UAAU,CACX,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,kBAAkB,EAAE,EAAE,EAC7H,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CACnB,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB;QAC9C,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,eAAe,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,GAAG,CAC/F,QAAQ,CACT,MAAM,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EACzD,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CACnB,CAAC;IACJ,CAAC;IAED,kBAAkB;IAElB,mCAAmC;IACnC,KAAK,CAAC,eAAe,CAAC,IAAa;QACjC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACvC,YAAY,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;cACpB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;cACtB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;kBACnE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,WAAW,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAC3F,CAAC,IAAI,EAAE,EAAE,CAAC,CACX,CAA4B,CAAC;QAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,qBAAqB,CAAC,IAAa;QACvC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACvC,qBAAqB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;cAC7B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;cACtB,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,GAAG,CACjF,QAAQ,CACT;cACM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;kBAC/E,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,WAAW,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAC3F,CAAC,IAAI,EAAE,EAAE,CAAC,CACX,CAA4B,CAAC;QAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,YAAY,CAAC,IAAa;QAC9B,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAC1B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC;SACjC,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChC,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,iBAAiB,CAAC,IAAa,EAAE,UAAkB;QACvD,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACvC;cACQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;cACtB,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,GAAG,CACjF,QAAQ,CACT;cACM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;kBAC/E,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,WAAW,IAAI,CAAC,GAAG,CAC9D,QAAQ,CACT,MAAM,CAAC,CAAC,IAAI,EAAE,UAAU,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE;eAC/C,EACT,CAAC,IAAI,EAAE,EAAE,EAAE,UAAU,CAAC,CACvB,CAAc,CAAC;QAChB,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzB,CAAC;CACF"}
+{"version":3,"file":"typeorm-authz.store.js","sourceRoot":"","sources":["../src/typeorm-authz.store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAgC,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAElG,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAO9D;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IAQT;IACA;IARF,KAAK,CAGpB;IACe,MAAM,CAAqB;IAE5C,YACmB,UAAsB,EACtB,OAA0B,EAAE;QAD5B,eAAU,GAAV,UAAU,CAAY;QACtB,SAAI,GAAJ,IAAI,CAAwB;QAE7C,IAAI,CAAC,KAAK,GAAG;YACX,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,IAAI,mBAAmB,CAAC,KAAK;YAC1D,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,IAAI,mBAAmB,CAAC,WAAW;YAC5E,cAAc,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,IAAI,mBAAmB,CAAC,cAAc;YACrF,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,IAAI,mBAAmB,CAAC,QAAQ;YACnE,cAAc,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,IAAI,mBAAmB,CAAC,cAAc;SACtF,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAE1B,2EAA2E;QAC3E,0EAA0E;QAC1E,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,oBAAoB,CAAC,IAAI,EAAE,eAAe,GAAG,GAAG,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,YAAY;QACV,OAAO,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,+EAA+E;IACvE,MAAM;QACZ,OAAO,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED,wDAAwD;IAChD,KAAK,CAAC,GAA4B;QACxC,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;IAEO,GAAG,CAAC,EAAU;QACpB,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,2DAA2D;IAE3D,qFAAqF;IAC7E,kBAAkB;QACxB,oFAAoF;QACpF,iFAAiF;QACjF,0BAA0B;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,cAAc;YAAE,OAAO,EAAE,CAAC;QACjF,OAAO,yBAAyB,CAAC;IACnC,CAAC;IAED,yEAAyE;IACjE,gBAAgB;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,cAAc;YAAE,OAAO,eAAe,CAAC;QAC9F,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,GAAG,IAAI,CAAC,gBAAgB,EAAE,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,CACpF,MAAM,CACP,KAAK,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,kBAAkB,EAAE,EAAE,EACrI,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAC/C,CAAC;QACF,6EAA6E;QAC7E,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,IAAI,CAAC,CAAC;QACxE,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,GAAG,IAAI,CAAC,gBAAgB,EAAE,SAAS,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,IAAI,CAAC,GAAG,CACvE,IAAI,CACL,KAAK,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,kBAAkB,EAAE,EAAE,EAC1J,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAC/C,CAAC;QACF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,IAAI,CAAC,CAAC;QAC9E,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,IAAY;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACvC,UAAU,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,GAAG,CAC1E,MAAM,CACP,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EACjB,CAAC,IAAI,CAAC,CACP,CAA0B,CAAC;QAC5B,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACzC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACvC,UAAU,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU,IAAI,CAAC,GAAG,CAChF,MAAM,CACP,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EACjB,CAAC,IAAI,CAAC,CACP,CAA0B,CAAC;QAC5B,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACrB,CAAC;IAED,4BAA4B;IAE5B,kFAAkF;IAClF,KAAK,CAAC,oBAAoB,CAAC,QAAgB,EAAE,cAAsB;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,GAAG,IAAI,CAAC,gBAAgB,EAAE,SAAS,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,IAAI,CAAC,GAAG,CAC1E,QAAQ,CACT,KAAK,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,kBAAkB,EAAE,EAAE,EAC/F,CAAC,MAAM,EAAE,YAAY,CAAC,CACvB,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,wBAAwB,CAAC,QAAgB,EAAE,cAAsB;QACrE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY;YAAE,OAAO;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,eAAe,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,UAAU,IAAI,CAAC,GAAG,CAC3D,QAAQ,CACT,MAAM,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAC/D,CAAC,MAAM,EAAE,YAAY,CAAC,CACvB,CAAC;IACJ,CAAC;IAED,sBAAsB;IAEtB;;;;;;;OAOG;IACH,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB,EAAE,KAAmB;QACnE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAQ,IAAI,aAAa,CAAC;QAClD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,GAAG,IAAI,CAAC,gBAAgB,EAAE,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,CACpE,UAAU,CACX,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,kBAAkB,EAAE,EAAE,EACnK,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAC7B,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,IAAa,EAAE,QAAgB,EAAE,KAAmB;QACnE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAQ,IAAI,aAAa,CAAC;QAClD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,eAAe,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,GAAG,CAC/F,QAAQ,CACT,MAAM,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EACnG,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAC7B,CAAC;IACJ,CAAC;IAED,oDAAoD;IAEpD;;;;OAIG;IACH,KAAK,CAAC,kBAAkB,CAAC,IAAa,EAAE,cAAsB;QAC5D,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,GAAG,IAAI,CAAC,gBAAgB,EAAE,SAAS,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,KAAK,IAAI,CAAC,GAAG,CAC1E,UAAU,CACX,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,kBAAkB,EAAE,EAAE,EACnI,CAAC,IAAI,EAAE,EAAE,EAAE,YAAY,CAAC,CACzB,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,oBAAoB,CAAC,IAAa,EAAE,cAAsB;QAC9D,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACjE,IAAI,CAAC,YAAY;YAAE,OAAO;QAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACzB,eAAe,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,UAAU,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,GAAG,CACrG,QAAQ,CACT,MAAM,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAC/D,CAAC,IAAI,EAAE,EAAE,EAAE,YAAY,CAAC,CACzB,CAAC;IACJ,CAAC;IAED,kBAAkB;IAElB;;;;;OAKG;IACK,YAAY,CAAC,KAAa,EAAE,KAA8B,EAAE,CAAe;QACjF,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAQ,IAAI,aAAa,CAAC;QAClD,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;YAC/B,OAAO,QAAQ,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/D,CAAC;QACD,2CAA2C;QAC3C,OAAO,SAAS,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,IAAI,CAAC,GAAG,CACjF,UAAU,CACX,MAAM,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC;IACrB,CAAC;IAED,qFAAqF;IAC7E,YAAY,CAAC,KAA8B;QACjD,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAQ,IAAI,aAAa,CAAC;QAClD,OAAO,QAAQ,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAClF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,IAAa,EAAE,KAAmB;QACtD,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CACvC,YAAY,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;cACpB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;cACtB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;kBACnE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,QAAQ,WAAW,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,MAAM,GAAG,MAAM,EAAE,EAClG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CACxC,CAA4B,CAAC;QAC9B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,qBAAqB,CAAC,IAAa,EAAE,KAAmB;QAC5D,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAE5C,+BAA+B;QAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAC3C,qBAAqB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;cAC7B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;cACtB,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,GAAG,CACjF,QAAQ,CACT;cACM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;kBAC/E,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,SAAS,WAAW,IAAI,CAAC,GAAG,CAC/D,QAAQ,CACT,MAAM,OAAO,GAAG,OAAO,EAAE,EAC3B,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CACxC,CAA4B,CAAC;QAE9B,qCAAqC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAC7C,qBAAqB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;cAC7B,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;cAC5B,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;kBAC/E,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,WAAW,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,EAC7F,CAAC,IAAI,EAAE,EAAE,CAAC,CACX,CAA4B,CAAC;QAE9B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,QAAQ;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,KAAK,MAAM,GAAG,IAAI,UAAU;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;IAClB,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,YAAY,CAAC,IAAa,EAAE,KAAmB;QACnD,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC;YACjC,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC;SACxC,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAChC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB,CACrB,IAAa,EACb,UAAkB,EAClB,KAAmB;QAEnB,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAE5C,4BAA4B;QAC5B,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAC3C;cACQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;cACtB,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,aAAa,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,GAAG,CACjF,QAAQ,CACT;cACM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;kBAC/E,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,SAAS,WAAW,IAAI,CAAC,GAAG,CAC/D,QAAQ,CACT,MAAM,OAAO,UAAU,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,GAAG,OAAO;eACrD,EACT,CAAC,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CACpD,CAAc,CAAC;QAChB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAErC,eAAe;QACf,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAC7C;cACQ,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;cAC5B,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;kBAC/E,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,WAAW,IAAI,CAAC,GAAG,CAC/D,QAAQ,CACT,MAAM,EAAE,CAAC,IAAI,EAAE,UAAU,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;eACjD,EACT,CAAC,IAAI,EAAE,EAAE,EAAE,UAAU,CAAC,CACvB,CAAc,CAAC;QAChB,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/B,CAAC;CACF"}

package/dist/types.d.ts

@@ -4,17 +4,18 @@ export interface TableNames {
     permissions?: string;
     rolePermission?: string;
     userRole?: string;
+    /** Direct user→permission pivot (post-v1). Defaults to `authz_user_permission`. */
+    userPermission?: string;
 }
-/**
- * A reference to a user. Matches nestjs-context's `UserRef` shape (`{ type, id }`),
- * but the store accepts either a full ref or a bare id (defaulting `type` to `'user'`).
- */
-export interface UserRefInput {
-    type?: string;
-    id: string | number;
+/** Optional tenant scope for a user-role assignment / role-or-permission query. */
+export interface TenantScope {
+    /**
+     * Restrict a role assignment (or a query) to this tenant. Omitted/undefined →
+     * the GLOBAL scope (an assignment applies in every tenant; a query sees global
+     * assignments only — a tenant-scoped role does NOT leak into an unscoped check).
+     */
+    tenantId?: string;
 }
-/** A user reference, or just its id (treated as `{ type: 'user', id }`). */
-export type UserRef = UserRefInput | string | number;
 export interface AuthzStoreOptions {
     /** BYO table names; each defaults to the matching {@link DEFAULT_TABLE_NAMES} entry. */
     tableNames?: TableNames;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;CACrB;AAED,4EAA4E;AAC5E,MAAM,MAAM,OAAO,GAAG,YAAY,GAAG,MAAM,GAAG,MAAM,CAAC;AAErD,MAAM,WAAW,iBAAiB;IAChC,wFAAwF;IACxF,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,wFAAwF;IACxF,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB"}