@dudousxd/nestjs-authz-typeorm 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # @dudousxd/nestjs-authz-typeorm
 
+## 0.7.0
+
+### Minor Changes
+
+- Back on the 0.x line. The 1.x and 2.x versions were published by accident: a release-tooling peer cascade bumped this package to a major, not an API decision. 0.7.0 contains everything those versions shipped (console `authorize` support, tenancy, Node 24+ `engines`) with no other change. Upgrade from 1.x/2.x to 0.7.0; those versions are deprecated.
+
+## 2.0.0
+
+### Major Changes
+
+- [#74](https://github.com/DavideCarvalho/nestjs-authz/pull/74) [`35421dc`](https://github.com/DavideCarvalho/nestjs-authz/commit/35421dc5b09bd271d5087d26e8536191ef6ba342) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - **Breaking:** require Node.js 24 or newer (`engines.node` is now `>=24`; it was `>=22`, and `>=20` for `-client` and `-react`). CI tests on Node 24 and 26. No API changes: see the Upgrading page in the docs.
+
+## 1.1.0
+
+### Minor Changes
+
+- [#72](https://github.com/DavideCarvalho/nestjs-authz/pull/72) [`58a5d72`](https://github.com/DavideCarvalho/nestjs-authz/commit/58a5d72d2964a7cfae9cbfe8506526c8518ba30a) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Tenancy for the RBAC modules, following the `@dudousxd/nestjs-context` tenancy switch.
+
+  - New `tenancy` option (`'inherit' | false | { enabled?, kinds?, nullRows?, roles? }`, default `'inherit'`). With context tenancy on, permission and role checks are scoped to the request's tenant from `Context.setTenant`. A request with no tenant, inside `Context.allTenants()`, or outside a request sees global assignments only. `kinds` limits the tenant kinds this module honours. With tenancy off nothing changes.
+  - `tenancy.roles` maps the caller's role inside the tenant (`tenant.role`) to authz roles that apply in that tenant only, e.g. `{ owner: 'org_admin' }`.
+  - New `tenant` resolver option, `(user) => tenantId | null | undefined`: an explicit tenant that wins over the context.
+  - MikroORM and Prisma can now store tenant-scoped role assignments like Drizzle and TypeORM: `assignRole`, `removeRole` and `setUserRoles` take `{ tenantId }`, and the read methods take a tenant scope. MikroORM: build the entities with `createAuthzEntitySchemas({}, { tenantScoped: true })`. Prisma: add `tenantId String @default("")` to `UserRole` and its `@@id`, then pass `tenantScoped: true`. Without that, every assignment stays global.
+
+## 1.0.0
+
+### Patch Changes
+
+- Updated dependencies [[`750a6b3`](https://github.com/DavideCarvalho/nestjs-authz/commit/750a6b3f80deea3803dec8df5f9f8cf67a046ac1)]:
+  - @dudousxd/nestjs-authz@0.10.0
+
 ## 0.6.0
 
 ### Minor Changes

package/README.md

@@ -79,6 +79,32 @@ The user is the one the official guard reads (`AuthorizationModule.forRoot({ get
 default `request.user`), mapped to a store ref with `userRefFrom` (default `{ type, id }` or
 `{ id }`).
 
+## Tenancy
+
+With `@dudousxd/nestjs-context` installed, the module reads the current tenant from the context
+accessor (`Context.tenantId()`). A tenant-scoped role then grants only inside its own tenant.
+Global roles and direct grants apply everywhere.
+
+With tenancy on (`ContextModule.forRoot({ tenancy: { enabled: true } })` in
+`@dudousxd/nestjs-context`), checks are scoped to the request's tenant from `Context.setTenant(...)`.
+A request with no tenant, or inside `Context.allTenants()`, sees global assignments only.
+
+```ts
+AuthzRbacModule.forRoot({
+  connectionName: 'default',
+  tenancy: {
+    kinds: ['organization'],                  // optional: tenant kinds this module honours
+    roles: { owner: 'org_admin', member: 'org_member' }, // optional: tenant.role → authz roles in that tenant
+  },
+  tenant: (user) => (user as { orgId?: string }).orgId, // optional: an explicit tenant wins over the context
+});
+```
+
+`tenancy` defaults to `'inherit'` (follow the context switch); `false` keeps this module out.
+Roles mapped with `roles` apply only inside that tenant and only to the context's current user.
+The `tenant` resolver returns a tenant id, `null` for the global scope, or `undefined` to fall
+back to the context.
+
 ## Query scopes
 
 ```ts

package/dist/authz-rbac.module.d.ts

@@ -1,5 +1,6 @@
 import type { UserRef } from '@dudousxd/nestjs-authz/store-kit';
 import { type DynamicModule } from '@nestjs/common';
+import { type AuthzTenancyOption, type TenantResolver } from './tenancy.js';
 import { TypeOrmAuthzStore } from './typeorm-authz.store.js';
 import type { AuthzStoreOptions } from './types.js';
 /** Injection token holding the {@link TypeOrmAuthzStore} the RBAC module manages. */
@@ -22,6 +23,17 @@ export interface AuthzRbacModuleBaseOptions {
      * {@link defaultUserRefMapper} (`{ type, id }` or `{ id }`).
      */
     userRefFrom?: UserRefMapper;
+    /**
+     * Tenancy, from `@dudousxd/nestjs-context`. `'inherit'` (default) follows `ContextModule`'s
+     * `tenancy.enabled`; with it on, checks are scoped to the context tenant. The object form adds
+     * `kinds` and `roles` (map the caller's `tenant.role` to authz roles in that tenant).
+     */
+    tenancy?: AuthzTenancyOption;
+    /**
+     * Explicit tenant for a check, from the user being checked. Wins over the context: return a
+     * tenant id, `null` for the global scope, or `undefined` to fall back to the context.
+     */
+    tenant?: TenantResolver;
 }
 /**
  * Where the store comes from: build it yourself (`store`), or name a TypeORM connection

package/dist/authz-rbac.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authz-rbac.module.d.ts","sourceRoot":"","sources":["../src/authz-rbac.module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EACL,KAAK,aAAa,EAQnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,qFAAqF;AACrF,eAAO,MAAM,gBAAgB,eAAqD,CAAC;AACnF,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,eAAuD,CAAC;AAEvF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,GAAG,SAAS,CAAC;AAEnE,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,WAAW,CAAC,EAAE,aAAa,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG,0BAA0B,GAC7D,CACI;IACE,sEAAsE;IACtE,KAAK,EAAE,iBAAiB,CAAC;IACzB,cAAc,CAAC,EAAE,KAAK,CAAC;IACvB,YAAY,CAAC,EAAE,KAAK,CAAC;CACtB,GACD;IACE,kGAAkG;IAClG,cAAc,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,CACJ,CAAC;AAKJ,MAAM,MAAM,2BAA2B,GACnC;IACE,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,UAAU,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,sBAAsB,CAAC,GAAG,sBAAsB,CAAC;IAC7F,cAAc,CAAC,EAAE,KAAK,CAAC;IACvB,YAAY,CAAC,EAAE,KAAK,CAAC;CACtB,GACD;IACE,qGAAqG;IACrG,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,UAAU,CAAC,EAAE,CACX,GAAG,IAAI,EAAE,OAAO,EAAE,KACf,OAAO,CAAC,0BAA0B,CAAC,GAAG,0BAA0B,CAAC;CACvE,CAAC;AA2EN,qFAAqF;AACrF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAOvE;AAkGD;;;;;;;GAOG;AACH,qBACa,eAAe;IAC1B,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa;IAqB9D,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,2BAA2B,GAAG,aAAa;IA0CxE,OAAO,CAAC,MAAM,CAAC,eAAe;CAc/B"}
+{"version":3,"file":"authz-rbac.module.d.ts","sourceRoot":"","sources":["../src/authz-rbac.module.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EACL,KAAK,aAAa,EAQnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,KAAK,kBAAkB,EAGvB,KAAK,cAAc,EAEpB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,qFAAqF;AACrF,eAAO,MAAM,gBAAgB,eAAqD,CAAC;AACnF,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,eAAuD,CAAC;AAEvF;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,GAAG,SAAS,CAAC;AAEnE,MAAM,WAAW,0BAA0B;IACzC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,WAAW,CAAC,EAAE,aAAa,CAAC;IAC5B;;;;OAIG;IACH,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B;;;OAGG;IACH,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG,0BAA0B,GAC7D,CACI;IACE,sEAAsE;IACtE,KAAK,EAAE,iBAAiB,CAAC;IACzB,cAAc,CAAC,EAAE,KAAK,CAAC;IACvB,YAAY,CAAC,EAAE,KAAK,CAAC;CACtB,GACD;IACE,kGAAkG;IAClG,cAAc,EAAE,MAAM,CAAC;IACvB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,CACJ,CAAC;AAKJ,MAAM,MAAM,2BAA2B,GACnC;IACE,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,UAAU,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,sBAAsB,CAAC,GAAG,sBAAsB,CAAC;IAC7F,cAAc,CAAC,EAAE,KAAK,CAAC;IACvB,YAAY,CAAC,EAAE,KAAK,CAAC;CACtB,GACD;IACE,qGAAqG;IACrG,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,UAAU,CAAC,EAAE,CACX,GAAG,IAAI,EAAE,OAAO,EAAE,KACf,OAAO,CAAC,0BAA0B,CAAC,GAAG,0BAA0B,CAAC;CACvE,CAAC;AA6BN,qFAAqF;AACrF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAOvE;AA4HD;;;;;;;GAOG;AACH,qBACa,eAAe;IAC1B,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,sBAAsB,GAAG,aAAa;IAqB9D,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,2BAA2B,GAAG,aAAa;IA0CxE,OAAO,CAAC,MAAM,CAAC,eAAe;CAc/B"}

package/dist/authz-rbac.module.js

@@ -15,6 +15,7 @@ import { createRequire } from 'node:module';
 import { CONTEXT_ACCESSOR, PERMISSION_PROVIDER, ROLE_PROVIDER, } from '@dudousxd/nestjs-authz';
 import { Inject, Injectable, Module, Optional, } from '@nestjs/common';
 import { ModuleRef } from '@nestjs/core';
+import { rbacTenant, } from './tenancy.js';
 import { TypeOrmAuthzStore } from './typeorm-authz.store.js';
 /** Injection token holding the {@link TypeOrmAuthzStore} the RBAC module manages. */
 export const AUTHZ_RBAC_STORE = Symbol.for('@dudousxd/nestjs-authz-typeorm:store');
@@ -42,42 +43,6 @@ function connectionToken(name) {
     }
     return official.getDataSourceToken(name);
 }
-/** Read the current tenant from the (optional) context accessor, defensively. */
-function tenantScopeFrom(context) {
-    if (!context || typeof context.tenantId !== 'function')
-        return {};
-    let tenantId;
-    try {
-        tenantId = context.tenantId();
-    }
-    catch {
-        tenantId = undefined;
-    }
-    return tenantId == null ? {} : { tenantId };
-}
-/**
- * Locate the context accessor for tenant scoping. Prefers a value injected into
- * this module; falls back to a non-strict {@link ModuleRef} lookup so an accessor
- * provided by ANY module (the app root, a global ContextModule) is still found —
- * the RBAC module is global and its providers don't import the app's modules, so a
- * plain `@Inject` would miss a root-provided accessor. Mirrors the Gate's seam.
- */
-function resolveTenantContext(injected, moduleRef, cache) {
-    if (injected)
-        return injected;
-    if (cache.resolved)
-        return cache.value;
-    cache.resolved = true;
-    if (moduleRef) {
-        try {
-            cache.value = moduleRef.get(CONTEXT_ACCESSOR, { strict: false });
-        }
-        catch {
-            cache.value = undefined;
-        }
-    }
-    return cache.value;
-}
 /** Default mapping: accept a `{ type, id }` ref, a `{ id }` object, or a bare id. */
 export function defaultUserRefMapper(user) {
     if (user == null)
@@ -110,8 +75,14 @@ let RbacPermissionProvider = class RbacPermissionProvider {
         this.context = context;
         this.moduleRef = moduleRef;
     }
-    scope() {
-        return tenantScopeFrom(resolveTenantContext(this.context, this.moduleRef, this.contextCache));
+    tenant(user, ref) {
+        return rbacTenant(this.options, user, ref, this.context, this.moduleRef, this.contextCache, true);
+    }
+    /** The permissions `tenancy.roles` grants through the caller's role in the tenant. */
+    async tenantRolePermissions(roles) {
+        if (roles.length === 0)
+            return [];
+        return Object.values(await this.options.store.getRolePermissions(roles)).flat();
     }
     // The core `PermissionProvider` interface passes an optional `resource` (3rd
     // arg); it is intentionally ignored here. RBAC grants are model-less,
@@ -124,7 +95,10 @@ let RbacPermissionProvider = class RbacPermissionProvider {
         const ref = map(user);
         if (ref === undefined)
             return undefined;
-        return this.options.store.userHasPermission(ref, permission, this.scope());
+        const tenant = this.tenant(user, ref);
+        if (await this.options.store.userHasPermission(ref, permission, tenant.scope))
+            return true;
+        return (await this.tenantRolePermissions(tenant.roles)).includes(permission);
     }
     // Expose the user's full granted permission set so the core can apply
     // Laravel/spatie-style wildcard matching (a granted `posts.*` satisfies a check
@@ -135,7 +109,11 @@ let RbacPermissionProvider = class RbacPermissionProvider {
         const ref = map(user);
         if (ref === undefined)
             return undefined;
-        return this.options.store.getPermissionsForUser(ref, this.scope());
+        const tenant = this.tenant(user, ref);
+        const own = await this.options.store.getPermissionsForUser(ref, tenant.scope);
+        if (tenant.roles.length === 0)
+            return own;
+        return [...new Set([...own, ...(await this.tenantRolePermissions(tenant.roles))])];
     }
 };
 RbacPermissionProvider = __decorate([
@@ -170,10 +148,11 @@ let RbacRoleProvider = class RbacRoleProvider {
         const ref = map(user);
         if (ref === undefined)
             return undefined;
-        // Scope roles by the current tenant (when nestjs-context is present): a
-        // tenant-scoped role only counts within its tenant; global roles always count.
-        const scope = tenantScopeFrom(resolveTenantContext(this.context, this.moduleRef, this.contextCache));
-        return this.options.store.getRolesForUser(ref, scope);
+        // Scope roles by the current tenant: a tenant-scoped role only counts within its
+        // tenant; global roles always count. `tenancy.roles` adds the caller's tenant roles.
+        const tenant = rbacTenant(this.options, user, ref, this.context, this.moduleRef, this.contextCache, true);
+        const own = await this.options.store.getRolesForUser(ref, tenant.scope);
+        return tenant.roles.length === 0 ? own : [...new Set([...own, ...tenant.roles])];
     }
 };
 RbacRoleProvider = __decorate([

package/dist/authz-rbac.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"authz-rbac.module.js","sourceRoot":"","sources":["../src/authz-rbac.module.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EAEnB,aAAa,GAEd,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAEL,MAAM,EACN,UAAU,EACV,MAAM,EAEN,QAAQ,GAGT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAG7D,qFAAqF;AACrF,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;AACnF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;AAiEvF,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEnD;;;GAGG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,QAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,QAAQ,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,CAAE,KAA+B,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACvE,IACE,CAAC,IAAI,KAAK,kBAAkB,IAAI,IAAI,KAAK,sBAAsB,CAAC;YAChE,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EACrC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,iFAAiF;gBAC/E,2DAA2D,CAC9D,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC;AAWD,iFAAiF;AACjF,SAAS,eAAe,CAAC,OAA0C;IACjE,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,UAAU;QAAE,OAAO,EAAE,CAAC;IAClE,IAAI,QAA4B,CAAC;IACjC,IAAI,CAAC;QACH,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,SAAS,CAAC;IACvB,CAAC;IACD,OAAO,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAC3B,QAA2C,EAC3C,SAAgC,EAChC,KAAsE;IAEtE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC;IACvC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;IACtB,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC;YACH,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC,GAAG,CAAwB,gBAAgB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1F,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC;AACrB,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,oBAAoB,CAAC,IAAa;IAChD,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACtE,MAAM,CAAC,GAAG,IAAwC,CAAC;IACnD,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAqB,CAAC;IACnC,OAAO,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,IACM,sBAAsB,GAD5B,MACM,sBAAsB;IAUqB;IACU;IAC1B;IAX/B,iFAAiF;IACxE,qBAAqB,GAAG,IAAI,CAAC;IAErB,YAAY,GAAG;QAC9B,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,SAA8C;KACtD,CAAC;IAEF,YAC+C,OAA4B,EAClB,OAA+B,EACzD,SAAqB;QAFL,YAAO,GAAP,OAAO,CAAqB;QAClB,YAAO,GAAP,OAAO,CAAwB;QACzD,cAAS,GAAT,SAAS,CAAY;IACjD,CAAC;IAEI,KAAK;QACX,OAAO,eAAe,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAChG,CAAC;IAED,6EAA6E;IAC7E,sEAAsE;IACtE,yEAAyE;IACzE,gFAAgF;IAChF,8EAA8E;IAC9E,uEAAuE;IACvE,KAAK,CAAC,aAAa,CAAC,IAAa,EAAE,UAAkB;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,sEAAsE;IACtE,gFAAgF;IAChF,kFAAkF;IAClF,uEAAuE;IACvE,KAAK,CAAC,cAAc,CAAC,IAAa;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACrE,CAAC;CACF,CAAA;AA1CK,sBAAsB;IAD3B,UAAU,EAAE;IAWR,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;IAC1B,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,gBAAgB,CAAC,CAAA;IACpC,WAAA,QAAQ,EAAE,CAAA;qDAA8B,SAAS;GAZhD,sBAAsB,CA0C3B;AAED;;;;;GAKG;AACH,IACM,gBAAgB,GADtB,MACM,gBAAgB;IAO2B;IACU;IAC1B;IARd,YAAY,GAAG;QAC9B,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,SAA8C;KACtD,CAAC;IAEF,YAC+C,OAA4B,EAClB,OAA+B,EACzD,SAAqB;QAFL,YAAO,GAAP,OAAO,CAAqB;QAClB,YAAO,GAAP,OAAO,CAAwB;QACzD,cAAS,GAAT,SAAS,CAAY;IACjD,CAAC;IAEJ,KAAK,CAAC,QAAQ,CAAC,IAAa;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,wEAAwE;QACxE,+EAA+E;QAC/E,MAAM,KAAK,GAAG,eAAe,CAC3B,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CACtE,CAAC;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxD,CAAC;CACF,CAAA;AAvBK,gBAAgB;IADrB,UAAU,EAAE;IAQR,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;IAC1B,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,gBAAgB,CAAC,CAAA;IACpC,WAAA,QAAQ,EAAE,CAAA;qDAA8B,SAAS;GAThD,gBAAgB,CAuBrB;AAED,qFAAqF;AACrF,IACM,kBAAkB,GADxB,MACM,kBAAkB;IAEqC;IAD3D,YAC2D,OAA6B;QAA7B,YAAO,GAAP,OAAO,CAAsB;IACrF,CAAC;IAEJ,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,KAAK,KAAK;YAAE,OAAO;QACpD,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;IAC1C,CAAC;CACF,CAAA;AAVK,kBAAkB;IADvB,UAAU,EAAE;IAGR,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;;GAFrC,kBAAkB,CAUvB;AAED;;;;;;;GAOG;AAEI,IAAM,eAAe,uBAArB,MAAM,eAAe;IAC1B,MAAM,CAAC,OAAO,CAAC,OAA+B;QAC5C,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;QACjE,MAAM,eAAe,GACnB,cAAc,KAAK,SAAS;YAC1B,CAAC,CAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,EAAE;YAC/D,CAAC,CAAC;gBACE,OAAO,EAAE,kBAAkB;gBAC3B,UAAU,EAAE,CAAC,UAAiB,EAAuB,EAAE,CAAC,CAAC;oBACvD,GAAG,IAAI;oBACP,KAAK,EAAE,IAAI,iBAAiB,CAAC,UAAU,EAAE,YAAY,CAAC;iBACvD,CAAC;gBACF,MAAM,EAAE,CAAC,eAAe,CAAC,cAAc,CAAkB,CAAC;aAC3D,CAAC;QACR,OAAO;YACL,MAAM,EAAE,iBAAe;YACvB,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,CAAC,eAAe,EAAE,GAAG,iBAAe,CAAC,eAAe,EAAE,CAAC;YAClE,OAAO,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,OAAoC;QACtD,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAyB,CAAC;QAC9D,IAAI,eAAyB,CAAC;QAC9B,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACzC,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;YAC/B,eAAe,GAAG;gBAChB,OAAO,EAAE,kBAAkB;gBAC3B,UAAU,EAAE,KAAK,EAAE,GAAG,IAAe,EAAgC,EAAE;oBACrE,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;oBAC3C,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;wBAC1C,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;oBACJ,CAAC;oBACD,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC;oBAC1E,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC;gBAC5B,CAAC;gBACD,MAAM;aACP,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;YAC7C,eAAe,GAAG;gBAChB,OAAO,EAAE,kBAAkB;gBAC3B,UAAU,EAAE,KAAK,EACf,UAAiB,EACjB,GAAG,IAAe,EACY,EAAE,CAAC,CAAC;oBAClC,GAAG,CAAC,CAAC,MAAM,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;oBACxC,KAAK,EAAE,IAAI,iBAAiB,CAAC,UAAU,EAAE,YAAY,CAAC;iBACvD,CAAC;gBACF,MAAM,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,cAAc,CAAkB,EAAE,GAAG,MAAM,CAAC;aAC9E,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,iBAAe;YACvB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAoB;YACnD,SAAS,EAAE,CAAC,eAAe,EAAE,GAAG,iBAAe,CAAC,eAAe,EAAE,CAAC;YAClE,OAAO,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,CAAC;SAChE,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,eAAe;QAC5B,OAAO;YACL,sBAAsB;YACtB,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,sBAAsB,EAAE;YACrE,gBAAgB;YAChB,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,gBAAgB,EAAE;YACzD;gBACE,OAAO,EAAE,gBAAgB;gBACzB,UAAU,EAAE,CAAC,IAAyB,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK;gBACrD,MAAM,EAAE,CAAC,kBAAkB,CAAC;aAC7B;YACD,kBAAkB;SACnB,CAAC;IACJ,CAAC;CACF,CAAA;AA9EY,eAAe;IAD3B,MAAM,CAAC,EAAE,CAAC;GACE,eAAe,CA8E3B"}
+{"version":3,"file":"authz-rbac.module.js","sourceRoot":"","sources":["../src/authz-rbac.module.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EAEnB,aAAa,GAEd,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAEL,MAAM,EACN,UAAU,EACV,MAAM,EAEN,QAAQ,GAGT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAKL,UAAU,GACX,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAG7D,qFAAqF;AACrF,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;AACnF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;AA4EvF,MAAM,WAAW,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEnD;;;GAGG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,QAAwD,CAAC;IAC7D,IAAI,CAAC;QACH,QAAQ,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA4B,CAAC,IAAI,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,CAAE,KAA+B,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACvE,IACE,CAAC,IAAI,KAAK,kBAAkB,IAAI,IAAI,KAAK,sBAAsB,CAAC;YAChE,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EACrC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,iFAAiF;gBAC/E,2DAA2D,CAC9D,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,oBAAoB,CAAC,IAAa;IAChD,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACtE,MAAM,CAAC,GAAG,IAAwC,CAAC;IACnD,IAAI,CAAC,CAAC,EAAE,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAqB,CAAC;IACnC,OAAO,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,IACM,sBAAsB,GAD5B,MACM,sBAAsB;IAUqB;IACU;IAC1B;IAX/B,iFAAiF;IACxE,qBAAqB,GAAG,IAAI,CAAC;IAErB,YAAY,GAAG;QAC9B,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,SAA8C;KACtD,CAAC;IAEF,YAC+C,OAA4B,EAClB,OAA+B,EACzD,SAAqB;QAFL,YAAO,GAAP,OAAO,CAAqB;QAClB,YAAO,GAAP,OAAO,CAAwB;QACzD,cAAS,GAAT,SAAS,CAAY;IACjD,CAAC;IAEI,MAAM,CAAC,IAAa,EAAE,GAAY;QACxC,OAAO,UAAU,CACf,IAAI,CAAC,OAAO,EACZ,IAAI,EACJ,GAAG,EACH,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,YAAY,EACjB,IAAI,CACL,CAAC;IACJ,CAAC;IAED,sFAAsF;IAC9E,KAAK,CAAC,qBAAqB,CAAC,KAAe;QACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClF,CAAC;IAED,6EAA6E;IAC7E,sEAAsE;IACtE,yEAAyE;IACzE,gFAAgF;IAChF,8EAA8E;IAC9E,uEAAuE;IACvE,KAAK,CAAC,aAAa,CAAC,IAAa,EAAE,UAAkB;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACtC,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3F,OAAO,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC/E,CAAC;IAED,sEAAsE;IACtE,gFAAgF;IAChF,kFAAkF;IAClF,uEAAuE;IACvE,KAAK,CAAC,cAAc,CAAC,IAAa;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9E,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QAC1C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;CACF,CAAA;AA7DK,sBAAsB;IAD3B,UAAU,EAAE;IAWR,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;IAC1B,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,gBAAgB,CAAC,CAAA;IACpC,WAAA,QAAQ,EAAE,CAAA;qDAA8B,SAAS;GAZhD,sBAAsB,CA6D3B;AAED;;;;;GAKG;AACH,IACM,gBAAgB,GADtB,MACM,gBAAgB;IAO2B;IACU;IAC1B;IARd,YAAY,GAAG;QAC9B,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,SAA8C;KACtD,CAAC;IAEF,YAC+C,OAA4B,EAClB,OAA+B,EACzD,SAAqB;QAFL,YAAO,GAAP,OAAO,CAAqB;QAClB,YAAO,GAAP,OAAO,CAAwB;QACzD,cAAS,GAAT,SAAS,CAAY;IACjD,CAAC;IAEJ,KAAK,CAAC,QAAQ,CAAC,IAAa;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;QAC7D,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,iFAAiF;QACjF,qFAAqF;QACrF,MAAM,MAAM,GAAG,UAAU,CACvB,IAAI,CAAC,OAAO,EACZ,IAAI,EACJ,GAAG,EACH,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,YAAY,EACjB,IAAI,CACL,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACxE,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;CACF,CAAA;AA9BK,gBAAgB;IADrB,UAAU,EAAE;IAQR,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;IAC1B,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,gBAAgB,CAAC,CAAA;IACpC,WAAA,QAAQ,EAAE,CAAA;qDAA8B,SAAS;GAThD,gBAAgB,CA8BrB;AAED,qFAAqF;AACrF,IACM,kBAAkB,GADxB,MACM,kBAAkB;IAEqC;IAD3D,YAC2D,OAA6B;QAA7B,YAAO,GAAP,OAAO,CAAsB;IACrF,CAAC;IAEJ,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,gBAAgB,KAAK,KAAK;YAAE,OAAO;QACpD,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;IAC1C,CAAC;CACF,CAAA;AAVK,kBAAkB;IADvB,UAAU,EAAE;IAGR,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;;GAFrC,kBAAkB,CAUvB;AAED;;;;;;;GAOG;AAEI,IAAM,eAAe,uBAArB,MAAM,eAAe;IAC1B,MAAM,CAAC,OAAO,CAAC,OAA+B;QAC5C,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;QACjE,MAAM,eAAe,GACnB,cAAc,KAAK,SAAS;YAC1B,CAAC,CAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,EAAE;YAC/D,CAAC,CAAC;gBACE,OAAO,EAAE,kBAAkB;gBAC3B,UAAU,EAAE,CAAC,UAAiB,EAAuB,EAAE,CAAC,CAAC;oBACvD,GAAG,IAAI;oBACP,KAAK,EAAE,IAAI,iBAAiB,CAAC,UAAU,EAAE,YAAY,CAAC;iBACvD,CAAC;gBACF,MAAM,EAAE,CAAC,eAAe,CAAC,cAAc,CAAkB,CAAC;aAC3D,CAAC;QACR,OAAO;YACL,MAAM,EAAE,iBAAe;YACvB,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,CAAC,eAAe,EAAE,GAAG,iBAAe,CAAC,eAAe,EAAE,CAAC;YAClE,OAAO,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,OAAoC;QACtD,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAyB,CAAC;QAC9D,IAAI,eAAyB,CAAC;QAC9B,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACzC,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;YAC/B,eAAe,GAAG;gBAChB,OAAO,EAAE,kBAAkB;gBAC3B,UAAU,EAAE,KAAK,EAAE,GAAG,IAAe,EAAgC,EAAE;oBACrE,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;oBAC3C,IAAI,QAAQ,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;wBAC1C,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;oBACJ,CAAC;oBACD,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC;oBAC1E,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC;gBAC5B,CAAC;gBACD,MAAM;aACP,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;YAC7C,eAAe,GAAG;gBAChB,OAAO,EAAE,kBAAkB;gBAC3B,UAAU,EAAE,KAAK,EACf,UAAiB,EACjB,GAAG,IAAe,EACY,EAAE,CAAC,CAAC;oBAClC,GAAG,CAAC,CAAC,MAAM,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;oBACxC,KAAK,EAAE,IAAI,iBAAiB,CAAC,UAAU,EAAE,YAAY,CAAC;iBACvD,CAAC;gBACF,MAAM,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,cAAc,CAAkB,EAAE,GAAG,MAAM,CAAC;aAC9E,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,iBAAe;YACvB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAoB;YACnD,SAAS,EAAE,CAAC,eAAe,EAAE,GAAG,iBAAe,CAAC,eAAe,EAAE,CAAC;YAClE,OAAO,EAAE,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,aAAa,CAAC;SAChE,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,eAAe;QAC5B,OAAO;YACL,sBAAsB;YACtB,EAAE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,sBAAsB,EAAE;YACrE,gBAAgB;YAChB,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,gBAAgB,EAAE;YACzD;gBACE,OAAO,EAAE,gBAAgB;gBACzB,UAAU,EAAE,CAAC,IAAyB,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK;gBACrD,MAAM,EAAE,CAAC,kBAAkB,CAAC;aAC7B;YACD,kBAAkB;SACnB,CAAC;IACJ,CAAC;CACF,CAAA;AA9EY,eAAe;IAD3B,MAAM,CAAC,EAAE,CAAC;GACE,eAAe,CA8E3B"}

package/dist/index.d.ts

@@ -5,6 +5,7 @@ export type { RoleAssignment, RoleAssignmentFilter, UserAuthz, UserRoleAssignmen
 export { AUTHZ_RBAC_OPTIONS, AUTHZ_RBAC_STORE, AuthzRbacModule, defaultUserRefMapper, } from './authz-rbac.module.js';
 export type { AuthzRbacModuleAsyncOptions, AuthzRbacModuleBaseOptions, AuthzRbacModuleOptions, UserRefMapper, } from './authz-rbac.module.js';
 export type { AuthzStoreOptions, RoleAssignmentScope, TableNames, TenantScope } from './types.js';
+export type { AuthzTenancyOption, TenantResolver } from './tenancy.js';
 export type { UserRef, UserRefInput } from '@dudousxd/nestjs-authz/store-kit';
 export { applyScope, applyScopeConstraint, compileScope } from './scope.js';
 export type { CompiledScope, ScopeResolver } from './scope.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,SAAS,EACT,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,2BAA2B,EAC3B,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAClG,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC5E,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,YAAY,EACV,cAAc,EACd,oBAAoB,EACpB,SAAS,EACT,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,2BAA2B,EAC3B,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,GACd,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAClG,YAAY,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACvE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC5E,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAO7D,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAShC,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,UAAU,EACV,oBAAoB,EACpB,oBAAoB,EACpB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAO7D,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAUhC,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC"}

package/dist/tenancy.d.ts

@@ -0,0 +1,100 @@
+import { type UserRef } from '@dudousxd/nestjs-authz/store-kit';
+import type { ModuleRef } from '@nestjs/core';
+/** A tenant as published by `@dudousxd/nestjs-context` (`Context.tenant()`). */
+export interface TenantRef {
+    id: string;
+    kind: string;
+    source: string;
+    slug?: string;
+    role?: string;
+}
+/** How the context says a lib must scope data right now (`Context.tenantFilter()`). */
+export type TenantFilter = {
+    mode: 'system';
+} | {
+    mode: 'all';
+} | {
+    mode: 'tenantless';
+} | {
+    mode: 'tenant';
+    tenant: TenantRef;
+};
+/**
+ * The RBAC module's `tenancy` option. `'inherit'` (default) follows `ContextModule`'s
+ * `tenancy.enabled`; `false` keeps this module out of tenancy.
+ */
+export type AuthzTenancyOption = 'inherit' | false | {
+    /** `'inherit'` (default) follows the context switch; a boolean overrides it. */
+    enabled?: 'inherit' | boolean;
+    /** Tenant kinds this module honours, instead of the context's `kinds`. */
+    kinds?: string[];
+    /**
+     * Accepted for the shared shape. It changes nothing here: a GLOBAL role assignment
+     * always applies, in every tenant.
+     */
+    nullRows?: 'tenantless' | 'shared';
+    /**
+     * Map the caller's role inside the context tenant (`tenant.role`) to authz roles that
+     * apply in that tenant's scope only, e.g. `{ owner: 'org_admin', member: 'org_member' }`.
+     * Unmapped roles grant nothing.
+     */
+    roles?: Record<string, string | readonly string[]>;
+};
+/**
+ * An explicit tenant for a check, from the user being checked. Return a tenant id to scope the
+ * check to it, `null` for the global scope, or `undefined` to fall back to the context.
+ */
+export type TenantResolver = (user: unknown) => string | null | undefined;
+/** The structural slice of nestjs-context's accessor this module reads. */
+export interface TenantContextAccessor {
+    tenantId?(): string | undefined;
+    userRef?(): {
+        type?: string;
+        id: string | number;
+    } | undefined;
+    tenancy?(): {
+        enabled: boolean;
+        kinds?: string[];
+    };
+    tenantFilter?(options?: {
+        kinds?: string[];
+    }): TenantFilter;
+}
+/** The tenant scope of one check, plus the roles `tenancy.roles` adds in that scope. */
+export interface RbacTenant {
+    scope: {
+        tenantId?: string;
+    };
+    roles: string[];
+}
+export interface ResolveRbacTenantInput {
+    /** The user as the Gate passed it. */
+    user: unknown;
+    /** The same user mapped to a store ref. */
+    ref: UserRef;
+    /** The module's explicit `tenant` resolver, if any. */
+    resolver?: TenantResolver | undefined;
+    /** The module's `tenancy` option. */
+    tenancy?: AuthzTenancyOption | undefined;
+    /** The context accessor found through DI, if any (else the global slot is read). */
+    accessor?: TenantContextAccessor | undefined;
+    /** With tenancy off, scope by the context's plain `tenantId()` (drizzle/typeorm behaviour). */
+    legacyContextTenant: boolean;
+}
+/**
+ * Precedence: the explicit `tenant` resolver, then (tenancy on) the context tenant filter, then
+ * (tenancy off) the adapter's behaviour without tenancy. `tenant` mode scopes to that tenant;
+ * `tenantless`, `all` and `system` use the global scope.
+ */
+export declare function resolveRbacTenant(input: ResolveRbacTenantInput): RbacTenant;
+/** A provider's per-instance cache for {@link rbacTenant}'s accessor lookup. */
+export interface TenantContextCache {
+    resolved: boolean;
+    value: TenantContextAccessor | undefined;
+}
+/** The tenant scope (and `tenancy.roles` roles) of one check for `user`. */
+export declare function rbacTenant(options: {
+    tenant?: TenantResolver | undefined;
+    tenancy?: AuthzTenancyOption | undefined;
+}, user: unknown, ref: UserRef, injected: TenantContextAccessor | undefined, moduleRef: ModuleRef | undefined, cache: TenantContextCache, legacyContextTenant: boolean): RbacTenant;
+//# sourceMappingURL=tenancy.d.ts.map

package/dist/tenancy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenancy.d.ts","sourceRoot":"","sources":["../src/tenancy.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,OAAO,EAAoB,MAAM,kCAAkC,CAAC;AAClF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,gFAAgF;AAChF,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,uFAAuF;AACvF,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,GACf;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,GACtB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAE1C;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAC1B,SAAS,GACT,KAAK,GACL;IACE,gFAAgF;IAChF,OAAO,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC;IAC9B,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,YAAY,GAAG,QAAQ,CAAC;IACnC;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC,CAAC;CACpD,CAAC;AAEN;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;AAE1E,2EAA2E;AAC3E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,MAAM,GAAG,SAAS,CAAC;IAChC,OAAO,CAAC,IAAI;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAC/D,OAAO,CAAC,IAAI;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACnD,YAAY,CAAC,CAAC,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,YAAY,CAAC;CAC7D;AAyDD,wFAAwF;AACxF,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,sCAAsC;IACtC,IAAI,EAAE,OAAO,CAAC;IACd,2CAA2C;IAC3C,GAAG,EAAE,OAAO,CAAC;IACb,uDAAuD;IACvD,QAAQ,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IACtC,qCAAqC;IACrC,OAAO,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IACzC,oFAAoF;IACpF,QAAQ,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC7C,+FAA+F;IAC/F,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,UAAU,CAgC3E;AA0BD,gFAAgF;AAChF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE,qBAAqB,GAAG,SAAS,CAAC;CAC1C;AAED,4EAA4E;AAC5E,wBAAgB,UAAU,CACxB,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAA;CAAE,EAC1F,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,qBAAqB,GAAG,SAAS,EAC3C,SAAS,EAAE,SAAS,GAAG,SAAS,EAChC,KAAK,EAAE,kBAAkB,EACzB,mBAAmB,EAAE,OAAO,GAC3B,UAAU,CASZ"}

package/dist/tenancy.js

@@ -0,0 +1,128 @@
+// Tenancy for the RBAC module: which tenant scope a permission/role check runs in, and which
+// roles the caller's role inside the context tenant maps to. The same file ships in every
+// store adapter. It reads the @dudousxd/nestjs-context tenancy contract STRUCTURALLY (no import),
+// so it works with any context version, and with none: a missing or older context reads as
+// tenancy off.
+import { CONTEXT_ACCESSOR } from '@dudousxd/nestjs-authz';
+import { normalizeUserRef } from '@dudousxd/nestjs-authz/store-kit';
+const SLOT = Symbol.for('@dudousxd/nestjs-diagnostics:accessor');
+/** Is tenancy on for this module? Call per check: the context can change between requests. */
+function readTenancy(option, a) {
+    if (option === false)
+        return { enabled: false };
+    if (typeof a?.tenancy !== 'function' || typeof a.tenantFilter !== 'function') {
+        return { enabled: false };
+    }
+    const own = typeof option === 'object' ? option : {};
+    const inherit = own.enabled === undefined || own.enabled === 'inherit';
+    if (!(inherit ? a.tenancy().enabled : own.enabled))
+        return { enabled: false };
+    const kinds = own.kinds;
+    const tenantFilter = a.tenantFilter.bind(a);
+    return { enabled: true, filter: () => tenantFilter(kinds ? { kinds } : undefined) };
+}
+/** The accessor found through DI, else the global slot `ContextModule` publishes. */
+function effectiveAccessor(injected) {
+    if (injected)
+        return injected;
+    const slot = globalThis[SLOT];
+    const current = slot?.current;
+    return current && typeof current === 'object' ? current : undefined;
+}
+/** Today's behaviour without tenancy: the context's plain `tenantId()`, read defensively. */
+function legacyTenantId(accessor) {
+    if (!accessor || typeof accessor.tenantId !== 'function')
+        return undefined;
+    try {
+        return accessor.tenantId() ?? undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Is `ref` the context's current user? Tenant roles belong to the caller, nobody else. */
+function isContextUser(ref, accessor) {
+    let current;
+    try {
+        current = accessor?.userRef?.();
+    }
+    catch {
+        current = undefined;
+    }
+    if (!current || current.id === undefined || current.id === null)
+        return false;
+    const a = normalizeUserRef(ref);
+    const b = normalizeUserRef(current);
+    return a.type === b.type && a.id === b.id;
+}
+/**
+ * Precedence: the explicit `tenant` resolver, then (tenancy on) the context tenant filter, then
+ * (tenancy off) the adapter's behaviour without tenancy. `tenant` mode scopes to that tenant;
+ * `tenantless`, `all` and `system` use the global scope.
+ */
+export function resolveRbacTenant(input) {
+    const explicit = input.resolver ? input.resolver(input.user) : undefined;
+    const accessor = effectiveAccessor(input.accessor);
+    const tenancy = readTenancy(input.tenancy, accessor);
+    const filter = tenancy.enabled ? tenancy.filter() : undefined;
+    let scope;
+    if (explicit !== undefined) {
+        scope = explicit === null ? {} : { tenantId: explicit };
+    }
+    else if (filter) {
+        scope = filter.mode === 'tenant' ? { tenantId: filter.tenant.id } : {};
+    }
+    else if (input.legacyContextTenant) {
+        const id = legacyTenantId(input.accessor);
+        scope = id === undefined ? {} : { tenantId: id };
+    }
+    else {
+        scope = {};
+    }
+    const map = typeof input.tenancy === 'object' ? input.tenancy.roles : undefined;
+    let roles = [];
+    if (map &&
+        filter?.mode === 'tenant' &&
+        filter.tenant.role !== undefined &&
+        scope.tenantId === filter.tenant.id &&
+        Object.prototype.hasOwnProperty.call(map, filter.tenant.role) &&
+        isContextUser(input.ref, accessor)) {
+        const mapped = map[filter.tenant.role];
+        roles = typeof mapped === 'string' ? [mapped] : [...(mapped ?? [])];
+    }
+    return { scope, roles };
+}
+/**
+ * Locate the context accessor. Prefers a value injected into the module; falls back to a
+ * non-strict {@link ModuleRef} lookup so an accessor provided by ANY module (the app root, a
+ * global ContextModule) is still found: the RBAC module is global and its providers don't import
+ * the app's modules, so a plain `@Inject` would miss a root-provided accessor.
+ */
+function resolveTenantContext(injected, moduleRef, cache) {
+    if (injected)
+        return injected;
+    if (cache.resolved)
+        return cache.value;
+    cache.resolved = true;
+    if (moduleRef) {
+        try {
+            cache.value = moduleRef.get(CONTEXT_ACCESSOR, { strict: false });
+        }
+        catch {
+            cache.value = undefined;
+        }
+    }
+    return cache.value;
+}
+/** The tenant scope (and `tenancy.roles` roles) of one check for `user`. */
+export function rbacTenant(options, user, ref, injected, moduleRef, cache, legacyContextTenant) {
+    return resolveRbacTenant({
+        user,
+        ref,
+        resolver: options.tenant,
+        tenancy: options.tenancy,
+        accessor: resolveTenantContext(injected, moduleRef, cache),
+        legacyContextTenant,
+    });
+}
+//# sourceMappingURL=tenancy.js.map

package/dist/tenancy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenancy.js","sourceRoot":"","sources":["../src/tenancy.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,0FAA0F;AAC1F,kGAAkG;AAClG,2FAA2F;AAC3F,eAAe;AACf,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAgB,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AA0DlF,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;AAIjE,8FAA8F;AAC9F,SAAS,WAAW,CAClB,MAAsC,EACtC,CAAoC;IAEpC,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAChD,IAAI,OAAO,CAAC,EAAE,OAAO,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;QAC7E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC;IACvE,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9E,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACxB,MAAM,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;AACtF,CAAC;AAED,qFAAqF;AACrF,SAAS,iBAAiB,CACxB,QAA2C;IAE3C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,IAAI,GAAI,UAA2E,CAAC,IAAI,CAAC,CAAC;IAChG,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC;IAC9B,OAAO,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAE,OAAiC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjG,CAAC;AAED,6FAA6F;AAC7F,SAAS,cAAc,CAAC,QAA2C;IACjE,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,CAAC,QAAQ,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IAC3E,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,EAAE,IAAI,SAAS,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,SAAS,aAAa,CAAC,GAAY,EAAE,QAA2C;IAC9E,IAAI,OAA2D,CAAC;IAChE,IAAI,CAAC;QACH,OAAO,GAAG,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,SAAS,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,IAAI,OAAO,CAAC,EAAE,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAuBD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAA6B;IAC7D,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAE9D,IAAI,KAA4B,CAAC;IACjC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,KAAK,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC1D,CAAC;SAAM,IAAI,MAAM,EAAE,CAAC;QAClB,KAAK,GAAG,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,CAAC;SAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1C,KAAK,GAAG,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACnD,CAAC;SAAM,CAAC;QACN,KAAK,GAAG,EAAE,CAAC;IACb,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,IAAI,KAAK,GAAa,EAAE,CAAC;IACzB,IACE,GAAG;QACH,MAAM,EAAE,IAAI,KAAK,QAAQ;QACzB,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;QAChC,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,MAAM,CAAC,EAAE;QACnC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QAC7D,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,EAClC,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,KAAK,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,QAA2C,EAC3C,SAAgC,EAChC,KAAsE;IAEtE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC;IACvC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;IACtB,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC;YACH,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC,GAAG,CAAwB,gBAAgB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1F,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,KAAK,GAAG,SAAS,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC;AACrB,CAAC;AAQD,4EAA4E;AAC5E,MAAM,UAAU,UAAU,CACxB,OAA0F,EAC1F,IAAa,EACb,GAAY,EACZ,QAA2C,EAC3C,SAAgC,EAChC,KAAyB,EACzB,mBAA4B;IAE5B,OAAO,iBAAiB,CAAC;QACvB,IAAI;QACJ,GAAG;QACH,QAAQ,EAAE,OAAO,CAAC,MAAM;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,oBAAoB,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;QAC1D,mBAAmB;KACpB,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dudousxd/nestjs-authz-typeorm",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "TypeORM RBAC persistence for @dudousxd/nestjs-authz — roles, permissions, and a Gate seam (zero connection ownership).",
   "license": "MIT",
   "repository": {
@@ -38,7 +38,7 @@
     "CHANGELOG.md"
   ],
   "peerDependencies": {
-    "@dudousxd/nestjs-authz": ">=0.9.0 <0.10.0",
+    "@dudousxd/nestjs-authz": ">=0.10.0",
     "@nestjs/authorization": "^0.1.3",
     "@nestjs/common": "^12.0.0",
     "@nestjs/core": "^12.0.0",
@@ -55,7 +55,7 @@
     "@nestjs/typeorm": "12.0.3",
     "@testcontainers/mysql": "12.1.0",
     "@testcontainers/postgresql": "12.1.0",
-    "@types/node": "22.20.5",
+    "@types/node": "24.19.2",
     "@types/supertest": "6.0.3",
     "mysql2": "3.24.4",
     "pg": "8.23.0",
@@ -66,10 +66,10 @@
     "typeorm": "0.3.31",
     "typescript": "5.9.3",
     "vitest": "3.2.7",
-    "@dudousxd/nestjs-authz": "^0.9.0"
+    "@dudousxd/nestjs-authz": "^0.11.0"
   },
   "engines": {
-    "node": ">=22"
+    "node": ">=24"
   },
   "peerDependenciesMeta": {
     "@nestjs/typeorm": {