@dudousxd/nestjs-authz 0.10.0 → 0.11.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @dudousxd/nestjs-authz
 
+## 0.11.0
+
+### Minor Changes
+
+- [#74](https://github.com/DavideCarvalho/nestjs-authz/pull/74) [`35421dc`](https://github.com/DavideCarvalho/nestjs-authz/commit/35421dc5b09bd271d5087d26e8536191ef6ba342) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - **Breaking:** require Node.js 24 or newer (`engines.node` is now `>=24`; it was `>=22`, and `>=20` for `-client` and `-react`). CI tests on Node 24 and 26. No API changes: see the Upgrading page in the docs.
+
 ## 0.10.0
 
 ### Minor Changes

package/README.md

@@ -37,7 +37,7 @@ See [`DESIGN.md`](https://github.com/DavideCarvalho/nestjs-authz/blob/main/DESIG
 pnpm add @nestjs/authorization @dudousxd/nestjs-authz
 ```
 
-Requires NestJS 12 and Node 22+. Two optional peers: `@nestjs/authentication` gives the `Gate`
+Requires NestJS 12 and Node 24+. Two optional peers: `@nestjs/authentication` gives the `Gate`
 its ambient user (`AuthenticationContext.user`); `@dudousxd/nestjs-context` gives it one too
 (outside an authentication scope), plus the per-request permission cache and
 tenant-scoped roles.

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export declare const VERSION = "0.10.0";
+export declare const VERSION = "0.11.0";
 export { AuthzModule } from './module.js';
 export { AuthzGuard } from './authz.guard.js';
 export { Gate, BoundGate } from './gate.js';

package/dist/index.js

@@ -1,7 +1,7 @@
 // Rewritten from this package's package.json by `scripts/sync-version.mjs`, which the root
 // `version-packages` script runs right after `changeset version`. The build is plain `tsc`
 // and injects nothing, so the literal below is what ships in dist.
-export const VERSION = '0.10.0';
+export const VERSION = '0.11.0';
 // Extras on top of @nestjs/authorization. Its own API (@Policy, @Can, Can.Anyone,
 // AuthorizationModule, AuthorizationService, AuthorizationGuard) is imported from there.
 export { AuthzModule } from './module.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dudousxd/nestjs-authz",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Extras on top of @nestjs/authorization: persisted RBAC policies, @Can helpers (byId, roles, permission), a Gate with batch checks and ad-hoc gates, super-admin, query scoping.",
   "license": "MIT",
   "repository": {
@@ -81,7 +81,7 @@
     "@nestjs/testing": "12.0.1",
     "@tanstack/intent": "0.4.0",
     "@types/express": "4.17.25",
-    "@types/node": "22.20.5",
+    "@types/node": "24.19.2",
     "@types/supertest": "6.0.3",
     "express": "4.22.2",
     "reflect-metadata": "0.2.2",
@@ -91,7 +91,7 @@
     "vitest": "3.2.7"
   },
   "engines": {
-    "node": ">=22"
+    "node": ">=24"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json --incremental false",

package/skills/authz-rbac-seams/SKILL.md

@@ -85,6 +85,16 @@ with its links and assignments, `listRoleAssignments({ tenantId?, role?, user?,
 raw `{ userType, userId, role, source, tenantId }` rows (`tenantId: null` = global only, a string =
 that tenant's scoped rows only), and `removeUser(user)` drops all of a user's assignments.
 
+Tenant scope: role assignments can be global or per tenant (`assignRole(user, role, { tenantId })`;
+MikroORM needs `createAuthzEntitySchemas({}, { tenantScoped: true })`, Prisma a `tenantId` column
+plus `tenantScoped: true`). Each `AuthzRbacModule` picks the tenant of a check: its `tenant`
+resolver (`(user) => id | null | undefined`) first; then, with tenancy on (`tenancy: 'inherit'`
+follows `ContextModule.forRoot({ tenancy: { enabled: true } })`; `false` opts out), the context
+tenant from `Context.setTenant`; with tenancy off, TypeORM/Drizzle read `Context.tenantId()` and
+MikroORM/Prisma check global assignments only. `tenancy: { roles: { owner: 'org_admin' } }` maps
+the caller's `tenant.role` to authz roles in that tenant only (context user only). No tenant,
+`allTenants` or no request = global assignments only.
+
 ## Core patterns
 
 ### A hand-rolled PermissionProvider

package/skills/authz-setup/SKILL.md

@@ -28,7 +28,7 @@ frontend glue. It never authenticates.
 pnpm add @nestjs/authorization @dudousxd/nestjs-authz
 ```
 
-NestJS 12, Node 22+. Peers: `@nestjs/common`, `@nestjs/core`, `@nestjs/authorization`,
+NestJS 12, Node 24+. Peers: `@nestjs/common`, `@nestjs/core`, `@nestjs/authorization`,
 `reflect-metadata`, `rxjs`; optional `@nestjs/authentication` and `@dudousxd/nestjs-context`.
 
 ```ts