@dudousxd/nestjs-authz 0.10.0 → 0.12.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dudousxd/nestjs-authz",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "Extras on top of @nestjs/authorization: persisted RBAC policies, @Can helpers (byId, roles, permission), a Gate with batch checks and ad-hoc gates, super-admin, query scoping.",
   "license": "MIT",
   "repository": {
@@ -81,7 +81,7 @@
     "@nestjs/testing": "12.0.1",
     "@tanstack/intent": "0.4.0",
     "@types/express": "4.17.25",
-    "@types/node": "22.20.5",
+    "@types/node": "24.19.2",
     "@types/supertest": "6.0.3",
     "express": "4.22.2",
     "reflect-metadata": "0.2.2",
@@ -91,7 +91,7 @@
     "vitest": "3.2.7"
   },
   "engines": {
-    "node": ">=22"
+    "node": ">=24"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json --incremental false",

package/skills/authz-rbac-seams/SKILL.md

@@ -85,6 +85,22 @@ with its links and assignments, `listRoleAssignments({ tenantId?, role?, user?,
 raw `{ userType, userId, role, source, tenantId }` rows (`tenantId: null` = global only, a string =
 that tenant's scoped rows only), and `removeUser(user)` drops all of a user's assignments.
 
+Tenant scope: role assignments can be global or per tenant (`assignRole(user, role, { tenantId })`;
+MikroORM needs `createAuthzEntitySchemas({}, { tenantScoped: true })`, Prisma a `tenantId` column
+plus `tenantScoped: true`). Each `AuthzRbacModule` picks the tenant of a check: a scope
+forced by `runInTenantScope` (the dev tools) first; then its `tenant`
+resolver (`(user) => id | null | undefined`); then, with tenancy on (`tenancy: 'inherit'`
+follows `ContextModule.forRoot({ tenancy: { enabled: true } })`; `false` opts out), the context
+tenant from `Context.setTenant`; with tenancy off, TypeORM/Drizzle read `Context.tenantId()` and
+MikroORM/Prisma check global assignments only. With nested tenants, assignments held at every
+level of the active chain the module honours apply (`tenancy.kinds`, else the context's `kinds`;
+`tenancy.family` narrows to one family). `tenancy: { roles: { owner: 'org_admin' } }` maps
+the caller's `tenant.role` at each honoured level to authz roles (context user only). No tenant
+(`tenantless`) or no request = global assignments only, unless `tenancy.required` (default: the
+context's) is set — then a check with no tenant throws `TenantRequiredError` (403,
+`E_TENANT_REQUIRED`). `all`/`system` (`Context.allTenants()` and siblings) stay global even
+when required.
+
 ## Core patterns
 
 ### A hand-rolled PermissionProvider

package/skills/authz-setup/SKILL.md

@@ -28,7 +28,7 @@ frontend glue. It never authenticates.
 pnpm add @nestjs/authorization @dudousxd/nestjs-authz
 ```
 
-NestJS 12, Node 22+. Peers: `@nestjs/common`, `@nestjs/core`, `@nestjs/authorization`,
+NestJS 12, Node 24+. Peers: `@nestjs/common`, `@nestjs/core`, `@nestjs/authorization`,
 `reflect-metadata`, `rxjs`; optional `@nestjs/authentication` and `@dudousxd/nestjs-context`.
 
 ```ts