@dudousxd/nestjs-authz 0.11.0 → 0.12.0

package/skills/authz-rbac-seams/SKILL.md

@@ -87,13 +87,19 @@ that tenant's scoped rows only), and `removeUser(user)` drops all of a user's as
 
 Tenant scope: role assignments can be global or per tenant (`assignRole(user, role, { tenantId })`;
 MikroORM needs `createAuthzEntitySchemas({}, { tenantScoped: true })`, Prisma a `tenantId` column
-plus `tenantScoped: true`). Each `AuthzRbacModule` picks the tenant of a check: its `tenant`
-resolver (`(user) => id | null | undefined`) first; then, with tenancy on (`tenancy: 'inherit'`
+plus `tenantScoped: true`). Each `AuthzRbacModule` picks the tenant of a check: a scope
+forced by `runInTenantScope` (the dev tools) first; then its `tenant`
+resolver (`(user) => id | null | undefined`); then, with tenancy on (`tenancy: 'inherit'`
 follows `ContextModule.forRoot({ tenancy: { enabled: true } })`; `false` opts out), the context
 tenant from `Context.setTenant`; with tenancy off, TypeORM/Drizzle read `Context.tenantId()` and
-MikroORM/Prisma check global assignments only. `tenancy: { roles: { owner: 'org_admin' } }` maps
-the caller's `tenant.role` to authz roles in that tenant only (context user only). No tenant,
-`allTenants` or no request = global assignments only.
+MikroORM/Prisma check global assignments only. With nested tenants, assignments held at every
+level of the active chain the module honours apply (`tenancy.kinds`, else the context's `kinds`;
+`tenancy.family` narrows to one family). `tenancy: { roles: { owner: 'org_admin' } }` maps
+the caller's `tenant.role` at each honoured level to authz roles (context user only). No tenant
+(`tenantless`) or no request = global assignments only, unless `tenancy.required` (default: the
+context's) is set — then a check with no tenant throws `TenantRequiredError` (403,
+`E_TENANT_REQUIRED`). `all`/`system` (`Context.allTenants()` and siblings) stay global even
+when required.
 
 ## Core patterns