@dudousxd/nestjs-authz 0.7.0 → 0.8.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @dudousxd/nestjs-authz
 
+## 0.8.0
+
+### Minor Changes
+
+- [#61](https://github.com/DavideCarvalho/nestjs-authz/pull/61) [`d1c719d`](https://github.com/DavideCarvalho/nestjs-authz/commit/d1c719d9ee973bc802ba8bf6854246875c4c2da9) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Admin management operations on every RBAC store adapter (TypeORM, MikroORM, Prisma, Drizzle), with the same semantics everywhere:
+
+  - `deleteRole(roleName): Promise<boolean>` deletes the role, its role→permission links and every user assignment of it (all tenants, all sources) in one transaction. Returns whether the role existed. Permissions are kept.
+  - `syncRolePermissions(roleName, permissionNames): Promise<void>` replaces the role's permission set with exactly these names (spatie's `syncPermissions`), creating the role and permissions by name when missing.
+  - `getRolePermissions(roleNames): Promise<Record<string, string[]>>` returns each role's sorted permission names without N+1 queries. Every existing requested role is a key, even with no permissions (`[]`). Roles that don't exist are absent.
+  - `listRoleAssignments(filter?): Promise<UserRoleAssignment[]>` returns raw `{ userType, userId, role, source, tenantId }` rows for admin listings, ordered by `(userType, userId, role, source, tenantId)`. Filters: `role` (a name or a list), `user`, `source`, and `tenantId`. Omitting `tenantId` applies no tenant filter, `null` returns global assignments only, and a string returns only that tenant's scoped assignments, without the global ones. MikroORM and Prisma have no tenant-scoped assignments, so there a tenant id string matches nothing.
+  - `removeUser(user): Promise<void>` deletes every role assignment of the user (all tenants, all sources) and, on TypeORM and Drizzle, every direct permission.
+
+  Core's `store-kit` exports the `RoleAssignmentFilter` and `UserRoleAssignment` types, plus the `roleFilterNames` and `compareUserRoleAssignments` helpers the adapters share. The adapters now require `@dudousxd/nestjs-authz >= 0.8.0`.
+
 ## 0.7.0
 
 ### Minor Changes

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export declare const VERSION = "0.7.0";
+export declare const VERSION = "0.8.0";
 export { Gate, BoundGate } from './gate.js';
 export type { BatchAbility, BatchResult } from './gate.js';
 export { PermissionCache } from './permission-cache.js';

package/dist/index.js

@@ -1,7 +1,7 @@
 // Rewritten from this package's package.json by `scripts/sync-version.mjs`, which the root
 // `version-packages` script runs right after `changeset version`. The build is plain `tsc`
 // and injects nothing, so the literal below is what ships in dist.
-export const VERSION = '0.7.0';
+export const VERSION = '0.8.0';
 export { Gate, BoundGate } from './gate.js';
 export { PermissionCache } from './permission-cache.js';
 export { authzDecisionChannel, publishAuthzDecision } from './diagnostics.js';

package/dist/store-kit.d.ts

@@ -38,4 +38,42 @@ export interface RoleAssignment {
     /** Tenant the assignment is scoped to, or `null` for a global one (tenant-aware adapters). */
     tenantId: string | null;
 }
+/**
+ * One persisted role assignment together with the user holding it — a raw row of the
+ * user↔role pivot, as returned by the adapters' `listRoleAssignments` (admin listings such as
+ * "every member's roles in tenant T" or "who holds role R").
+ */
+export interface UserRoleAssignment extends RoleAssignment {
+    /** The user's type (`'user'` unless the assignment was made with a typed {@link UserRef}). */
+    userType: string;
+    /** The user's id, stringified. */
+    userId: string;
+}
+/** Filter for the adapters' `listRoleAssignments`. Every field is optional; they AND together. */
+export interface RoleAssignmentFilter {
+    /**
+     * Tenant filter:
+     * - `undefined` (omitted): no tenant filter — global AND every tenant's assignments;
+     * - `null`: GLOBAL assignments only;
+     * - a string: exactly that tenant's scoped assignments. Global assignments are NOT included
+     *   (unlike the permission checks, where a global assignment applies in every tenant) — pass
+     *   `null` in a second call when you need them too.
+     *
+     * Adapters without tenant support store every assignment as global, so a string matches nothing.
+     */
+    tenantId?: string | null;
+    /** Only assignments of this role, or of any of these roles (an empty list matches nothing). */
+    role?: string | readonly string[];
+    /** Only this user's assignments. */
+    user?: UserRef;
+    /** Only assignments from this source (`'manual'`, `'sso'`, …). */
+    source?: string;
+}
+/** Normalize {@link RoleAssignmentFilter.role} to a list (`undefined` = no role filter). */
+export declare function roleFilterNames(role: RoleAssignmentFilter['role']): string[] | undefined;
+/**
+ * Deterministic order for `listRoleAssignments` rows: `(userType, userId, role, source, tenantId)`,
+ * by code unit (not locale), so every adapter returns the same order for the same data.
+ */
+export declare function compareUserRoleAssignments(a: UserRoleAssignment, b: UserRoleAssignment): number;
 //# sourceMappingURL=store-kit.d.ts.map

package/dist/store-kit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store-kit.d.ts","sourceRoot":"","sources":["../src/store-kit.ts"],"names":[],"mappings":"AAQA;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;CACrB;AAED,4EAA4E;AAC5E,MAAM,MAAM,OAAO,GAAG,YAAY,GAAG,MAAM,GAAG,MAAM,CAAC;AAErD;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAK3E;AAED;;;GAGG;AACH,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,wFAAwF;AACxF,MAAM,WAAW,cAAc;IAC7B,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB"}
+{"version":3,"file":"store-kit.d.ts","sourceRoot":"","sources":["../src/store-kit.ts"],"names":[],"mappings":"AAQA;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;CACrB;AAED,4EAA4E;AAC5E,MAAM,MAAM,OAAO,GAAG,YAAY,GAAG,MAAM,GAAG,MAAM,CAAC;AAErD;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAK3E;AAED;;;GAGG;AACH,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,wFAAwF;AACxF,MAAM,WAAW,cAAc;IAC7B,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACxD,8FAA8F;IAC9F,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,kGAAkG;AAClG,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,+FAA+F;IAC/F,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IAClC,oCAAoC;IACpC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,4FAA4F;AAC5F,wBAAgB,eAAe,CAAC,IAAI,EAAE,oBAAoB,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,GAAG,SAAS,CAGxF;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,EAAE,kBAAkB,GAAG,MAAM,CAgB/F"}

package/dist/store-kit.js

@@ -17,4 +17,32 @@ export function normalizeUserRef(ref) {
  * (`assignRole`) and every row that predates per-source assignments.
  */
 export const DEFAULT_ROLE_SOURCE = 'manual';
+/** Normalize {@link RoleAssignmentFilter.role} to a list (`undefined` = no role filter). */
+export function roleFilterNames(role) {
+    if (role === undefined)
+        return undefined;
+    return typeof role === 'string' ? [role] : [...new Set(role)];
+}
+/**
+ * Deterministic order for `listRoleAssignments` rows: `(userType, userId, role, source, tenantId)`,
+ * by code unit (not locale), so every adapter returns the same order for the same data.
+ */
+export function compareUserRoleAssignments(a, b) {
+    const keys = (x) => [
+        x.userType,
+        x.userId,
+        x.role,
+        x.source,
+        x.tenantId ?? '',
+    ];
+    const ka = keys(a);
+    const kb = keys(b);
+    for (let i = 0; i < ka.length; i++) {
+        const l = ka[i];
+        const r = kb[i];
+        if (l !== r)
+            return l < r ? -1 : 1;
+    }
+    return 0;
+}
 //# sourceMappingURL=store-kit.js.map

package/dist/store-kit.js.map

@@ -1 +1 @@
-{"version":3,"file":"store-kit.js","sourceRoot":"","sources":["../src/store-kit.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,EAAE;AACF,8EAA8E;AAC9E,kFAAkF;AAClF,8EAA8E;AAC9E,kFAAkF;AAClF,+EAA+E;AAuB/E,2EAA2E;AAC3E,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACvD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC"}
+{"version":3,"file":"store-kit.js","sourceRoot":"","sources":["../src/store-kit.ts"],"names":[],"mappings":"AAAA,iCAAiC;AACjC,EAAE;AACF,8EAA8E;AAC9E,kFAAkF;AAClF,8EAA8E;AAC9E,kFAAkF;AAClF,+EAA+E;AAuB/E,2EAA2E;AAC3E,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACvD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC;AAgD5C,4FAA4F;AAC5F,MAAM,UAAU,eAAe,CAAC,IAAkC;IAChE,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,CAAqB,EAAE,CAAqB;IACrF,MAAM,IAAI,GAAG,CAAC,CAAqB,EAAE,EAAE,CAAC;QACtC,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,QAAQ,IAAI,EAAE;KACjB,CAAC;IACF,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAW,CAAC;QAC1B,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAW,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dudousxd/nestjs-authz",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "NestJS authorization — Laravel-style Gates & Policies, @Can guard, resource resolver (zero DB).",
   "license": "MIT",
   "repository": {

package/skills/authz-rbac-seams/SKILL.md

@@ -62,6 +62,13 @@ await gate.forUser(user).allows('posts.publish'); // true via PERMISSION_PROVIDE
 await gate.forUser(user).hasRole('editor');        // true via ROLE_PROVIDER
 ```
 
+Admin-UI management lives on every adapter's store too (same semantics everywhere):
+`syncRolePermissions(role, names)` replaces a role's permission set, `getRolePermissions(roles)`
+returns `{ [role]: permissionNames }` (missing roles absent), `deleteRole(role)` removes the role
+with its links and assignments, `listRoleAssignments({ tenantId?, role?, user?, source? })` lists
+raw `{ userType, userId, role, source, tenantId }` rows (`tenantId: null` = global only, a string =
+that tenant's scoped rows only), and `removeUser(user)` drops all of a user's assignments.
+
 ## Core patterns
 
 ### A hand-rolled PermissionProvider