@dudousxd/nestjs-authz 0.8.0 → 0.9.0

package/skills/authz-setup/SKILL.md

@@ -1,153 +1,92 @@
 ---
 name: authz-setup
 description: >
-  Set up @dudousxd/nestjs-authz in a NestJS app — install, peer deps, and wire
-  AuthzModule.forRoot / forRootAsync (global module that registers the Gate,
-  CanGuard + RolesGuard as APP_GUARD, PolicyRegistry, default IdParamResourceResolver,
-  and the opt-in POST /authz/can endpoint). Covers the optional @dudousxd/nestjs-context
-  peer (CONTEXT_ACCESSOR) for the current user, and the load-bearing resolveUser hook
-  that hydrates the full user entity from a UserRef ({type,id}) so superAdmin and
-  policy checks like user.isAdmin / post.authorId === user.id actually see real columns.
+  Set up @dudousxd/nestjs-authz 0.9, the extras on top of NestJS's first-party
+  @nestjs/authorization. Import AuthorizationModule.forRoot() (official: global
+  deny-by-default AuthorizationGuard, @Can, AuthorizationService, getUser) next to
+  AuthzModule.forRoot / forRootAsync (ours: Gate, RolePolicy / PermissionPolicy /
+  GatePolicy, the ResourceResolver byId() uses, superAdmin, the allow+deny decision event,
+  the opt-in POST /authz/can endpoint). Covers the optional peers: @nestjs/authentication
+  (AuthenticationContext.user is the ambient Gate user) and @dudousxd/nestjs-context
+  (fallback ambient user via resolveUser, per-request permission cache, tenant).
 metadata:
   type: core
   library: "@dudousxd/nestjs-authz"
-  library_version: "0.6.3"
+  library_version: "0.9.0"
   framework: nestjs
 ---
 
 # Setting up @dudousxd/nestjs-authz
 
-`@dudousxd/nestjs-authz` is **authorization, not authentication**: it reads the
-current user and decides what they may do, Laravel Gate/Policy style. The core has
-**zero database** dependencies.
+Authorization decisions belong to [`@nestjs/authorization`](https://docs.nestjs.com/security/authorization).
+This package adds RBAC, `@Can` helpers, a service-layer `Gate`, super-admin, query scopes and
+frontend glue. It never authenticates.
 
 ## Setup
 
 ```sh
-pnpm add @dudousxd/nestjs-authz
+pnpm add @nestjs/authorization @dudousxd/nestjs-authz
 ```
 
-Peer deps: `@nestjs/common`, `@nestjs/core`, `reflect-metadata`.
-`@dudousxd/nestjs-context` is an **optional** peer — when present the Gate reads the
-current user for free; when absent you pass the user explicitly via `gate.forUser(...)`.
-
-Register the module once (it is `global: true`, so every module sees the `Gate` and the
-guards):
+NestJS 12, Node 22+. Peers: `@nestjs/common`, `@nestjs/core`, `@nestjs/authorization`,
+`reflect-metadata`, `rxjs`; optional `@nestjs/authentication` and `@dudousxd/nestjs-context`.
 
 ```ts
-import { Module } from '@nestjs/common';
+import { AuthorizationModule } from '@nestjs/authorization';
 import { AuthzModule } from '@dudousxd/nestjs-authz';
-import { PostPolicy } from './post.policy';
 
 @Module({
   imports: [
+    AuthorizationModule.forRoot({ getUser: (ctx) => ctx.switchToHttp().getRequest().user }),
     AuthzModule.forRoot({
-      policies: [PostPolicy], // optional — @Policy classes are also auto-discovered
-      superAdmin: (user) => (user as { isAdmin?: boolean }).isAdmin === true,
+      superAdmin: (user) => user?.isRoot === true,
+      resourceResolver: new OrmResourceResolver(), // for byId(); default builds { id } from :id
     }),
   ],
+  providers: [PostPolicy], // official policies are discovered wherever they are providers
 })
 export class AppModule {}
 ```
 
-`forRoot` registers: `Gate`, `PolicyRegistry`, `CanGuard` **and** `RolesGuard` (both as
-`APP_GUARD`, so `@Can` / `@Roles` enforce app-wide), a default `IdParamResourceResolver`
-bound to `RESOURCE_RESOLVER`, and a bootstrap provider that fills the `PolicyRegistry` on
-init from `policies: []` **and** auto-discovered `@Policy` providers.
+`forRootAsync({ imports, inject, useFactory | useClass | useExisting, canEndpoint, decorators, unannotated })` takes the
+same options. `canEndpoint`, `decorators` and `unannotated` are static (read from the top
+level next to `useFactory`, never from the factory's return — `decorators` and `unannotated` in the factory's return throw).
 
 ## Core patterns
 
-### forRootAsync (config from DI)
-
-Use when policy lists or hooks depend on injected config. Policies returned from the
-factory are registered too (the bootstrap reads the **resolved** options).
-
-```ts
-AuthzModule.forRootAsync({
-  imports: [ConfigModule],
-  inject: [ConfigService],
-  useFactory: (config: ConfigService) => ({
-    policies: [PostPolicy],
-    superAdmin: (user) => (user as { role?: string }).role === config.get('SUPER_ROLE'),
-  }),
-});
-```
-
-`canEndpoint` and `resourceLoaders` may be declared **statically** on the async options
-too (controllers are registered at module-definition time, before the factory resolves).
-
-### Wiring the current user via nestjs-context
-
-The Gate resolves the current user structurally through the well-known capability token
-`CONTEXT_ACCESSOR` (`capability('context','accessor')` ===
-`Symbol.for('@dudousxd/nestjs-context:accessor')`). Install and configure
-`@dudousxd/nestjs-context` so requests carry a user; the Gate then needs no wiring. With
-**no** accessor and no explicit user, checks treat the request as anonymous and **deny**.
-
-### resolveUser — hydrate the real entity (the critical hook)
-
-On the **context path**, the value handed to `superAdmin`, `after`, `resolveRoles`, and
-your policy methods is the raw **`UserRef`** (`{ type, id }`) from nestjs-context — **not**
-your hydrated user row. Provide `resolveUser` to load the entity before those run:
-
-```ts
-AuthzModule.forRoot({
-  resolveUser: (ref) => userRepo.findOneBy({ id: Number(ref.id) }), // ref: { type, id }
-  superAdmin: (user) => (user as User).isAdmin, // now sees a real column
-});
-```
-
-`resolveUser` returning nullish is treated as "no user" (deny). It is **only** applied on
-the context path — `gate.forUser(entity)` always uses the value you pass verbatim.
+- The official module must stay global (its default): the `Gate` injects `AuthorizationService`.
+- `getUser` is the only user on routes. The `Gate`'s ambient user (calls without `forUser`) is
+  `@nestjs/authentication`'s `AuthenticationContext.user` when that package is installed and its
+  scope is active (its answer is final, so an anonymous call there is a guest), else nestjs-context's
+  `{ type, id }` ref, hydrated by `resolveUser` once per request.
+- Every route needs a declaration: the official guard denies a handler with no `@Can()`,
+  `@Can.Anyone()` or `@Public()`.
 
 ## Common mistakes
 
-### 1. Expecting `superAdmin: u => u.isAdmin` to work without `resolveUser`
+### 1. Importing only AuthzModule
 
 ```ts
-// Wrong — on the context path `user` is just { type, id }; `isAdmin` is undefined,
-// so the super-admin grant never fires from a route or gate.allows(...).
-AuthzModule.forRoot({ superAdmin: (u) => (u as User).isAdmin });
-
-// Correct — hydrate the entity first.
-AuthzModule.forRoot({
-  resolveUser: (ref) => userRepo.findOneBy({ id: Number(ref.id) }),
-  superAdmin: (u) => (u as User).isAdmin,
-});
-```
+// Wrong — no AuthorizationService for the Gate, no guard on routes.
+imports: [AuthzModule.forRoot()]
 
-Mechanism: the context accessor yields only a `UserRef` (`{ type, id }`); `resolveUser`
-is the hook that turns that ref into your `User` entity before hooks/policies run.
-Source: `packages/core/src/types.ts` (`AuthzModuleOptions.superAdmin` / `resolveUser` docs),
-`packages/core/src/gate.ts` (`currentUser`).
+// Correct
+imports: [AuthorizationModule.forRoot(), AuthzModule.forRoot()]
+```
 
-### 2. Importing AuthzModule in every feature module
+### 2. Passing policies to AuthzModule
 
 ```ts
-// Wrong — forRoot is global; re-importing creates duplicate providers/options.
-@Module({ imports: [AuthzModule.forRoot({ policies: [PostPolicy] })] })
-export class PostsModule {}
+// Wrong (0.x) — `policies` is gone from AuthzModuleOptions.
+AuthzModule.forRoot({ policies: [PostPolicy] })
 
-// Correct — register once in the root module; the Gate is exported globally.
-@Module({ imports: [AuthzModule.forRoot({ policies: [PostPolicy] })] })
-export class AppModule {}
+// Correct — register them as providers, or with the official module.
+AuthorizationModule.forRoot({ policies: [PostPolicy] })
 ```
 
-Mechanism: `forRoot`/`forRootAsync` return `{ global: true }`, so a single root
-registration exports `Gate`, the guards, and `RESOURCE_RESOLVER` to the whole app.
-Source: `packages/core/src/module.ts` (`forRoot` returns `global: true`).
-
-### 3. Reaching for the `canEndpoint` before it is enabled
+### 3. Leaving routes undeclared after upgrading from 0.x
 
-```ts
-// Wrong — POST /authz/can returns 404; the endpoint is OFF by default.
-AuthzModule.forRoot({ policies: [PostPolicy] });
-
-// Correct — opt in (true = default path 'authz/can', or pass a custom string).
-AuthzModule.forRoot({ policies: [PostPolicy], canEndpoint: true });
-```
+0.x let un-annotated routes through. The official guard denies them (401 for guests, 403
+otherwise). Add `@Can.Anyone()` to routes anyone may call.
 
-Mechanism: `canControllers` registers the fallback controller only when `canEndpoint` is
-truthy; it is the last-resort path for abilities not already hydrated on the client.
-Source: `packages/core/src/module.ts` (`canControllers`), `packages/core/src/types.ts`
-(`canEndpoint`).
+Source: `packages/core/src/module.ts`, `packages/core/src/runtime.ts`.

package/dist/decorator/can.decorator.d.ts

@@ -1,29 +0,0 @@
-import 'reflect-metadata';
-import { type Type } from '@nestjs/common';
-export interface CanOptions {
-    /**
-     * Class-level ability (e.g. `create`): the policy method is keyed to the
-     * resource class but receives NO instance, so the guard skips resource loading.
-     */
-    classLevel?: boolean;
-}
-export interface CanMetadata {
-    ability: string;
-    /** Resource class — to load an instance, or (for class-level) to locate the policy. */
-    resource?: Type<unknown>;
-    /** When true, skip resource loading and dispatch against the resource class. */
-    classLevel?: boolean;
-}
-/**
- * Guard a route with an authorization check.
- *
- * @example
- *   `@Can('update', Post)`                    // resolve Post by :id, run PostPolicy.update(user, post)
- *   `@Can('create', Post, { classLevel: true })` // run PostPolicy.create(user) — no instance loaded
- *   `@Can('access-admin')`                    // ad-hoc gate, no resource
- *
- * When a resource class is provided (and not `classLevel`), the guard loads an
- * instance via the registered `ResourceResolver` (default: by route `:id`).
- */
-export declare function Can(ability: string, resource?: Type<unknown>, options?: CanOptions): MethodDecorator & ClassDecorator;
-//# sourceMappingURL=can.decorator.d.ts.map

package/dist/decorator/can.decorator.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"can.decorator.d.ts","sourceRoot":"","sources":["../../src/decorator/can.decorator.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAe,KAAK,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAGxD,MAAM,WAAW,UAAU;IACzB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,uFAAuF;IACvF,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,gFAAgF;IAChF,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,GAAG,CACjB,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,EACxB,OAAO,CAAC,EAAE,UAAU,GACnB,eAAe,GAAG,cAAc,CAKlC"}

package/dist/decorator/can.decorator.js

@@ -1,23 +0,0 @@
-import 'reflect-metadata';
-import { SetMetadata } from '@nestjs/common';
-import { CAN_METADATA } from '../tokens.js';
-/**
- * Guard a route with an authorization check.
- *
- * @example
- *   `@Can('update', Post)`                    // resolve Post by :id, run PostPolicy.update(user, post)
- *   `@Can('create', Post, { classLevel: true })` // run PostPolicy.create(user) — no instance loaded
- *   `@Can('access-admin')`                    // ad-hoc gate, no resource
- *
- * When a resource class is provided (and not `classLevel`), the guard loads an
- * instance via the registered `ResourceResolver` (default: by route `:id`).
- */
-export function Can(ability, resource, options) {
-    const meta = { ability };
-    if (resource !== undefined)
-        meta.resource = resource;
-    if (options?.classLevel)
-        meta.classLevel = true;
-    return SetMetadata(CAN_METADATA, meta);
-}
-//# sourceMappingURL=can.decorator.js.map

package/dist/decorator/can.decorator.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"can.decorator.js","sourceRoot":"","sources":["../../src/decorator/can.decorator.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAa,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAkB5C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,GAAG,CACjB,OAAe,EACf,QAAwB,EACxB,OAAoB;IAEpB,MAAM,IAAI,GAAgB,EAAE,OAAO,EAAE,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS;QAAE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACrD,IAAI,OAAO,EAAE,UAAU;QAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IAChD,OAAO,WAAW,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;AACzC,CAAC"}

package/dist/decorator/policy.decorator.d.ts

@@ -1,18 +0,0 @@
-import 'reflect-metadata';
-import { type Type } from '@nestjs/common';
-/**
- * Marks a class as the policy for `resource`. The class methods become abilities
- * dispatched by name (e.g. `update(user, post)` answers `gate.authorize('update', post)`).
- *
- * Applying `@Policy` also makes the class an `@Injectable()` provider so it can
- * be auto-discovered and resolved from the Nest container.
- */
-export declare function Policy(resource: Type<unknown>): ClassDecorator;
-/**
- * Returns the resource class a policy was declared for, or `undefined`.
- *
- * Uses `getMetadata` (not `getOwnMetadata`) so a subclass of a `@Policy`-decorated
- * class still resolves the inherited resource via the prototype chain.
- */
-export declare function getPolicyResource(policy: Type<unknown> | object): Type<unknown> | undefined;
-//# sourceMappingURL=policy.decorator.d.ts.map

package/dist/decorator/policy.decorator.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"policy.decorator.d.ts","sourceRoot":"","sources":["../../src/decorator/policy.decorator.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAc,KAAK,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAIvD;;;;;;GAMG;AACH,wBAAgB,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,cAAc,CAM9D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,SAAS,CAG3F"}

package/dist/decorator/policy.decorator.js

@@ -1,28 +0,0 @@
-import 'reflect-metadata';
-import { Injectable } from '@nestjs/common';
-import { POLICY_RESOURCE_METADATA } from '../tokens.js';
-/**
- * Marks a class as the policy for `resource`. The class methods become abilities
- * dispatched by name (e.g. `update(user, post)` answers `gate.authorize('update', post)`).
- *
- * Applying `@Policy` also makes the class an `@Injectable()` provider so it can
- * be auto-discovered and resolved from the Nest container.
- */
-export function Policy(resource) {
-    return (target) => {
-        Reflect.defineMetadata(POLICY_RESOURCE_METADATA, resource, target);
-        // Make the policy a provider without forcing the app to add @Injectable().
-        Injectable()(target);
-    };
-}
-/**
- * Returns the resource class a policy was declared for, or `undefined`.
- *
- * Uses `getMetadata` (not `getOwnMetadata`) so a subclass of a `@Policy`-decorated
- * class still resolves the inherited resource via the prototype chain.
- */
-export function getPolicyResource(policy) {
-    const ctor = typeof policy === 'function' ? policy : policy.constructor;
-    return Reflect.getMetadata(POLICY_RESOURCE_METADATA, ctor);
-}
-//# sourceMappingURL=policy.decorator.js.map

package/dist/decorator/policy.decorator.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"policy.decorator.js","sourceRoot":"","sources":["../../src/decorator/policy.decorator.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAa,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAGxD;;;;;;GAMG;AACH,MAAM,UAAU,MAAM,CAAC,QAAuB;IAC5C,OAAO,CAAC,MAAM,EAAE,EAAE;QAChB,OAAO,CAAC,cAAc,CAAC,wBAAwB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnE,2EAA2E;QAC3E,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA8B;IAC9D,MAAM,IAAI,GAAG,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,MAAyB,CAAC,WAAW,CAAC;IAC5F,OAAO,OAAO,CAAC,WAAW,CAAC,wBAAwB,EAAE,IAAI,CAA8B,CAAC;AAC1F,CAAC"}

package/dist/guard/can.guard.d.ts

@@ -1,31 +0,0 @@
-import { type CanActivate, type ExecutionContext } from '@nestjs/common';
-import { ModuleRef, Reflector } from '@nestjs/core';
-import { Gate } from '../gate.js';
-import type { ResourceResolver } from '../resource-resolver.js';
-/**
- * Enforces `@Can(ability, Resource?)` on routes.
- *
- * - No `@Can` metadata → allow (the guard is inert on un-annotated routes).
- * - Resource class + not class-level → load instance via {@link ResourceResolver}
- *   (a missing/undefined instance is a denial).
- * - Class-level or no resource → dispatch against the class / ad-hoc gate.
- *
- * The decision is delegated to {@link Gate.authorize}, which throws
- * `ForbiddenException` on denial.
- */
-export declare class CanGuard implements CanActivate {
-    private readonly reflector;
-    private readonly gate;
-    private readonly moduleRef;
-    private readonly resolver?;
-    constructor(reflector: Reflector, gate: Gate, moduleRef: ModuleRef, resolver?: ResourceResolver | undefined);
-    /**
-     * Locate the resource resolver. Prefers the value injected into this module;
-     * falls back to a non-strict {@link ModuleRef} lookup so a resolver provided by
-     * ANY module (e.g. the app root) is found even though the guard lives in the
-     * global AuthzModule.
-     */
-    private resolveResolver;
-    canActivate(ctx: ExecutionContext): Promise<boolean>;
-}
-//# sourceMappingURL=can.guard.d.ts.map

package/dist/guard/can.guard.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"can.guard.d.ts","sourceRoot":"","sources":["../../src/guard/can.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,gBAAgB,EAKtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGpD,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAClC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAIhE;;;;;;;;;;GAUG;AACH,qBACa,QAAS,YAAW,WAAW;IAExC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAG1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBALT,SAAS,EAAE,SAAS,EACpB,IAAI,EAAE,IAAI,EACV,SAAS,EAAE,SAAS,EAGpB,QAAQ,CAAC,EAAE,gBAAgB,YAAA;IAG9C;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IASjB,WAAW,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CA2B3D"}

package/dist/guard/can.guard.js

@@ -1,92 +0,0 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-import { ForbiddenException, Inject, Injectable, Optional, } from '@nestjs/common';
-import { ModuleRef, Reflector } from '@nestjs/core';
-import { ResourceResolverMissingException } from '../errors/exceptions.js';
-import { Gate } from '../gate.js';
-import { CAN_METADATA, RESOURCE_RESOLVER } from '../tokens.js';
-/**
- * Enforces `@Can(ability, Resource?)` on routes.
- *
- * - No `@Can` metadata → allow (the guard is inert on un-annotated routes).
- * - Resource class + not class-level → load instance via {@link ResourceResolver}
- *   (a missing/undefined instance is a denial).
- * - Class-level or no resource → dispatch against the class / ad-hoc gate.
- *
- * The decision is delegated to {@link Gate.authorize}, which throws
- * `ForbiddenException` on denial.
- */
-let CanGuard = class CanGuard {
-    reflector;
-    gate;
-    moduleRef;
-    resolver;
-    constructor(reflector, gate, moduleRef, resolver) {
-        this.reflector = reflector;
-        this.gate = gate;
-        this.moduleRef = moduleRef;
-        this.resolver = resolver;
-    }
-    /**
-     * Locate the resource resolver. Prefers the value injected into this module;
-     * falls back to a non-strict {@link ModuleRef} lookup so a resolver provided by
-     * ANY module (e.g. the app root) is found even though the guard lives in the
-     * global AuthzModule.
-     */
-    resolveResolver() {
-        if (this.resolver)
-            return this.resolver;
-        try {
-            return this.moduleRef.get(RESOURCE_RESOLVER, { strict: false });
-        }
-        catch {
-            return undefined;
-        }
-    }
-    async canActivate(ctx) {
-        const meta = this.reflector.getAllAndOverride(CAN_METADATA, [
-            ctx.getHandler(),
-            ctx.getClass(),
-        ]);
-        if (!meta)
-            return true;
-        // Ad-hoc gate or class-level → no instance to load.
-        if (!meta.resource || meta.classLevel) {
-            const resource = meta.classLevel ? meta.resource : undefined;
-            await this.gate.authorize(meta.ability, resource);
-            return true;
-        }
-        // Instance ability → resolve the resource by route param / app resolver.
-        const resolver = this.resolveResolver();
-        if (!resolver) {
-            throw new ResourceResolverMissingException(meta.ability);
-        }
-        const instance = await resolver.resolve(meta.resource, ctx);
-        if (instance === undefined) {
-            // Not found → deny rather than dispatch a policy with a bogus resource.
-            throw new ForbiddenException(`Unauthorized: ${meta.ability}`);
-        }
-        await this.gate.authorize(meta.ability, instance);
-        return true;
-    }
-};
-CanGuard = __decorate([
-    Injectable(),
-    __param(3, Optional()),
-    __param(3, Inject(RESOURCE_RESOLVER)),
-    __metadata("design:paramtypes", [Reflector,
-        Gate,
-        ModuleRef, Object])
-], CanGuard);
-export { CanGuard };
-//# sourceMappingURL=can.guard.js.map

package/dist/guard/can.guard.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"can.guard.js","sourceRoot":"","sources":["../../src/guard/can.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAGL,kBAAkB,EAClB,MAAM,EACN,UAAU,EACV,QAAQ,GACT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EAAE,gCAAgC,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAElC,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAG/D;;;;;;;;;;GAUG;AAEI,IAAM,QAAQ,GAAd,MAAM,QAAQ;IAEA;IACA;IACA;IAGA;IANnB,YACmB,SAAoB,EACpB,IAAU,EACV,SAAoB,EAGpB,QAA2B;QAL3B,cAAS,GAAT,SAAS,CAAW;QACpB,SAAI,GAAJ,IAAI,CAAM;QACV,cAAS,GAAT,SAAS,CAAW;QAGpB,aAAQ,GAAR,QAAQ,CAAmB;IAC3C,CAAC;IAEJ;;;;;OAKG;IACK,eAAe;QACrB,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QACxC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAmB,iBAAiB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACpF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAqB;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAA0B,YAAY,EAAE;YACnF,GAAG,CAAC,UAAU,EAAE;YAChB,GAAG,CAAC,QAAQ,EAAE;SACf,CAAC,CAAC;QACH,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,oDAAoD;QACpD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAE,IAAI,CAAC,QAAgC,CAAC,CAAC,CAAC,SAAS,CAAC;YACtF,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAClD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,yEAAyE;QACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC5D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,wEAAwE;YACxE,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AApDY,QAAQ;IADpB,UAAU,EAAE;IAMR,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,MAAM,CAAC,iBAAiB,CAAC,CAAA;qCAJE,SAAS;QACd,IAAI;QACC,SAAS;GAJ5B,QAAQ,CAoDpB"}

package/dist/guard/roles.guard.d.ts

@@ -1,21 +0,0 @@
-import { type CanActivate, type ExecutionContext } from '@nestjs/common';
-import { Reflector } from '@nestjs/core';
-import { Gate } from '../gate.js';
-/**
- * Enforces `@Roles(...roles)` on routes.
- *
- * - No `@Roles` metadata → allow (the guard is inert on un-annotated routes).
- * - Otherwise allow when the current user holds ANY of the listed roles.
- *
- * The current user is resolved EXACTLY as the {@link Gate} does — from the optional
- * context accessor (nestjs-context) — and an unauthenticated request is denied by
- * default (`gate.hasAnyRole` returns `false` for a NO_USER caller). The verdict is
- * delegated to {@link Gate.hasAnyRole}; a denial throws `ForbiddenException`.
- */
-export declare class RolesGuard implements CanActivate {
-    private readonly reflector;
-    private readonly gate;
-    constructor(reflector: Reflector, gate: Gate);
-    canActivate(ctx: ExecutionContext): Promise<boolean>;
-}
-//# sourceMappingURL=roles.guard.d.ts.map

package/dist/guard/roles.guard.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"roles.guard.d.ts","sourceRoot":"","sources":["../../src/guard/roles.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,gBAAgB,EAGtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAGlC;;;;;;;;;;GAUG;AACH,qBACa,UAAW,YAAW,WAAW;IAE1C,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI;gBADJ,SAAS,EAAE,SAAS,EACpB,IAAI,EAAE,IAAI;IAGvB,WAAW,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CAS3D"}

package/dist/guard/roles.guard.js

@@ -1,50 +0,0 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-import { ForbiddenException, Injectable, } from '@nestjs/common';
-import { Reflector } from '@nestjs/core';
-import { Gate } from '../gate.js';
-import { ROLES_METADATA } from '../tokens.js';
-/**
- * Enforces `@Roles(...roles)` on routes.
- *
- * - No `@Roles` metadata → allow (the guard is inert on un-annotated routes).
- * - Otherwise allow when the current user holds ANY of the listed roles.
- *
- * The current user is resolved EXACTLY as the {@link Gate} does — from the optional
- * context accessor (nestjs-context) — and an unauthenticated request is denied by
- * default (`gate.hasAnyRole` returns `false` for a NO_USER caller). The verdict is
- * delegated to {@link Gate.hasAnyRole}; a denial throws `ForbiddenException`.
- */
-let RolesGuard = class RolesGuard {
-    reflector;
-    gate;
-    constructor(reflector, gate) {
-        this.reflector = reflector;
-        this.gate = gate;
-    }
-    async canActivate(ctx) {
-        const roles = this.reflector.getAllAndOverride(ROLES_METADATA, [
-            ctx.getHandler(),
-            ctx.getClass(),
-        ]);
-        if (!roles || roles.length === 0)
-            return true;
-        if (await this.gate.hasAnyRole(roles))
-            return true;
-        throw new ForbiddenException(`Unauthorized: requires one of [${roles.join(', ')}]`);
-    }
-};
-RolesGuard = __decorate([
-    Injectable(),
-    __metadata("design:paramtypes", [Reflector,
-        Gate])
-], RolesGuard);
-export { RolesGuard };
-//# sourceMappingURL=roles.guard.js.map

package/dist/guard/roles.guard.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"roles.guard.js","sourceRoot":"","sources":["../../src/guard/roles.guard.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAGL,kBAAkB,EAClB,UAAU,GACX,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C;;;;;;;;;;GAUG;AAEI,IAAM,UAAU,GAAhB,MAAM,UAAU;IAEF;IACA;IAFnB,YACmB,SAAoB,EACpB,IAAU;QADV,cAAS,GAAT,SAAS,CAAW;QACpB,SAAI,GAAJ,IAAI,CAAM;IAC1B,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,GAAqB;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAuB,cAAc,EAAE;YACnF,GAAG,CAAC,UAAU,EAAE;YAChB,GAAG,CAAC,QAAQ,EAAE;SACf,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,IAAI,kBAAkB,CAAC,kCAAkC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtF,CAAC;CACF,CAAA;AAfY,UAAU;IADtB,UAAU,EAAE;qCAGmB,SAAS;QACd,IAAI;GAHlB,UAAU,CAetB"}

package/dist/policy-registry.d.ts

@@ -1,46 +0,0 @@
-import { type Type } from '@nestjs/common';
-import type { PolicyInstance } from './types.js';
-/**
- * Maps a resource class → its policy instance. Populated at module init from
- * explicit `policies: []` and/or auto-discovered `@Policy` providers.
- */
-export declare class PolicyRegistry {
-    private readonly byResource;
-    private classAbilitiesCache;
-    /**
-     * Register a policy instance. Throws if the instance's class was not decorated
-     * with `@Policy(Resource)`.
-     */
-    register(policy: PolicyInstance): void;
-    /** Resolve the policy instance for a resource class, or `undefined`. */
-    forResource(resource: Type<unknown>): PolicyInstance | undefined;
-    /** Resolve the policy for the class of a resource instance, or `undefined`. */
-    forInstance(instance: object): PolicyInstance | undefined;
-    /** True when a policy is registered for the resource class. */
-    has(resource: Type<unknown>): boolean;
-    /** All registered policies (for introspection/testing). */
-    all(): PolicyInstance[];
-    /** All registered resource classes (insertion order). */
-    resources(): Type<unknown>[];
-    /**
-     * Enumerate the CLASS-LEVEL ability method names declared on each registered
-     * policy, keyed by resource class. Used by integrations that pre-resolve a
-     * user's class-level abilities (e.g. to share them as Inertia props).
-     *
-     * Walks the policy prototype chain and collects own function-valued members,
-     * excluding `constructor` and the reserved `before` hook. Inherited Object
-     * members are skipped.
-     *
-     * Only methods that take NO resource instance are included — heuristically,
-     * arity `<= 1` (just `user`, e.g. `create(user)` / `viewAny(user)`). An
-     * instance method like `update(user, post)` is excluded: dispatching it
-     * against the resource CLASS would call it with the class constructor as
-     * `post` and write a bogus class-level verdict.
-     */
-    classAbilities(): Array<{
-        resource: Type<unknown>;
-        abilities: string[];
-    }>;
-    private computeClassAbilities;
-}
-//# sourceMappingURL=policy-registry.d.ts.map

package/dist/policy-registry.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"policy-registry.d.ts","sourceRoot":"","sources":["../src/policy-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAGvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD;;;GAGG;AACH,qBACa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4C;IAIvE,OAAO,CAAC,mBAAmB,CAAsE;IAEjG;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAUtC,wEAAwE;IACxE,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,cAAc,GAAG,SAAS;IAIhE,+EAA+E;IAC/E,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIzD,+DAA+D;IAC/D,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,OAAO;IAIrC,2DAA2D;IAC3D,GAAG,IAAI,cAAc,EAAE;IAIvB,yDAAyD;IACzD,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE;IAI5B;;;;;;;;;;;;;;OAcG;IACH,cAAc,IAAI,KAAK,CAAC;QAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAOzE,OAAO,CAAC,qBAAqB;CAsB9B"}