@dudousxd/nestjs-authz 0.8.0 → 0.9.0

package/dist/module.js

@@ -11,226 +11,197 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 var AuthzModule_1;
+import { AUTHORIZATION_MODULE_OPTIONS, defaultGetUser, } from '@nestjs/authorization';
 import { Inject, Injectable, Module, Optional, } from '@nestjs/common';
-import { APP_GUARD, DiscoveryModule, DiscoveryService, ModuleRef } from '@nestjs/core';
+import { APP_GUARD, APP_INTERCEPTOR, DiscoveryModule } from '@nestjs/core';
+import { AuthzGuard, AuthzGuardStartupCheck } from './authz.guard.js';
 import { DEFAULT_CAN_ENDPOINT_PATH, createCanController } from './can-endpoint.controller.js';
-import { getPolicyResource } from './decorator/policy.decorator.js';
+import { AuthzDecisionPublisher } from './decisions.js';
 import { Gate } from './gate.js';
-import { CanGuard } from './guard/can.guard.js';
-import { RolesGuard } from './guard/roles.guard.js';
-import { PolicyRegistry } from './policy-registry.js';
+import { OFFICIAL_CAN_ANYONE_METADATA } from './official.js';
+import { GatePolicy } from './policies/gate.policy.js';
+import { PermissionPolicy } from './policies/permission.policy.js';
+import { RolePolicy } from './policies/role.policy.js';
+import { PolicyIndex } from './policy-index.js';
+import { AuthzRbac } from './rbac.js';
 import { IdParamResourceResolver } from './resource-resolver.js';
+import { configureAuthzRuntime } from './runtime.js';
 import { AUTHZ_MODULE_OPTIONS, RESOURCE_HYDRATOR, RESOURCE_RESOLVER } from './tokens.js';
 /**
- * Populates the {@link PolicyRegistry} at boot from explicit `policies: []` and
- * auto-discovered `@Policy`-decorated providers.
- *
- * Explicit policies are read from the RESOLVED {@link AUTHZ_MODULE_OPTIONS} (so a
- * `forRootAsync` `useFactory`/`useClass` that returns `policies: [...]` registers
- * them too) and resolved as provider instances via {@link ModuleRef}.
+ * Hands the official `@Can()` argument resolvers and `AuthzPolicy` what they cannot
+ * inject: the resource resolver, the `superAdmin` hook, the external decision point,
+ * and the official `getUser`.
  */
-let AuthzPolicyBootstrap = class AuthzPolicyBootstrap {
-    registry;
-    discovery;
-    moduleRef;
+let AuthzRuntimeBootstrap = class AuthzRuntimeBootstrap {
+    resolver;
+    rbac;
     options;
-    constructor(registry, discovery, moduleRef, options) {
-        this.registry = registry;
-        this.discovery = discovery;
-        this.moduleRef = moduleRef;
+    official;
+    constructor(resolver, rbac, options, official) {
+        this.resolver = resolver;
+        this.rbac = rbac;
         this.options = options;
+        this.official = official;
     }
-    async onModuleInit() {
-        const seen = new Set();
-        // 1. Explicit `policies: []` from resolved options (forRoot AND forRootAsync).
-        for (const PolicyClass of this.options?.policies ?? []) {
-            if (seen.has(PolicyClass))
-                continue;
-            const instance = await this.resolvePolicyInstance(PolicyClass);
-            if (instance) {
-                seen.add(PolicyClass);
-                this.registry.register(instance);
-            }
-        }
-        // 2. Auto-discovered @Policy-decorated providers.
-        for (const wrapper of this.discovery.getProviders()) {
-            const instance = wrapper.instance;
-            if (!instance || typeof instance !== 'object')
-                continue;
-            const ctor = instance.constructor;
-            if (!ctor || seen.has(ctor))
-                continue;
-            if (getPolicyResource(instance)) {
-                seen.add(ctor);
-                this.registry.register(instance);
-            }
-        }
-    }
-    /**
-     * Resolve a policy class to an instance. Prefers an existing provider (so DI
-     * deps are honored); falls back to instantiating it through the container when
-     * the class was passed via `forRootAsync` options but not registered as a
-     * provider anywhere.
-     */
-    async resolvePolicyInstance(PolicyClass) {
-        try {
-            return this.moduleRef.get(PolicyClass, { strict: false });
-        }
-        catch {
-            // not a registered provider — instantiate via the container.
-        }
-        try {
-            return await this.moduleRef.create(PolicyClass);
-        }
-        catch {
-            return undefined;
-        }
+    onModuleInit() {
+        configureAuthzRuntime({
+            resourceResolver: this.resolver,
+            superAdmin: this.options?.superAdmin,
+            decisionProvider: () => this.rbac.decisions(),
+            // Always set: an app without its own `getUser` must not keep a previous app's.
+            getUser: this.official?.getUser ?? defaultGetUser,
+        });
     }
 };
-AuthzPolicyBootstrap = __decorate([
+AuthzRuntimeBootstrap = __decorate([
     Injectable(),
+    __param(0, Inject(RESOURCE_RESOLVER)),
+    __param(2, Optional()),
+    __param(2, Inject(AUTHZ_MODULE_OPTIONS)),
     __param(3, Optional()),
-    __param(3, Inject(AUTHZ_MODULE_OPTIONS)),
-    __metadata("design:paramtypes", [PolicyRegistry,
-        DiscoveryService,
-        ModuleRef, Object])
-], AuthzPolicyBootstrap);
+    __param(3, Inject(AUTHORIZATION_MODULE_OPTIONS)),
+    __metadata("design:paramtypes", [Object, AuthzRbac, Object, Object])
+], AuthzRuntimeBootstrap);
+/** The static options, which a `forRootAsync()` factory returning them would silently drop. */
+const STATIC_OPTIONS = ['unannotated', 'decorators'];
+function checkFactoryOptions(options) {
+    for (const key of STATIC_OPTIONS) {
+        if (options?.[key] !== undefined) {
+            throw new Error(`AuthzModule: \`${key}\` is in the options the forRootAsync() factory returned. It goes at the top level of forRootAsync(), next to useFactory, because it decides what the module registers.`);
+        }
+    }
+    return options;
+}
+const EXPORTS = [
+    Gate,
+    AuthzGuard,
+    PolicyIndex,
+    AuthzRbac,
+    RolePolicy,
+    PermissionPolicy,
+    GatePolicy,
+    AUTHZ_MODULE_OPTIONS,
+    RESOURCE_RESOLVER,
+    RESOURCE_HYDRATOR,
+];
+/**
+ * The extras on top of `@nestjs/authorization`. Import it next to the official module:
+ *
+ * ```ts
+ * imports: [
+ *   AuthorizationModule.forRoot(),            // the official guard, @Can, AuthorizationService
+ *   AuthzModule.forRoot({ superAdmin: (u) => u?.isRoot === true }),
+ * ]
+ * ```
+ *
+ * Registers `RolePolicy`, `PermissionPolicy` and `GatePolicy` (official policies), the
+ * `Gate`, the resource resolver `byId()` uses, and the allow+deny decision event.
+ * It needs the official module to be global (its default).
+ */
 let AuthzModule = AuthzModule_1 = class AuthzModule {
     static forRoot(options = {}) {
-        const policyProviders = (options.policies ?? []).map((P) => P);
         return {
             module: AuthzModule_1,
             global: true,
             imports: [DiscoveryModule],
-            controllers: AuthzModule_1.canControllers(options.canEndpoint),
+            controllers: AuthzModule_1.controllers(options),
             providers: [
                 { provide: AUTHZ_MODULE_OPTIONS, useValue: options },
-                ...policyProviders,
-                PolicyRegistry,
-                Gate,
-                CanGuard,
-                { provide: APP_GUARD, useExisting: CanGuard },
-                RolesGuard,
-                { provide: APP_GUARD, useExisting: RolesGuard },
-                ...AuthzModule_1.resourceResolverProviders(),
-                ...AuthzModule_1.resourceHydratorProviders(),
-                ...AuthzModule_1.bootstrapProviders(),
-            ],
-            exports: [
-                Gate,
-                PolicyRegistry,
-                CanGuard,
-                RolesGuard,
-                AUTHZ_MODULE_OPTIONS,
-                RESOURCE_RESOLVER,
-                RESOURCE_HYDRATOR,
-                ...(options.policies ?? []),
+                ...AuthzModule_1.common(),
+                ...AuthzModule_1.guards(options),
             ],
+            exports: EXPORTS,
         };
     }
     static forRootAsync(options) {
-        const asyncProvider = AuthzModule_1.buildAsyncOptionsProvider(options);
-        const asyncProviders = Array.isArray(asyncProvider) ? asyncProvider : [asyncProvider];
         return {
             module: AuthzModule_1,
             global: true,
             imports: [DiscoveryModule, ...(options.imports ?? [])],
-            controllers: AuthzModule_1.canControllers(options.canEndpoint),
+            controllers: AuthzModule_1.controllers(options),
             providers: [
-                ...asyncProviders,
-                PolicyRegistry,
-                Gate,
-                CanGuard,
-                { provide: APP_GUARD, useExisting: CanGuard },
-                RolesGuard,
-                { provide: APP_GUARD, useExisting: RolesGuard },
-                ...AuthzModule_1.resourceResolverProviders(),
-                ...AuthzModule_1.resourceHydratorProviders(),
-                ...AuthzModule_1.bootstrapProviders(),
-            ],
-            exports: [
-                Gate,
-                PolicyRegistry,
-                CanGuard,
-                RolesGuard,
-                AUTHZ_MODULE_OPTIONS,
-                RESOURCE_RESOLVER,
-                RESOURCE_HYDRATOR,
+                ...AuthzModule_1.asyncOptionsProviders(options),
+                ...AuthzModule_1.common(),
+                ...AuthzModule_1.guards(options),
             ],
+            exports: EXPORTS,
         };
     }
-    /**
-     * Register a default {@link ResourceResolver} bound to {@link RESOURCE_RESOLVER}
-     * so `@Can('update', Post)` works out-of-the-box on a clean install (no manual
-     * resolver wiring needed). Reads the resolved options so a `resourceResolver`
-     * override / `idParam` knob from forRoot OR forRootAsync is honored.
-     */
-    static resourceResolverProviders() {
+    static common() {
         return [
+            PolicyIndex,
+            AuthzRbac,
+            Gate,
+            RolePolicy,
+            PermissionPolicy,
+            GatePolicy,
             {
                 provide: RESOURCE_RESOLVER,
                 useFactory: (options) => options?.resourceResolver ?? new IdParamResourceResolver(options?.idParam),
                 inject: [{ token: AUTHZ_MODULE_OPTIONS, optional: true }],
             },
-        ];
-    }
-    /**
-     * Bind the {@link RESOURCE_HYDRATOR} token to the resolved options'
-     * `resourceLoaders` map so the opt-in `POST /authz/can` endpoint can rehydrate a
-     * `{ type, id }` shim into the REAL entity before authorizing. Reads the resolved
-     * options so the map from forRoot OR a forRootAsync factory is honored. Resolves to
-     * `undefined` when no `resourceLoaders` are configured (endpoint behavior unchanged).
-     */
-    static resourceHydratorProviders() {
-        return [
             {
                 provide: RESOURCE_HYDRATOR,
                 useFactory: (options) => options?.resourceLoaders,
                 inject: [{ token: AUTHZ_MODULE_OPTIONS, optional: true }],
             },
+            AuthzGuard,
+            AuthzRuntimeBootstrap,
+            AuthzDecisionPublisher,
+            { provide: APP_INTERCEPTOR, useExisting: AuthzDecisionPublisher },
         ];
     }
     /**
-     * Provider that populates the {@link PolicyRegistry} on init (explicit policies
-     * + auto-discovered `@Policy` providers). Registered for both forRoot/forRootAsync.
+     * `unannotated: 'allow'`: the migration guard, registered globally, and the check that the
+     * official global guard is off. Static, so it is read from `forRoot()` / the top level of
+     * `forRootAsync()`, never from the factory.
      */
-    static bootstrapProviders() {
-        return [AuthzPolicyBootstrap];
+    static guards(options) {
+        const mode = options.unannotated ?? 'deny';
+        if (mode !== 'allow' && mode !== 'deny') {
+            throw new Error(`AuthzModule: \`unannotated\` must be 'allow' or 'deny', got ${String(mode)}.`);
+        }
+        if (mode === 'deny')
+            return [];
+        return [AuthzGuardStartupCheck, { provide: APP_GUARD, useExisting: AuthzGuard }];
     }
     /**
-     * Build the opt-in `POST /authz/can` fallback controller (or none). Off by
-     * default; `true` mounts at the default path, a string mounts at that path.
+     * The controllers this module mounts, each a fresh class (so `decorators` never leak between
+     * registrations), open to the official guard, then decorated with `decorators`.
      */
-    static canControllers(canEndpoint) {
+    static controllers(options) {
+        const { canEndpoint, decorators = [] } = options;
         if (!canEndpoint)
             return [];
         const path = typeof canEndpoint === 'string' ? canEndpoint : DEFAULT_CAN_ENDPOINT_PATH;
-        return [createCanController(path)];
-    }
-    static buildAsyncOptionsProvider(options) {
-        if (options.useFactory) {
-            return {
-                provide: AUTHZ_MODULE_OPTIONS,
-                useFactory: options.useFactory,
-                inject: (options.inject ?? []),
-            };
+        const controller = createCanController(path);
+        Reflect.defineMetadata(OFFICIAL_CAN_ANYONE_METADATA, true, controller);
+        // Applied in order, after the module's own, like a stack written above the class.
+        for (const decorate of [...decorators].reverse()) {
+            decorate(controller);
         }
-        if (options.useClass) {
+        return [controller];
+    }
+    static asyncOptionsProviders(options) {
+        const { useFactory } = options;
+        if (useFactory) {
             return [
-                { provide: options.useClass, useClass: options.useClass },
                 {
                     provide: AUTHZ_MODULE_OPTIONS,
-                    useFactory: async (factory) => factory.createAuthzOptions(),
-                    inject: [options.useClass],
+                    useFactory: async (...args) => checkFactoryOptions(await useFactory(...args)),
+                    inject: (options.inject ?? []),
                 },
             ];
         }
-        const factoryClass = options.useExisting;
-        return {
-            provide: AUTHZ_MODULE_OPTIONS,
-            useFactory: async (factory) => factory.createAuthzOptions(),
-            inject: [factoryClass],
-        };
+        const factory = (options.useClass ?? options.useExisting);
+        return [
+            ...(options.useClass ? [{ provide: options.useClass, useClass: options.useClass }] : []),
+            {
+                provide: AUTHZ_MODULE_OPTIONS,
+                useFactory: async (f) => checkFactoryOptions(await f.createAuthzOptions()),
+                inject: [factory],
+            },
+        ];
     }
 };
 AuthzModule = AuthzModule_1 = __decorate([

package/dist/module.js.map

@@ -1 +1 @@
-{"version":3,"file":"module.js","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EAEL,MAAM,EACN,UAAU,EACV,MAAM,EAEN,QAAQ,GAGT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACvF,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAyB,MAAM,wBAAwB,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AASzF;;;;;;;GAOG;AACH,IACM,oBAAoB,GAD1B,MACM,oBAAoB;IAEL;IACA;IACA;IAC0C;IAJ7D,YACmB,QAAwB,EACxB,SAA2B,EAC3B,SAAoB,EACsB,OAA4B;QAHtE,aAAQ,GAAR,QAAQ,CAAgB;QACxB,cAAS,GAAT,SAAS,CAAkB;QAC3B,cAAS,GAAT,SAAS,CAAW;QACsB,YAAO,GAAP,OAAO,CAAqB;IACtF,CAAC;IAEJ,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAW,CAAC;QAEhC,+EAA+E;QAC/E,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;YACvD,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;gBAAE,SAAS;YACpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;YAC/D,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACtB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,kDAAkD;QAClD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAsC,CAAC;YAChE,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;gBAAE,SAAS;YACxD,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,CAAC;YAClC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YACtC,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACf,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,qBAAqB,CACjC,WAAiC;QAEjC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAiB,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;QAC/D,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAiB,WAAW,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF,CAAA;AAtDK,oBAAoB;IADzB,UAAU,EAAE;IAMR,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,oBAAoB,CAAC,CAAA;qCAHd,cAAc;QACb,gBAAgB;QAChB,SAAS;GAJnC,oBAAoB,CAsDzB;AAGM,IAAM,WAAW,mBAAjB,MAAM,WAAW;IACtB,MAAM,CAAC,OAAO,CAAC,UAA8B,EAAE;QAC7C,MAAM,eAAe,GAAe,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAa,CAAC,CAAC;QACvF,OAAO;YACL,MAAM,EAAE,aAAW;YACnB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,eAAe,CAAC;YAC1B,WAAW,EAAE,aAAW,CAAC,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC;YAC5D,SAAS,EAAE;gBACT,EAAE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,OAAO,EAAE;gBACpD,GAAG,eAAe;gBAClB,cAAc;gBACd,IAAI;gBACJ,QAAQ;gBACR,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE;gBAC7C,UAAU;gBACV,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE;gBAC/C,GAAG,aAAW,CAAC,yBAAyB,EAAE;gBAC1C,GAAG,aAAW,CAAC,yBAAyB,EAAE;gBAC1C,GAAG,aAAW,CAAC,kBAAkB,EAAE;aACpC;YACD,OAAO,EAAE;gBACP,IAAI;gBACJ,cAAc;gBACd,QAAQ;gBACR,UAAU;gBACV,oBAAoB;gBACpB,iBAAiB;gBACjB,iBAAiB;gBACjB,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;aAC5B;SACF,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,OAAgC;QAClD,MAAM,aAAa,GAAG,aAAW,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACtF,OAAO;YACL,MAAM,EAAE,aAAW;YACnB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,eAAe,EAAE,GAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAqB,CAAC;YAC3E,WAAW,EAAE,aAAW,CAAC,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC;YAC5D,SAAS,EAAE;gBACT,GAAG,cAAc;gBACjB,cAAc;gBACd,IAAI;gBACJ,QAAQ;gBACR,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE;gBAC7C,UAAU;gBACV,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE;gBAC/C,GAAG,aAAW,CAAC,yBAAyB,EAAE;gBAC1C,GAAG,aAAW,CAAC,yBAAyB,EAAE;gBAC1C,GAAG,aAAW,CAAC,kBAAkB,EAAE;aACpC;YACD,OAAO,EAAE;gBACP,IAAI;gBACJ,cAAc;gBACd,QAAQ;gBACR,UAAU;gBACV,oBAAoB;gBACpB,iBAAiB;gBACjB,iBAAiB;aAClB;SACF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,yBAAyB;QACtC,OAAO;YACL;gBACE,OAAO,EAAE,iBAAiB;gBAC1B,UAAU,EAAE,CAAC,OAA4B,EAAoB,EAAE,CAC7D,OAAO,EAAE,gBAAgB,IAAI,IAAI,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC;gBAC5E,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;aAC1D;SACF,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,yBAAyB;QACtC,OAAO;YACL;gBACE,OAAO,EAAE,iBAAiB;gBAC1B,UAAU,EAAE,CAAC,OAA4B,EAAiC,EAAE,CAC1E,OAAO,EAAE,eAAe;gBAC1B,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;aAC1D;SACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,kBAAkB;QAC/B,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAChC,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,cAAc,CAAC,WAAyC;QACrE,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,yBAAyB,CAAC;QACvF,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;IACrC,CAAC;IAEO,MAAM,CAAC,yBAAyB,CACtC,OAAgC;QAEhC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,OAAO;gBACL,OAAO,EAAE,oBAAoB;gBAC7B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAyB;aACvD,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,OAAO;gBACL,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;gBACzD;oBACE,OAAO,EAAE,oBAAoB;oBAC7B,UAAU,EAAE,KAAK,EAAE,OAAkC,EAAE,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE;oBACtF,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;iBAC3B;aACF,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,OAAO,CAAC,WAA8C,CAAC;QAC5E,OAAO;YACL,OAAO,EAAE,oBAAoB;YAC7B,UAAU,EAAE,KAAK,EAAE,OAAkC,EAAE,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE;YACtF,MAAM,EAAE,CAAC,YAAY,CAAC;SACvB,CAAC;IACJ,CAAC;CACF,CAAA;AAlJY,WAAW;IADvB,MAAM,CAAC,EAAE,CAAC;GACE,WAAW,CAkJvB"}
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EACL,4BAA4B,EAE5B,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,MAAM,EACN,UAAU,EACV,MAAM,EAEN,QAAQ,GAGT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAC9F,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,uBAAuB,EAAyB,MAAM,wBAAwB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AASzF;;;;GAIG;AACH,IACM,qBAAqB,GAD3B,MACM,qBAAqB;IAEqB;IAC3B;IAC0C;IAG1C;IANnB,YAC8C,QAA0B,EACrD,IAAe,EAC2B,OAA4B,EAGtE,QAAqC;QALV,aAAQ,GAAR,QAAQ,CAAkB;QACrD,SAAI,GAAJ,IAAI,CAAW;QAC2B,YAAO,GAAP,OAAO,CAAqB;QAGtE,aAAQ,GAAR,QAAQ,CAA6B;IACrD,CAAC;IAEJ,YAAY;QACV,qBAAqB,CAAC;YACpB,gBAAgB,EAAE,IAAI,CAAC,QAAQ;YAC/B,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU;YACpC,gBAAgB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAC7C,+EAA+E;YAC/E,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI,cAAc;SAClD,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAnBK,qBAAqB;IAD1B,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,iBAAiB,CAAC,CAAA;IAEzB,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,oBAAoB,CAAC,CAAA;IACxC,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,MAAM,CAAC,4BAA4B,CAAC,CAAA;6CAHd,SAAS;GAH9B,qBAAqB,CAmB1B;AAED,+FAA+F;AAC/F,MAAM,cAAc,GAAG,CAAC,aAAa,EAAE,YAAY,CAAU,CAAC;AAE9D,SAAS,mBAAmB,CAAC,OAA2B;IACtD,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,IAAI,OAAO,EAAE,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,kBAAkB,GAAG,yKAAyK,CAC/L,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,OAAO,GAAG;IACd,IAAI;IACJ,UAAU;IACV,WAAW;IACX,SAAS;IACT,UAAU;IACV,gBAAgB;IAChB,UAAU;IACV,oBAAoB;IACpB,iBAAiB;IACjB,iBAAiB;CAClB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AAEI,IAAM,WAAW,mBAAjB,MAAM,WAAW;IACtB,MAAM,CAAC,OAAO,CAAC,UAA8B,EAAE;QAC7C,OAAO;YACL,MAAM,EAAE,aAAW;YACnB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,eAAe,CAAC;YAC1B,WAAW,EAAE,aAAW,CAAC,WAAW,CAAC,OAAO,CAAC;YAC7C,SAAS,EAAE;gBACT,EAAE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,OAAO,EAAE;gBACpD,GAAG,aAAW,CAAC,MAAM,EAAE;gBACvB,GAAG,aAAW,CAAC,MAAM,CAAC,OAAO,CAAC;aAC/B;YACD,OAAO,EAAE,OAAO;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,OAAgC;QAClD,OAAO;YACL,MAAM,EAAE,aAAW;YACnB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,eAAe,EAAE,GAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAqB,CAAC;YAC3E,WAAW,EAAE,aAAW,CAAC,WAAW,CAAC,OAAO,CAAC;YAC7C,SAAS,EAAE;gBACT,GAAG,aAAW,CAAC,qBAAqB,CAAC,OAAO,CAAC;gBAC7C,GAAG,aAAW,CAAC,MAAM,EAAE;gBACvB,GAAG,aAAW,CAAC,MAAM,CAAC,OAAO,CAAC;aAC/B;YACD,OAAO,EAAE,OAAO;SACjB,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,MAAM;QACnB,OAAO;YACL,WAAW;YACX,SAAS;YACT,IAAI;YACJ,UAAU;YACV,gBAAgB;YAChB,UAAU;YACV;gBACE,OAAO,EAAE,iBAAiB;gBAC1B,UAAU,EAAE,CAAC,OAA4B,EAAoB,EAAE,CAC7D,OAAO,EAAE,gBAAgB,IAAI,IAAI,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC;gBAC5E,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;aAC1D;YACD;gBACE,OAAO,EAAE,iBAAiB;gBAC1B,UAAU,EAAE,CAAC,OAA4B,EAAiC,EAAE,CAC1E,OAAO,EAAE,eAAe;gBAC1B,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;aAC1D;YACD,UAAU;YACV,qBAAqB;YACrB,sBAAsB;YACtB,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,sBAAsB,EAAE;SAClE,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,MAAM,CAAC,OAAiC;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC;QAC3C,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,+DAA+D,MAAM,CAAC,IAAI,CAAC,GAAG,CAC/E,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,EAAE,CAAC;QAC/B,OAAO,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;IACnF,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,WAAW,CAAC,OAAiC;QAC1D,MAAM,EAAE,WAAW,EAAE,UAAU,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC;QACjD,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,yBAAyB,CAAC;QACvF,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC7C,OAAO,CAAC,cAAc,CAAC,4BAA4B,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QACvE,kFAAkF;QAClF,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACjD,QAAQ,CAAC,UAAU,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,CAAC,UAAU,CAAC,CAAC;IACtB,CAAC;IAEO,MAAM,CAAC,qBAAqB,CAAC,OAAgC;QACnE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAC/B,IAAI,UAAU,EAAE,CAAC;YACf,OAAO;gBACL;oBACE,OAAO,EAAE,oBAAoB;oBAC7B,UAAU,EAAE,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;oBACxF,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAyB;iBACvD;aACF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAoC,CAAC;QAC7F,OAAO;YACL,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF;gBACE,OAAO,EAAE,oBAAoB;gBAC7B,UAAU,EAAE,KAAK,EAAE,CAA4B,EAAE,EAAE,CACjD,mBAAmB,CAAC,MAAM,CAAC,CAAC,kBAAkB,EAAE,CAAC;gBACnD,MAAM,EAAE,CAAC,OAAO,CAAC;aAClB;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AAjHY,WAAW;IADvB,MAAM,CAAC,EAAE,CAAC;GACE,WAAW,CAiHvB"}

package/dist/official.d.ts

@@ -0,0 +1,39 @@
+import 'reflect-metadata';
+import type { ExecutionContext, Type } from '@nestjs/common';
+/**
+ * The metadata keys `@nestjs/authorization` reads and writes. The package does not
+ * export them, so they are spelled here, once. `test/official-contract.spec.ts`
+ * fails if the official package stops honoring metadata written under these keys.
+ */
+export declare const OFFICIAL_POLICY_METADATA = "authorization:policy";
+/** Written by the official `@Can()`: an array of {@link OfficialCanRequirement}, read top-down. */
+export declare const OFFICIAL_CAN_METADATA = "authorization:can";
+/** Written by the official `Can.Anyone()`. */
+export declare const OFFICIAL_CAN_ANYONE_METADATA = "authorization:can-anyone";
+/**
+ * Written by `@nestjs/authentication`'s `@Public()` (`true`) and `@Authenticate()` (`false`).
+ * A registry symbol, which the official guard reads without depending on that package.
+ */
+export declare const OFFICIAL_PUBLIC_METADATA: unique symbol;
+/** One official `@Can()` requirement, as stored in the metadata. */
+export interface OfficialCanRequirement {
+    policy: Type<unknown>;
+    ability: string;
+    args?: (context: ExecutionContext) => readonly unknown[] | Promise<readonly unknown[]>;
+}
+/** True when `value` is a class marked with the official `@Policy()`. */
+export declare function isOfficialPolicy(value: unknown): value is Type<unknown>;
+/** The official `@Can()` requirements declared directly on `target` (a class or a method). */
+export declare function readCanRequirements(target: object): OfficialCanRequirement[];
+/**
+ * The requirements the official guard enforces on `handler` of `type`: the class's
+ * first, then the method's, the class's dropped when the method is opened with
+ * `Can.Anyone()` or `@Public()`. Mirrors the official `routeChecks()`.
+ */
+export declare function routeRequirements(type: Type<unknown>, handler: object): OfficialCanRequirement[];
+/**
+ * `dependency`, or a clear error when `@nestjs/authorization`'s `AuthorizationModule` is not
+ * imported: without it Nest only reports an unresolvable constructor argument of `consumer`.
+ */
+export declare function requireOfficial<T>(dependency: T | undefined, name: string, consumer: string): T;
+//# sourceMappingURL=official.d.ts.map

package/dist/official.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"official.d.ts","sourceRoot":"","sources":["../src/official.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAE7D;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,yBAAyB,CAAC;AAC/D,mGAAmG;AACnG,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AACzD,8CAA8C;AAC9C,eAAO,MAAM,4BAA4B,6BAA6B,CAAC;AACvE;;;GAGG;AACH,eAAO,MAAM,wBAAwB,eAA8C,CAAC;AAEpF,oEAAoE;AACpE,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC,CAAC;CACxF;AAED,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,CAIvE;AAED,8FAA8F;AAC9F,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,sBAAsB,EAAE,CAE5E;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,sBAAsB,EAAE,CAKhG;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,CAAC,CAK/F"}

package/dist/official.js

@@ -0,0 +1,44 @@
+import 'reflect-metadata';
+/**
+ * The metadata keys `@nestjs/authorization` reads and writes. The package does not
+ * export them, so they are spelled here, once. `test/official-contract.spec.ts`
+ * fails if the official package stops honoring metadata written under these keys.
+ */
+export const OFFICIAL_POLICY_METADATA = 'authorization:policy';
+/** Written by the official `@Can()`: an array of {@link OfficialCanRequirement}, read top-down. */
+export const OFFICIAL_CAN_METADATA = 'authorization:can';
+/** Written by the official `Can.Anyone()`. */
+export const OFFICIAL_CAN_ANYONE_METADATA = 'authorization:can-anyone';
+/**
+ * Written by `@nestjs/authentication`'s `@Public()` (`true`) and `@Authenticate()` (`false`).
+ * A registry symbol, which the official guard reads without depending on that package.
+ */
+export const OFFICIAL_PUBLIC_METADATA = Symbol.for('@nestjs/authentication:public');
+/** True when `value` is a class marked with the official `@Policy()`. */
+export function isOfficialPolicy(value) {
+    return (typeof value === 'function' && Reflect.getMetadata(OFFICIAL_POLICY_METADATA, value) === true);
+}
+/** The official `@Can()` requirements declared directly on `target` (a class or a method). */
+export function readCanRequirements(target) {
+    return Reflect.getMetadata(OFFICIAL_CAN_METADATA, target) ?? [];
+}
+/**
+ * The requirements the official guard enforces on `handler` of `type`: the class's
+ * first, then the method's, the class's dropped when the method is opened with
+ * `Can.Anyone()` or `@Public()`. Mirrors the official `routeChecks()`.
+ */
+export function routeRequirements(type, handler) {
+    const methodOpen = Reflect.getMetadata(OFFICIAL_PUBLIC_METADATA, handler) === true ||
+        Reflect.getMetadata(OFFICIAL_CAN_ANYONE_METADATA, handler) === true;
+    return [...(methodOpen ? [] : readCanRequirements(type)), ...readCanRequirements(handler)];
+}
+/**
+ * `dependency`, or a clear error when `@nestjs/authorization`'s `AuthorizationModule` is not
+ * imported: without it Nest only reports an unresolvable constructor argument of `consumer`.
+ */
+export function requireOfficial(dependency, name, consumer) {
+    if (dependency !== undefined && dependency !== null)
+        return dependency;
+    throw new Error(`AuthzModule: ${consumer} needs ${name} from @nestjs/authorization, which is not available. Import AuthorizationModule.forRoot() (global, its default) next to AuthzModule: imports: [AuthorizationModule.forRoot(), AuthzModule.forRoot()].`);
+}
+//# sourceMappingURL=official.js.map

package/dist/official.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"official.js","sourceRoot":"","sources":["../src/official.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAG1B;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAC/D,mGAAmG;AACnG,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AACzD,8CAA8C;AAC9C,MAAM,CAAC,MAAM,4BAA4B,GAAG,0BAA0B,CAAC;AACvE;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;AASpF,yEAAyE;AACzE,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,CACL,OAAO,KAAK,KAAK,UAAU,IAAI,OAAO,CAAC,WAAW,CAAC,wBAAwB,EAAE,KAAK,CAAC,KAAK,IAAI,CAC7F,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAQ,OAAO,CAAC,WAAW,CAAC,qBAAqB,EAAE,MAAM,CAA8B,IAAI,EAAE,CAAC;AAChG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAmB,EAAE,OAAe;IACpE,MAAM,UAAU,GACd,OAAO,CAAC,WAAW,CAAC,wBAAwB,EAAE,OAAO,CAAC,KAAK,IAAI;QAC/D,OAAO,CAAC,WAAW,CAAC,4BAA4B,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACtE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAI,UAAyB,EAAE,IAAY,EAAE,QAAgB;IAC1F,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC;IACvE,MAAM,IAAI,KAAK,CACb,gBAAgB,QAAQ,UAAU,IAAI,uMAAuM,CAC9O,CAAC;AACJ,CAAC"}

package/dist/permission-cache.d.ts

@@ -1,21 +1,28 @@
 import type { PermissionProvider } from './permission-provider.js';
+import type { RoleProvider } from './role-provider.js';
 import type { User } from './types.js';
 /**
- * A memo over a {@link PermissionProvider}'s `getPermissions(user)` so a user's
- * granted-permission set is fetched AT MOST ONCE per logical scope (a single
- * `allowsMany` batch, or — when wired to nestjs-context — a single HTTP request).
+ * A memo over a {@link PermissionProvider}'s `getPermissions(user)` and a
+ * {@link RoleProvider}'s `getRoles(user)` so each is fetched AT MOST ONCE per
+ * logical scope (a single `allowsMany` batch, or — when wired to nestjs-context —
+ * a single HTTP request).
  *
  * Without it, every `gate.allows(...)` re-fetches the set (an N+1 within a list
- * page, since each card runs its own check). The cache keys by the resolved
- * `user` identity so two checks for the SAME user share one fetch while a
- * different user still triggers its own.
+ * page, since each card runs its own check). Entries are keyed by the row a user
+ * names (see {@link rowKey}), else by identity, so checks for the SAME user share
+ * one fetch while a different user still triggers its own. The granted set is
+ * compiled once per entry, so each check is a hash lookup plus a scan of the
+ * wildcard grants only.
  *
- * Only the `getPermissions` (full-set, wildcard-matched) path is memoized — the
- * exact-match `hasPermission` fast path is left to the provider, which is free to
- * memoize internally. A provider WITHOUT `getPermissions` makes this a no-op.
+ * A grant or revocation made while the scope is alive is seen by the next scope
+ * (the next request), not by later checks in the same one.
  */
 export declare class PermissionCache {
     private readonly byUser;
+    private readonly rolesByUser;
+    private readonly rowTokens;
+    private userCacheKey;
+    private compiled;
     /**
      * Resolve the user's granted-permission set via the provider, memoized for the
      * cache's lifetime. Returns `undefined` when the provider can't list grants
@@ -29,5 +36,7 @@ export declare class PermissionCache {
      * defer to `hasPermission`).
      */
     satisfies(provider: PermissionProvider, user: User, ability: string): Promise<boolean | undefined>;
+    /** The user's roles from `provider`, memoized for the cache's lifetime. */
+    getRoles(provider: RoleProvider, user: User): Promise<string[] | undefined>;
 }
 //# sourceMappingURL=permission-cache.d.ts.map

package/dist/permission-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-cache.d.ts","sourceRoot":"","sources":["../src/permission-cache.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEvC;;;;;;;;;;;;;GAaG;AACH,qBAAa,eAAe;IAG1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgE;IAEvF;;;;;OAKG;IACG,cAAc,CAClB,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE,IAAI,GACT,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IAW3C;;;;OAIG;IACG,SAAS,CACb,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;CAKhC"}
+{"version":3,"file":"permission-cache.d.ts","sourceRoot":"","sources":["../src/permission-cache.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAmCvC;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,eAAe;IAG1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgE;IACvF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqD;IAEjF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA6B;IAEvD,OAAO,CAAC,YAAY;IAYpB,OAAO,CAAC,QAAQ;IAgBhB;;;;;OAKG;IACG,cAAc,CAClB,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE,IAAI,GACT,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IAI3C;;;;OAIG;IACG,SAAS,CACb,QAAQ,EAAE,kBAAkB,EAC5B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IAI/B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC;CAS5E"}