@dudousxd/nestjs-authz 0.8.0 → 0.9.0

package/dist/permission-cache.js

@@ -1,22 +1,84 @@
-import { permissionSatisfied } from './permission-matcher.js';
+import { CompiledPermissions } from './permission-matcher.js';
+/** A distinct number per user class, so two classes that share a name never share a key. */
+const classIds = new WeakMap();
+let nextClassId = 0;
+function classIdOf(ctor) {
+    let id = classIds.get(ctor);
+    if (id === undefined) {
+        id = nextClassId++;
+        classIds.set(ctor, id);
+    }
+    return id;
+}
+/**
+ * The string identity of a user object that names its row, or `undefined` when it
+ * doesn't. A string/number `id` names a row when the object also says what kind of
+ * row it is: a string `type`, or a class of its own (an ORM entity). Two
+ * separately-loaded copies of that row (an ORM without an identity map, or a
+ * re-hydrated user) then share one entry. A plain object without `type` names
+ * nothing beyond itself (a human user and a service account may both be `{ id: 1 }`),
+ * so it keys by identity.
+ */
+function rowKey(user) {
+    const { type, id } = user;
+    if (typeof id !== 'string' && typeof id !== 'number')
+        return undefined;
+    const proto = Object.getPrototypeOf(user);
+    const plain = proto === null || proto === Object.prototype;
+    if (plain && typeof type !== 'string')
+        return undefined;
+    const ctor = proto?.constructor;
+    const kind = typeof ctor === 'function' ? classIdOf(ctor) : -1;
+    return JSON.stringify([kind, typeof type === 'string' ? type : null, typeof id, id]);
+}
 /**
- * A memo over a {@link PermissionProvider}'s `getPermissions(user)` so a user's
- * granted-permission set is fetched AT MOST ONCE per logical scope (a single
- * `allowsMany` batch, or — when wired to nestjs-context — a single HTTP request).
+ * A memo over a {@link PermissionProvider}'s `getPermissions(user)` and a
+ * {@link RoleProvider}'s `getRoles(user)` so each is fetched AT MOST ONCE per
+ * logical scope (a single `allowsMany` batch, or — when wired to nestjs-context —
+ * a single HTTP request).
  *
  * Without it, every `gate.allows(...)` re-fetches the set (an N+1 within a list
- * page, since each card runs its own check). The cache keys by the resolved
- * `user` identity so two checks for the SAME user share one fetch while a
- * different user still triggers its own.
+ * page, since each card runs its own check). Entries are keyed by the row a user
+ * names (see {@link rowKey}), else by identity, so checks for the SAME user share
+ * one fetch while a different user still triggers its own. The granted set is
+ * compiled once per entry, so each check is a hash lookup plus a scan of the
+ * wildcard grants only.
  *
- * Only the `getPermissions` (full-set, wildcard-matched) path is memoized — the
- * exact-match `hasPermission` fast path is left to the provider, which is free to
- * memoize internally. A provider WITHOUT `getPermissions` makes this a no-op.
+ * A grant or revocation made while the scope is alive is seen by the next scope
+ * (the next request), not by later checks in the same one.
  */
 export class PermissionCache {
-    // Keyed by the user object identity. `Map` (not WeakMap) because a batch/request
-    // cache is short-lived and we also accept primitive ids/refs as keys.
+    // `Map` (not WeakMap) because a batch/request cache is short-lived and keys are
+    // strings or primitive ids as often as objects.
     byUser = new Map();
+    rolesByUser = new Map();
+    // One token object per row key, so a string row key can never equal a bare-id user.
+    rowTokens = new Map();
+    userCacheKey(user) {
+        if (user === null || typeof user !== 'object')
+            return user;
+        const row = rowKey(user);
+        if (row === undefined)
+            return user;
+        let token = this.rowTokens.get(row);
+        if (!token) {
+            token = {};
+            this.rowTokens.set(row, token);
+        }
+        return token;
+    }
+    compiled(provider, user) {
+        if (typeof provider.getPermissions !== 'function')
+            return undefined;
+        const key = this.userCacheKey(user);
+        const cached = this.byUser.get(key);
+        if (cached)
+            return cached;
+        const pending = Promise.resolve(provider.getPermissions(user)).then((granted) => granted == null ? undefined : new CompiledPermissions(granted));
+        this.byUser.set(key, pending);
+        pending.catch(() => this.byUser.delete(key));
+        return pending;
+    }
     /**
      * Resolve the user's granted-permission set via the provider, memoized for the
      * cache's lifetime. Returns `undefined` when the provider can't list grants
@@ -24,14 +86,7 @@ export class PermissionCache {
      * exact-match `hasPermission` path.
      */
     async getPermissions(provider, user) {
-        if (typeof provider.getPermissions !== 'function')
-            return undefined;
-        const cached = this.byUser.get(user);
-        if (cached)
-            return cached;
-        const pending = Promise.resolve(provider.getPermissions(user)).then((granted) => granted == null ? undefined : new Set(granted));
-        this.byUser.set(user, pending);
-        return pending;
+        return (await this.compiled(provider, user))?.granted;
     }
     /**
      * True when the user's (memoized) granted set satisfies `ability` under the
@@ -39,10 +94,18 @@ export class PermissionCache {
      * defer to `hasPermission`).
      */
     async satisfies(provider, user, ability) {
-        const set = await this.getPermissions(provider, user);
-        if (set === undefined)
-            return undefined;
-        return permissionSatisfied(set, ability);
+        return (await this.compiled(provider, user))?.satisfies(ability);
+    }
+    /** The user's roles from `provider`, memoized for the cache's lifetime. */
+    getRoles(provider, user) {
+        const key = this.userCacheKey(user);
+        const cached = this.rolesByUser.get(key);
+        if (cached)
+            return cached;
+        const pending = Promise.resolve(provider.getRoles(user));
+        this.rolesByUser.set(key, pending);
+        pending.catch(() => this.rolesByUser.delete(key));
+        return pending;
     }
 }
 //# sourceMappingURL=permission-cache.js.map

package/dist/permission-cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission-cache.js","sourceRoot":"","sources":["../src/permission-cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAI9D;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,eAAe;IAC1B,iFAAiF;IACjF,sEAAsE;IACrD,MAAM,GAAG,IAAI,GAAG,EAAqD,CAAC;IAEvF;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAClB,QAA4B,EAC5B,IAAU;QAEV,IAAI,OAAO,QAAQ,CAAC,cAAc,KAAK,UAAU;YAAE,OAAO,SAAS,CAAC;QACpE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC9E,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAC/C,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CACb,QAA4B,EAC5B,IAAU,EACV,OAAe;QAEf,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACtD,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACxC,OAAO,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;CACF"}
+{"version":3,"file":"permission-cache.js","sourceRoot":"","sources":["../src/permission-cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAK9D,4FAA4F;AAC5F,MAAM,QAAQ,GAAG,IAAI,OAAO,EAAkB,CAAC;AAC/C,IAAI,WAAW,GAAG,CAAC,CAAC;AAEpB,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,EAAE,GAAG,WAAW,EAAE,CAAC;QACnB,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,MAAM,CAAC,IAAY;IAC1B,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,IAAwC,CAAC;IAC9D,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACvE,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAqC,CAAC;IAC9E,MAAM,KAAK,GAAG,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,MAAM,CAAC,SAAS,CAAC;IAC3D,IAAI,KAAK,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,IAAI,GAAG,KAAK,EAAE,WAAW,CAAC;IAChC,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,eAAe;IAC1B,gFAAgF;IAChF,gDAAgD;IAC/B,MAAM,GAAG,IAAI,GAAG,EAAqD,CAAC;IACtE,WAAW,GAAG,IAAI,GAAG,EAA0C,CAAC;IACjF,oFAAoF;IACnE,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE/C,YAAY,CAAC,IAAU;QAC7B,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACnC,IAAI,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,EAAE,CAAC;YACX,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,QAAQ,CACd,QAA4B,EAC5B,IAAU;QAEV,IAAI,OAAO,QAAQ,CAAC,cAAc,KAAK,UAAU;YAAE,OAAO,SAAS,CAAC;QACpE,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC9E,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,mBAAmB,CAAC,OAAO,CAAC,CAC/D,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAClB,QAA4B,EAC5B,IAAU;QAEV,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC;IACxD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CACb,QAA4B,EAC5B,IAAU,EACV,OAAe;QAEf,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;IACnE,CAAC;IAED,2EAA2E;IAC3E,QAAQ,CAAC,QAAsB,EAAE,IAAU;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACnC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAClD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/permission-matcher.d.ts

@@ -19,4 +19,17 @@
 export declare function permissionMatches(granted: string, required: string): boolean;
 /** True when ANY permission in the granted set satisfies the required ability. */
 export declare function permissionSatisfied(granted: Iterable<string>, required: string): boolean;
+/**
+ * A granted set prepared once for repeated checks with the same semantics as
+ * {@link permissionSatisfied}: grants without a `*` segment can only match by
+ * equality, so they live in a `Set`; only the wildcard grants are pre-split and
+ * scanned. A check costs one hash lookup plus one pass over the wildcard grants.
+ */
+export declare class CompiledPermissions {
+    readonly granted: ReadonlySet<string>;
+    private readonly grantsAll;
+    private readonly patterns;
+    constructor(granted: Iterable<string>);
+    satisfies(required: string): boolean;
+}
 //# sourceMappingURL=permission-matcher.d.ts.map

package/dist/permission-matcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-matcher.d.ts","sourceRoot":"","sources":["../src/permission-matcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CA0B5E;AAED,kFAAkF;AAClF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAKxF"}
+{"version":3,"file":"permission-matcher.d.ts","sourceRoot":"","sources":["../src/permission-matcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAI5E;AAwBD,kFAAkF;AAClF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAKxF;AAED;;;;;GAKG;AACH,qBAAa,mBAAmB;IAC9B,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAU;IACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkB;gBAE/B,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC;IAWrC,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;CASrC"}

package/dist/permission-matcher.js

@@ -21,8 +21,9 @@ export function permissionMatches(granted, required) {
         return true;
     if (granted === '*')
         return true;
-    const grantedParts = granted.split('.');
-    const requiredParts = required.split('.');
+    return segmentsMatch(granted.split('.'), required.split('.'));
+}
+function segmentsMatch(grantedParts, requiredParts) {
     for (let i = 0; i < grantedParts.length; i++) {
         const g = grantedParts[i];
         if (g === '*') {
@@ -52,4 +53,39 @@ export function permissionSatisfied(granted, required) {
     }
     return false;
 }
+/**
+ * A granted set prepared once for repeated checks with the same semantics as
+ * {@link permissionSatisfied}: grants without a `*` segment can only match by
+ * equality, so they live in a `Set`; only the wildcard grants are pre-split and
+ * scanned. A check costs one hash lookup plus one pass over the wildcard grants.
+ */
+export class CompiledPermissions {
+    granted;
+    grantsAll;
+    patterns = [];
+    constructor(granted) {
+        const set = new Set(granted);
+        this.granted = set;
+        this.grantsAll = set.has('*');
+        for (const g of set) {
+            if (!g.includes('*'))
+                continue;
+            const parts = g.split('.');
+            if (parts.includes('*'))
+                this.patterns.push(parts);
+        }
+    }
+    satisfies(required) {
+        if (this.grantsAll || this.granted.has(required))
+            return true;
+        if (this.patterns.length === 0)
+            return false;
+        const requiredParts = required.split('.');
+        for (const parts of this.patterns) {
+            if (segmentsMatch(parts, requiredParts))
+                return true;
+        }
+        return false;
+    }
+}
 //# sourceMappingURL=permission-matcher.js.map

package/dist/permission-matcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission-matcher.js","sourceRoot":"","sources":["../src/permission-matcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,QAAgB;IACjE,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAEjC,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAE1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,kEAAkE;YAClE,yEAAyE;YACzE,0DAA0D;YAC1D,IAAI,CAAC,KAAK,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClC,OAAO,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;YAClC,CAAC;YACD,yEAAyE;YACzE,IAAI,aAAa,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YACjD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAC3C,CAAC;IAED,6EAA6E;IAC7E,uDAAuD;IACvD,OAAO,YAAY,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM,CAAC;AACtD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,mBAAmB,CAAC,OAAyB,EAAE,QAAgB;IAC7E,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,iBAAiB,CAAC,CAAC,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"permission-matcher.js","sourceRoot":"","sources":["../src/permission-matcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,QAAgB;IACjE,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,aAAa,CAAC,YAA+B,EAAE,aAAgC;IACtF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,kEAAkE;YAClE,yEAAyE;YACzE,0DAA0D;YAC1D,IAAI,CAAC,KAAK,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClC,OAAO,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;YAClC,CAAC;YACD,yEAAyE;YACzE,IAAI,aAAa,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YACjD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAC3C,CAAC;IAED,6EAA6E;IAC7E,uDAAuD;IACvD,OAAO,YAAY,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM,CAAC;AACtD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,mBAAmB,CAAC,OAAyB,EAAE,QAAgB;IAC7E,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,iBAAiB,CAAC,CAAC,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,mBAAmB;IACrB,OAAO,CAAsB;IACrB,SAAS,CAAU;IACnB,QAAQ,GAAe,EAAE,CAAC;IAE3C,YAAY,OAAyB;QACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC;QACnB,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACpB,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC/B,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,SAAS,CAAC,QAAgB;QACxB,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9D,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7C,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,IAAI,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC;gBAAE,OAAO,IAAI,CAAC;QACvD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/permission-provider.d.ts

@@ -28,6 +28,8 @@ import type { Resource, User } from './types.js';
  * (see `permission-matcher.ts`), so wildcard semantics work regardless of adapter
  * and without each adapter re-implementing the matching. `hasPermission` remains the
  * exact-match fast path (and the sole contract for providers that don't list grants).
+ * Within one request (nestjs-context) or one `allowsMany` batch, the set is fetched once
+ * per user.
  */
 export interface PermissionProvider {
     hasPermission(user: User, permission: string, resource?: Resource): boolean | undefined | Promise<boolean | undefined>;
@@ -39,5 +41,14 @@ export interface PermissionProvider {
      * `hasPermission` (e.g. for an anonymous/unmappable user).
      */
     getPermissions?(user: User): Iterable<string> | undefined | Promise<Iterable<string> | undefined>;
+    /**
+     * Optional: `true` when the set returned by {@link getPermissions} is everything
+     * {@link hasPermission} would ever grant, for any resource. The Gate then answers a
+     * check the set doesn't satisfy as "no grant" without calling `hasPermission`, so a
+     * request costs one `getPermissions` fetch no matter how many checks it runs. Leave it
+     * unset when `hasPermission` can grant beyond the listed set (e.g. it inspects the
+     * resource); the Gate then still calls `hasPermission` for those checks.
+     */
+    readonly exhaustivePermissions?: boolean;
 }
 //# sourceMappingURL=permission-provider.d.ts.map

package/dist/permission-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permission-provider.d.ts","sourceRoot":"","sources":["../src/permission-provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,kBAAkB;IACjC,aAAa,CACX,IAAI,EAAE,IAAI,EACV,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,QAAQ,GAClB,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;IACtD;;;;;;OAMG;IACH,cAAc,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC;CACnG"}
+{"version":3,"file":"permission-provider.d.ts","sourceRoot":"","sources":["../src/permission-provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,WAAW,kBAAkB;IACjC,aAAa,CACX,IAAI,EAAE,IAAI,EACV,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,QAAQ,GAClB,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;IACtD;;;;;;OAMG;IACH,cAAc,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC;IAClG;;;;;;;OAOG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;CAC1C"}

package/dist/policies/authz-policy.d.ts

@@ -0,0 +1,42 @@
+/**
+ * @internal Runs `fn` (the `Gate` handing a string check to the official service) knowing
+ * `superAdmin` did not grant `ability` and the decision point abstained, so the policy's
+ * {@link superAdminBefore} / {@link decisionProviderBefore} skip asking them again.
+ */
+export declare function withAskedCheck<T>(user: unknown, ability: string, args: readonly unknown[], fn: () => Promise<T>): Promise<T>;
+/**
+ * Asks the `superAdmin` hook given to `AuthzModule.forRoot()`. `true` grants; anything
+ * else falls through. Call it from your own `before()` when a policy cannot extend
+ * {@link AuthzPolicy}.
+ */
+export declare function superAdminBefore(user: unknown, ability: string, resource?: object): Promise<true | undefined>;
+/**
+ * Asks the external decision point (`DECISION_PROVIDER`, e.g. the Cerbos adapter), when
+ * one is registered: `true` allows, `false` denies, `undefined` abstains (no provider, or
+ * it has no opinion). Call it from your own `before()` when a policy cannot extend
+ * {@link AuthzPolicy}.
+ */
+export declare function decisionProviderBefore(user: unknown, ability: string, resource?: object): Promise<boolean | undefined>;
+/**
+ * Base class for official policies that honor the global `superAdmin` hook and the
+ * optional external decision point.
+ *
+ * The official guard runs only each policy's own `before()`, so a global "super-admins
+ * may do anything" needs every policy to ask. Extend this class and they do:
+ *
+ * ```ts
+ * @Policy()
+ * export class PostPolicy extends AuthzPolicy {
+ *   update(user: User | null, post: Post) { return post.authorId === user?.id; }
+ * }
+ * ```
+ *
+ * `before()` asks `superAdmin(user, ability, resource)` (a `true` allows), then the
+ * `DECISION_PROVIDER` when one is registered (its allow or deny is final, `undefined`
+ * abstains), then lets the ability decide. The resource is the check's first argument.
+ * To add your own `before()`, override it and call `super.before(...)` first.
+ */
+export declare abstract class AuthzPolicy {
+    before(user: unknown, ability: string, ...args: unknown[]): boolean | undefined | Promise<boolean | undefined>;
+}
+//# sourceMappingURL=authz-policy.d.ts.map

package/dist/policies/authz-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-policy.d.ts","sourceRoot":"","sources":["../../src/policies/authz-policy.ts"],"names":[],"mappings":"AAqBA;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAC9B,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,OAAO,EAAE,EACxB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CAEZ;AAaD;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAI3B;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAI9B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,8BAAsB,WAAW;IAC/B,MAAM,CACJ,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,MAAM,EACf,GAAG,IAAI,EAAE,OAAO,EAAE,GACjB,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;CAOtD"}

package/dist/policies/authz-policy.js

@@ -0,0 +1,80 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { normalizeVerdict } from '../decision-provider.js';
+import { authzRuntime } from '../runtime.js';
+/** The resource of a policy check: its first argument, when that is an object or a class. */
+function resourceOf(args) {
+    const first = args[0];
+    return (typeof first === 'object' && first !== null) || typeof first === 'function'
+        ? first
+        : undefined;
+}
+const asked = new AsyncLocalStorage();
+/**
+ * @internal Runs `fn` (the `Gate` handing a string check to the official service) knowing
+ * `superAdmin` did not grant `ability` and the decision point abstained, so the policy's
+ * {@link superAdminBefore} / {@link decisionProviderBefore} skip asking them again.
+ */
+export function withAskedCheck(user, ability, args, fn) {
+    return asked.run({ user: user ?? null, ability, resource: resourceOf(args) }, fn);
+}
+/** True when the `Gate` already asked about exactly this check (see {@link withAskedCheck}). */
+function alreadyAsked(user, ability, resource) {
+    const check = asked.getStore();
+    return (check !== undefined &&
+        check.user === (user ?? null) &&
+        check.ability === ability &&
+        check.resource === resource);
+}
+/**
+ * Asks the `superAdmin` hook given to `AuthzModule.forRoot()`. `true` grants; anything
+ * else falls through. Call it from your own `before()` when a policy cannot extend
+ * {@link AuthzPolicy}.
+ */
+export async function superAdminBefore(user, ability, resource) {
+    const hook = authzRuntime().superAdmin;
+    if (!hook || alreadyAsked(user, ability, resource))
+        return undefined;
+    return (await hook(user ?? null, ability, resource)) === true ? true : undefined;
+}
+/**
+ * Asks the external decision point (`DECISION_PROVIDER`, e.g. the Cerbos adapter), when
+ * one is registered: `true` allows, `false` denies, `undefined` abstains (no provider, or
+ * it has no opinion). Call it from your own `before()` when a policy cannot extend
+ * {@link AuthzPolicy}.
+ */
+export async function decisionProviderBefore(user, ability, resource) {
+    const provider = authzRuntime().decisionProvider();
+    if (!provider || alreadyAsked(user, ability, resource))
+        return undefined;
+    return normalizeVerdict(await provider.decide(user ?? null, ability, resource)).allowed;
+}
+/**
+ * Base class for official policies that honor the global `superAdmin` hook and the
+ * optional external decision point.
+ *
+ * The official guard runs only each policy's own `before()`, so a global "super-admins
+ * may do anything" needs every policy to ask. Extend this class and they do:
+ *
+ * ```ts
+ * @Policy()
+ * export class PostPolicy extends AuthzPolicy {
+ *   update(user: User | null, post: Post) { return post.authorId === user?.id; }
+ * }
+ * ```
+ *
+ * `before()` asks `superAdmin(user, ability, resource)` (a `true` allows), then the
+ * `DECISION_PROVIDER` when one is registered (its allow or deny is final, `undefined`
+ * abstains), then lets the ability decide. The resource is the check's first argument.
+ * To add your own `before()`, override it and call `super.before(...)` first.
+ */
+export class AuthzPolicy {
+    before(user, ability, ...args) {
+        const resource = resourceOf(args);
+        return (async () => {
+            if (await superAdminBefore(user, ability, resource))
+                return true;
+            return decisionProviderBefore(user, ability, resource);
+        })();
+    }
+}
+//# sourceMappingURL=authz-policy.js.map

package/dist/policies/authz-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-policy.js","sourceRoot":"","sources":["../../src/policies/authz-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,6FAA6F;AAC7F,SAAS,UAAU,CAAC,IAAwB;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,OAAO,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,IAAI,OAAO,KAAK,KAAK,UAAU;QACjF,CAAC,CAAE,KAAgB;QACnB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AASD,MAAM,KAAK,GAAG,IAAI,iBAAiB,EAAc,CAAC;AAElD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAa,EACb,OAAe,EACf,IAAwB,EACxB,EAAoB;IAEpB,OAAO,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,gGAAgG;AAChG,SAAS,YAAY,CAAC,IAAa,EAAE,OAAe,EAAE,QAA4B;IAChF,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC/B,OAAO,CACL,KAAK,KAAK,SAAS;QACnB,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;QAC7B,KAAK,CAAC,OAAO,KAAK,OAAO;QACzB,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAC5B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAa,EACb,OAAe,EACf,QAAiB;IAEjB,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC,UAAU,CAAC;IACvC,IAAI,CAAC,IAAI,IAAI,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IACrE,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACnF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAa,EACb,OAAe,EACf,QAAiB;IAEjB,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC,gBAAgB,EAAE,CAAC;IACnD,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IACzE,OAAO,gBAAgB,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;AAC1F,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAgB,WAAW;IAC/B,MAAM,CACJ,IAAa,EACb,OAAe,EACf,GAAG,IAAe;QAElB,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO,CAAC,KAAK,IAAI,EAAE;YACjB,IAAI,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjE,OAAO,sBAAsB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACzD,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;CACF"}

package/dist/policies/gate.policy.d.ts

@@ -0,0 +1,18 @@
+import { Gate } from '../gate.js';
+/**
+ * The `Gate`'s string abilities as an official policy: ad-hoc gates from
+ * `gate.define()`, named permissions, and `ability` + resource checks through the
+ * resource's linked policy.
+ *
+ * ```ts
+ * gate.define('access-admin', (user) => user.isStaff);
+ *
+ * @Can(GatePolicy, 'allows', ability('access-admin'))
+ * ```
+ */
+export declare class GatePolicy {
+    private readonly gate;
+    constructor(gate: Gate);
+    allows(user: unknown, ability: string, resource?: object): Promise<boolean>;
+}
+//# sourceMappingURL=gate.policy.d.ts.map

package/dist/policies/gate.policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.policy.d.ts","sourceRoot":"","sources":["../../src/policies/gate.policy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAElC;;;;;;;;;;GAUG;AACH,qBACa,UAAU;IACT,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,IAAI;IAEvC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAG5E"}

package/dist/policies/gate.policy.js

@@ -0,0 +1,37 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Policy } from '@nestjs/authorization';
+import { Gate } from '../gate.js';
+/**
+ * The `Gate`'s string abilities as an official policy: ad-hoc gates from
+ * `gate.define()`, named permissions, and `ability` + resource checks through the
+ * resource's linked policy.
+ *
+ * ```ts
+ * gate.define('access-admin', (user) => user.isStaff);
+ *
+ * @Can(GatePolicy, 'allows', ability('access-admin'))
+ * ```
+ */
+let GatePolicy = class GatePolicy {
+    gate;
+    constructor(gate) {
+        this.gate = gate;
+    }
+    allows(user, ability, resource) {
+        return this.gate.forUser(user).allows(ability, resource);
+    }
+};
+GatePolicy = __decorate([
+    Policy(),
+    __metadata("design:paramtypes", [Gate])
+], GatePolicy);
+export { GatePolicy };
+//# sourceMappingURL=gate.policy.js.map

package/dist/policies/gate.policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.policy.js","sourceRoot":"","sources":["../../src/policies/gate.policy.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAElC;;;;;;;;;;GAUG;AAEI,IAAM,UAAU,GAAhB,MAAM,UAAU;IACQ;IAA7B,YAA6B,IAAU;QAAV,SAAI,GAAJ,IAAI,CAAM;IAAG,CAAC;IAE3C,MAAM,CAAC,IAAa,EAAE,OAAe,EAAE,QAAiB;QACtD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC3D,CAAC;CACF,CAAA;AANY,UAAU;IADtB,MAAM,EAAE;qCAE4B,IAAI;GAD5B,UAAU,CAMtB"}

package/dist/policies/index.d.ts

@@ -0,0 +1,5 @@
+export { AuthzPolicy, decisionProviderBefore, superAdminBefore } from './authz-policy.js';
+export { RolePolicy } from './role.policy.js';
+export { PermissionPolicy } from './permission.policy.js';
+export { GatePolicy } from './gate.policy.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/policies/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policies/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1F,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/policies/index.js

@@ -0,0 +1,5 @@
+export { AuthzPolicy, decisionProviderBefore, superAdminBefore } from './authz-policy.js';
+export { RolePolicy } from './role.policy.js';
+export { PermissionPolicy } from './permission.policy.js';
+export { GatePolicy } from './gate.policy.js';
+//# sourceMappingURL=index.js.map

package/dist/policies/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policies/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1F,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/policies/permission.policy.d.ts

@@ -0,0 +1,27 @@
+import { AuthzRbac } from '../rbac.js';
+import { AuthzPolicy } from './authz-policy.js';
+/**
+ * Persisted permissions (through roles, tenant-scoped roles, or granted directly) as an
+ * official policy. Wildcard grants apply: `posts.*` satisfies `posts.update`.
+ *
+ * ```ts
+ * @Can(PermissionPolicy, 'has', permission('posts.update'))
+ * @Can(PermissionPolicy, 'hasAll', permission('posts.update', 'posts.publish'))
+ * ```
+ *
+ * Honors `superAdmin`.
+ */
+export declare class PermissionPolicy extends AuthzPolicy {
+    private readonly rbac;
+    constructor(rbac: AuthzRbac);
+    /**
+     * Asks only `superAdmin`: the abilities here name permissions, not a resource, so the
+     * external decision point is not consulted.
+     */
+    before(user: unknown, ability: string): Promise<true | undefined>;
+    /** The user holds any of `permissions`. */
+    has(user: unknown, ...permissions: string[]): Promise<boolean>;
+    /** The user holds every one of `permissions`. */
+    hasAll(user: unknown, ...permissions: string[]): Promise<boolean>;
+}
+//# sourceMappingURL=permission.policy.d.ts.map

package/dist/policies/permission.policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.policy.d.ts","sourceRoot":"","sources":["../../src/policies/permission.policy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,WAAW,EAAoB,MAAM,mBAAmB,CAAC;AAElE;;;;;;;;;;GAUG;AACH,qBACa,gBAAiB,SAAQ,WAAW;IACnC,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,SAAS;IAI5C;;;OAGG;IACM,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAI1E,2CAA2C;IACrC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAOpE,iDAAiD;IAC3C,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;CAOxE"}

package/dist/policies/permission.policy.js

@@ -0,0 +1,61 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Policy } from '@nestjs/authorization';
+import { AuthzRbac } from '../rbac.js';
+import { AuthzPolicy, superAdminBefore } from './authz-policy.js';
+/**
+ * Persisted permissions (through roles, tenant-scoped roles, or granted directly) as an
+ * official policy. Wildcard grants apply: `posts.*` satisfies `posts.update`.
+ *
+ * ```ts
+ * @Can(PermissionPolicy, 'has', permission('posts.update'))
+ * @Can(PermissionPolicy, 'hasAll', permission('posts.update', 'posts.publish'))
+ * ```
+ *
+ * Honors `superAdmin`.
+ */
+let PermissionPolicy = class PermissionPolicy extends AuthzPolicy {
+    rbac;
+    constructor(rbac) {
+        super();
+        this.rbac = rbac;
+    }
+    /**
+     * Asks only `superAdmin`: the abilities here name permissions, not a resource, so the
+     * external decision point is not consulted.
+     */
+    before(user, ability) {
+        return superAdminBefore(user, ability);
+    }
+    /** The user holds any of `permissions`. */
+    async has(user, ...permissions) {
+        for (const permission of permissions) {
+            if (await this.rbac.grants(user, permission))
+                return true;
+        }
+        return false;
+    }
+    /** The user holds every one of `permissions`. */
+    async hasAll(user, ...permissions) {
+        if (permissions.length === 0)
+            return false;
+        for (const permission of permissions) {
+            if (!(await this.rbac.grants(user, permission)))
+                return false;
+        }
+        return true;
+    }
+};
+PermissionPolicy = __decorate([
+    Policy(),
+    __metadata("design:paramtypes", [AuthzRbac])
+], PermissionPolicy);
+export { PermissionPolicy };
+//# sourceMappingURL=permission.policy.js.map

package/dist/policies/permission.policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.policy.js","sourceRoot":"","sources":["../../src/policies/permission.policy.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAElE;;;;;;;;;;GAUG;AAEI,IAAM,gBAAgB,GAAtB,MAAM,gBAAiB,SAAQ,WAAW;IAClB;IAA7B,YAA6B,IAAe;QAC1C,KAAK,EAAE,CAAC;QADmB,SAAI,GAAJ,IAAI,CAAW;IAE5C,CAAC;IAED;;;OAGG;IACM,MAAM,CAAC,IAAa,EAAE,OAAe;QAC5C,OAAO,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,2CAA2C;IAC3C,KAAK,CAAC,GAAG,CAAC,IAAa,EAAE,GAAG,WAAqB;QAC/C,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC5D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,MAAM,CAAC,IAAa,EAAE,GAAG,WAAqB;QAClD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;QAChE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA7BY,gBAAgB;IAD5B,MAAM,EAAE;qCAE4B,SAAS;GADjC,gBAAgB,CA6B5B"}

package/dist/policies/role.policy.d.ts

@@ -0,0 +1,27 @@
+import { AuthzRbac } from '../rbac.js';
+import { AuthzPolicy } from './authz-policy.js';
+/**
+ * Persisted (and user-object) roles as an official policy.
+ *
+ * ```ts
+ * @Can(RolePolicy, 'has', roles('admin', 'editor'))   // any of
+ * @Can(RolePolicy, 'hasAll', roles('admin', 'editor')) // all of
+ * ```
+ *
+ * Roles come from `user.roles` / `user.role` (or `resolveRoles`) and from the RBAC
+ * adapter's role store, scoped to the current tenant. Honors `superAdmin`.
+ */
+export declare class RolePolicy extends AuthzPolicy {
+    private readonly rbac;
+    constructor(rbac: AuthzRbac);
+    /**
+     * Asks only `superAdmin`: the abilities here name roles, not a resource, so the
+     * external decision point is not consulted.
+     */
+    before(user: unknown, ability: string): Promise<true | undefined>;
+    /** The user holds any of `roles`. */
+    has(user: unknown, ...roles: string[]): Promise<boolean>;
+    /** The user holds every one of `roles`. */
+    hasAll(user: unknown, ...roles: string[]): Promise<boolean>;
+}
+//# sourceMappingURL=role.policy.d.ts.map

package/dist/policies/role.policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role.policy.d.ts","sourceRoot":"","sources":["../../src/policies/role.policy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,WAAW,EAAoB,MAAM,mBAAmB,CAAC;AAElE;;;;;;;;;;GAUG;AACH,qBACa,UAAW,SAAQ,WAAW;IAC7B,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,SAAS;IAI5C;;;OAGG;IACM,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAI1E,qCAAqC;IACrC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAIxD,2CAA2C;IAC3C,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;CAG5D"}