@dudousxd/nestjs-authz 0.8.0 → 0.9.0

package/dist/resource-resolver.d.ts

@@ -1,29 +1,27 @@
 import type { ExecutionContext, Type } from '@nestjs/common';
+/** Per-call hints `byId(Resource, { param })` passes to the resolver. */
+export interface ResourceResolveHints {
+    /** The route param holding the id, when `byId` named one. */
+    param?: string;
+}
 /**
- * Resolves a resource instance for a `@Can(ability, Resource)` route so the guard
- * can pass it to the policy method. Apps register an implementation (typically
- * ORM-backed) via `AuthzModule.forRoot({ ... })` or as a provider bound to the
- * {@link RESOURCE_RESOLVER} token.
- *
- * Class-level abilities (no resource class on `@Can`) never call the resolver.
+ * Loads the resource a `byId(Resource)` argument resolver hands to the policy
+ * (`@Can(PostPolicy, 'update', byId(Post))`). Register one, typically ORM-backed, with
+ * `AuthzModule.forRoot({ resourceResolver })`. Return `undefined` for "not found":
+ * `byId` then refuses the call with a 403 before the policy runs.
  */
 export interface ResourceResolver {
-    /**
-     * Load the resource instance for `resource` in the given request context.
-     * Return `undefined` to signal "not found" — the guard treats a missing
-     * resource as a denial.
-     */
-    resolve(resource: Type<unknown>, ctx: ExecutionContext): Promise<object | undefined> | object | undefined;
+    resolve(resource: Type<unknown>, ctx: ExecutionContext, hints?: ResourceResolveHints): Promise<object | undefined> | object | undefined;
 }
 /**
- * Default resolver: reads the route `:id` param and produces a lightweight
- * `{ id }` shim of the requested resource class. This keeps the guard usable
- * out-of-the-box (e.g. ownership checks on `resource.id`) without an ORM, while
- * apps that need real entities register their own {@link ResourceResolver}.
+ * Default resolver: reads the route `:id` param and produces a lightweight `{ id }`
+ * object whose prototype is the resource class's, enough for ownership checks on
+ * `resource.id` without an ORM. Register your own {@link ResourceResolver} to load
+ * real entities.
  */
 export declare class IdParamResourceResolver implements ResourceResolver {
     private readonly param;
     constructor(param?: string);
-    resolve(resource: Type<unknown>, ctx: ExecutionContext): object | undefined;
+    resolve(resource: Type<unknown>, ctx: ExecutionContext, hints?: ResourceResolveHints): object | undefined;
 }
 //# sourceMappingURL=resource-resolver.d.ts.map

package/dist/resource-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-resolver.d.ts","sourceRoot":"","sources":["../src/resource-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,OAAO,CACL,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,EACvB,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,SAAS,CAAC;CACrD;AAED;;;;;GAKG;AACH,qBAAa,uBAAwB,YAAW,gBAAgB;IAClD,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,GAAE,MAAa;IAEjD,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS;CAU5E"}
+{"version":3,"file":"resource-resolver.d.ts","sourceRoot":"","sources":["../src/resource-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAE7D,yEAAyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CACL,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,EACvB,GAAG,EAAE,gBAAgB,EACrB,KAAK,CAAC,EAAE,oBAAoB,GAC3B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,SAAS,CAAC;CACrD;AAED;;;;;GAKG;AACH,qBAAa,uBAAwB,YAAW,gBAAgB;IAClD,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,GAAE,MAAa;IAEjD,OAAO,CACL,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,EACvB,GAAG,EAAE,gBAAgB,EACrB,KAAK,CAAC,EAAE,oBAAoB,GAC3B,MAAM,GAAG,SAAS;CAStB"}

package/dist/resource-resolver.js

@@ -1,21 +1,21 @@
 /**
- * Default resolver: reads the route `:id` param and produces a lightweight
- * `{ id }` shim of the requested resource class. This keeps the guard usable
- * out-of-the-box (e.g. ownership checks on `resource.id`) without an ORM, while
- * apps that need real entities register their own {@link ResourceResolver}.
+ * Default resolver: reads the route `:id` param and produces a lightweight `{ id }`
+ * object whose prototype is the resource class's, enough for ownership checks on
+ * `resource.id` without an ORM. Register your own {@link ResourceResolver} to load
+ * real entities.
  */
 export class IdParamResourceResolver {
     param;
     constructor(param = 'id') {
         this.param = param;
     }
-    resolve(resource, ctx) {
+    resolve(resource, ctx, hints) {
+        if (ctx.getType() !== 'http')
+            return undefined;
         const req = ctx.switchToHttp().getRequest();
-        const id = req?.params?.[this.param];
+        const id = req?.params?.[hints?.param ?? this.param];
         if (id === undefined)
             return undefined;
-        // Construct a shaped instance so `instance.constructor === resource`, which
-        // is how PolicyRegistry maps an instance back to its policy.
         const instance = Object.create(resource.prototype);
         instance.id = id;
         return instance;

package/dist/resource-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-resolver.js","sourceRoot":"","sources":["../src/resource-resolver.ts"],"names":[],"mappings":"AAsBA;;;;;GAKG;AACH,MAAM,OAAO,uBAAuB;IACL;IAA7B,YAA6B,QAAgB,IAAI;QAApB,UAAK,GAAL,KAAK,CAAe;IAAG,CAAC;IAErD,OAAO,CAAC,QAAuB,EAAE,GAAqB;QACpD,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAwC,CAAC;QAClF,MAAM,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACvC,4EAA4E;QAC5E,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAA4B,CAAC;QAC9E,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC;QACjB,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}
+{"version":3,"file":"resource-resolver.js","sourceRoot":"","sources":["../src/resource-resolver.ts"],"names":[],"mappings":"AAsBA;;;;;GAKG;AACH,MAAM,OAAO,uBAAuB;IACL;IAA7B,YAA6B,QAAgB,IAAI;QAApB,UAAK,GAAL,KAAK,CAAe;IAAG,CAAC;IAErD,OAAO,CACL,QAAuB,EACvB,GAAqB,EACrB,KAA4B;QAE5B,IAAI,GAAG,CAAC,OAAO,EAAE,KAAK,MAAM;YAAE,OAAO,SAAS,CAAC;QAC/C,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAwC,CAAC;QAClF,MAAM,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAA4B,CAAC;QAC9E,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC;QACjB,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/runtime.d.ts

@@ -0,0 +1,31 @@
+import type { ExecutionContext } from '@nestjs/common';
+import type { DecisionProvider } from './decision-provider.js';
+import { type ResourceResolver } from './resource-resolver.js';
+import type { SuperAdminHook } from './types.js';
+/**
+ * What `@Can()` argument resolvers and policy base classes need from the app but
+ * cannot inject: the official resolvers run with only the `ExecutionContext`, and a
+ * policy base class cannot add constructor parameters to its subclasses. `AuthzModule`
+ * fills this in when it boots. One application per process is the expected case; with
+ * several, the last one to boot wins.
+ */
+interface AuthzRuntime {
+    resourceResolver: ResourceResolver;
+    superAdmin: SuperAdminHook | undefined;
+    /** The external decision point, looked up lazily (an adapter may register it late). */
+    decisionProvider: () => DecisionProvider | undefined;
+    getUser: (context: ExecutionContext) => unknown;
+}
+/** @internal Called by `AuthzModule` at boot, and by the testing helpers. */
+export declare function configureAuthzRuntime(patch: Partial<AuthzRuntime>): void;
+/** @internal Restore the defaults (tests). */
+export declare function resetAuthzRuntime(): void;
+/** @internal */
+export declare function authzRuntime(): Readonly<AuthzRuntime>;
+/**
+ * The user the official guard sees for this call: the `getUser` given to
+ * `AuthorizationModule.forRoot()`, else the official `defaultGetUser`. `null` for a guest.
+ */
+export declare function currentUserOf(context: ExecutionContext): Promise<unknown>;
+export {};
+//# sourceMappingURL=runtime.d.ts.map

package/dist/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAA2B,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACxF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD;;;;;;GAMG;AACH,UAAU,YAAY;IACpB,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,UAAU,EAAE,cAAc,GAAG,SAAS,CAAC;IACvC,uFAAuF;IACvF,gBAAgB,EAAE,MAAM,gBAAgB,GAAG,SAAS,CAAC;IACrD,OAAO,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC;CACjD;AAWD,6EAA6E;AAC7E,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,IAAI,CAKxE;AAED,8CAA8C;AAC9C,wBAAgB,iBAAiB,IAAI,IAAI,CAKxC;AAED,gBAAgB;AAChB,wBAAgB,YAAY,IAAI,QAAQ,CAAC,YAAY,CAAC,CAErD;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAG/E"}

package/dist/runtime.js

@@ -0,0 +1,40 @@
+import { defaultGetUser } from '@nestjs/authorization';
+import { IdParamResourceResolver } from './resource-resolver.js';
+const noDecisionProvider = () => undefined;
+const runtime = {
+    resourceResolver: new IdParamResourceResolver(),
+    superAdmin: undefined,
+    decisionProvider: noDecisionProvider,
+    getUser: defaultGetUser,
+};
+/** @internal Called by `AuthzModule` at boot, and by the testing helpers. */
+export function configureAuthzRuntime(patch) {
+    if (patch.resourceResolver)
+        runtime.resourceResolver = patch.resourceResolver;
+    if ('superAdmin' in patch)
+        runtime.superAdmin = patch.superAdmin;
+    if (patch.decisionProvider)
+        runtime.decisionProvider = patch.decisionProvider;
+    if (patch.getUser)
+        runtime.getUser = patch.getUser;
+}
+/** @internal Restore the defaults (tests). */
+export function resetAuthzRuntime() {
+    runtime.resourceResolver = new IdParamResourceResolver();
+    runtime.superAdmin = undefined;
+    runtime.decisionProvider = noDecisionProvider;
+    runtime.getUser = defaultGetUser;
+}
+/** @internal */
+export function authzRuntime() {
+    return runtime;
+}
+/**
+ * The user the official guard sees for this call: the `getUser` given to
+ * `AuthorizationModule.forRoot()`, else the official `defaultGetUser`. `null` for a guest.
+ */
+export async function currentUserOf(context) {
+    const user = await runtime.getUser(context);
+    return user === undefined || user === false ? null : user;
+}
+//# sourceMappingURL=runtime.js.map

package/dist/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGvD,OAAO,EAAE,uBAAuB,EAAyB,MAAM,wBAAwB,CAAC;AAkBxF,MAAM,kBAAkB,GAAG,GAAiC,EAAE,CAAC,SAAS,CAAC;AAEzE,MAAM,OAAO,GAAiB;IAC5B,gBAAgB,EAAE,IAAI,uBAAuB,EAAE;IAC/C,UAAU,EAAE,SAAS;IACrB,gBAAgB,EAAE,kBAAkB;IACpC,OAAO,EAAE,cAAc;CACxB,CAAC;AAEF,6EAA6E;AAC7E,MAAM,UAAU,qBAAqB,CAAC,KAA4B;IAChE,IAAI,KAAK,CAAC,gBAAgB;QAAE,OAAO,CAAC,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAC9E,IAAI,YAAY,IAAI,KAAK;QAAE,OAAO,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACjE,IAAI,KAAK,CAAC,gBAAgB;QAAE,OAAO,CAAC,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAC9E,IAAI,KAAK,CAAC,OAAO;QAAE,OAAO,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;AACrD,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,iBAAiB;IAC/B,OAAO,CAAC,gBAAgB,GAAG,IAAI,uBAAuB,EAAE,CAAC;IACzD,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;IAC/B,OAAO,CAAC,gBAAgB,GAAG,kBAAkB,CAAC;IAC9C,OAAO,CAAC,OAAO,GAAG,cAAc,CAAC;AACnC,CAAC;AAED,gBAAgB;AAChB,MAAM,UAAU,YAAY;IAC1B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAyB;IAC3D,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5D,CAAC"}

package/dist/tokens.d.ts

@@ -17,12 +17,8 @@ export declare const RESOURCE_RESOLVER: symbol;
  * or empty, the endpoint behaves exactly as before (class-level / ad-hoc only).
  */
 export declare const RESOURCE_HYDRATOR: symbol;
-/** Metadata key for `@Policy(Resource)` — stores the resource class on the policy. */
-export declare const POLICY_RESOURCE_METADATA = "nestjs-authz:policy-resource";
-/** Metadata key for `@Can(ability, Resource?)` — stores the ability descriptor on a route. */
-export declare const CAN_METADATA = "nestjs-authz:can";
-/** Metadata key for `@Roles(...roles)` — stores the allowed role names on a route. */
-export declare const ROLES_METADATA = "nestjs-authz:roles";
+/** Metadata key of the `@PolicyFor(Resource)` link on a policy class. */
+export { POLICY_RESOURCE_METADATA } from './links.js';
 /**
  * Cross-lib injection token for an optional {@link PermissionProvider} — the seam the
  * RBAC adapter (`@dudousxd/nestjs-authz-typeorm`) registers so that a model-less,
@@ -31,8 +27,8 @@ export declare const ROLES_METADATA = "nestjs-authz:roles";
  *
  * `Symbol.for(key)` uses the global symbol registry so an RBAC package registering
  * this same key resolves to the SAME symbol instance without importing core internals.
- * The token is consulted with `@Optional()` — when absent, the Gate behaves exactly
- * as before (backward-compatible: unknown abilities still throw).
+ * The token is consulted with `@Optional()` — when absent, an unknown string ability
+ * still throws.
  */
 export declare const PERMISSION_PROVIDER: symbol;
 /**

package/dist/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAEA,uEAAuE;AACvE,eAAO,MAAM,oBAAoB,QAAiC,CAAC;AAEnE,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,QAA2C,CAAC;AAE1E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,QAA2C,CAAC;AAE1E,sFAAsF;AACtF,eAAO,MAAM,wBAAwB,iCAAiC,CAAC;AAEvE,8FAA8F;AAC9F,eAAO,MAAM,YAAY,qBAAqB,CAAC;AAE/C,sFAAsF;AACtF,eAAO,MAAM,cAAc,uBAAuB,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,QAA6C,CAAC;AAE9E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa,QAAuC,CAAC;AAElE;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,QAA2C,CAAC;AAE1E;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,QAAoC,CAAC"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAEA,uEAAuE;AACvE,eAAO,MAAM,oBAAoB,QAAiC,CAAC;AAEnE,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,QAA2C,CAAC;AAE1E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,QAA2C,CAAC;AAE1E,yEAAyE;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAEtD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,QAA6C,CAAC;AAE9E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa,QAAuC,CAAC;AAElE;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,QAA2C,CAAC;AAE1E;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,QAAoC,CAAC"}

package/dist/tokens.js

@@ -18,12 +18,8 @@ export const RESOURCE_RESOLVER = capability('authz', 'resource-resolver');
  * or empty, the endpoint behaves exactly as before (class-level / ad-hoc only).
  */
 export const RESOURCE_HYDRATOR = capability('authz', 'resource-hydrator');
-/** Metadata key for `@Policy(Resource)` — stores the resource class on the policy. */
-export const POLICY_RESOURCE_METADATA = 'nestjs-authz:policy-resource';
-/** Metadata key for `@Can(ability, Resource?)` — stores the ability descriptor on a route. */
-export const CAN_METADATA = 'nestjs-authz:can';
-/** Metadata key for `@Roles(...roles)` — stores the allowed role names on a route. */
-export const ROLES_METADATA = 'nestjs-authz:roles';
+/** Metadata key of the `@PolicyFor(Resource)` link on a policy class. */
+export { POLICY_RESOURCE_METADATA } from './links.js';
 /**
  * Cross-lib injection token for an optional {@link PermissionProvider} — the seam the
  * RBAC adapter (`@dudousxd/nestjs-authz-typeorm`) registers so that a model-less,
@@ -32,8 +28,8 @@ export const ROLES_METADATA = 'nestjs-authz:roles';
  *
  * `Symbol.for(key)` uses the global symbol registry so an RBAC package registering
  * this same key resolves to the SAME symbol instance without importing core internals.
- * The token is consulted with `@Optional()` — when absent, the Gate behaves exactly
- * as before (backward-compatible: unknown abilities still throw).
+ * The token is consulted with `@Optional()` — when absent, an unknown string ability
+ * still throws.
  */
 export const PERMISSION_PROVIDER = capability('authz', 'permission-provider');
 /**

package/dist/tokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAE1D,uEAAuE;AACvE,MAAM,CAAC,MAAM,oBAAoB,GAAG,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAEnE,uFAAuF;AACvF,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;AAE1E;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;AAE1E,sFAAsF;AACtF,MAAM,CAAC,MAAM,wBAAwB,GAAG,8BAA8B,CAAC;AAEvE,8FAA8F;AAC9F,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAE/C,sFAAsF;AACtF,MAAM,CAAC,MAAM,cAAc,GAAG,oBAAoB,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,UAAU,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;AAElE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;AAE1E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC"}
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAE1D,uEAAuE;AACvE,MAAM,CAAC,MAAM,oBAAoB,GAAG,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAEnE,uFAAuF;AACvF,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;AAE1E;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;AAE1E,yEAAyE;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAEtD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,UAAU,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;AAElE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;AAE1E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC"}

package/dist/types.d.ts

@@ -1,217 +1,100 @@
 import type { Type } from '@nestjs/common';
 import type { UserRef } from './context-accessor.js';
 import type { ResourceResolver } from './resource-resolver.js';
-/**
- * A resource instance passed to policy methods. `unknown` because authz never
- * inspects the resource itself — the policy method does.
- */
+/** A resource passed to a policy ability. authz never inspects it; the policy does. */
 export type Resource = object;
 /**
- * The current user as seen by a policy/gate. authz does not model the user; it
- * is whatever the app's auth layer produced (or `undefined` when unauthenticated).
+ * The user a policy or gate sees: whatever authentication produced, `null` for a
+ * guest. authz does not model it.
  */
 export type User = unknown;
 /**
- * The richer result a policy method / ad-hoc gate may return instead of a bare
- * boolean: a verdict plus an optional human-readable `message` explaining a denial.
- * The message is surfaced on the thrown `ForbiddenException` (so a 403 is debuggable)
- * and published on the diagnostics decision. Returning a bare boolean is unchanged.
- *
- * Mirrors Laravel's `Response::allow()/deny('message')`.
+ * A verdict with an optional reason. What a {@link DecisionProvider} may answer instead of
+ * a bare boolean. Only `allowed` is used: `@nestjs/authorization` has no deny-with-reason, so a
+ * route denial is the official 403 and the `message` is dropped (README, "Migrating from 0.8").
  */
 export interface PolicyResponse {
     allowed: boolean;
     message?: string;
 }
-/**
- * What a policy method / gate / hook may return: a bare boolean (unchanged) or the
- * richer {@link PolicyResponse}. Hooks additionally allow `void`/`undefined` to mean
- * "no opinion — fall through".
- */
+/** A bare boolean or a {@link PolicyResponse}. */
 export type PolicyResult = boolean | PolicyResponse;
+/** An ad-hoc, model-less gate registered with `gate.define(name, fn)`. */
+export type GateFn = (user: User, resource?: Resource) => boolean | Promise<boolean>;
 /**
- * A policy method: decides a single ability for a `(user, resource?)` pair.
- * Class-level abilities (e.g. `create`) omit the resource. May be async. May return
- * a bare boolean (unchanged) or a richer {@link PolicyResponse} with a deny message.
+ * The global super-admin hook. `true` grants any check; anything else falls through.
+ * Policies honor it when they extend `AuthzPolicy` (or call `superAdminBefore` from
+ * their `before()`); `RolePolicy` and `PermissionPolicy` do. The `Gate`'s string
+ * abilities and `gate.scope()` ask it first.
  */
-export type PolicyMethod = (user: User, resource?: Resource) => PolicyResult | Promise<PolicyResult>;
-/**
- * Optional per-policy `before` hook. Runs before the ability method.
- * - return `true`  → allow (short-circuit)
- * - return `false` → deny (short-circuit)
- * - return `void`/`undefined` → fall through to the ability method
- */
-export type PolicyBeforeHook = (user: User, ability: string) => PolicyResult | undefined | Promise<PolicyResult | undefined>;
-/** A policy instance is an arbitrary object whose methods are abilities. */
-export type PolicyInstance = Record<string, unknown> & {
-    before?: PolicyBeforeHook;
-};
-/**
- * An ad-hoc gate: a model-less ability resolved by name via `gate.define`.
- * May return a bare boolean (unchanged) or a richer {@link PolicyResponse}.
- */
-export type GateFn = (user: User, resource?: Resource) => PolicyResult | Promise<PolicyResult>;
-/**
- * Global `after` hook. Mirrors Laravel's `Gate::after()`: runs AFTER policy/gate
- * resolution and may observe or override the decision.
- *
- * `result` is the verdict produced by the policy/gate (`true`/`false`), or
- * `undefined` when the policy/gate returned a nullish value (it had "no opinion").
- *
- * Override semantics (Laravel-idiomatic): the hook's return value REPLACES the
- * decision ONLY when the policy/gate produced no explicit verdict (`result` is
- * `undefined`). When the policy/gate DID decide (returned a boolean), `after` is
- * purely an observer and its return value is ignored — so it can never silently
- * overturn an explicit allow/deny. Returning `void`/`undefined` always leaves the
- * decision untouched. Like a policy, it may return a {@link PolicyResponse} to
- * attach a deny message.
- */
-export type AfterHook = (user: User, ability: string, result: boolean | undefined, resource?: Resource) => PolicyResult | undefined | Promise<PolicyResult | undefined>;
+export type SuperAdminHook = (user: User, ability: string, 
 /**
- * A resource loader: turns an `id` into the REAL entity instance for a resource
- * `type`. Used by the opt-in `POST /authz/can` endpoint to rehydrate the client's
- * `{ type, id }` shim before authorizing, so an instance-bound `@Policy` matches by
- * constructor. Returning nullish signals "not found" (the endpoint denies). May be async.
+ * What the check targets: the resource of a single check (the policy's first
+ * argument), or the entity class for `gate.scope(...)`. `undefined` for a model-less
+ * ability. Lets the hook scope the bypass (e.g. to one tenant's resources).
  */
+resource?: Resource) => boolean | null | undefined | Promise<boolean | null | undefined>;
+/** Loads the real entity for a client `{ type, id }` reference (the `POST /authz/can` endpoint). */
 export type ResourceLoader = (id: string | number) => unknown | Promise<unknown>;
-/**
- * Resource loaders keyed by the resource `type` name as emitted by the client/codegen
- * (e.g. `'Post'`). See {@link AuthzModuleOptions.resourceLoaders}.
- */
+/** Resource loaders keyed by the resource `type` name the client sends (e.g. `'Post'`). */
 export type ResourceLoaderMap = Record<string, ResourceLoader>;
 /**
- * Global super-admin before-hook. Runs before any policy/gate; truthy → allow.
- * `void`/`undefined`/`false` falls through to normal resolution.
+ * What happens to a route that declares no `@Can()` (nor `Can.Anyone()` / `@Public()`):
+ * - `'deny'` (default): nothing special; the official `AuthorizationGuard` denies it.
+ * - `'allow'`: the migration mode. `AuthzModule` registers its own global {@link AuthzGuard},
+ *   which enforces the official requirements exactly as the official guard does and lets
+ *   unannotated routes through. Needs `AuthorizationModule.forRoot({ globalGuard: false })`.
  */
-export type SuperAdminHook = (user: User, ability: string, 
-/**
- * The dispatch target: the resource instance/class of a single check, or the scoped entity
- * class for `gate.scope(...)`. `undefined` for a model-less ability.
- */
-resource?: Resource) => PolicyResult | undefined | Promise<PolicyResult | undefined>;
-export interface AuthzModuleOptions {
+export type UnannotatedRoutes = 'allow' | 'deny';
+/** Options that decide what the module registers, so they are static (read before any factory runs). */
+export interface AuthzModuleStaticOptions {
     /**
-     * Policy classes to register explicitly. Each must be decorated with
-     * `@Policy(Resource)`. Auto-discovery of `@Policy` providers also works, so
-     * this is optional.
+     * Opt-in `POST /authz/can` endpoint for client checks that are not hydrated. `true`
+     * mounts it at `authz/can`; a string at that path. Off by default.
      */
-    policies?: Array<Type<PolicyInstance>>;
+    canEndpoint?: boolean | string;
     /**
-     * Global super-admin before-hook applied to every authorization check. Return
-     * `true` to grant (e.g. super-admins). Returning `void`/`false` falls through.
-     *
-     * ⚠️ IMPORTANT — what `user` is: on the **context path** (no `forUser`), the
-     * `user` passed here is the raw {@link UserRef} from nestjs-context — just
-     * `{ type, id }`, NOT your hydrated user entity. So `superAdmin: u => u.isAdmin`
-     * will NOT fire from a route/`gate.allows(...)` unless you also configure
-     * {@link AuthzModuleOptions.resolveUser} to hydrate the full entity. On the
-     * explicit `gate.forUser(entity)` path you receive exactly what you passed.
+     * Class decorators applied to every controller this module mounts (the `POST /authz/can`
+     * endpoint), after its own: `[UseGuards(JwtAuthGuard), ApiTags('authz')]`. The controllers
+     * are open to the official guard by default (`Can.Anyone()`); a `@Can()` here restricts them.
      */
+    decorators?: ClassDecorator[];
+    /** See {@link UnannotatedRoutes}. Default `'deny'`. */
+    unannotated?: UnannotatedRoutes;
+}
+export interface AuthzModuleOptions extends AuthzModuleStaticOptions {
+    /** The global super-admin hook. See {@link SuperAdminHook}. */
     superAdmin?: SuperAdminHook;
     /**
-     * Global `after` hook (Laravel's `Gate::after()`). Runs AFTER policy/gate
-     * resolution and may observe or override the decision. It can only OVERRIDE the
-     * verdict when the policy/gate produced no explicit result (returned nullish);
-     * when the policy/gate decided explicitly, `after` is observe-only and its return
-     * value is ignored. Returning `void`/`undefined` always leaves the decision
-     * untouched. See {@link AfterHook}.
-     *
-     * Receives the same (possibly un-hydrated) `user` as {@link superAdmin} on the
-     * context path — apply {@link resolveUser} if you need the full entity.
-     */
-    after?: AfterHook;
-    /**
-     * Optional hook to hydrate the full user entity from the context's
-     * {@link UserRef} (`{ type, id }`) before policies / `before` / `superAdmin`
-     * run. WITHOUT this hook, the context path passes only `{ type, id }` to those
-     * functions (it does not load your `User` row), so property checks such as
-     * `superAdmin: u => u.isAdmin` or `post.authorId === user.id` against a real
-     * column will not see hydrated fields. Provide `resolveUser` to load the entity
-     * (e.g. from your ORM) keyed by the ref. Returning `undefined` is treated as
-     * "no user" (deny path), identical to an anonymous request.
-     *
-     * Only affects the context path; `gate.forUser(entity)` always uses the value
-     * you pass directly and never invokes this hook.
+     * Hydrates the full user from nestjs-context's `{ type, id }` ref for `Gate` calls
+     * made without a user (`gate.allows(...)` rather than `gate.forUser(user)`), when
+     * `@nestjs/authentication`'s `AuthenticationContext` has no user to offer. Runs once
+     * per `type:id` per request (nestjs-context store). Routes never use it: the official
+     * guard reads the user with its own `getUser`.
      */
     resolveUser?: (ref: UserRef) => User | undefined | Promise<User | undefined>;
     /**
-     * Override the default {@link RoleResolver} used by coarse role-checks
-     * (`gate.hasRole('teacher')`, `@Roles('admin')`). The default reads `user.roles`
-     * (`string[]`) OR `user.role` (`string | string[]`) off the user object, so
-     * role-checks work with ZERO RBAC tables. Provide this to derive roles from a
-     * different shape. When the optional `ROLE_PROVIDER` seam is ALSO registered, the
-     * Gate unions both sources' roles.
-     *
-     * On the context path the resolver receives whatever the context produced (the
-     * raw {@link UserRef} unless `resolveUser` hydrated the entity); on the explicit
-     * `gate.forUser(entity)` path it receives exactly what you passed.
+     * Derives roles from the user object. Default: `user.roles` (`string[]`) or
+     * `user.role` (`string | string[]`). Unioned with the RBAC adapter's role store.
      */
     resolveRoles?: (user: User) => string[] | undefined | Promise<string[] | undefined>;
-    /**
-     * Override the default {@link ResourceResolver} used to load an instance for
-     * `@Can(ability, Resource)` routes. Defaults to {@link IdParamResourceResolver}
-     * (reads the route `:id` param), registered automatically by `forRoot`. Apps
-     * needing real ORM entities provide their own here (or bind the
-     * `RESOURCE_RESOLVER` token directly).
-     */
+    /** Loads the resource for `byId(Resource)`. Default: {@link IdParamResourceResolver}. */
     resourceResolver?: ResourceResolver;
-    /**
-     * Route param name the default {@link IdParamResourceResolver} reads to build
-     * the resource shim. Defaults to `'id'`. Ignored when {@link resourceResolver}
-     * is supplied.
-     */
+    /** Route param the default resolver reads. Default `'id'`. */
     idParam?: string;
-    /**
-     * Opt-in `POST /authz/can` fallback endpoint. **Off by default.** When enabled,
-     * registers a controller that runs `gate.allows(ability, resource?)` for the
-     * current (context) user and returns `{ allowed: boolean }`. This is the
-     * last-resort path the codegen-emitted `can()` helper targets.
-     *
-     * - `true` → mount at the default path `authz/can`.
-     * - `string` → mount at that path (e.g. `'api/authz/can'`).
-     * - `false`/omitted → no endpoint is registered.
-     *
-     * Prefer the no-request paths (shared Inertia props, per-resource `can` maps)
-     * — this endpoint exists only for abilities not already hydrated on the client.
-     */
-    canEndpoint?: boolean | string;
-    /**
-     * Resource loaders keyed by the resource `type` name the client/codegen emits
-     * (e.g. `'Post'`). They close the per-instance gap in the {@link canEndpoint}
-     * fallback: when the endpoint receives `{ ability, resource: { type, id } }` and a
-     * loader is registered for `type`, it `await`s `loader(id)` and authorizes the REAL
-     * entity — so an instance-bound `@Policy` matches by constructor and its method runs
-     * with the loaded resource. A loader returning nullish is treated as "not found"
-     * (the endpoint denies). Types WITHOUT a loader keep the prior behavior (class-level
-     * / ad-hoc only; a resource-bound ability still denies). Opt-in: unset → unchanged.
-     *
-     * ```ts
-     * resourceLoaders: { Post: (id) => postRepo.findOneBy({ id: Number(id) }) }
-     * ```
-     */
+    /** Loaders that turn the endpoint's `{ type, id }` into the real entity, keyed by type. */
     resourceLoaders?: ResourceLoaderMap;
 }
 export interface AuthzModuleOptionsFactory {
     createAuthzOptions(): Promise<AuthzModuleOptions> | AuthzModuleOptions;
 }
-export interface AuthzModuleAsyncOptions {
+export interface AuthzModuleAsyncOptions extends AuthzModuleStaticOptions {
     imports?: unknown[];
     useExisting?: Type<AuthzModuleOptionsFactory>;
     useClass?: Type<AuthzModuleOptionsFactory>;
     useFactory?: (...args: unknown[]) => Promise<AuthzModuleOptions> | AuthzModuleOptions;
     inject?: unknown[];
-    /**
-     * Opt-in `POST /authz/can` fallback endpoint (see {@link AuthzModuleOptions.canEndpoint}).
-     * Declared statically here because controllers are registered at module-definition
-     * time, before the async options factory resolves. Off by default.
-     */
-    canEndpoint?: boolean | string;
-    /**
-     * Resource loaders for the {@link canEndpoint} fallback
-     * (see {@link AuthzModuleOptions.resourceLoaders}). May also be returned from the
-     * async options factory; either way the endpoint reads them from the resolved
-     * options, so this declaration is for the rarer case of supplying them statically.
-     */
+    /** See {@link AuthzModuleOptions.resourceLoaders}. */
     resourceLoaders?: ResourceLoaderMap;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE9B;;;GAGG;AACH,MAAM,MAAM,IAAI,GAAG,OAAO,CAAC;AAE3B;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,cAAc,CAAC;AAEpD;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,IAAI,EAAE,IAAI,EACV,QAAQ,CAAC,EAAE,QAAQ,KAChB,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,MAAM,KACZ,YAAY,GAAG,SAAS,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;AAElE,4EAA4E;AAC5E,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IACrD,MAAM,CAAC,EAAE,gBAAgB,CAAC;CAC3B,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,QAAQ,KAAK,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;AAE/F;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,SAAS,GAAG,CACtB,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,OAAO,GAAG,SAAS,EAC3B,QAAQ,CAAC,EAAE,QAAQ,KAChB,YAAY,GAAG,SAAS,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;AAElE;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEjF;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AAE/D;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAC3B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,MAAM;AACf;;;GAGG;AACH,QAAQ,CAAC,EAAE,QAAQ,KAChB,YAAY,GAAG,SAAS,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;AAElE,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IACvC;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IAC7E;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM,EAAE,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACpF;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC/B;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,EAAE,iBAAiB,CAAC;CACrC;AAED,MAAM,WAAW,yBAAyB;IACxC,kBAAkB,IAAI,OAAO,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAAC;CACxE;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC9C,QAAQ,CAAC,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC3C,UAAU,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAAC;IACtF,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC/B;;;;;OAKG;IACH,eAAe,CAAC,EAAE,iBAAiB,CAAC;CACrC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,uFAAuF;AACvF,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE9B;;;GAGG;AACH,MAAM,MAAM,IAAI,GAAG,OAAO,CAAC;AAE3B;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,kDAAkD;AAClD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,cAAc,CAAC;AAEpD,0EAA0E;AAC1E,MAAM,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,QAAQ,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAErF;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,CAC3B,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,MAAM;AACf;;;;GAIG;AACH,QAAQ,CAAC,EAAE,QAAQ,KAChB,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;AAEtE,oGAAoG;AACpG,MAAM,MAAM,cAAc,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEjF,2FAA2F;AAC3F,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,MAAM,CAAC;AAEjD,wGAAwG;AACxG,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC/B;;;;OAIG;IACH,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;IAC9B,uDAAuD;IACvD,WAAW,CAAC,EAAE,iBAAiB,CAAC;CACjC;AAED,MAAM,WAAW,kBAAmB,SAAQ,wBAAwB;IAClE,+DAA+D;IAC/D,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IAC7E;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM,EAAE,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACpF,yFAAyF;IACzF,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,8DAA8D;IAC9D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2FAA2F;IAC3F,eAAe,CAAC,EAAE,iBAAiB,CAAC;CACrC;AAED,MAAM,WAAW,yBAAyB;IACxC,kBAAkB,IAAI,OAAO,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAAC;CACxE;AAED,MAAM,WAAW,uBAAwB,SAAQ,wBAAwB;IACvE,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC9C,QAAQ,CAAC,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC3C,UAAU,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,kBAAkB,CAAC,GAAG,kBAAkB,CAAC;IACtF,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,sDAAsD;IACtD,eAAe,CAAC,EAAE,iBAAiB,CAAC;CACrC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@dudousxd/nestjs-authz",
-  "version": "0.8.0",
-  "description": "NestJS authorization — Laravel-style Gates & Policies, @Can guard, resource resolver (zero DB).",
+  "version": "0.9.0",
+  "description": "Extras on top of @nestjs/authorization: persisted RBAC policies, @Can helpers (byId, roles, permission), a Gate with batch checks and ad-hoc gates, super-admin, query scoping.",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -21,7 +21,8 @@
     "acl",
     "rbac",
     "tanstack-intent",
-    "cerbos"
+    "cerbos",
+    "nestjs-authorization"
   ],
   "author": "Davi Carvalho <davi@goflip.ai>",
   "type": "module",
@@ -55,24 +56,32 @@
   },
   "peerDependencies": {
     "@dudousxd/nestjs-context": ">=0.1.0",
-    "@nestjs/common": ">=10.0.0",
-    "@nestjs/core": ">=10.0.0",
-    "reflect-metadata": ">=0.1.13"
+    "@nestjs/authentication": "^0.1.5",
+    "@nestjs/authorization": "^0.1.3",
+    "@nestjs/common": "^12.0.0",
+    "@nestjs/core": "^12.0.0",
+    "reflect-metadata": ">=0.1.13",
+    "rxjs": "^7.1.0"
   },
   "peerDependenciesMeta": {
     "@dudousxd/nestjs-context": {
       "optional": true
+    },
+    "@nestjs/authentication": {
+      "optional": true
     }
   },
   "devDependencies": {
     "@cerbos/http": "0.29.0",
+    "@nestjs/authentication": "0.1.5",
+    "@nestjs/authorization": "0.1.3",
     "@nestjs/common": "12.0.1",
     "@nestjs/core": "12.0.1",
     "@nestjs/platform-express": "12.0.1",
     "@nestjs/testing": "12.0.1",
     "@tanstack/intent": "0.4.0",
     "@types/express": "4.17.25",
-    "@types/node": "20.19.43",
+    "@types/node": "22.20.5",
     "@types/supertest": "6.0.3",
     "express": "4.22.2",
     "reflect-metadata": "0.2.2",
@@ -82,12 +91,12 @@
     "vitest": "3.2.7"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=22"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.json",
+    "build": "tsc -p tsconfig.json --incremental false",
     "test": "vitest run --passWithNoTests",
     "test:watch": "vitest",
-    "typecheck": "tsc -p tsconfig.json --noEmit"
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.test.json"
   }
 }