@dudousxd/nestjs-authz 0.8.1 → 0.9.0

package/CHANGELOG.md

@@ -1,5 +1,114 @@
 # @dudousxd/nestjs-authz
 
+## 0.9.0
+
+### Minor Changes
+
+- [#67](https://github.com/DavideCarvalho/nestjs-authz/pull/67) [`32e967f`](https://github.com/DavideCarvalho/nestjs-authz/commit/32e967ffbcd68a97e8effc77af9c16bbbafdc918) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Build on NestJS's first-party `@nestjs/authorization` instead of a parallel engine. Requires
+  NestJS 12, `@nestjs/authorization` ^0.1.3 and Node 22+.
+
+  **Use the official API** for policies (`@Policy()`), route checks (`@Can(Policy, 'ability',
+args?)`, `Can.Anyone()`), the global deny-by-default `AuthorizationGuard`, the current user
+  (`getUser`) and `AuthorizationService`. Import `AuthorizationModule.forRoot()` next to
+  `AuthzModule.forRoot()`.
+
+  **Added on top:**
+
+  - `RolePolicy` (`has`, `hasAll`) and `PermissionPolicy` (`has`, `hasAll`, wildcards) as
+    official policies over the RBAC seams; `GatePolicy` (`allows`) for `gate.define()` gates.
+  - `@Can()` helpers: `byId(Resource, { param? })` (loads the record with the `ResourceResolver`;
+    `authorizedResource(req, Resource)` reads it back), `roles()`, `permission()` /
+    `permissions()`, `ability()`, `staticCanArgs()`. Static resolvers carry their args on
+    `Symbol.for('@dudousxd/static-can-args')`.
+  - `@Roles(...)` and `@Permission(...)` sugar that writes official `@Can` metadata.
+  - `@PolicyFor(Resource)`: links a resource to its official policy (and applies `@Policy()`).
+  - `AuthzPolicy` base class, `superAdminBefore()` and `decisionProviderBefore()`: the
+    `superAdmin` hook and the `DECISION_PROVIDER` (e.g. the Cerbos adapter at
+    `@dudousxd/nestjs-authz/cerbos`) for official policies. `superAdmin` receives the resource.
+    `RolePolicy` / `PermissionPolicy` ask only `superAdmin`.
+  - `Gate.allows/denies/authorize(Policy, ability, ...args)` (delegates to `AuthorizationService`)
+    next to the string form; `allowsMany` also takes `{ policy, ability, args }`.
+  - The `authz:decision` channel now also carries the official guard's decisions (allowed and
+    denied, `reason: 'route'`, with `policy` and `handler`).
+  - `PolicyIndex`, `routeRequirements()`, `readCanRequirements()`, `isOfficialPolicy()`,
+    `currentUserOf()`.
+  - The per-request cache (nestjs-context store) now spans the official guard and the handler:
+    `RolePolicy` / `PermissionPolicy` and `Gate` calls share one `getPermissions`, one
+    `getRoles` and one `resolveUser` per user per request.
+  - `Gate` calls without `forUser()` read `@nestjs/authentication`'s `AuthenticationContext.user`
+    (optional peer, resolved through `ModuleRef`). Inside its scope (a call it handles, or
+    `AuthenticationContext.run()`) its answer is final, so an anonymous call is a guest;
+    nestjs-context's user ref is read only when there is no authentication scope at all.
+  - A migration mode, `AuthzModule.forRoot({ unannotated: 'allow' })` (`forRootAsync`: next to
+    `useFactory`), for apps that cannot annotate every route at once. With
+    `AuthorizationModule.forRoot({ globalGuard: false })`, it registers a global `AuthzGuard` that
+    hands every route with `@Can()` requirements to the official `AuthorizationGuard` (same user,
+    401/403 and `denied` event) and lets unannotated routes through. The startup fails if the
+    official global guard is still on. Default `'deny'`: nothing is registered. `AuthzGuard` is
+    exported for `@UseGuards()`.
+  - `decorators?: ClassDecorator[]`: class decorators applied to every controller the module
+    mounts (the `POST /authz/can` endpoint), which are open to the official guard by default
+    (`authorization:can-anyone`). `canEndpoint` and `decorators` are static options.
+
+  **Removed, with no compatibility shim** (move each to the official form): this package's
+  `Can` and `Policy` exports and `CanOptions`. The string `@Can('update', Post)` →
+  `@Can(PostPolicy, 'update', byId(Post))` (`Can` from `@nestjs/authorization`);
+  `@Can('create', Post, { classLevel: true })` → `@Can(PostPolicy, 'create')`;
+  `@Can('access-admin')` → `@Can(GatePolicy, 'allows', ability('access-admin'))`;
+  `@Policy(Post)` → official `@Policy()` + `@PolicyFor(Post)` (or `@PolicyFor(Post)` alone).
+
+  **Also removed:** `CanGuard`, `RolesGuard`, `PolicyRegistry` (use `PolicyIndex`), `CAN_METADATA`,
+  `ROLES_METADATA`, the `policies` and `after` options, deny messages on policy results
+  (`PolicyResponse` / `PolicyResult` remain only as `DecisionProvider` verdicts),
+  `PolicyNotDecoratedException`, `ResourceResolverMissingException`, `AfterHook`,
+  `PolicyMethod`, `PolicyBeforeHook`, `PolicyInstance`.
+
+  **The policy has the final word:** string abilities now ask `superAdmin` →
+  `DECISION_PROVIDER` → the linked policy → the persisted permissions → the ad-hoc gate. A
+  persisted permission named like a policy ability (`update`) no longer bypasses the policy, in
+  checks and in `gate.scope()`; only `superAdmin` does. Permissions still grant named abilities
+  no policy defines (`posts.publish`).
+
+  **Behavior changes from the official guard:** routes with no `@Can()` are denied (add
+  `@Can.Anyone()`, or migrate with `unannotated: 'allow'`); class- and method-level requirements add up; guests reach policies as
+  `null` and are answered 401; only a literal `true` allows; `superAdmin` applies to policies
+  that extend `AuthzPolicy` (and to the built-in ones, string `Gate` checks and `gate.scope`).
+  `gate.hasRole()` stays a plain fact (no `superAdmin`); `RolePolicy` honors it. A
+  `DecisionProvider` and `superAdmin` see a guest as `null` (was `undefined`).
+
+- [#67](https://github.com/DavideCarvalho/nestjs-authz/pull/67) [`32e967f`](https://github.com/DavideCarvalho/nestjs-authz/commit/32e967ffbcd68a97e8effc77af9c16bbbafdc918) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - `@PolicyFor(Resource)` now throws when `Resource` is already linked to a different policy,
+  instead of silently replacing the process-wide link. Linking the same pair again stays a
+  no-op, and a re-declared class of the same name (a test helper declaring its policy per
+  call, a hot reload) still replaces the link.
+
+### Patch Changes
+
+- [#67](https://github.com/DavideCarvalho/nestjs-authz/pull/67) [`32e967f`](https://github.com/DavideCarvalho/nestjs-authz/commit/32e967ffbcd68a97e8effc77af9c16bbbafdc918) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Fix packages that could be published without files their `exports` point to. `tsc` builds no longer use a `.tsbuildinfo` that can outlive `dist/` and skip emitting files. A new `check:exports` step (also `prepack`) fails the release if any `exports`/`main`/`types` path is missing.
+
+- [#67](https://github.com/DavideCarvalho/nestjs-authz/pull/67) [`32e967f`](https://github.com/DavideCarvalho/nestjs-authz/commit/32e967ffbcd68a97e8effc77af9c16bbbafdc918) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Document that a `DecisionProvider` deny `message` no longer reaches the 403 in 0.9. The official
+  guard answers `{ statusCode: 403, message: 'Forbidden' }`, and `@nestjs/authorization` has no
+  deny-with-reason. Added to the 0.8 → 0.9 migration table, with the workaround and what it costs.
+  `PolicyResponse`'s doc comment no longer claims the message is published on the decision event.
+
+- [#67](https://github.com/DavideCarvalho/nestjs-authz/pull/67) [`32e967f`](https://github.com/DavideCarvalho/nestjs-authz/commit/32e967ffbcd68a97e8effc77af9c16bbbafdc918) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - A `Gate` string check that reaches a linked `AuthzPolicy` now asks `superAdmin` and the
+  `DECISION_PROVIDER` once, not again in the policy's `before()`. Same decision order and verdicts.
+
+- [#67](https://github.com/DavideCarvalho/nestjs-authz/pull/67) [`32e967f`](https://github.com/DavideCarvalho/nestjs-authz/commit/32e967ffbcd68a97e8effc77af9c16bbbafdc918) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Importing `AuthzModule` without `@nestjs/authorization`'s `AuthorizationModule` now fails the boot
+  with an error naming the missing `AuthorizationModule.forRoot()` import, instead of Nest's
+  unresolvable-dependency error on `Gate` / `AuthzGuard`.
+
+- [#67](https://github.com/DavideCarvalho/nestjs-authz/pull/67) [`32e967f`](https://github.com/DavideCarvalho/nestjs-authz/commit/32e967ffbcd68a97e8effc77af9c16bbbafdc918) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - `PolicyIndex` no longer freezes its first discovery scan: it rescans when a module or provider
+  is added (a lazy module) or a policy was not instantiated yet, so `resourcePolicies()`,
+  `classAbilities()` (the Inertia ability map) and `gate.scope()` see the same policies.
+
+- [#67](https://github.com/DavideCarvalho/nestjs-authz/pull/67) [`32e967f`](https://github.com/DavideCarvalho/nestjs-authz/commit/32e967ffbcd68a97e8effc77af9c16bbbafdc918) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - `unannotated: 'allow'`: explain the official boot error. `@nestjs/authorization` 0.1.3 recognizes only its
+  own `AuthorizationGuard` when it checks at startup that each `@Can()` is enforced, so with
+  `globalGuard: false` it logs "`@Can() is not enforced on …`" for the routes the global `AuthzGuard`
+  enforces. `AuthzModule` now logs a line right after it that names the same handlers and says the
+  error is expected in this mode. `AuthzGuard` keeps no official brand on purpose: with it the
+  official check would report every route this mode lets through as denied. Documented in the
+  README's migration section.
+
 ## 0.8.1
 
 ### Patch Changes

package/README.md

@@ -0,0 +1,279 @@
+<p align="center">
+  <a href="https://davidecarvalho.github.io/aviary/docs/authz">
+    <img src="https://raw.githubusercontent.com/DavideCarvalho/nestjs-authz/main/.github/banner.svg" alt="@dudousxd/nestjs-authz — an Aviary library. Call sign: Falcon.">
+  </a>
+</p>
+
+<p align="center">
+  <b><a href="https://davidecarvalho.github.io/aviary/docs/authz">📖 Read the documentation</a></b>
+  &nbsp;·&nbsp; part of the <a href="https://davidecarvalho.github.io/aviary/"><b>Aviary</b></a> ecosystem for NestJS
+</p>
+
+---
+
+# `@dudousxd/nestjs-authz`
+
+Extras on top of NestJS's first-party [`@nestjs/authorization`](https://docs.nestjs.com/security/authorization).
+Policies, `@Can()`, the global deny-by-default guard and `AuthorizationService` come from the
+official package: read its docs first. This package adds what it does not have:
+
+- **Persisted RBAC as official policies**: `RolePolicy` and `PermissionPolicy` (wildcards,
+  tenant-scoped roles, direct permissions, role sources), backed by the TypeORM / MikroORM /
+  Prisma / Drizzle adapters, fetched once per request.
+- **Helpers for the official `@Can()`**: `byId(Post)`, `roles(...)`, `permission(...)`,
+  `ability(...)`, `staticCanArgs(...)`; sugar `@Roles(...)` / `@Permission(...)`.
+- **A global super-admin** and an **external policy engine** (Cerbos, OPA, …): extend
+  `AuthzPolicy`.
+- **A `Gate`** for services: string abilities, batches (`allowsMany`), ad-hoc gates
+  (`define`), roles, query scopes (`scope` + the adapters' `applyScope`).
+- **Frontend and tooling**: Inertia props, a typed `can()` from codegen, client/React
+  helpers, test helpers, and an allow + deny decision event for Telescope.
+
+See [`DESIGN.md`](https://github.com/DavideCarvalho/nestjs-authz/blob/main/DESIGN.md) for the design and the trade-offs.
+
+## Install
+
+```sh
+pnpm add @nestjs/authorization @dudousxd/nestjs-authz
+```
+
+Requires NestJS 12 and Node 22+. Two optional peers: `@nestjs/authentication` gives the `Gate`
+its ambient user (`AuthenticationContext.user`); `@dudousxd/nestjs-context` gives it one too
+(outside an authentication scope), plus the per-request permission cache and
+tenant-scoped roles.
+
+```ts
+@Module({
+  imports: [
+    AuthorizationModule.forRoot(),                        // official: guard, @Can, AuthorizationService
+    AuthzModule.forRoot({ superAdmin: (user) => user?.isRoot === true }),
+  ],
+  providers: [PostPolicy],
+})
+export class AppModule {}
+```
+
+## Policies (official) + `@PolicyFor`
+
+```ts
+import { Can, Policy } from '@nestjs/authorization';
+import { AuthzPolicy, PolicyFor, authorizedResource, byId } from '@dudousxd/nestjs-authz';
+
+@Policy()
+@PolicyFor(Post)                       // optional: links Post → PostPolicy for the extras
+export class PostPolicy extends AuthzPolicy {   // optional: honors `superAdmin`
+  update(user: User | null, post: Post) {
+    return post.authorId === user?.id;
+  }
+}
+
+@Controller('posts')
+export class PostController {
+  @Patch(':id')
+  @Can(PostPolicy, 'update', byId(Post))   // byId loads the Post named by :id
+  update(@Req() req: Request) {
+    const post = authorizedResource(req, Post); // the record byId loaded, no second query
+  }
+}
+```
+
+`byId` uses the `ResourceResolver` given to `AuthzModule.forRoot({ resourceResolver })`
+(default: an `{ id }` object from the route param; `idParam` renames it, `byId(Post, { param })`
+per route). A record that is not found is a 403 before the policy runs.
+
+`@PolicyFor(Post)` is what lets the extras go from a resource to its policy:
+`gate.allows('update', post)`, `gate.scope(Post)`, the client ability map. The official API
+never needs it, and `@PolicyFor` applies the official `@Policy()` itself.
+
+## Roles and permissions
+
+```ts
+@Roles('admin', 'editor')                                  // any of
+@Can(RolePolicy, 'hasAll', roles('admin', 'editor'))      // all of
+@Permission('posts.publish')                              // any of; posts.* grants it
+@Can(PermissionPolicy, 'hasAll', permission('posts.publish', 'posts.delete'))
+```
+
+Roles come from `user.roles` / `user.role` (or `resolveRoles`) and from the RBAC adapter's role
+store; permissions from the adapter:
+
+```ts
+AuthzRbacModule.forRootAsync({
+  inject: [DataSource],
+  useFactory: (ds: DataSource) => ({ store: new TypeOrmAuthzStore(ds) }),
+});
+```
+
+Within one request (a nestjs-context store), a user's permissions and the adapter's roles are
+fetched once, however many checks run: the official guard's `RolePolicy` / `PermissionPolicy`
+and the handler's `Gate` calls share the fetch. The entry is keyed by the row the user names
+(its class or `type`, plus `id`); a plain object without `type` is keyed by identity. A grant
+made mid-request applies from the next request. Adapters set `exhaustivePermissions`, so a
+permission the set lacks is answered without another query.
+
+`roles()`, `permission()`, `ability()` and `staticCanArgs()` return resolvers whose arguments do
+not depend on the call. They carry them on a non-enumerable `Symbol.for('@dudousxd/static-can-args')`
+property, so tools such as the Aviary agent can evaluate a requirement without a request.
+
+## Super-admin
+
+The official guard runs only each policy's own `before()`. Extend `AuthzPolicy` (or call
+`superAdminBefore(user, ability, resource)` from your `before()`) and the `superAdmin` hook
+grants every ability of that policy. The hook receives the resource (the ability's first
+argument), so it can scope the bypass. `RolePolicy` and `PermissionPolicy` extend it.
+
+## The `Gate`
+
+```ts
+constructor(private readonly gate: Gate) {}
+
+await this.gate.forUser(user).authorize(PostPolicy, 'update', post); // = AuthorizationService.authorize
+await this.gate.forUser(user).allows('update', post);                // the policy linked to Post
+await this.gate.forUser(user).allows('posts.publish');               // a persisted permission
+
+this.gate.define('access-admin', (user) => user.isStaff);
+// on a route: @Can(GatePolicy, 'allows', ability('access-admin'))
+
+const results = await this.gate.forUser(user).allowsMany([
+  { ability: 'update', resource: post },
+  { policy: ReportPolicy, ability: 'export', args: ['csv'] },
+]);                                                                  // one permission fetch
+
+const where = await this.gate.forUser(user).scope(Post);            // from PostPolicy.scope(user)
+```
+
+String abilities ask `superAdmin`, then the external decision point (below), then the policy
+linked to the resource, then the persisted permissions, then the ad-hoc gate. **The policy has
+the final word**: holding a permission named like one of its abilities (`update`) does not
+bypass it; only `superAdmin` does. Permissions grant the named abilities no policy defines
+(`posts.publish`). The same goes for `scope()`: a permission scopes an entity only when no
+policy method can.
+
+Policy decisions are always the official service's. `authorize()` throws the official
+`AuthorizationError`, which the official module turns into a 401/403.
+
+Without `forUser`, the user is, in order:
+
+1. `@nestjs/authentication`'s `AuthenticationContext.user`, when that optional peer is
+   installed and its module imported (found through Nest's `ModuleRef`), and its scope is active:
+   a call it handles, or `AuthenticationContext.run()`. Its answer is final there: `null` is a
+   guest, and nestjs-context is not asked. It is `AsyncLocalStorage`-backed, correct in handlers
+   and everything they await;
+2. outside any authentication scope (a queue worker, a cron job, or without the package),
+   nestjs-context's user ref, hydrated by `resolveUser` (once per request) when configured;
+3. a guest (`null`).
+
+## Decisions
+
+Every `Gate` check and every requirement the official guard enforced is published, allowed or
+denied, on the `aviary:authz:decision` diagnostics channel (`authzDecisionChannel`). The official
+package publishes denials only, on `nestjs:authorization:denied`.
+
+## Migrating from 0.8
+
+0.8 and earlier had their own engine. 0.9 runs on `@nestjs/authorization`, and the old
+decorators are gone: move each one to its official form.
+
+| 0.8 | 0.9 |
+| --- | --- |
+| `@Policy(Post)` | `@Policy()` from `@nestjs/authorization` + `@PolicyFor(Post)` (or `@PolicyFor(Post)` alone) |
+| `@Can('update', Post)` | `@Can(PostPolicy, 'update', byId(Post))`, `@Can` from `@nestjs/authorization` |
+| `@Can('create', Post, { classLevel: true })` | `@Can(PostPolicy, 'create')` |
+| `@Can('access-admin')` | `@Can(GatePolicy, 'allows', ability('access-admin'))` |
+| `@Roles('admin')` + `RolesGuard` | `@Roles('admin')`, enforced by the official guard |
+| `CanGuard`, `RolesGuard`, `PolicyRegistry` | removed: the official `AuthorizationGuard`; `PolicyIndex` |
+| `AuthzModule.forRoot({ policies })` | register policies as providers (or `AuthorizationModule.forRoot({ policies })`) |
+| `superAdmin` applied everywhere | applied by `AuthzPolicy` subclasses, the built-in policies and the `Gate` |
+| `after` hook, `{ allowed, message }` results | removed: only a literal `true` allows |
+| current user from nestjs-context on routes | the official `getUser` (default `request.user`) |
+| `gate.allows()` user from nestjs-context | `AuthenticationContext.user` inside its scope (`null` there is a guest), nestjs-context outside it |
+| a persisted permission named like a policy ability grants it | the policy decides (only `superAdmin` bypasses it), in checks and in `scope()` |
+| `DecisionProvider` / `superAdmin` see a guest as `undefined` | `null` |
+| `DecisionProvider` asked by the Gate on every check | asked by `AuthzPolicy.before()` on routes, and by `Gate` string abilities |
+| `import … from '@dudousxd/nestjs-authz-inertia/client'` | `import … from '@dudousxd/nestjs-authz-client'` (the subpath is removed) |
+
+Behavior the official guard brings:
+
+- **Deny by default.** A handler with no `@Can()` is denied; add `@Can.Anyone()` (or
+  `@Public()` from `@nestjs/authentication`) where anyone may call it.
+- **Class and method requirements add up.** A class-level `@Roles` no longer gives way to the
+  method's.
+- **Guests reach the policy as `null`.** Type the user `User | null`; a guest denial is a 401.
+
+### Migrating one controller at a time: `unannotated: 'allow'`
+
+The official guard denies every route that declares no `@Can()`: the app's public routes, and
+every controller another library mounts. 0.8 let them through. Turning authorization on for a
+large app in one go is rarely possible, so this package has a migration mode (the official guard
+has no such option):
+
+1. **Turn the official global guard off**, and switch the migration mode on:
+
+   ```ts
+   imports: [
+     AuthenticationModule.forRoot({ ... }),                 // or your Passport guard, first
+     AuthorizationModule.forRoot({ globalGuard: false }),
+     AuthzModule.forRoot({ unannotated: 'allow' }),         // forRootAsync: next to useFactory
+   ]
+   ```
+
+   `AuthzModule` registers its own global `AuthzGuard`. A route with official `@Can()`
+   requirements (class or method, `@Roles`, `@Permission`) is handed
+   to the official `AuthorizationGuard` as is: same `getUser`, same policies, same 401 for a guest
+   and 403 for a user, same `denied` event. A route with no requirement is let through. The app
+   fails to start if the official global guard is still on, because it would keep denying them.
+
+2. **Drop the 0.8 guard and move the old decorators.** Remove `RolesGuard` / `CanGuard` from
+   `APP_GUARD` and `@UseGuards()`, and rewrite each string `@Can` / `@Policy(Post)` with the table
+   above (`@Can('page.documents')` → `@Can(GatePolicy, 'allows', ability('page.documents'))`).
+   `@Roles('admin')` and `@Permission(...)` are unchanged. All of them are enforced by `AuthzGuard`.
+
+3. **Annotate the open routes**, one controller at a time: `@Can.Anyone()` where anyone may call
+   it, `@Public()` (from `@nestjs/authentication`) where no sign-in is needed, a `@Can(...)`
+   everywhere else.
+
+4. **Switch to deny by default** when every route declares something: remove `unannotated` (or set
+   `'deny'`) and `globalGuard: false`. The official guard is global again, and a forgotten
+   `@Can()` is a 403 instead of an open route.
+
+A route that slipped through in step 3 is open in this mode, so keep it for the migration only.
+
+## External policy engines (Cerbos, OPA, …)
+
+Register a `DecisionProvider` under `DECISION_PROVIDER` to hand decisions to an external policy
+decision point. Unlike the grant-only RBAC seam, it can **allow or deny** a resource-aware check.
+Returning `undefined` abstains. The provider can also batch `gate.allowsMany`, and it can map the
+engine's query plan onto `gate.scope()`. It runs right after the `superAdmin` hook:
+
+- on routes, in the `before()` of every policy that extends `AuthzPolicy`, with the ability and
+  its first argument (`byId(Post)`'s record). `RolePolicy` and `PermissionPolicy` do not ask it:
+  their abilities name roles and permissions, not resources. Call `decisionProviderBefore()`
+  from your own `before()` when a policy cannot extend `AuthzPolicy`;
+- in the `Gate`, before the policy, the permissions and the ad-hoc gate of a string ability.
+  `allowsMany` asks `decideMany` once for the batch.
+
+A guest reaches it as `null`. A Cerbos adapter ships in the box as a subpath with no extra
+dependency; bring your own `@cerbos/http` or `@cerbos/grpc` client:
+
+```ts
+import { DECISION_PROVIDER } from '@dudousxd/nestjs-authz';
+import { CerbosDecisionProvider } from '@dudousxd/nestjs-authz/cerbos';
+import { HTTP } from '@cerbos/http';
+
+providers: [{
+  provide: DECISION_PROVIDER,
+  useValue: new CerbosDecisionProvider({
+    client: new HTTP(process.env.CERBOS_URL!),            // or (user) => per-tenant client | undefined
+    principal: (u) => u && { id: u.id, roles: u.roles, attr: { tenantId: u.tenantId } },
+    resource: (ability, r) => (r instanceof Post ? { kind: 'app:post', id: r.id, attr: { ownerId: r.ownerId } } : undefined),
+    scope: { resource: (entity) => (entity === Post ? { kind: 'app:post' } : undefined) },
+  }),
+}]
+```
+
+The adapter fails **closed** by default. An unreachable PDP denies, and an unsupported query plan
+scopes to no rows. Set `onFailure: 'abstain'` to fall back to your own policies instead.
+
+## License
+
+MIT © Davi Carvalho

package/dist/authz.guard.d.ts

@@ -0,0 +1,48 @@
+import { AuthorizationGuard } from '@nestjs/authorization';
+import { type CanActivate, type ExecutionContext, type OnApplicationBootstrap, type OnModuleInit } from '@nestjs/common';
+import { DiscoveryService, MetadataScanner } from '@nestjs/core';
+/**
+ * The migration guard `AuthzModule.forRoot({ unannotated: 'allow' })` registers globally.
+ *
+ * A route with official `@Can()` requirements (on the class or the method, including
+ * `@Roles` and `@Permission`, which write the same metadata) is
+ * handed to the official `AuthorizationGuard` as is: the same evaluator, the same `getUser`,
+ * the same 401/403, the same denied event. A route that declares no requirement is let
+ * through, where the official guard would deny it. That lets an app turn authorization on
+ * one controller at a time.
+ *
+ * It needs `AuthorizationModule.forRoot({ globalGuard: false })`: the official global guard
+ * would still deny the unannotated routes. The application fails to start when both run.
+ *
+ * It deliberately does not carry the official guard's brand. `@nestjs/authorization` 0.1.3
+ * recognizes a guard that enforces `@Can()` only by that brand, and with it every route this
+ * guard lets through would be logged as "AuthorizationGuard denies every call to …". Without it,
+ * the official module logs "@Can() is not enforced on …" for the routes this guard does enforce;
+ * {@link AuthzGuardStartupCheck} explains that line right after it.
+ */
+export declare class AuthzGuard implements CanActivate {
+    private readonly official;
+    constructor(official?: AuthorizationGuard);
+    canActivate(context: ExecutionContext): Promise<boolean> | boolean;
+}
+/**
+ * With `unannotated: 'allow'`:
+ *
+ * - fails the startup when the official module still registers its own global guard: that guard
+ *   runs too, and denies every unannotated route, so the option would do nothing;
+ * - after the official module's startup check, explains its "@Can() is not enforced on …" error.
+ *   That check sees only `AuthorizationGuard` (by its brand), not the global `AuthzGuard` that
+ *   enforces those routes, so it reports them at every boot in this mode.
+ */
+export declare class AuthzGuardStartupCheck implements OnModuleInit, OnApplicationBootstrap {
+    private readonly discovery;
+    private readonly metadataScanner;
+    private readonly logger;
+    constructor(discovery: DiscoveryService, metadataScanner: MetadataScanner);
+    /** Runs after every `onModuleInit()`, so after the official error it explains. */
+    onApplicationBootstrap(): void;
+    /** Handlers with a `@Can()` requirement and no official guard of their own: AuthzGuard's alone. */
+    private routesOnlyAuthzGuardEnforces;
+    onModuleInit(): void;
+}
+//# sourceMappingURL=authz.guard.d.ts.map

package/dist/authz.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz.guard.d.ts","sourceRoot":"","sources":["../src/authz.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,gBAAgB,EAIrB,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EAGlB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAMjE;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBACa,UAAW,YAAW,WAAW;IAC5C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;gBAEM,QAAQ,CAAC,EAAE,kBAAkB;IAIjF,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO;CAInE;AAuBD;;;;;;;;GAQG;AACH,qBACa,sBAAuB,YAAW,YAAY,EAAE,sBAAsB;IAI/E,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAJlC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;gBAGjC,SAAS,EAAE,gBAAgB,EAC3B,eAAe,EAAE,eAAe;IAGnD,kFAAkF;IAClF,sBAAsB,IAAI,IAAI;IAc9B,mGAAmG;IACnG,OAAO,CAAC,4BAA4B;IAuBpC,YAAY,IAAI,IAAI;CAgBrB"}

package/dist/authz.guard.js

@@ -0,0 +1,144 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { AuthorizationGuard } from '@nestjs/authorization';
+import { Inject, Injectable, Logger, Optional, } from '@nestjs/common';
+import { GUARDS_METADATA } from '@nestjs/common/constants.js';
+import { DiscoveryService, MetadataScanner } from '@nestjs/core';
+import { requireOfficial, routeRequirements } from './official.js';
+/** The static brand `@nestjs/authorization` puts on `AuthorizationGuard` (and its subclasses). */
+const OFFICIAL_GUARD_BRAND = Symbol.for('@nestjs/authorization:guard');
+/**
+ * The migration guard `AuthzModule.forRoot({ unannotated: 'allow' })` registers globally.
+ *
+ * A route with official `@Can()` requirements (on the class or the method, including
+ * `@Roles` and `@Permission`, which write the same metadata) is
+ * handed to the official `AuthorizationGuard` as is: the same evaluator, the same `getUser`,
+ * the same 401/403, the same denied event. A route that declares no requirement is let
+ * through, where the official guard would deny it. That lets an app turn authorization on
+ * one controller at a time.
+ *
+ * It needs `AuthorizationModule.forRoot({ globalGuard: false })`: the official global guard
+ * would still deny the unannotated routes. The application fails to start when both run.
+ *
+ * It deliberately does not carry the official guard's brand. `@nestjs/authorization` 0.1.3
+ * recognizes a guard that enforces `@Can()` only by that brand, and with it every route this
+ * guard lets through would be logged as "AuthorizationGuard denies every call to …". Without it,
+ * the official module logs "@Can() is not enforced on …" for the routes this guard does enforce;
+ * {@link AuthzGuardStartupCheck} explains that line right after it.
+ */
+let AuthzGuard = class AuthzGuard {
+    official;
+    constructor(official) {
+        this.official = requireOfficial(official, 'AuthorizationGuard', 'AuthzGuard');
+    }
+    canActivate(context) {
+        if (routeRequirements(context.getClass(), context.getHandler()).length === 0)
+            return true;
+        return this.official.canActivate(context);
+    }
+};
+AuthzGuard = __decorate([
+    Injectable(),
+    __param(0, Optional()),
+    __param(0, Inject(AuthorizationGuard)),
+    __metadata("design:paramtypes", [AuthorizationGuard])
+], AuthzGuard);
+export { AuthzGuard };
+/** True when `value` is the official `AuthorizationGuard` (or a subclass of it). */
+function isOfficialGuard(value) {
+    const type = value?.constructor;
+    return typeof type === 'function' && type[OFFICIAL_GUARD_BRAND] === true;
+}
+/** True when `guard` (a class from `@UseGuards()`, or an instance) carries the official brand. */
+function isBrandedGuard(guard) {
+    const type = typeof guard === 'function' ? guard : guard?.constructor;
+    return (typeof type === 'function' &&
+        Boolean(type[OFFICIAL_GUARD_BRAND]));
+}
+const list = (wheres) => wheres.length > 3
+    ? `${wheres.slice(0, 3).join(', ')} and ${wheres.length - 3} more`
+    : wheres.join(', ');
+/**
+ * With `unannotated: 'allow'`:
+ *
+ * - fails the startup when the official module still registers its own global guard: that guard
+ *   runs too, and denies every unannotated route, so the option would do nothing;
+ * - after the official module's startup check, explains its "@Can() is not enforced on …" error.
+ *   That check sees only `AuthorizationGuard` (by its brand), not the global `AuthzGuard` that
+ *   enforces those routes, so it reports them at every boot in this mode.
+ */
+let AuthzGuardStartupCheck = class AuthzGuardStartupCheck {
+    discovery;
+    metadataScanner;
+    logger = new Logger('AuthzModule');
+    constructor(discovery, metadataScanner) {
+        this.discovery = discovery;
+        this.metadataScanner = metadataScanner;
+    }
+    /** Runs after every `onModuleInit()`, so after the official error it explains. */
+    onApplicationBootstrap() {
+        const enforced = this.routesOnlyAuthzGuardEnforces();
+        if (enforced.length === 0)
+            return;
+        const official = '"@Can() is not enforced on …"';
+        this.logger.log([
+            `unannotated: 'allow': the global AuthzGuard enforces @Can() on ${list(enforced)}.`,
+            `@nestjs/authorization logs ${official} for these handlers because it only recognizes`,
+            'its own AuthorizationGuard; in this mode that error is expected. It goes away when you',
+            "remove `unannotated: 'allow'` and turn the official global guard back on.",
+        ].join(' '));
+    }
+    /** Handlers with a `@Can()` requirement and no official guard of their own: AuthzGuard's alone. */
+    routesOnlyAuthzGuardEnforces() {
+        const wheres = [];
+        const seen = new Set();
+        for (const wrapper of [...this.discovery.getControllers(), ...this.discovery.getProviders()]) {
+            const type = wrapper.metatype;
+            if (typeof type !== 'function' || wrapper.isFactory || !type.prototype || seen.has(type)) {
+                continue;
+            }
+            seen.add(type);
+            const classGuards = Reflect.getMetadata(GUARDS_METADATA, type) ?? [];
+            for (const key of this.metadataScanner.getAllMethodNames(type.prototype)) {
+                const method = type.prototype[key];
+                // An undecorated method under a class-level @Can() is a helper, not a handler.
+                if (typeof method !== 'function' || Reflect.getOwnMetadataKeys(method).length === 0)
+                    continue;
+                if (routeRequirements(type, method).length === 0)
+                    continue;
+                const guards = [...classGuards, ...(Reflect.getMetadata(GUARDS_METADATA, method) ?? [])];
+                if (!guards.some(isBrandedGuard))
+                    wheres.push(`${type.name}.${key}`);
+            }
+        }
+        return wheres;
+    }
+    onModuleInit() {
+        const officialGlobal = this.discovery
+            .getProviders()
+            .some((wrapper) => typeof wrapper.token === 'string' &&
+            wrapper.token.startsWith('APP_GUARD') &&
+            isOfficialGuard(wrapper.instance));
+        if (officialGlobal) {
+            throw new Error("AuthzModule: `unannotated: 'allow'` needs AuthorizationModule.forRoot({ globalGuard: false }). " +
+                "The official global guard is registered too, and it denies every route that declares no @Can(), so 'allow' would have no effect.");
+        }
+    }
+};
+AuthzGuardStartupCheck = __decorate([
+    Injectable(),
+    __metadata("design:paramtypes", [DiscoveryService,
+        MetadataScanner])
+], AuthzGuardStartupCheck);
+export { AuthzGuardStartupCheck };
+//# sourceMappingURL=authz.guard.js.map

package/dist/authz.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz.guard.js","sourceRoot":"","sources":["../src/authz.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAGL,MAAM,EACN,UAAU,EACV,MAAM,EAGN,QAAQ,GAET,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEnE,kGAAkG;AAClG,MAAM,oBAAoB,GAAG,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;AAEvE;;;;;;;;;;;;;;;;;;GAkBG;AAEI,IAAM,UAAU,GAAhB,MAAM,UAAU;IACJ,QAAQ,CAAqB;IAE9C,YAAoD,QAA6B;QAC/E,IAAI,CAAC,QAAQ,GAAG,eAAe,CAAC,QAAQ,EAAE,oBAAoB,EAAE,YAAY,CAAC,CAAC;IAChF,CAAC;IAED,WAAW,CAAC,OAAyB;QACnC,IAAI,iBAAiB,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1F,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;CACF,CAAA;AAXY,UAAU;IADtB,UAAU,EAAE;IAIE,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,kBAAkB,CAAC,CAAA;qCAAY,kBAAkB;GAHtE,UAAU,CAWtB;;AAED,oFAAoF;AACpF,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,IAAI,GAAI,KAA0D,EAAE,WAAW,CAAC;IACtF,OAAO,OAAO,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,oBAAoB,CAAC,KAAK,IAAI,CAAC;AAC3E,CAAC;AAED,kGAAkG;AAClG,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,IAAI,GACR,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,KAA0C,EAAE,WAAW,CAAC;IACjG,OAAO,CACL,OAAO,IAAI,KAAK,UAAU;QAC1B,OAAO,CAAE,IAA2C,CAAC,oBAAoB,CAAC,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,MAAgB,EAAU,EAAE,CACxC,MAAM,CAAC,MAAM,GAAG,CAAC;IACf,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,MAAM,CAAC,MAAM,GAAG,CAAC,OAAO;IAClE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAExB;;;;;;;;GAQG;AAEI,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IAId;IACA;IAJF,MAAM,GAAG,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC;IAEpD,YACmB,SAA2B,EAC3B,eAAgC;QADhC,cAAS,GAAT,SAAS,CAAkB;QAC3B,oBAAe,GAAf,eAAe,CAAiB;IAChD,CAAC;IAEJ,kFAAkF;IAClF,sBAAsB;QACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,4BAA4B,EAAE,CAAC;QACrD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAClC,MAAM,QAAQ,GAAG,+BAA+B,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,GAAG,CACb;YACE,kEAAkE,IAAI,CAAC,QAAQ,CAAC,GAAG;YACnF,8BAA8B,QAAQ,gDAAgD;YACtF,wFAAwF;YACxF,2EAA2E;SAC5E,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CAAC;IACJ,CAAC;IAED,mGAAmG;IAC3F,4BAA4B;QAClC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAiB,CAAC;QACtC,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,EAAE,CAAC;YAC7F,MAAM,IAAI,GAAG,OAAO,CAAC,QAAqC,CAAC;YAC3D,IAAI,OAAO,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzF,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACf,MAAM,WAAW,GAAc,OAAO,CAAC,WAAW,CAAC,eAAe,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YAChF,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBACzE,MAAM,MAAM,GAAI,IAAI,CAAC,SAAqC,CAAC,GAAG,CAAC,CAAC;gBAChE,+EAA+E;gBAC/E,IAAI,OAAO,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;oBACjF,SAAS;gBACX,IAAI,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBAC3D,MAAM,MAAM,GAAG,CAAC,GAAG,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,eAAe,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBACzF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC;oBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,YAAY;QACV,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS;aAClC,YAAY,EAAE;aACd,IAAI,CACH,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;YACjC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC;YACrC,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CACpC,CAAC;QACJ,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,iGAAiG;gBAC/F,kIAAkI,CACrI,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAA;AA/DY,sBAAsB;IADlC,UAAU,EAAE;qCAKmB,gBAAgB;QACV,eAAe;GALxC,sBAAsB,CA+DlC"}

package/dist/can-endpoint.controller.d.ts

@@ -30,25 +30,6 @@ export interface CanBatchResultItem {
     } | null;
     allowed: boolean;
 }
-/**
- * Build the opt-in fallback controller class, mounted at `path`. Kept as a
- * factory so the route path is configurable via `AuthzModule.forRoot({ canEndpoint })`.
- *
- * The endpoint runs `gate.allows(ability, resource?)` for the CURRENT (context)
- * user.
- *
- * RESOURCE REHYDRATION — how per-instance decisions resolve:
- * the client sends a `{ type, id }` shim whose constructor is `Object`, which never
- * matches a registered instance `@Policy` (those are keyed by the entity constructor).
- * To bridge that, register `resourceLoaders` in `AuthzModule.forRoot({ resourceLoaders })`
- * (keyed by the `type` name): when a loader exists for `resource.type`, the endpoint
- * `await`s `loader(id)` and authorizes the REAL entity, so the instance `@Policy`
- * matches and its method runs. A loader returning nullish → `{ allowed: false }` (not
- * found). With NO loader for the type the raw shim is forwarded as before, so only
- * class-level abilities and ad-hoc gates resolve and a resource-bound ability denies
- * (a deliberate, documented fall-through, not a silent dead-end). An unresolved ability
- * is likewise treated as a deny (never a 500).
- */
 export declare function createCanController(path: string): Type<unknown>;
 /** Default mount path for the fallback endpoint (matches codegen's `/authz/can`). */
 export declare const DEFAULT_CAN_ENDPOINT_PATH = "authz/can";

package/dist/can-endpoint.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"can-endpoint.controller.d.ts","sourceRoot":"","sources":["../src/can-endpoint.controller.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsC,KAAK,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAM/E;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC1D;AAED,gDAAgD;AAChD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,cAAc,EAAE,CAAC;AAEnD,iFAAiF;AACjF,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACzD,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAiH/D;AAED,qFAAqF;AACrF,eAAO,MAAM,yBAAyB,cAAc,CAAC"}
+{"version":3,"file":"can-endpoint.controller.d.ts","sourceRoot":"","sources":["../src/can-endpoint.controller.ts"],"names":[],"mappings":"AACA,OAAO,EAML,KAAK,IAAI,EAEV,MAAM,gBAAgB,CAAC;AAOxB;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC1D;AAED,gDAAgD;AAChD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,cAAc,EAAE,CAAC;AAEnD,iFAAiF;AACjF,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACzD,OAAO,EAAE,OAAO,CAAC;CAClB;AAwBD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAyH/D;AAED,qFAAqF;AACrF,eAAO,MAAM,yBAAyB,cAAc,CAAC"}