@dudousxd/nestjs-authz 0.8.1 → 0.9.0

package/dist/decorator/policy.decorator.js

@@ -1,28 +0,0 @@
-import 'reflect-metadata';
-import { Injectable } from '@nestjs/common';
-import { POLICY_RESOURCE_METADATA } from '../tokens.js';
-/**
- * Marks a class as the policy for `resource`. The class methods become abilities
- * dispatched by name (e.g. `update(user, post)` answers `gate.authorize('update', post)`).
- *
- * Applying `@Policy` also makes the class an `@Injectable()` provider so it can
- * be auto-discovered and resolved from the Nest container.
- */
-export function Policy(resource) {
-    return (target) => {
-        Reflect.defineMetadata(POLICY_RESOURCE_METADATA, resource, target);
-        // Make the policy a provider without forcing the app to add @Injectable().
-        Injectable()(target);
-    };
-}
-/**
- * Returns the resource class a policy was declared for, or `undefined`.
- *
- * Uses `getMetadata` (not `getOwnMetadata`) so a subclass of a `@Policy`-decorated
- * class still resolves the inherited resource via the prototype chain.
- */
-export function getPolicyResource(policy) {
-    const ctor = typeof policy === 'function' ? policy : policy.constructor;
-    return Reflect.getMetadata(POLICY_RESOURCE_METADATA, ctor);
-}
-//# sourceMappingURL=policy.decorator.js.map

package/dist/decorator/policy.decorator.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"policy.decorator.js","sourceRoot":"","sources":["../../src/decorator/policy.decorator.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAa,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAGxD;;;;;;GAMG;AACH,MAAM,UAAU,MAAM,CAAC,QAAuB;IAC5C,OAAO,CAAC,MAAM,EAAE,EAAE;QAChB,OAAO,CAAC,cAAc,CAAC,wBAAwB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnE,2EAA2E;QAC3E,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA8B;IAC9D,MAAM,IAAI,GAAG,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,MAAyB,CAAC,WAAW,CAAC;IAC5F,OAAO,OAAO,CAAC,WAAW,CAAC,wBAAwB,EAAE,IAAI,CAA8B,CAAC;AAC1F,CAAC"}

package/dist/guard/can.guard.d.ts

@@ -1,31 +0,0 @@
-import { type CanActivate, type ExecutionContext } from '@nestjs/common';
-import { ModuleRef, Reflector } from '@nestjs/core';
-import { Gate } from '../gate.js';
-import type { ResourceResolver } from '../resource-resolver.js';
-/**
- * Enforces `@Can(ability, Resource?)` on routes.
- *
- * - No `@Can` metadata → allow (the guard is inert on un-annotated routes).
- * - Resource class + not class-level → load instance via {@link ResourceResolver}
- *   (a missing/undefined instance is a denial).
- * - Class-level or no resource → dispatch against the class / ad-hoc gate.
- *
- * The decision is delegated to {@link Gate.authorize}, which throws
- * `ForbiddenException` on denial.
- */
-export declare class CanGuard implements CanActivate {
-    private readonly reflector;
-    private readonly gate;
-    private readonly moduleRef;
-    private readonly resolver?;
-    constructor(reflector: Reflector, gate: Gate, moduleRef: ModuleRef, resolver?: ResourceResolver | undefined);
-    /**
-     * Locate the resource resolver. Prefers the value injected into this module;
-     * falls back to a non-strict {@link ModuleRef} lookup so a resolver provided by
-     * ANY module (e.g. the app root) is found even though the guard lives in the
-     * global AuthzModule.
-     */
-    private resolveResolver;
-    canActivate(ctx: ExecutionContext): Promise<boolean>;
-}
-//# sourceMappingURL=can.guard.d.ts.map

package/dist/guard/can.guard.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"can.guard.d.ts","sourceRoot":"","sources":["../../src/guard/can.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,gBAAgB,EAKtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGpD,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAClC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAIhE;;;;;;;;;;GAUG;AACH,qBACa,QAAS,YAAW,WAAW;IAExC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAG1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBALT,SAAS,EAAE,SAAS,EACpB,IAAI,EAAE,IAAI,EACV,SAAS,EAAE,SAAS,EAGpB,QAAQ,CAAC,EAAE,gBAAgB,YAAA;IAG9C;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IASjB,WAAW,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CA2B3D"}

package/dist/guard/can.guard.js

@@ -1,92 +0,0 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
-import { ForbiddenException, Inject, Injectable, Optional, } from '@nestjs/common';
-import { ModuleRef, Reflector } from '@nestjs/core';
-import { ResourceResolverMissingException } from '../errors/exceptions.js';
-import { Gate } from '../gate.js';
-import { CAN_METADATA, RESOURCE_RESOLVER } from '../tokens.js';
-/**
- * Enforces `@Can(ability, Resource?)` on routes.
- *
- * - No `@Can` metadata → allow (the guard is inert on un-annotated routes).
- * - Resource class + not class-level → load instance via {@link ResourceResolver}
- *   (a missing/undefined instance is a denial).
- * - Class-level or no resource → dispatch against the class / ad-hoc gate.
- *
- * The decision is delegated to {@link Gate.authorize}, which throws
- * `ForbiddenException` on denial.
- */
-let CanGuard = class CanGuard {
-    reflector;
-    gate;
-    moduleRef;
-    resolver;
-    constructor(reflector, gate, moduleRef, resolver) {
-        this.reflector = reflector;
-        this.gate = gate;
-        this.moduleRef = moduleRef;
-        this.resolver = resolver;
-    }
-    /**
-     * Locate the resource resolver. Prefers the value injected into this module;
-     * falls back to a non-strict {@link ModuleRef} lookup so a resolver provided by
-     * ANY module (e.g. the app root) is found even though the guard lives in the
-     * global AuthzModule.
-     */
-    resolveResolver() {
-        if (this.resolver)
-            return this.resolver;
-        try {
-            return this.moduleRef.get(RESOURCE_RESOLVER, { strict: false });
-        }
-        catch {
-            return undefined;
-        }
-    }
-    async canActivate(ctx) {
-        const meta = this.reflector.getAllAndOverride(CAN_METADATA, [
-            ctx.getHandler(),
-            ctx.getClass(),
-        ]);
-        if (!meta)
-            return true;
-        // Ad-hoc gate or class-level → no instance to load.
-        if (!meta.resource || meta.classLevel) {
-            const resource = meta.classLevel ? meta.resource : undefined;
-            await this.gate.authorize(meta.ability, resource);
-            return true;
-        }
-        // Instance ability → resolve the resource by route param / app resolver.
-        const resolver = this.resolveResolver();
-        if (!resolver) {
-            throw new ResourceResolverMissingException(meta.ability);
-        }
-        const instance = await resolver.resolve(meta.resource, ctx);
-        if (instance === undefined) {
-            // Not found → deny rather than dispatch a policy with a bogus resource.
-            throw new ForbiddenException(`Unauthorized: ${meta.ability}`);
-        }
-        await this.gate.authorize(meta.ability, instance);
-        return true;
-    }
-};
-CanGuard = __decorate([
-    Injectable(),
-    __param(3, Optional()),
-    __param(3, Inject(RESOURCE_RESOLVER)),
-    __metadata("design:paramtypes", [Reflector,
-        Gate,
-        ModuleRef, Object])
-], CanGuard);
-export { CanGuard };
-//# sourceMappingURL=can.guard.js.map

package/dist/guard/can.guard.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"can.guard.js","sourceRoot":"","sources":["../../src/guard/can.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAGL,kBAAkB,EAClB,MAAM,EACN,UAAU,EACV,QAAQ,GACT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EAAE,gCAAgC,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAElC,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAG/D;;;;;;;;;;GAUG;AAEI,IAAM,QAAQ,GAAd,MAAM,QAAQ;IAEA;IACA;IACA;IAGA;IANnB,YACmB,SAAoB,EACpB,IAAU,EACV,SAAoB,EAGpB,QAA2B;QAL3B,cAAS,GAAT,SAAS,CAAW;QACpB,SAAI,GAAJ,IAAI,CAAM;QACV,cAAS,GAAT,SAAS,CAAW;QAGpB,aAAQ,GAAR,QAAQ,CAAmB;IAC3C,CAAC;IAEJ;;;;;OAKG;IACK,eAAe;QACrB,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC;QACxC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAmB,iBAAiB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACpF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAqB;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAA0B,YAAY,EAAE;YACnF,GAAG,CAAC,UAAU,EAAE;YAChB,GAAG,CAAC,QAAQ,EAAE;SACf,CAAC,CAAC;QACH,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,oDAAoD;QACpD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAE,IAAI,CAAC,QAAgC,CAAC,CAAC,CAAC,SAAS,CAAC;YACtF,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAClD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,yEAAyE;QACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC5D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,wEAAwE;YACxE,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AApDY,QAAQ;IADpB,UAAU,EAAE;IAMR,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,MAAM,CAAC,iBAAiB,CAAC,CAAA;qCAJE,SAAS;QACd,IAAI;QACC,SAAS;GAJ5B,QAAQ,CAoDpB"}

package/dist/guard/roles.guard.d.ts

@@ -1,21 +0,0 @@
-import { type CanActivate, type ExecutionContext } from '@nestjs/common';
-import { Reflector } from '@nestjs/core';
-import { Gate } from '../gate.js';
-/**
- * Enforces `@Roles(...roles)` on routes.
- *
- * - No `@Roles` metadata → allow (the guard is inert on un-annotated routes).
- * - Otherwise allow when the current user holds ANY of the listed roles.
- *
- * The current user is resolved EXACTLY as the {@link Gate} does — from the optional
- * context accessor (nestjs-context) — and an unauthenticated request is denied by
- * default (`gate.hasAnyRole` returns `false` for a NO_USER caller). The verdict is
- * delegated to {@link Gate.hasAnyRole}; a denial throws `ForbiddenException`.
- */
-export declare class RolesGuard implements CanActivate {
-    private readonly reflector;
-    private readonly gate;
-    constructor(reflector: Reflector, gate: Gate);
-    canActivate(ctx: ExecutionContext): Promise<boolean>;
-}
-//# sourceMappingURL=roles.guard.d.ts.map

package/dist/guard/roles.guard.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"roles.guard.d.ts","sourceRoot":"","sources":["../../src/guard/roles.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,gBAAgB,EAGtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAGlC;;;;;;;;;;GAUG;AACH,qBACa,UAAW,YAAW,WAAW;IAE1C,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,IAAI;gBADJ,SAAS,EAAE,SAAS,EACpB,IAAI,EAAE,IAAI;IAGvB,WAAW,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CAS3D"}

package/dist/guard/roles.guard.js

@@ -1,50 +0,0 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-import { ForbiddenException, Injectable, } from '@nestjs/common';
-import { Reflector } from '@nestjs/core';
-import { Gate } from '../gate.js';
-import { ROLES_METADATA } from '../tokens.js';
-/**
- * Enforces `@Roles(...roles)` on routes.
- *
- * - No `@Roles` metadata → allow (the guard is inert on un-annotated routes).
- * - Otherwise allow when the current user holds ANY of the listed roles.
- *
- * The current user is resolved EXACTLY as the {@link Gate} does — from the optional
- * context accessor (nestjs-context) — and an unauthenticated request is denied by
- * default (`gate.hasAnyRole` returns `false` for a NO_USER caller). The verdict is
- * delegated to {@link Gate.hasAnyRole}; a denial throws `ForbiddenException`.
- */
-let RolesGuard = class RolesGuard {
-    reflector;
-    gate;
-    constructor(reflector, gate) {
-        this.reflector = reflector;
-        this.gate = gate;
-    }
-    async canActivate(ctx) {
-        const roles = this.reflector.getAllAndOverride(ROLES_METADATA, [
-            ctx.getHandler(),
-            ctx.getClass(),
-        ]);
-        if (!roles || roles.length === 0)
-            return true;
-        if (await this.gate.hasAnyRole(roles))
-            return true;
-        throw new ForbiddenException(`Unauthorized: requires one of [${roles.join(', ')}]`);
-    }
-};
-RolesGuard = __decorate([
-    Injectable(),
-    __metadata("design:paramtypes", [Reflector,
-        Gate])
-], RolesGuard);
-export { RolesGuard };
-//# sourceMappingURL=roles.guard.js.map

package/dist/guard/roles.guard.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"roles.guard.js","sourceRoot":"","sources":["../../src/guard/roles.guard.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAGL,kBAAkB,EAClB,UAAU,GACX,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C;;;;;;;;;;GAUG;AAEI,IAAM,UAAU,GAAhB,MAAM,UAAU;IAEF;IACA;IAFnB,YACmB,SAAoB,EACpB,IAAU;QADV,cAAS,GAAT,SAAS,CAAW;QACpB,SAAI,GAAJ,IAAI,CAAM;IAC1B,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,GAAqB;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAuB,cAAc,EAAE;YACnF,GAAG,CAAC,UAAU,EAAE;YAChB,GAAG,CAAC,QAAQ,EAAE;SACf,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,IAAI,kBAAkB,CAAC,kCAAkC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtF,CAAC;CACF,CAAA;AAfY,UAAU;IADtB,UAAU,EAAE;qCAGmB,SAAS;QACd,IAAI;GAHlB,UAAU,CAetB"}

package/dist/policy-registry.d.ts

@@ -1,46 +0,0 @@
-import { type Type } from '@nestjs/common';
-import type { PolicyInstance } from './types.js';
-/**
- * Maps a resource class → its policy instance. Populated at module init from
- * explicit `policies: []` and/or auto-discovered `@Policy` providers.
- */
-export declare class PolicyRegistry {
-    private readonly byResource;
-    private classAbilitiesCache;
-    /**
-     * Register a policy instance. Throws if the instance's class was not decorated
-     * with `@Policy(Resource)`.
-     */
-    register(policy: PolicyInstance): void;
-    /** Resolve the policy instance for a resource class, or `undefined`. */
-    forResource(resource: Type<unknown>): PolicyInstance | undefined;
-    /** Resolve the policy for the class of a resource instance, or `undefined`. */
-    forInstance(instance: object): PolicyInstance | undefined;
-    /** True when a policy is registered for the resource class. */
-    has(resource: Type<unknown>): boolean;
-    /** All registered policies (for introspection/testing). */
-    all(): PolicyInstance[];
-    /** All registered resource classes (insertion order). */
-    resources(): Type<unknown>[];
-    /**
-     * Enumerate the CLASS-LEVEL ability method names declared on each registered
-     * policy, keyed by resource class. Used by integrations that pre-resolve a
-     * user's class-level abilities (e.g. to share them as Inertia props).
-     *
-     * Walks the policy prototype chain and collects own function-valued members,
-     * excluding `constructor` and the reserved `before` hook. Inherited Object
-     * members are skipped.
-     *
-     * Only methods that take NO resource instance are included — heuristically,
-     * arity `<= 1` (just `user`, e.g. `create(user)` / `viewAny(user)`). An
-     * instance method like `update(user, post)` is excluded: dispatching it
-     * against the resource CLASS would call it with the class constructor as
-     * `post` and write a bogus class-level verdict.
-     */
-    classAbilities(): Array<{
-        resource: Type<unknown>;
-        abilities: string[];
-    }>;
-    private computeClassAbilities;
-}
-//# sourceMappingURL=policy-registry.d.ts.map

package/dist/policy-registry.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"policy-registry.d.ts","sourceRoot":"","sources":["../src/policy-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAGvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD;;;GAGG;AACH,qBACa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4C;IAIvE,OAAO,CAAC,mBAAmB,CAAsE;IAEjG;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAUtC,wEAAwE;IACxE,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,cAAc,GAAG,SAAS;IAIhE,+EAA+E;IAC/E,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIzD,+DAA+D;IAC/D,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,OAAO;IAIrC,2DAA2D;IAC3D,GAAG,IAAI,cAAc,EAAE;IAIvB,yDAAyD;IACzD,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE;IAI5B;;;;;;;;;;;;;;OAcG;IACH,cAAc,IAAI,KAAK,CAAC;QAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAOzE,OAAO,CAAC,qBAAqB;CAsB9B"}

package/dist/policy-registry.js

@@ -1,101 +0,0 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-import { Injectable } from '@nestjs/common';
-import { getPolicyResource } from './decorator/policy.decorator.js';
-import { PolicyNotDecoratedException } from './errors/exceptions.js';
-/**
- * Maps a resource class → its policy instance. Populated at module init from
- * explicit `policies: []` and/or auto-discovered `@Policy` providers.
- */
-let PolicyRegistry = class PolicyRegistry {
-    byResource = new Map();
-    // Cache for classAbilities(): the result is static after registration, so it
-    // is computed lazily once and invalidated whenever a policy is registered.
-    classAbilitiesCache;
-    /**
-     * Register a policy instance. Throws if the instance's class was not decorated
-     * with `@Policy(Resource)`.
-     */
-    register(policy) {
-        const resource = getPolicyResource(policy);
-        if (!resource) {
-            const name = policy.constructor?.name ?? 'Policy';
-            throw new PolicyNotDecoratedException(name);
-        }
-        this.byResource.set(resource, policy);
-        this.classAbilitiesCache = undefined;
-    }
-    /** Resolve the policy instance for a resource class, or `undefined`. */
-    forResource(resource) {
-        return this.byResource.get(resource);
-    }
-    /** Resolve the policy for the class of a resource instance, or `undefined`. */
-    forInstance(instance) {
-        return this.byResource.get(instance.constructor);
-    }
-    /** True when a policy is registered for the resource class. */
-    has(resource) {
-        return this.byResource.has(resource);
-    }
-    /** All registered policies (for introspection/testing). */
-    all() {
-        return [...this.byResource.values()];
-    }
-    /** All registered resource classes (insertion order). */
-    resources() {
-        return [...this.byResource.keys()];
-    }
-    /**
-     * Enumerate the CLASS-LEVEL ability method names declared on each registered
-     * policy, keyed by resource class. Used by integrations that pre-resolve a
-     * user's class-level abilities (e.g. to share them as Inertia props).
-     *
-     * Walks the policy prototype chain and collects own function-valued members,
-     * excluding `constructor` and the reserved `before` hook. Inherited Object
-     * members are skipped.
-     *
-     * Only methods that take NO resource instance are included — heuristically,
-     * arity `<= 1` (just `user`, e.g. `create(user)` / `viewAny(user)`). An
-     * instance method like `update(user, post)` is excluded: dispatching it
-     * against the resource CLASS would call it with the class constructor as
-     * `post` and write a bogus class-level verdict.
-     */
-    classAbilities() {
-        if (this.classAbilitiesCache === undefined) {
-            this.classAbilitiesCache = this.computeClassAbilities();
-        }
-        return this.classAbilitiesCache;
-    }
-    computeClassAbilities() {
-        const out = [];
-        for (const [resource, policy] of this.byResource) {
-            const abilities = new Set();
-            let proto = Object.getPrototypeOf(policy);
-            while (proto && proto !== Object.prototype) {
-                for (const name of Object.getOwnPropertyNames(proto)) {
-                    if (name === 'constructor' || name === 'before')
-                        continue;
-                    const member = policy[name];
-                    // Class-level abilities take only `user` (arity <= 1). A method that
-                    // also declares a resource param (arity >= 2) is instance-scoped and
-                    // must not be dispatched against the class.
-                    if (typeof member === 'function' && member.length <= 1) {
-                        abilities.add(name);
-                    }
-                }
-                proto = Object.getPrototypeOf(proto);
-            }
-            out.push({ resource, abilities: [...abilities] });
-        }
-        return out;
-    }
-};
-PolicyRegistry = __decorate([
-    Injectable()
-], PolicyRegistry);
-export { PolicyRegistry };
-//# sourceMappingURL=policy-registry.js.map

package/dist/policy-registry.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"policy-registry.js","sourceRoot":"","sources":["../src/policy-registry.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAa,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAGrE;;;GAGG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAc;IACR,UAAU,GAAG,IAAI,GAAG,EAAiC,CAAC;IAEvE,6EAA6E;IAC7E,2EAA2E;IACnE,mBAAmB,CAAsE;IAEjG;;;OAGG;IACH,QAAQ,CAAC,MAAsB;QAC7B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,QAAQ,CAAC;YAClD,MAAM,IAAI,2BAA2B,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,mBAAmB,GAAG,SAAS,CAAC;IACvC,CAAC;IAED,wEAAwE;IACxE,WAAW,CAAC,QAAuB;QACjC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED,+EAA+E;IAC/E,WAAW,CAAC,QAAgB;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,WAA4B,CAAC,CAAC;IACpE,CAAC;IAED,+DAA+D;IAC/D,GAAG,CAAC,QAAuB;QACzB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED,2DAA2D;IAC3D,GAAG;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,yDAAyD;IACzD,SAAS;QACP,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,cAAc;QACZ,IAAI,IAAI,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;YAC3C,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC1D,CAAC;QACD,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;IAEO,qBAAqB;QAC3B,MAAM,GAAG,GAA4D,EAAE,CAAC;QACxE,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACjD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;YACpC,IAAI,KAAK,GAAkB,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YACzD,OAAO,KAAK,IAAI,KAAK,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC3C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;oBACrD,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,QAAQ;wBAAE,SAAS;oBAC1D,MAAM,MAAM,GAAI,MAAkC,CAAC,IAAI,CAAC,CAAC;oBACzD,qEAAqE;oBACrE,qEAAqE;oBACrE,4CAA4C;oBAC5C,IAAI,OAAO,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;wBACvD,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBACtB,CAAC;gBACH,CAAC;gBACD,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YACvC,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF,CAAA;AA1FY,cAAc;IAD1B,UAAU,EAAE;GACA,cAAc,CA0F1B"}