@dudousxd/nestjs-authz 0.8.1 → 0.9.0

package/dist/module.js

@@ -11,226 +11,197 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 var AuthzModule_1;
+import { AUTHORIZATION_MODULE_OPTIONS, defaultGetUser, } from '@nestjs/authorization';
 import { Inject, Injectable, Module, Optional, } from '@nestjs/common';
-import { APP_GUARD, DiscoveryModule, DiscoveryService, ModuleRef } from '@nestjs/core';
+import { APP_GUARD, APP_INTERCEPTOR, DiscoveryModule } from '@nestjs/core';
+import { AuthzGuard, AuthzGuardStartupCheck } from './authz.guard.js';
 import { DEFAULT_CAN_ENDPOINT_PATH, createCanController } from './can-endpoint.controller.js';
-import { getPolicyResource } from './decorator/policy.decorator.js';
+import { AuthzDecisionPublisher } from './decisions.js';
 import { Gate } from './gate.js';
-import { CanGuard } from './guard/can.guard.js';
-import { RolesGuard } from './guard/roles.guard.js';
-import { PolicyRegistry } from './policy-registry.js';
+import { OFFICIAL_CAN_ANYONE_METADATA } from './official.js';
+import { GatePolicy } from './policies/gate.policy.js';
+import { PermissionPolicy } from './policies/permission.policy.js';
+import { RolePolicy } from './policies/role.policy.js';
+import { PolicyIndex } from './policy-index.js';
+import { AuthzRbac } from './rbac.js';
 import { IdParamResourceResolver } from './resource-resolver.js';
+import { configureAuthzRuntime } from './runtime.js';
 import { AUTHZ_MODULE_OPTIONS, RESOURCE_HYDRATOR, RESOURCE_RESOLVER } from './tokens.js';
 /**
- * Populates the {@link PolicyRegistry} at boot from explicit `policies: []` and
- * auto-discovered `@Policy`-decorated providers.
- *
- * Explicit policies are read from the RESOLVED {@link AUTHZ_MODULE_OPTIONS} (so a
- * `forRootAsync` `useFactory`/`useClass` that returns `policies: [...]` registers
- * them too) and resolved as provider instances via {@link ModuleRef}.
+ * Hands the official `@Can()` argument resolvers and `AuthzPolicy` what they cannot
+ * inject: the resource resolver, the `superAdmin` hook, the external decision point,
+ * and the official `getUser`.
  */
-let AuthzPolicyBootstrap = class AuthzPolicyBootstrap {
-    registry;
-    discovery;
-    moduleRef;
+let AuthzRuntimeBootstrap = class AuthzRuntimeBootstrap {
+    resolver;
+    rbac;
     options;
-    constructor(registry, discovery, moduleRef, options) {
-        this.registry = registry;
-        this.discovery = discovery;
-        this.moduleRef = moduleRef;
+    official;
+    constructor(resolver, rbac, options, official) {
+        this.resolver = resolver;
+        this.rbac = rbac;
         this.options = options;
+        this.official = official;
     }
-    async onModuleInit() {
-        const seen = new Set();
-        // 1. Explicit `policies: []` from resolved options (forRoot AND forRootAsync).
-        for (const PolicyClass of this.options?.policies ?? []) {
-            if (seen.has(PolicyClass))
-                continue;
-            const instance = await this.resolvePolicyInstance(PolicyClass);
-            if (instance) {
-                seen.add(PolicyClass);
-                this.registry.register(instance);
-            }
-        }
-        // 2. Auto-discovered @Policy-decorated providers.
-        for (const wrapper of this.discovery.getProviders()) {
-            const instance = wrapper.instance;
-            if (!instance || typeof instance !== 'object')
-                continue;
-            const ctor = instance.constructor;
-            if (!ctor || seen.has(ctor))
-                continue;
-            if (getPolicyResource(instance)) {
-                seen.add(ctor);
-                this.registry.register(instance);
-            }
-        }
-    }
-    /**
-     * Resolve a policy class to an instance. Prefers an existing provider (so DI
-     * deps are honored); falls back to instantiating it through the container when
-     * the class was passed via `forRootAsync` options but not registered as a
-     * provider anywhere.
-     */
-    async resolvePolicyInstance(PolicyClass) {
-        try {
-            return this.moduleRef.get(PolicyClass, { strict: false });
-        }
-        catch {
-            // not a registered provider — instantiate via the container.
-        }
-        try {
-            return await this.moduleRef.create(PolicyClass);
-        }
-        catch {
-            return undefined;
-        }
+    onModuleInit() {
+        configureAuthzRuntime({
+            resourceResolver: this.resolver,
+            superAdmin: this.options?.superAdmin,
+            decisionProvider: () => this.rbac.decisions(),
+            // Always set: an app without its own `getUser` must not keep a previous app's.
+            getUser: this.official?.getUser ?? defaultGetUser,
+        });
     }
 };
-AuthzPolicyBootstrap = __decorate([
+AuthzRuntimeBootstrap = __decorate([
     Injectable(),
+    __param(0, Inject(RESOURCE_RESOLVER)),
+    __param(2, Optional()),
+    __param(2, Inject(AUTHZ_MODULE_OPTIONS)),
     __param(3, Optional()),
-    __param(3, Inject(AUTHZ_MODULE_OPTIONS)),
-    __metadata("design:paramtypes", [PolicyRegistry,
-        DiscoveryService,
-        ModuleRef, Object])
-], AuthzPolicyBootstrap);
+    __param(3, Inject(AUTHORIZATION_MODULE_OPTIONS)),
+    __metadata("design:paramtypes", [Object, AuthzRbac, Object, Object])
+], AuthzRuntimeBootstrap);
+/** The static options, which a `forRootAsync()` factory returning them would silently drop. */
+const STATIC_OPTIONS = ['unannotated', 'decorators'];
+function checkFactoryOptions(options) {
+    for (const key of STATIC_OPTIONS) {
+        if (options?.[key] !== undefined) {
+            throw new Error(`AuthzModule: \`${key}\` is in the options the forRootAsync() factory returned. It goes at the top level of forRootAsync(), next to useFactory, because it decides what the module registers.`);
+        }
+    }
+    return options;
+}
+const EXPORTS = [
+    Gate,
+    AuthzGuard,
+    PolicyIndex,
+    AuthzRbac,
+    RolePolicy,
+    PermissionPolicy,
+    GatePolicy,
+    AUTHZ_MODULE_OPTIONS,
+    RESOURCE_RESOLVER,
+    RESOURCE_HYDRATOR,
+];
+/**
+ * The extras on top of `@nestjs/authorization`. Import it next to the official module:
+ *
+ * ```ts
+ * imports: [
+ *   AuthorizationModule.forRoot(),            // the official guard, @Can, AuthorizationService
+ *   AuthzModule.forRoot({ superAdmin: (u) => u?.isRoot === true }),
+ * ]
+ * ```
+ *
+ * Registers `RolePolicy`, `PermissionPolicy` and `GatePolicy` (official policies), the
+ * `Gate`, the resource resolver `byId()` uses, and the allow+deny decision event.
+ * It needs the official module to be global (its default).
+ */
 let AuthzModule = AuthzModule_1 = class AuthzModule {
     static forRoot(options = {}) {
-        const policyProviders = (options.policies ?? []).map((P) => P);
         return {
             module: AuthzModule_1,
             global: true,
             imports: [DiscoveryModule],
-            controllers: AuthzModule_1.canControllers(options.canEndpoint),
+            controllers: AuthzModule_1.controllers(options),
             providers: [
                 { provide: AUTHZ_MODULE_OPTIONS, useValue: options },
-                ...policyProviders,
-                PolicyRegistry,
-                Gate,
-                CanGuard,
-                { provide: APP_GUARD, useExisting: CanGuard },
-                RolesGuard,
-                { provide: APP_GUARD, useExisting: RolesGuard },
-                ...AuthzModule_1.resourceResolverProviders(),
-                ...AuthzModule_1.resourceHydratorProviders(),
-                ...AuthzModule_1.bootstrapProviders(),
-            ],
-            exports: [
-                Gate,
-                PolicyRegistry,
-                CanGuard,
-                RolesGuard,
-                AUTHZ_MODULE_OPTIONS,
-                RESOURCE_RESOLVER,
-                RESOURCE_HYDRATOR,
-                ...(options.policies ?? []),
+                ...AuthzModule_1.common(),
+                ...AuthzModule_1.guards(options),
             ],
+            exports: EXPORTS,
         };
     }
     static forRootAsync(options) {
-        const asyncProvider = AuthzModule_1.buildAsyncOptionsProvider(options);
-        const asyncProviders = Array.isArray(asyncProvider) ? asyncProvider : [asyncProvider];
         return {
             module: AuthzModule_1,
             global: true,
             imports: [DiscoveryModule, ...(options.imports ?? [])],
-            controllers: AuthzModule_1.canControllers(options.canEndpoint),
+            controllers: AuthzModule_1.controllers(options),
             providers: [
-                ...asyncProviders,
-                PolicyRegistry,
-                Gate,
-                CanGuard,
-                { provide: APP_GUARD, useExisting: CanGuard },
-                RolesGuard,
-                { provide: APP_GUARD, useExisting: RolesGuard },
-                ...AuthzModule_1.resourceResolverProviders(),
-                ...AuthzModule_1.resourceHydratorProviders(),
-                ...AuthzModule_1.bootstrapProviders(),
-            ],
-            exports: [
-                Gate,
-                PolicyRegistry,
-                CanGuard,
-                RolesGuard,
-                AUTHZ_MODULE_OPTIONS,
-                RESOURCE_RESOLVER,
-                RESOURCE_HYDRATOR,
+                ...AuthzModule_1.asyncOptionsProviders(options),
+                ...AuthzModule_1.common(),
+                ...AuthzModule_1.guards(options),
             ],
+            exports: EXPORTS,
         };
     }
-    /**
-     * Register a default {@link ResourceResolver} bound to {@link RESOURCE_RESOLVER}
-     * so `@Can('update', Post)` works out-of-the-box on a clean install (no manual
-     * resolver wiring needed). Reads the resolved options so a `resourceResolver`
-     * override / `idParam` knob from forRoot OR forRootAsync is honored.
-     */
-    static resourceResolverProviders() {
+    static common() {
         return [
+            PolicyIndex,
+            AuthzRbac,
+            Gate,
+            RolePolicy,
+            PermissionPolicy,
+            GatePolicy,
             {
                 provide: RESOURCE_RESOLVER,
                 useFactory: (options) => options?.resourceResolver ?? new IdParamResourceResolver(options?.idParam),
                 inject: [{ token: AUTHZ_MODULE_OPTIONS, optional: true }],
             },
-        ];
-    }
-    /**
-     * Bind the {@link RESOURCE_HYDRATOR} token to the resolved options'
-     * `resourceLoaders` map so the opt-in `POST /authz/can` endpoint can rehydrate a
-     * `{ type, id }` shim into the REAL entity before authorizing. Reads the resolved
-     * options so the map from forRoot OR a forRootAsync factory is honored. Resolves to
-     * `undefined` when no `resourceLoaders` are configured (endpoint behavior unchanged).
-     */
-    static resourceHydratorProviders() {
-        return [
             {
                 provide: RESOURCE_HYDRATOR,
                 useFactory: (options) => options?.resourceLoaders,
                 inject: [{ token: AUTHZ_MODULE_OPTIONS, optional: true }],
             },
+            AuthzGuard,
+            AuthzRuntimeBootstrap,
+            AuthzDecisionPublisher,
+            { provide: APP_INTERCEPTOR, useExisting: AuthzDecisionPublisher },
         ];
     }
     /**
-     * Provider that populates the {@link PolicyRegistry} on init (explicit policies
-     * + auto-discovered `@Policy` providers). Registered for both forRoot/forRootAsync.
+     * `unannotated: 'allow'`: the migration guard, registered globally, and the check that the
+     * official global guard is off. Static, so it is read from `forRoot()` / the top level of
+     * `forRootAsync()`, never from the factory.
      */
-    static bootstrapProviders() {
-        return [AuthzPolicyBootstrap];
+    static guards(options) {
+        const mode = options.unannotated ?? 'deny';
+        if (mode !== 'allow' && mode !== 'deny') {
+            throw new Error(`AuthzModule: \`unannotated\` must be 'allow' or 'deny', got ${String(mode)}.`);
+        }
+        if (mode === 'deny')
+            return [];
+        return [AuthzGuardStartupCheck, { provide: APP_GUARD, useExisting: AuthzGuard }];
     }
     /**
-     * Build the opt-in `POST /authz/can` fallback controller (or none). Off by
-     * default; `true` mounts at the default path, a string mounts at that path.
+     * The controllers this module mounts, each a fresh class (so `decorators` never leak between
+     * registrations), open to the official guard, then decorated with `decorators`.
      */
-    static canControllers(canEndpoint) {
+    static controllers(options) {
+        const { canEndpoint, decorators = [] } = options;
         if (!canEndpoint)
             return [];
         const path = typeof canEndpoint === 'string' ? canEndpoint : DEFAULT_CAN_ENDPOINT_PATH;
-        return [createCanController(path)];
-    }
-    static buildAsyncOptionsProvider(options) {
-        if (options.useFactory) {
-            return {
-                provide: AUTHZ_MODULE_OPTIONS,
-                useFactory: options.useFactory,
-                inject: (options.inject ?? []),
-            };
+        const controller = createCanController(path);
+        Reflect.defineMetadata(OFFICIAL_CAN_ANYONE_METADATA, true, controller);
+        // Applied in order, after the module's own, like a stack written above the class.
+        for (const decorate of [...decorators].reverse()) {
+            decorate(controller);
         }
-        if (options.useClass) {
+        return [controller];
+    }
+    static asyncOptionsProviders(options) {
+        const { useFactory } = options;
+        if (useFactory) {
             return [
-                { provide: options.useClass, useClass: options.useClass },
                 {
                     provide: AUTHZ_MODULE_OPTIONS,
-                    useFactory: async (factory) => factory.createAuthzOptions(),
-                    inject: [options.useClass],
+                    useFactory: async (...args) => checkFactoryOptions(await useFactory(...args)),
+                    inject: (options.inject ?? []),
                 },
             ];
         }
-        const factoryClass = options.useExisting;
-        return {
-            provide: AUTHZ_MODULE_OPTIONS,
-            useFactory: async (factory) => factory.createAuthzOptions(),
-            inject: [factoryClass],
-        };
+        const factory = (options.useClass ?? options.useExisting);
+        return [
+            ...(options.useClass ? [{ provide: options.useClass, useClass: options.useClass }] : []),
+            {
+                provide: AUTHZ_MODULE_OPTIONS,
+                useFactory: async (f) => checkFactoryOptions(await f.createAuthzOptions()),
+                inject: [factory],
+            },
+        ];
     }
 };
 AuthzModule = AuthzModule_1 = __decorate([

package/dist/module.js.map

@@ -1 +1 @@
-{"version":3,"file":"module.js","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EAEL,MAAM,EACN,UAAU,EACV,MAAM,EAEN,QAAQ,GAGT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACvF,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAyB,MAAM,wBAAwB,CAAC;AACxF,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AASzF;;;;;;;GAOG;AACH,IACM,oBAAoB,GAD1B,MACM,oBAAoB;IAEL;IACA;IACA;IAC0C;IAJ7D,YACmB,QAAwB,EACxB,SAA2B,EAC3B,SAAoB,EACsB,OAA4B;QAHtE,aAAQ,GAAR,QAAQ,CAAgB;QACxB,cAAS,GAAT,SAAS,CAAkB;QAC3B,cAAS,GAAT,SAAS,CAAW;QACsB,YAAO,GAAP,OAAO,CAAqB;IACtF,CAAC;IAEJ,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAW,CAAC;QAEhC,+EAA+E;QAC/E,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;YACvD,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;gBAAE,SAAS;YACpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;YAC/D,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACtB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,kDAAkD;QAClD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAsC,CAAC;YAChE,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;gBAAE,SAAS;YACxD,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,CAAC;YAClC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YACtC,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACf,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,qBAAqB,CACjC,WAAiC;QAEjC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAiB,WAAW,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;QAC/D,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAiB,WAAW,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;CACF,CAAA;AAtDK,oBAAoB;IADzB,UAAU,EAAE;IAMR,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,oBAAoB,CAAC,CAAA;qCAHd,cAAc;QACb,gBAAgB;QAChB,SAAS;GAJnC,oBAAoB,CAsDzB;AAGM,IAAM,WAAW,mBAAjB,MAAM,WAAW;IACtB,MAAM,CAAC,OAAO,CAAC,UAA8B,EAAE;QAC7C,MAAM,eAAe,GAAe,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAa,CAAC,CAAC;QACvF,OAAO;YACL,MAAM,EAAE,aAAW;YACnB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,eAAe,CAAC;YAC1B,WAAW,EAAE,aAAW,CAAC,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC;YAC5D,SAAS,EAAE;gBACT,EAAE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,OAAO,EAAE;gBACpD,GAAG,eAAe;gBAClB,cAAc;gBACd,IAAI;gBACJ,QAAQ;gBACR,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE;gBAC7C,UAAU;gBACV,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE;gBAC/C,GAAG,aAAW,CAAC,yBAAyB,EAAE;gBAC1C,GAAG,aAAW,CAAC,yBAAyB,EAAE;gBAC1C,GAAG,aAAW,CAAC,kBAAkB,EAAE;aACpC;YACD,OAAO,EAAE;gBACP,IAAI;gBACJ,cAAc;gBACd,QAAQ;gBACR,UAAU;gBACV,oBAAoB;gBACpB,iBAAiB;gBACjB,iBAAiB;gBACjB,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;aAC5B;SACF,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,OAAgC;QAClD,MAAM,aAAa,GAAG,aAAW,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC;QACrE,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACtF,OAAO;YACL,MAAM,EAAE,aAAW;YACnB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,eAAe,EAAE,GAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAqB,CAAC;YAC3E,WAAW,EAAE,aAAW,CAAC,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC;YAC5D,SAAS,EAAE;gBACT,GAAG,cAAc;gBACjB,cAAc;gBACd,IAAI;gBACJ,QAAQ;gBACR,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE;gBAC7C,UAAU;gBACV,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE;gBAC/C,GAAG,aAAW,CAAC,yBAAyB,EAAE;gBAC1C,GAAG,aAAW,CAAC,yBAAyB,EAAE;gBAC1C,GAAG,aAAW,CAAC,kBAAkB,EAAE;aACpC;YACD,OAAO,EAAE;gBACP,IAAI;gBACJ,cAAc;gBACd,QAAQ;gBACR,UAAU;gBACV,oBAAoB;gBACpB,iBAAiB;gBACjB,iBAAiB;aAClB;SACF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,yBAAyB;QACtC,OAAO;YACL;gBACE,OAAO,EAAE,iBAAiB;gBAC1B,UAAU,EAAE,CAAC,OAA4B,EAAoB,EAAE,CAC7D,OAAO,EAAE,gBAAgB,IAAI,IAAI,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC;gBAC5E,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;aAC1D;SACF,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,yBAAyB;QACtC,OAAO;YACL;gBACE,OAAO,EAAE,iBAAiB;gBAC1B,UAAU,EAAE,CAAC,OAA4B,EAAiC,EAAE,CAC1E,OAAO,EAAE,eAAe;gBAC1B,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;aAC1D;SACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,kBAAkB;QAC/B,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAChC,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,cAAc,CAAC,WAAyC;QACrE,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,yBAAyB,CAAC;QACvF,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;IACrC,CAAC;IAEO,MAAM,CAAC,yBAAyB,CACtC,OAAgC;QAEhC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,OAAO;gBACL,OAAO,EAAE,oBAAoB;gBAC7B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAyB;aACvD,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,OAAO;gBACL,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;gBACzD;oBACE,OAAO,EAAE,oBAAoB;oBAC7B,UAAU,EAAE,KAAK,EAAE,OAAkC,EAAE,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE;oBACtF,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;iBAC3B;aACF,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,OAAO,CAAC,WAA8C,CAAC;QAC5E,OAAO;YACL,OAAO,EAAE,oBAAoB;YAC7B,UAAU,EAAE,KAAK,EAAE,OAAkC,EAAE,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE;YACtF,MAAM,EAAE,CAAC,YAAY,CAAC;SACvB,CAAC;IACJ,CAAC;CACF,CAAA;AAlJY,WAAW;IADvB,MAAM,CAAC,EAAE,CAAC;GACE,WAAW,CAkJvB"}
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EACL,4BAA4B,EAE5B,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,MAAM,EACN,UAAU,EACV,MAAM,EAEN,QAAQ,GAGT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAC9F,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,uBAAuB,EAAyB,MAAM,wBAAwB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AASzF;;;;GAIG;AACH,IACM,qBAAqB,GAD3B,MACM,qBAAqB;IAEqB;IAC3B;IAC0C;IAG1C;IANnB,YAC8C,QAA0B,EACrD,IAAe,EAC2B,OAA4B,EAGtE,QAAqC;QALV,aAAQ,GAAR,QAAQ,CAAkB;QACrD,SAAI,GAAJ,IAAI,CAAW;QAC2B,YAAO,GAAP,OAAO,CAAqB;QAGtE,aAAQ,GAAR,QAAQ,CAA6B;IACrD,CAAC;IAEJ,YAAY;QACV,qBAAqB,CAAC;YACpB,gBAAgB,EAAE,IAAI,CAAC,QAAQ;YAC/B,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU;YACpC,gBAAgB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAC7C,+EAA+E;YAC/E,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI,cAAc;SAClD,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAnBK,qBAAqB;IAD1B,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,iBAAiB,CAAC,CAAA;IAEzB,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,oBAAoB,CAAC,CAAA;IACxC,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,MAAM,CAAC,4BAA4B,CAAC,CAAA;6CAHd,SAAS;GAH9B,qBAAqB,CAmB1B;AAED,+FAA+F;AAC/F,MAAM,cAAc,GAAG,CAAC,aAAa,EAAE,YAAY,CAAU,CAAC;AAE9D,SAAS,mBAAmB,CAAC,OAA2B;IACtD,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,IAAI,OAAO,EAAE,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,kBAAkB,GAAG,yKAAyK,CAC/L,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,OAAO,GAAG;IACd,IAAI;IACJ,UAAU;IACV,WAAW;IACX,SAAS;IACT,UAAU;IACV,gBAAgB;IAChB,UAAU;IACV,oBAAoB;IACpB,iBAAiB;IACjB,iBAAiB;CAClB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AAEI,IAAM,WAAW,mBAAjB,MAAM,WAAW;IACtB,MAAM,CAAC,OAAO,CAAC,UAA8B,EAAE;QAC7C,OAAO;YACL,MAAM,EAAE,aAAW;YACnB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,eAAe,CAAC;YAC1B,WAAW,EAAE,aAAW,CAAC,WAAW,CAAC,OAAO,CAAC;YAC7C,SAAS,EAAE;gBACT,EAAE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,OAAO,EAAE;gBACpD,GAAG,aAAW,CAAC,MAAM,EAAE;gBACvB,GAAG,aAAW,CAAC,MAAM,CAAC,OAAO,CAAC;aAC/B;YACD,OAAO,EAAE,OAAO;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,OAAgC;QAClD,OAAO;YACL,MAAM,EAAE,aAAW;YACnB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,eAAe,EAAE,GAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAqB,CAAC;YAC3E,WAAW,EAAE,aAAW,CAAC,WAAW,CAAC,OAAO,CAAC;YAC7C,SAAS,EAAE;gBACT,GAAG,aAAW,CAAC,qBAAqB,CAAC,OAAO,CAAC;gBAC7C,GAAG,aAAW,CAAC,MAAM,EAAE;gBACvB,GAAG,aAAW,CAAC,MAAM,CAAC,OAAO,CAAC;aAC/B;YACD,OAAO,EAAE,OAAO;SACjB,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,MAAM;QACnB,OAAO;YACL,WAAW;YACX,SAAS;YACT,IAAI;YACJ,UAAU;YACV,gBAAgB;YAChB,UAAU;YACV;gBACE,OAAO,EAAE,iBAAiB;gBAC1B,UAAU,EAAE,CAAC,OAA4B,EAAoB,EAAE,CAC7D,OAAO,EAAE,gBAAgB,IAAI,IAAI,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC;gBAC5E,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;aAC1D;YACD;gBACE,OAAO,EAAE,iBAAiB;gBAC1B,UAAU,EAAE,CAAC,OAA4B,EAAiC,EAAE,CAC1E,OAAO,EAAE,eAAe;gBAC1B,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;aAC1D;YACD,UAAU;YACV,qBAAqB;YACrB,sBAAsB;YACtB,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,sBAAsB,EAAE;SAClE,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,MAAM,CAAC,OAAiC;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC;QAC3C,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,+DAA+D,MAAM,CAAC,IAAI,CAAC,GAAG,CAC/E,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,EAAE,CAAC;QAC/B,OAAO,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;IACnF,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,WAAW,CAAC,OAAiC;QAC1D,MAAM,EAAE,WAAW,EAAE,UAAU,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC;QACjD,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,yBAAyB,CAAC;QACvF,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC7C,OAAO,CAAC,cAAc,CAAC,4BAA4B,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QACvE,kFAAkF;QAClF,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACjD,QAAQ,CAAC,UAAU,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,CAAC,UAAU,CAAC,CAAC;IACtB,CAAC;IAEO,MAAM,CAAC,qBAAqB,CAAC,OAAgC;QACnE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAC/B,IAAI,UAAU,EAAE,CAAC;YACf,OAAO;gBACL;oBACE,OAAO,EAAE,oBAAoB;oBAC7B,UAAU,EAAE,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;oBACxF,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAyB;iBACvD;aACF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAoC,CAAC;QAC7F,OAAO;YACL,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF;gBACE,OAAO,EAAE,oBAAoB;gBAC7B,UAAU,EAAE,KAAK,EAAE,CAA4B,EAAE,EAAE,CACjD,mBAAmB,CAAC,MAAM,CAAC,CAAC,kBAAkB,EAAE,CAAC;gBACnD,MAAM,EAAE,CAAC,OAAO,CAAC;aAClB;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AAjHY,WAAW;IADvB,MAAM,CAAC,EAAE,CAAC;GACE,WAAW,CAiHvB"}

package/dist/official.d.ts

@@ -0,0 +1,39 @@
+import 'reflect-metadata';
+import type { ExecutionContext, Type } from '@nestjs/common';
+/**
+ * The metadata keys `@nestjs/authorization` reads and writes. The package does not
+ * export them, so they are spelled here, once. `test/official-contract.spec.ts`
+ * fails if the official package stops honoring metadata written under these keys.
+ */
+export declare const OFFICIAL_POLICY_METADATA = "authorization:policy";
+/** Written by the official `@Can()`: an array of {@link OfficialCanRequirement}, read top-down. */
+export declare const OFFICIAL_CAN_METADATA = "authorization:can";
+/** Written by the official `Can.Anyone()`. */
+export declare const OFFICIAL_CAN_ANYONE_METADATA = "authorization:can-anyone";
+/**
+ * Written by `@nestjs/authentication`'s `@Public()` (`true`) and `@Authenticate()` (`false`).
+ * A registry symbol, which the official guard reads without depending on that package.
+ */
+export declare const OFFICIAL_PUBLIC_METADATA: unique symbol;
+/** One official `@Can()` requirement, as stored in the metadata. */
+export interface OfficialCanRequirement {
+    policy: Type<unknown>;
+    ability: string;
+    args?: (context: ExecutionContext) => readonly unknown[] | Promise<readonly unknown[]>;
+}
+/** True when `value` is a class marked with the official `@Policy()`. */
+export declare function isOfficialPolicy(value: unknown): value is Type<unknown>;
+/** The official `@Can()` requirements declared directly on `target` (a class or a method). */
+export declare function readCanRequirements(target: object): OfficialCanRequirement[];
+/**
+ * The requirements the official guard enforces on `handler` of `type`: the class's
+ * first, then the method's, the class's dropped when the method is opened with
+ * `Can.Anyone()` or `@Public()`. Mirrors the official `routeChecks()`.
+ */
+export declare function routeRequirements(type: Type<unknown>, handler: object): OfficialCanRequirement[];
+/**
+ * `dependency`, or a clear error when `@nestjs/authorization`'s `AuthorizationModule` is not
+ * imported: without it Nest only reports an unresolvable constructor argument of `consumer`.
+ */
+export declare function requireOfficial<T>(dependency: T | undefined, name: string, consumer: string): T;
+//# sourceMappingURL=official.d.ts.map

package/dist/official.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"official.d.ts","sourceRoot":"","sources":["../src/official.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAE7D;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,yBAAyB,CAAC;AAC/D,mGAAmG;AACnG,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AACzD,8CAA8C;AAC9C,eAAO,MAAM,4BAA4B,6BAA6B,CAAC;AACvE;;;GAGG;AACH,eAAO,MAAM,wBAAwB,eAA8C,CAAC;AAEpF,oEAAoE;AACpE,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC,CAAC;CACxF;AAED,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,CAIvE;AAED,8FAA8F;AAC9F,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,sBAAsB,EAAE,CAE5E;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,sBAAsB,EAAE,CAKhG;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,CAAC,CAK/F"}

package/dist/official.js

@@ -0,0 +1,44 @@
+import 'reflect-metadata';
+/**
+ * The metadata keys `@nestjs/authorization` reads and writes. The package does not
+ * export them, so they are spelled here, once. `test/official-contract.spec.ts`
+ * fails if the official package stops honoring metadata written under these keys.
+ */
+export const OFFICIAL_POLICY_METADATA = 'authorization:policy';
+/** Written by the official `@Can()`: an array of {@link OfficialCanRequirement}, read top-down. */
+export const OFFICIAL_CAN_METADATA = 'authorization:can';
+/** Written by the official `Can.Anyone()`. */
+export const OFFICIAL_CAN_ANYONE_METADATA = 'authorization:can-anyone';
+/**
+ * Written by `@nestjs/authentication`'s `@Public()` (`true`) and `@Authenticate()` (`false`).
+ * A registry symbol, which the official guard reads without depending on that package.
+ */
+export const OFFICIAL_PUBLIC_METADATA = Symbol.for('@nestjs/authentication:public');
+/** True when `value` is a class marked with the official `@Policy()`. */
+export function isOfficialPolicy(value) {
+    return (typeof value === 'function' && Reflect.getMetadata(OFFICIAL_POLICY_METADATA, value) === true);
+}
+/** The official `@Can()` requirements declared directly on `target` (a class or a method). */
+export function readCanRequirements(target) {
+    return Reflect.getMetadata(OFFICIAL_CAN_METADATA, target) ?? [];
+}
+/**
+ * The requirements the official guard enforces on `handler` of `type`: the class's
+ * first, then the method's, the class's dropped when the method is opened with
+ * `Can.Anyone()` or `@Public()`. Mirrors the official `routeChecks()`.
+ */
+export function routeRequirements(type, handler) {
+    const methodOpen = Reflect.getMetadata(OFFICIAL_PUBLIC_METADATA, handler) === true ||
+        Reflect.getMetadata(OFFICIAL_CAN_ANYONE_METADATA, handler) === true;
+    return [...(methodOpen ? [] : readCanRequirements(type)), ...readCanRequirements(handler)];
+}
+/**
+ * `dependency`, or a clear error when `@nestjs/authorization`'s `AuthorizationModule` is not
+ * imported: without it Nest only reports an unresolvable constructor argument of `consumer`.
+ */
+export function requireOfficial(dependency, name, consumer) {
+    if (dependency !== undefined && dependency !== null)
+        return dependency;
+    throw new Error(`AuthzModule: ${consumer} needs ${name} from @nestjs/authorization, which is not available. Import AuthorizationModule.forRoot() (global, its default) next to AuthzModule: imports: [AuthorizationModule.forRoot(), AuthzModule.forRoot()].`);
+}
+//# sourceMappingURL=official.js.map

package/dist/official.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"official.js","sourceRoot":"","sources":["../src/official.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAG1B;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAC/D,mGAAmG;AACnG,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AACzD,8CAA8C;AAC9C,MAAM,CAAC,MAAM,4BAA4B,GAAG,0BAA0B,CAAC;AACvE;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;AASpF,yEAAyE;AACzE,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,CACL,OAAO,KAAK,KAAK,UAAU,IAAI,OAAO,CAAC,WAAW,CAAC,wBAAwB,EAAE,KAAK,CAAC,KAAK,IAAI,CAC7F,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAQ,OAAO,CAAC,WAAW,CAAC,qBAAqB,EAAE,MAAM,CAA8B,IAAI,EAAE,CAAC;AAChG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAmB,EAAE,OAAe;IACpE,MAAM,UAAU,GACd,OAAO,CAAC,WAAW,CAAC,wBAAwB,EAAE,OAAO,CAAC,KAAK,IAAI;QAC/D,OAAO,CAAC,WAAW,CAAC,4BAA4B,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACtE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAI,UAAyB,EAAE,IAAY,EAAE,QAAgB;IAC1F,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC;IACvE,MAAM,IAAI,KAAK,CACb,gBAAgB,QAAQ,UAAU,IAAI,uMAAuM,CAC9O,CAAC;AACJ,CAAC"}

package/dist/policies/authz-policy.d.ts

@@ -0,0 +1,42 @@
+/**
+ * @internal Runs `fn` (the `Gate` handing a string check to the official service) knowing
+ * `superAdmin` did not grant `ability` and the decision point abstained, so the policy's
+ * {@link superAdminBefore} / {@link decisionProviderBefore} skip asking them again.
+ */
+export declare function withAskedCheck<T>(user: unknown, ability: string, args: readonly unknown[], fn: () => Promise<T>): Promise<T>;
+/**
+ * Asks the `superAdmin` hook given to `AuthzModule.forRoot()`. `true` grants; anything
+ * else falls through. Call it from your own `before()` when a policy cannot extend
+ * {@link AuthzPolicy}.
+ */
+export declare function superAdminBefore(user: unknown, ability: string, resource?: object): Promise<true | undefined>;
+/**
+ * Asks the external decision point (`DECISION_PROVIDER`, e.g. the Cerbos adapter), when
+ * one is registered: `true` allows, `false` denies, `undefined` abstains (no provider, or
+ * it has no opinion). Call it from your own `before()` when a policy cannot extend
+ * {@link AuthzPolicy}.
+ */
+export declare function decisionProviderBefore(user: unknown, ability: string, resource?: object): Promise<boolean | undefined>;
+/**
+ * Base class for official policies that honor the global `superAdmin` hook and the
+ * optional external decision point.
+ *
+ * The official guard runs only each policy's own `before()`, so a global "super-admins
+ * may do anything" needs every policy to ask. Extend this class and they do:
+ *
+ * ```ts
+ * @Policy()
+ * export class PostPolicy extends AuthzPolicy {
+ *   update(user: User | null, post: Post) { return post.authorId === user?.id; }
+ * }
+ * ```
+ *
+ * `before()` asks `superAdmin(user, ability, resource)` (a `true` allows), then the
+ * `DECISION_PROVIDER` when one is registered (its allow or deny is final, `undefined`
+ * abstains), then lets the ability decide. The resource is the check's first argument.
+ * To add your own `before()`, override it and call `super.before(...)` first.
+ */
+export declare abstract class AuthzPolicy {
+    before(user: unknown, ability: string, ...args: unknown[]): boolean | undefined | Promise<boolean | undefined>;
+}
+//# sourceMappingURL=authz-policy.d.ts.map

package/dist/policies/authz-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-policy.d.ts","sourceRoot":"","sources":["../../src/policies/authz-policy.ts"],"names":[],"mappings":"AAqBA;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAC9B,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,OAAO,EAAE,EACxB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CAEZ;AAaD;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAI3B;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAI9B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,8BAAsB,WAAW;IAC/B,MAAM,CACJ,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,MAAM,EACf,GAAG,IAAI,EAAE,OAAO,EAAE,GACjB,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;CAOtD"}

package/dist/policies/authz-policy.js

@@ -0,0 +1,80 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { normalizeVerdict } from '../decision-provider.js';
+import { authzRuntime } from '../runtime.js';
+/** The resource of a policy check: its first argument, when that is an object or a class. */
+function resourceOf(args) {
+    const first = args[0];
+    return (typeof first === 'object' && first !== null) || typeof first === 'function'
+        ? first
+        : undefined;
+}
+const asked = new AsyncLocalStorage();
+/**
+ * @internal Runs `fn` (the `Gate` handing a string check to the official service) knowing
+ * `superAdmin` did not grant `ability` and the decision point abstained, so the policy's
+ * {@link superAdminBefore} / {@link decisionProviderBefore} skip asking them again.
+ */
+export function withAskedCheck(user, ability, args, fn) {
+    return asked.run({ user: user ?? null, ability, resource: resourceOf(args) }, fn);
+}
+/** True when the `Gate` already asked about exactly this check (see {@link withAskedCheck}). */
+function alreadyAsked(user, ability, resource) {
+    const check = asked.getStore();
+    return (check !== undefined &&
+        check.user === (user ?? null) &&
+        check.ability === ability &&
+        check.resource === resource);
+}
+/**
+ * Asks the `superAdmin` hook given to `AuthzModule.forRoot()`. `true` grants; anything
+ * else falls through. Call it from your own `before()` when a policy cannot extend
+ * {@link AuthzPolicy}.
+ */
+export async function superAdminBefore(user, ability, resource) {
+    const hook = authzRuntime().superAdmin;
+    if (!hook || alreadyAsked(user, ability, resource))
+        return undefined;
+    return (await hook(user ?? null, ability, resource)) === true ? true : undefined;
+}
+/**
+ * Asks the external decision point (`DECISION_PROVIDER`, e.g. the Cerbos adapter), when
+ * one is registered: `true` allows, `false` denies, `undefined` abstains (no provider, or
+ * it has no opinion). Call it from your own `before()` when a policy cannot extend
+ * {@link AuthzPolicy}.
+ */
+export async function decisionProviderBefore(user, ability, resource) {
+    const provider = authzRuntime().decisionProvider();
+    if (!provider || alreadyAsked(user, ability, resource))
+        return undefined;
+    return normalizeVerdict(await provider.decide(user ?? null, ability, resource)).allowed;
+}
+/**
+ * Base class for official policies that honor the global `superAdmin` hook and the
+ * optional external decision point.
+ *
+ * The official guard runs only each policy's own `before()`, so a global "super-admins
+ * may do anything" needs every policy to ask. Extend this class and they do:
+ *
+ * ```ts
+ * @Policy()
+ * export class PostPolicy extends AuthzPolicy {
+ *   update(user: User | null, post: Post) { return post.authorId === user?.id; }
+ * }
+ * ```
+ *
+ * `before()` asks `superAdmin(user, ability, resource)` (a `true` allows), then the
+ * `DECISION_PROVIDER` when one is registered (its allow or deny is final, `undefined`
+ * abstains), then lets the ability decide. The resource is the check's first argument.
+ * To add your own `before()`, override it and call `super.before(...)` first.
+ */
+export class AuthzPolicy {
+    before(user, ability, ...args) {
+        const resource = resourceOf(args);
+        return (async () => {
+            if (await superAdminBefore(user, ability, resource))
+                return true;
+            return decisionProviderBefore(user, ability, resource);
+        })();
+    }
+}
+//# sourceMappingURL=authz-policy.js.map

package/dist/policies/authz-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-policy.js","sourceRoot":"","sources":["../../src/policies/authz-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,6FAA6F;AAC7F,SAAS,UAAU,CAAC,IAAwB;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,OAAO,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,IAAI,OAAO,KAAK,KAAK,UAAU;QACjF,CAAC,CAAE,KAAgB;QACnB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AASD,MAAM,KAAK,GAAG,IAAI,iBAAiB,EAAc,CAAC;AAElD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAa,EACb,OAAe,EACf,IAAwB,EACxB,EAAoB;IAEpB,OAAO,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,gGAAgG;AAChG,SAAS,YAAY,CAAC,IAAa,EAAE,OAAe,EAAE,QAA4B;IAChF,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC/B,OAAO,CACL,KAAK,KAAK,SAAS;QACnB,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;QAC7B,KAAK,CAAC,OAAO,KAAK,OAAO;QACzB,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAC5B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAa,EACb,OAAe,EACf,QAAiB;IAEjB,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC,UAAU,CAAC;IACvC,IAAI,CAAC,IAAI,IAAI,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IACrE,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACnF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAa,EACb,OAAe,EACf,QAAiB;IAEjB,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC,gBAAgB,EAAE,CAAC;IACnD,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IACzE,OAAO,gBAAgB,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;AAC1F,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAgB,WAAW;IAC/B,MAAM,CACJ,IAAa,EACb,OAAe,EACf,GAAG,IAAe;QAElB,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO,CAAC,KAAK,IAAI,EAAE;YACjB,IAAI,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjE,OAAO,sBAAsB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACzD,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;CACF"}

package/dist/policies/gate.policy.d.ts

@@ -0,0 +1,18 @@
+import { Gate } from '../gate.js';
+/**
+ * The `Gate`'s string abilities as an official policy: ad-hoc gates from
+ * `gate.define()`, named permissions, and `ability` + resource checks through the
+ * resource's linked policy.
+ *
+ * ```ts
+ * gate.define('access-admin', (user) => user.isStaff);
+ *
+ * @Can(GatePolicy, 'allows', ability('access-admin'))
+ * ```
+ */
+export declare class GatePolicy {
+    private readonly gate;
+    constructor(gate: Gate);
+    allows(user: unknown, ability: string, resource?: object): Promise<boolean>;
+}
+//# sourceMappingURL=gate.policy.d.ts.map

package/dist/policies/gate.policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.policy.d.ts","sourceRoot":"","sources":["../../src/policies/gate.policy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAElC;;;;;;;;;;GAUG;AACH,qBACa,UAAU;IACT,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,IAAI;IAEvC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAG5E"}