@dudousxd/nestjs-authz 0.8.1 → 0.9.0

package/dist/policies/gate.policy.js

@@ -0,0 +1,37 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Policy } from '@nestjs/authorization';
+import { Gate } from '../gate.js';
+/**
+ * The `Gate`'s string abilities as an official policy: ad-hoc gates from
+ * `gate.define()`, named permissions, and `ability` + resource checks through the
+ * resource's linked policy.
+ *
+ * ```ts
+ * gate.define('access-admin', (user) => user.isStaff);
+ *
+ * @Can(GatePolicy, 'allows', ability('access-admin'))
+ * ```
+ */
+let GatePolicy = class GatePolicy {
+    gate;
+    constructor(gate) {
+        this.gate = gate;
+    }
+    allows(user, ability, resource) {
+        return this.gate.forUser(user).allows(ability, resource);
+    }
+};
+GatePolicy = __decorate([
+    Policy(),
+    __metadata("design:paramtypes", [Gate])
+], GatePolicy);
+export { GatePolicy };
+//# sourceMappingURL=gate.policy.js.map

package/dist/policies/gate.policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.policy.js","sourceRoot":"","sources":["../../src/policies/gate.policy.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAElC;;;;;;;;;;GAUG;AAEI,IAAM,UAAU,GAAhB,MAAM,UAAU;IACQ;IAA7B,YAA6B,IAAU;QAAV,SAAI,GAAJ,IAAI,CAAM;IAAG,CAAC;IAE3C,MAAM,CAAC,IAAa,EAAE,OAAe,EAAE,QAAiB;QACtD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC3D,CAAC;CACF,CAAA;AANY,UAAU;IADtB,MAAM,EAAE;qCAE4B,IAAI;GAD5B,UAAU,CAMtB"}

package/dist/policies/index.d.ts

@@ -0,0 +1,5 @@
+export { AuthzPolicy, decisionProviderBefore, superAdminBefore } from './authz-policy.js';
+export { RolePolicy } from './role.policy.js';
+export { PermissionPolicy } from './permission.policy.js';
+export { GatePolicy } from './gate.policy.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/policies/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/policies/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1F,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/policies/index.js

@@ -0,0 +1,5 @@
+export { AuthzPolicy, decisionProviderBefore, superAdminBefore } from './authz-policy.js';
+export { RolePolicy } from './role.policy.js';
+export { PermissionPolicy } from './permission.policy.js';
+export { GatePolicy } from './gate.policy.js';
+//# sourceMappingURL=index.js.map

package/dist/policies/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policies/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1F,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/policies/permission.policy.d.ts

@@ -0,0 +1,27 @@
+import { AuthzRbac } from '../rbac.js';
+import { AuthzPolicy } from './authz-policy.js';
+/**
+ * Persisted permissions (through roles, tenant-scoped roles, or granted directly) as an
+ * official policy. Wildcard grants apply: `posts.*` satisfies `posts.update`.
+ *
+ * ```ts
+ * @Can(PermissionPolicy, 'has', permission('posts.update'))
+ * @Can(PermissionPolicy, 'hasAll', permission('posts.update', 'posts.publish'))
+ * ```
+ *
+ * Honors `superAdmin`.
+ */
+export declare class PermissionPolicy extends AuthzPolicy {
+    private readonly rbac;
+    constructor(rbac: AuthzRbac);
+    /**
+     * Asks only `superAdmin`: the abilities here name permissions, not a resource, so the
+     * external decision point is not consulted.
+     */
+    before(user: unknown, ability: string): Promise<true | undefined>;
+    /** The user holds any of `permissions`. */
+    has(user: unknown, ...permissions: string[]): Promise<boolean>;
+    /** The user holds every one of `permissions`. */
+    hasAll(user: unknown, ...permissions: string[]): Promise<boolean>;
+}
+//# sourceMappingURL=permission.policy.d.ts.map

package/dist/policies/permission.policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.policy.d.ts","sourceRoot":"","sources":["../../src/policies/permission.policy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,WAAW,EAAoB,MAAM,mBAAmB,CAAC;AAElE;;;;;;;;;;GAUG;AACH,qBACa,gBAAiB,SAAQ,WAAW;IACnC,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,SAAS;IAI5C;;;OAGG;IACM,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAI1E,2CAA2C;IACrC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAOpE,iDAAiD;IAC3C,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;CAOxE"}

package/dist/policies/permission.policy.js

@@ -0,0 +1,61 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Policy } from '@nestjs/authorization';
+import { AuthzRbac } from '../rbac.js';
+import { AuthzPolicy, superAdminBefore } from './authz-policy.js';
+/**
+ * Persisted permissions (through roles, tenant-scoped roles, or granted directly) as an
+ * official policy. Wildcard grants apply: `posts.*` satisfies `posts.update`.
+ *
+ * ```ts
+ * @Can(PermissionPolicy, 'has', permission('posts.update'))
+ * @Can(PermissionPolicy, 'hasAll', permission('posts.update', 'posts.publish'))
+ * ```
+ *
+ * Honors `superAdmin`.
+ */
+let PermissionPolicy = class PermissionPolicy extends AuthzPolicy {
+    rbac;
+    constructor(rbac) {
+        super();
+        this.rbac = rbac;
+    }
+    /**
+     * Asks only `superAdmin`: the abilities here name permissions, not a resource, so the
+     * external decision point is not consulted.
+     */
+    before(user, ability) {
+        return superAdminBefore(user, ability);
+    }
+    /** The user holds any of `permissions`. */
+    async has(user, ...permissions) {
+        for (const permission of permissions) {
+            if (await this.rbac.grants(user, permission))
+                return true;
+        }
+        return false;
+    }
+    /** The user holds every one of `permissions`. */
+    async hasAll(user, ...permissions) {
+        if (permissions.length === 0)
+            return false;
+        for (const permission of permissions) {
+            if (!(await this.rbac.grants(user, permission)))
+                return false;
+        }
+        return true;
+    }
+};
+PermissionPolicy = __decorate([
+    Policy(),
+    __metadata("design:paramtypes", [AuthzRbac])
+], PermissionPolicy);
+export { PermissionPolicy };
+//# sourceMappingURL=permission.policy.js.map

package/dist/policies/permission.policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.policy.js","sourceRoot":"","sources":["../../src/policies/permission.policy.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAElE;;;;;;;;;;GAUG;AAEI,IAAM,gBAAgB,GAAtB,MAAM,gBAAiB,SAAQ,WAAW;IAClB;IAA7B,YAA6B,IAAe;QAC1C,KAAK,EAAE,CAAC;QADmB,SAAI,GAAJ,IAAI,CAAW;IAE5C,CAAC;IAED;;;OAGG;IACM,MAAM,CAAC,IAAa,EAAE,OAAe;QAC5C,OAAO,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,2CAA2C;IAC3C,KAAK,CAAC,GAAG,CAAC,IAAa,EAAE,GAAG,WAAqB;QAC/C,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC5D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,MAAM,CAAC,IAAa,EAAE,GAAG,WAAqB;QAClD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;QAChE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA7BY,gBAAgB;IAD5B,MAAM,EAAE;qCAE4B,SAAS;GADjC,gBAAgB,CA6B5B"}

package/dist/policies/role.policy.d.ts

@@ -0,0 +1,27 @@
+import { AuthzRbac } from '../rbac.js';
+import { AuthzPolicy } from './authz-policy.js';
+/**
+ * Persisted (and user-object) roles as an official policy.
+ *
+ * ```ts
+ * @Can(RolePolicy, 'has', roles('admin', 'editor'))   // any of
+ * @Can(RolePolicy, 'hasAll', roles('admin', 'editor')) // all of
+ * ```
+ *
+ * Roles come from `user.roles` / `user.role` (or `resolveRoles`) and from the RBAC
+ * adapter's role store, scoped to the current tenant. Honors `superAdmin`.
+ */
+export declare class RolePolicy extends AuthzPolicy {
+    private readonly rbac;
+    constructor(rbac: AuthzRbac);
+    /**
+     * Asks only `superAdmin`: the abilities here name roles, not a resource, so the
+     * external decision point is not consulted.
+     */
+    before(user: unknown, ability: string): Promise<true | undefined>;
+    /** The user holds any of `roles`. */
+    has(user: unknown, ...roles: string[]): Promise<boolean>;
+    /** The user holds every one of `roles`. */
+    hasAll(user: unknown, ...roles: string[]): Promise<boolean>;
+}
+//# sourceMappingURL=role.policy.d.ts.map

package/dist/policies/role.policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role.policy.d.ts","sourceRoot":"","sources":["../../src/policies/role.policy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,WAAW,EAAoB,MAAM,mBAAmB,CAAC;AAElE;;;;;;;;;;GAUG;AACH,qBACa,UAAW,SAAQ,WAAW;IAC7B,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,SAAS;IAI5C;;;OAGG;IACM,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAI1E,qCAAqC;IACrC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAIxD,2CAA2C;IAC3C,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;CAG5D"}

package/dist/policies/role.policy.js

@@ -0,0 +1,51 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Policy } from '@nestjs/authorization';
+import { AuthzRbac } from '../rbac.js';
+import { AuthzPolicy, superAdminBefore } from './authz-policy.js';
+/**
+ * Persisted (and user-object) roles as an official policy.
+ *
+ * ```ts
+ * @Can(RolePolicy, 'has', roles('admin', 'editor'))   // any of
+ * @Can(RolePolicy, 'hasAll', roles('admin', 'editor')) // all of
+ * ```
+ *
+ * Roles come from `user.roles` / `user.role` (or `resolveRoles`) and from the RBAC
+ * adapter's role store, scoped to the current tenant. Honors `superAdmin`.
+ */
+let RolePolicy = class RolePolicy extends AuthzPolicy {
+    rbac;
+    constructor(rbac) {
+        super();
+        this.rbac = rbac;
+    }
+    /**
+     * Asks only `superAdmin`: the abilities here name roles, not a resource, so the
+     * external decision point is not consulted.
+     */
+    before(user, ability) {
+        return superAdminBefore(user, ability);
+    }
+    /** The user holds any of `roles`. */
+    has(user, ...roles) {
+        return this.rbac.hasAnyRole(user, roles);
+    }
+    /** The user holds every one of `roles`. */
+    hasAll(user, ...roles) {
+        return this.rbac.hasAllRoles(user, roles);
+    }
+};
+RolePolicy = __decorate([
+    Policy(),
+    __metadata("design:paramtypes", [AuthzRbac])
+], RolePolicy);
+export { RolePolicy };
+//# sourceMappingURL=role.policy.js.map

package/dist/policies/role.policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role.policy.js","sourceRoot":"","sources":["../../src/policies/role.policy.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAElE;;;;;;;;;;GAUG;AAEI,IAAM,UAAU,GAAhB,MAAM,UAAW,SAAQ,WAAW;IACZ;IAA7B,YAA6B,IAAe;QAC1C,KAAK,EAAE,CAAC;QADmB,SAAI,GAAJ,IAAI,CAAW;IAE5C,CAAC;IAED;;;OAGG;IACM,MAAM,CAAC,IAAa,EAAE,OAAe;QAC5C,OAAO,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,qCAAqC;IACrC,GAAG,CAAC,IAAa,EAAE,GAAG,KAAe;QACnC,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,2CAA2C;IAC3C,MAAM,CAAC,IAAa,EAAE,GAAG,KAAe;QACtC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;CACF,CAAA;AAtBY,UAAU;IADtB,MAAM,EAAE;qCAE4B,SAAS;GADjC,UAAU,CAsBtB"}

package/dist/policy-index.d.ts

@@ -0,0 +1,51 @@
+import { type Type } from '@nestjs/common';
+import { DiscoveryService, ModuleRef, ModulesContainer } from '@nestjs/core';
+/** One official policy of the application, as the extras see it. */
+export interface IndexedPolicy {
+    policy: Type<unknown>;
+    /** The instance the official registry uses (an `overrideProvider` replacement in tests). */
+    instance: object;
+    /** The resource linked with `@PolicyFor`, if any. */
+    resource: Type<unknown> | undefined;
+}
+/**
+ * The application's official `@Policy()` providers and their resource links. Read-only:
+ * the official `PolicyRegistry` owns registration; this only looks them up for the
+ * extras (resource → policy, `scope()`, ability listings).
+ */
+export declare class PolicyIndex {
+    private readonly discovery;
+    private readonly moduleRef;
+    private readonly modules;
+    /** The last scan, reused while the container's shape (modules, providers) is unchanged. */
+    private cache;
+    constructor(discovery: DiscoveryService, moduleRef: ModuleRef, modules: ModulesContainer);
+    /**
+     * Every official policy registered as a provider, built-ins included. Rescanned when a
+     * module or provider is added (a lazy module) or a policy was not instantiated yet.
+     */
+    all(): IndexedPolicy[];
+    /** Cheap fingerprint of the container: module count and each module's provider count. */
+    private signature;
+    /** Official policies about a resource (built-ins left out). */
+    resourcePolicies(): IndexedPolicy[];
+    /** The policy class linked to a resource class. */
+    policyFor(resource: Type<unknown>): Type<unknown> | undefined;
+    /** The policy class for a resource instance (by its constructor), or for a class. */
+    policyOf(resource: object): Type<unknown> | undefined;
+    /** Linked policy classes defining `ability`, for a check that names no resource. */
+    linkedPoliciesWith(ability: string): Type<unknown>[];
+    /** The policy instance the app uses for `policy`, or `undefined` when it is not registered. */
+    instanceOf(policy: Type<unknown>): object | undefined;
+    /**
+     * Abilities of each resource policy that take no argument after the user (arity
+     * `<= 1`, e.g. `create(user)`), safe to check without a record. `before`, `scope` and
+     * the constructor are not abilities.
+     */
+    classAbilities(): Array<{
+        policy: Type<unknown>;
+        resource: Type<unknown> | undefined;
+        abilities: string[];
+    }>;
+}
+//# sourceMappingURL=policy-index.d.ts.map

package/dist/policy-index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-index.d.ts","sourceRoot":"","sources":["../src/policy-index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAO7E,oEAAoE;AACpE,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,4FAA4F;IAC5F,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC;CACrC;AAED;;;;GAIG;AACH,qBACa,WAAW;IAKpB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAN1B,2FAA2F;IAC3F,OAAO,CAAC,KAAK,CAA+D;gBAGzD,SAAS,EAAE,gBAAgB,EAC3B,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,gBAAgB;IAG5C;;;OAGG;IACH,GAAG,IAAI,aAAa,EAAE;IA6BtB,yFAAyF;IACzF,OAAO,CAAC,SAAS;IAMjB,+DAA+D;IAC/D,gBAAgB,IAAI,aAAa,EAAE;IAInC,mDAAmD;IACnD,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,SAAS;IAI7D,qFAAqF;IACrF,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,SAAS;IAKrD,oFAAoF;IACpF,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE;IAMpD,+FAA+F;IAC/F,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,SAAS;IAUrD;;;;OAIG;IACH,cAAc,IAAI,KAAK,CAAC;QACtB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACtB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC;QACpC,SAAS,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;CAeH"}

package/dist/policy-index.js

@@ -0,0 +1,135 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Injectable } from '@nestjs/common';
+import { DiscoveryService, ModuleRef, ModulesContainer } from '@nestjs/core';
+import { getPolicyResource, policyForResource, policyLinks } from './links.js';
+import { isOfficialPolicy } from './official.js';
+/** Built-in policies that are not about a resource; left out of ability listings. */
+const BUILT_IN = new Set(['RolePolicy', 'PermissionPolicy', 'GatePolicy']);
+/**
+ * The application's official `@Policy()` providers and their resource links. Read-only:
+ * the official `PolicyRegistry` owns registration; this only looks them up for the
+ * extras (resource → policy, `scope()`, ability listings).
+ */
+let PolicyIndex = class PolicyIndex {
+    discovery;
+    moduleRef;
+    modules;
+    /** The last scan, reused while the container's shape (modules, providers) is unchanged. */
+    cache;
+    constructor(discovery, moduleRef, modules) {
+        this.discovery = discovery;
+        this.moduleRef = moduleRef;
+        this.modules = modules;
+    }
+    /**
+     * Every official policy registered as a provider, built-ins included. Rescanned when a
+     * module or provider is added (a lazy module) or a policy was not instantiated yet.
+     */
+    all() {
+        const signature = this.signature();
+        if (this.cache?.signature === signature)
+            return this.cache.policies;
+        const seen = new Set();
+        const out = [];
+        let complete = true;
+        for (const wrapper of this.discovery.getProviders()) {
+            const token = wrapper.token;
+            const key = isOfficialPolicy(token)
+                ? token
+                : !wrapper.isFactory && isOfficialPolicy(wrapper.metatype)
+                    ? wrapper.metatype
+                    : undefined;
+            if (!key || seen.has(key))
+                continue;
+            if (!wrapper.instance || typeof wrapper.instance !== 'object') {
+                complete = false;
+                continue;
+            }
+            seen.add(key);
+            out.push({
+                policy: key,
+                instance: wrapper.instance,
+                resource: getPolicyResource(key),
+            });
+        }
+        this.cache = complete ? { signature, policies: out } : undefined;
+        return out;
+    }
+    /** Cheap fingerprint of the container: module count and each module's provider count. */
+    signature() {
+        let out = String(this.modules.size);
+        for (const module of this.modules.values())
+            out += `,${module.providers.size}`;
+        return out;
+    }
+    /** Official policies about a resource (built-ins left out). */
+    resourcePolicies() {
+        return this.all().filter((p) => !BUILT_IN.has(p.policy.name));
+    }
+    /** The policy class linked to a resource class. */
+    policyFor(resource) {
+        return policyForResource(resource);
+    }
+    /** The policy class for a resource instance (by its constructor), or for a class. */
+    policyOf(resource) {
+        if (typeof resource === 'function')
+            return policyForResource(resource);
+        return policyForResource(resource.constructor);
+    }
+    /** Linked policy classes defining `ability`, for a check that names no resource. */
+    linkedPoliciesWith(ability) {
+        return policyLinks()
+            .map((l) => l.policy)
+            .filter((p) => typeof p.prototype[ability] === 'function');
+    }
+    /** The policy instance the app uses for `policy`, or `undefined` when it is not registered. */
+    instanceOf(policy) {
+        const indexed = this.all().find((p) => p.policy === policy);
+        if (indexed)
+            return indexed.instance;
+        try {
+            return this.moduleRef.get(policy, { strict: false });
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /**
+     * Abilities of each resource policy that take no argument after the user (arity
+     * `<= 1`, e.g. `create(user)`), safe to check without a record. `before`, `scope` and
+     * the constructor are not abilities.
+     */
+    classAbilities() {
+        return this.resourcePolicies().map(({ policy, instance, resource }) => {
+            const abilities = new Set();
+            let proto = Object.getPrototypeOf(instance);
+            while (proto && proto !== Object.prototype) {
+                for (const name of Object.getOwnPropertyNames(proto)) {
+                    if (name === 'constructor' || name === 'before' || name === 'scope')
+                        continue;
+                    const member = instance[name];
+                    if (typeof member === 'function' && member.length <= 1)
+                        abilities.add(name);
+                }
+                proto = Object.getPrototypeOf(proto);
+            }
+            return { policy, resource, abilities: [...abilities] };
+        });
+    }
+};
+PolicyIndex = __decorate([
+    Injectable(),
+    __metadata("design:paramtypes", [DiscoveryService,
+        ModuleRef,
+        ModulesContainer])
+], PolicyIndex);
+export { PolicyIndex };
+//# sourceMappingURL=policy-index.js.map

package/dist/policy-index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-index.js","sourceRoot":"","sources":["../src/policy-index.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAa,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD,qFAAqF;AACrF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,kBAAkB,EAAE,YAAY,CAAC,CAAC,CAAC;AAW3E;;;;GAIG;AAEI,IAAM,WAAW,GAAjB,MAAM,WAAW;IAKH;IACA;IACA;IANnB,2FAA2F;IACnF,KAAK,CAA+D;IAE5E,YACmB,SAA2B,EAC3B,SAAoB,EACpB,OAAyB;QAFzB,cAAS,GAAT,SAAS,CAAkB;QAC3B,cAAS,GAAT,SAAS,CAAW;QACpB,YAAO,GAAP,OAAO,CAAkB;IACzC,CAAC;IAEJ;;;OAGG;IACH,GAAG;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,KAAK,EAAE,SAAS,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QACpE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAW,CAAC;QAChC,MAAM,GAAG,GAAoB,EAAE,CAAC;QAChC,IAAI,QAAQ,GAAG,IAAI,CAAC;QACpB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,CAAC;YACpD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;YAC5B,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC;gBACjC,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC;oBACxD,CAAC,CAAE,OAAO,CAAC,QAA0B;oBACrC,CAAC,CAAC,SAAS,CAAC;YAChB,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YACpC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC9D,QAAQ,GAAG,KAAK,CAAC;gBACjB,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,GAAG,CAAC,IAAI,CAAC;gBACP,MAAM,EAAE,GAAG;gBACX,QAAQ,EAAE,OAAO,CAAC,QAAkB;gBACpC,QAAQ,EAAE,iBAAiB,CAAC,GAAG,CAAC;aACjC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,OAAO,GAAG,CAAC;IACb,CAAC;IAED,yFAAyF;IACjF,SAAS;QACf,IAAI,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACpC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;YAAE,GAAG,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAC/E,OAAO,GAAG,CAAC;IACb,CAAC;IAED,+DAA+D;IAC/D,gBAAgB;QACd,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,mDAAmD;IACnD,SAAS,CAAC,QAAuB;QAC/B,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,qFAAqF;IACrF,QAAQ,CAAC,QAAgB;QACvB,IAAI,OAAO,QAAQ,KAAK,UAAU;YAAE,OAAO,iBAAiB,CAAC,QAAyB,CAAC,CAAC;QACxF,OAAO,iBAAiB,CAAE,QAA2C,CAAC,WAAW,CAAC,CAAC;IACrF,CAAC;IAED,oFAAoF;IACpF,kBAAkB,CAAC,OAAe;QAChC,OAAO,WAAW,EAAE;aACjB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAQ,CAAC,CAAC,SAAqC,CAAC,OAAO,CAAC,KAAK,UAAU,CAAC,CAAC;IAC5F,CAAC;IAED,+FAA+F;IAC/F,UAAU,CAAC,MAAqB;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QAC5D,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC,QAAQ,CAAC;QACrC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,cAAc;QAKZ,OAAO,IAAI,CAAC,gBAAgB,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE;YACpE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;YACpC,IAAI,KAAK,GAAkB,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC3D,OAAO,KAAK,IAAI,KAAK,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC3C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;oBACrD,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO;wBAAE,SAAS;oBAC9E,MAAM,MAAM,GAAI,QAAoC,CAAC,IAAI,CAAC,CAAC;oBAC3D,IAAI,OAAO,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC;wBAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC9E,CAAC;gBACD,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;YACvC,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;QACzD,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA5GY,WAAW;IADvB,UAAU,EAAE;qCAMmB,gBAAgB;QAChB,SAAS;QACX,gBAAgB;GAPjC,WAAW,CA4GvB"}

package/dist/rbac.d.ts

@@ -0,0 +1,92 @@
+import { type OnModuleInit } from '@nestjs/common';
+import { ModuleRef } from '@nestjs/core';
+import type { ContextAccessor } from './context-accessor.js';
+import type { DecisionProvider } from './decision-provider.js';
+import { PermissionCache } from './permission-cache.js';
+import type { PermissionProvider } from './permission-provider.js';
+import { type RoleProvider } from './role-provider.js';
+import type { AuthzModuleOptions, Resource, User } from './types.js';
+/**
+ * Roles and permissions of a user, from the persisted RBAC seams (`ROLE_PROVIDER`,
+ * `PERMISSION_PROVIDER`, registered by the TypeORM / MikroORM / Prisma / Drizzle adapters)
+ * and from the user object itself (`user.roles` / `user.role`); the optional external
+ * decision point (`DECISION_PROVIDER`); and the ambient user for `Gate` calls made without
+ * one. Shared by `RolePolicy`, `PermissionPolicy`, `AuthzPolicy` and the `Gate`.
+ *
+ * Within one request (a nestjs-context store), a user's permissions and provider roles
+ * are fetched once, however many checks run, in guards and in handlers alike.
+ */
+export declare class AuthzRbac implements OnModuleInit {
+    private readonly context?;
+    private readonly moduleRef?;
+    private readonly permissionProvider?;
+    private readonly roleProvider?;
+    private readonly decisionProvider?;
+    private readonly roleResolver;
+    private readonly resolveUser;
+    private readonly lookups;
+    private authentication;
+    constructor(options: AuthzModuleOptions | undefined, context?: ContextAccessor | undefined, moduleRef?: ModuleRef | undefined, permissionProvider?: PermissionProvider | undefined, roleProvider?: RoleProvider | undefined, decisionProvider?: DecisionProvider | undefined);
+    /**
+     * Finds `@nestjs/authentication`'s `AuthenticationContext` when that optional peer is
+     * installed and its module is imported. The class is the DI token, so the package is
+     * loaded only here, and its absence is not an error.
+     */
+    onModuleInit(): Promise<void>;
+    /**
+     * A provider registered by any module: the injected one, else a non-strict lookup,
+     * memoized, so a global RBAC module or a root-level accessor is found too.
+     */
+    private lookup;
+    /** @internal The nestjs-context accessor, when one is registered. */
+    contextAccessor(): ContextAccessor | undefined;
+    /** The persisted permission seam, when an RBAC adapter registered one. */
+    permissions(): PermissionProvider | undefined;
+    /** The persisted role seam, when an RBAC adapter registered one. */
+    roles(): RoleProvider | undefined;
+    /** The external decision point (Cerbos, OPA, …), when one is registered. */
+    decisions(): DecisionProvider | undefined;
+    /**
+     * The user for a `Gate` call made without one:
+     *
+     * 1. `@nestjs/authentication`'s `AuthenticationContext.user`, when that optional peer is
+     *    installed and its scope is active (a call it handles, or `AuthenticationContext.run()`):
+     *    its answer is final, so a `null` there is a guest;
+     * 2. else, with no authentication scope at all, nestjs-context's user ref, hydrated by
+     *    `resolveUser` when configured (once per `type:id` per request);
+     * 3. else `null` (a guest).
+     */
+    currentUser(): Promise<User>;
+    /**
+     * `AuthenticationContext.user` (`null` for an anonymous call) when its scope is active;
+     * `undefined` without the package or outside its scope. A version that hides the scope is
+     * read as before: a user is an answer, `null` is not.
+     */
+    private authenticatedUser;
+    /** The nestjs-context store for the current request, or `undefined` when there is none. */
+    private requestStore;
+    /**
+     * The per-request {@link PermissionCache} on the nestjs-context store, so every check
+     * in one request shares a single `getPermissions` and `getRoles` fetch per user.
+     * `undefined` without a store.
+     */
+    requestCache(): PermissionCache | undefined;
+    /**
+     * The user's role names: the role resolver's (the user object) and the role provider's,
+     * the latter fetched through `cache` (the request's, by default).
+     */
+    rolesOf(user: User, cache?: PermissionCache | undefined): Promise<Set<string>>;
+    /** True when the user holds any of `roles`. A guest holds none. */
+    hasAnyRole(user: User, roles: readonly string[], cache?: PermissionCache | undefined): Promise<boolean>;
+    /** True when the user holds every one of `roles`. */
+    hasAllRoles(user: User, roles: readonly string[]): Promise<boolean>;
+    /**
+     * True when the permission seam grants `permission` to `user`. With `getPermissions`,
+     * wildcard grants apply (`posts.*` satisfies `posts.update`, `*` anything), fetched
+     * once per `cache` (the request's, by default). A set the provider marks
+     * `exhaustivePermissions` answers on its own; otherwise a miss still asks the
+     * exact-match `hasPermission`. A guest, or no seam, is never granted.
+     */
+    grants(user: User, permission: string, resource?: Resource, cache?: PermissionCache | undefined): Promise<boolean>;
+}
+//# sourceMappingURL=rbac.d.ts.map

package/dist/rbac.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../src/rbac.ts"],"names":[],"mappings":"AACA,OAAO,EAAsB,KAAK,YAAY,EAAY,MAAM,gBAAgB,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,uBAAuB,CAAC;AAC3E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,KAAK,YAAY,EAA0C,MAAM,oBAAoB,CAAC;AAQ/F,OAAO,KAAK,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAsBrE;;;;;;;;;GASG;AACH,qBACa,SAAU,YAAW,YAAY;IAQD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IACtD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAGvC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IACD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;IAC1B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IAb3E,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoC;IAChE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyC;IACjE,OAAO,CAAC,cAAc,CAAwC;gBAGlB,OAAO,EAAE,kBAAkB,GAAG,SAAS,EACvB,OAAO,CAAC,EAAE,eAAe,YAAA,EACtD,SAAS,CAAC,EAAE,SAAS,YAAA,EAGjC,kBAAkB,CAAC,EAAE,kBAAkB,YAAA,EACJ,YAAY,CAAC,EAAE,YAAY,YAAA,EACvB,gBAAgB,CAAC,EAAE,gBAAgB,YAAA;IAM7F;;;;OAIG;IACG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAoBnC;;;OAGG;IACH,OAAO,CAAC,MAAM;IAcd,qEAAqE;IACrE,eAAe,IAAI,eAAe,GAAG,SAAS;IAI9C,0EAA0E;IAC1E,WAAW,IAAI,kBAAkB,GAAG,SAAS;IAI7C,oEAAoE;IACpE,KAAK,IAAI,YAAY,GAAG,SAAS;IAIjC,4EAA4E;IAC5E,SAAS,IAAI,gBAAgB,GAAG,SAAS;IAIzC;;;;;;;;;OASG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IA4BlC;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAczB,2FAA2F;IAC3F,OAAO,CAAC,YAAY;IAYpB;;;;OAIG;IACH,YAAY,IAAI,eAAe,GAAG,SAAS;IAU3C;;;OAGG;IACG,OAAO,CACX,IAAI,EAAE,IAAI,EACV,KAAK,GAAE,eAAe,GAAG,SAA+B,GACvD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAiBvB,mEAAmE;IAC7D,UAAU,CACd,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,KAAK,CAAC,EAAE,eAAe,GAAG,SAAS,GAClC,OAAO,CAAC,OAAO,CAAC;IAMnB,qDAAqD;IAC/C,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAMzE;;;;;;OAMG;IACG,MAAM,CACV,IAAI,EAAE,IAAI,EACV,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,QAAQ,EACnB,KAAK,GAAE,eAAe,GAAG,SAA+B,GACvD,OAAO,CAAC,OAAO,CAAC;CAgBpB"}