@dudousxd/nestjs-authz 0.8.1 → 0.9.0

package/dist/rbac.js

@@ -0,0 +1,293 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { InjectCapability } from '@dudousxd/nestjs-diagnostics/nestjs';
+import { Inject, Injectable, Optional } from '@nestjs/common';
+import { ModuleRef } from '@nestjs/core';
+import { PermissionCache } from './permission-cache.js';
+import { permissionSatisfied } from './permission-matcher.js';
+import { defaultRoleResolver } from './role-provider.js';
+import { AUTHZ_MODULE_OPTIONS, CONTEXT_ACCESSOR, DECISION_PROVIDER, PERMISSION_PROVIDER, ROLE_PROVIDER, } from './tokens.js';
+/**
+ * Key of the per-request {@link PermissionCache} on the nestjs-context store. `Symbol.for`
+ * so every copy of this module shares it.
+ */
+const REQUEST_PERMISSION_CACHE = Symbol.for('@dudousxd/nestjs-authz:request-permission-cache');
+/** Key under which the per-request `resolveUser` results are stashed on the context store. */
+const REQUEST_USERS = Symbol.for('@dudousxd/nestjs-authz:request-users');
+/**
+ * Roles and permissions of a user, from the persisted RBAC seams (`ROLE_PROVIDER`,
+ * `PERMISSION_PROVIDER`, registered by the TypeORM / MikroORM / Prisma / Drizzle adapters)
+ * and from the user object itself (`user.roles` / `user.role`); the optional external
+ * decision point (`DECISION_PROVIDER`); and the ambient user for `Gate` calls made without
+ * one. Shared by `RolePolicy`, `PermissionPolicy`, `AuthzPolicy` and the `Gate`.
+ *
+ * Within one request (a nestjs-context store), a user's permissions and provider roles
+ * are fetched once, however many checks run, in guards and in handlers alike.
+ */
+let AuthzRbac = class AuthzRbac {
+    context;
+    moduleRef;
+    permissionProvider;
+    roleProvider;
+    decisionProvider;
+    roleResolver;
+    resolveUser;
+    lookups = new Map();
+    authentication;
+    constructor(options, context, moduleRef, permissionProvider, roleProvider, decisionProvider) {
+        this.context = context;
+        this.moduleRef = moduleRef;
+        this.permissionProvider = permissionProvider;
+        this.roleProvider = roleProvider;
+        this.decisionProvider = decisionProvider;
+        this.roleResolver = options?.resolveRoles ?? defaultRoleResolver;
+        this.resolveUser = options?.resolveUser;
+    }
+    /**
+     * Finds `@nestjs/authentication`'s `AuthenticationContext` when that optional peer is
+     * installed and its module is imported. The class is the DI token, so the package is
+     * loaded only here, and its absence is not an error.
+     */
+    async onModuleInit() {
+        if (!this.moduleRef || this.authentication)
+            return;
+        let token;
+        try {
+            const specifier = '@nestjs/authentication';
+            token = (await import(specifier))
+                .AuthenticationContext;
+        }
+        catch {
+            return;
+        }
+        if (typeof token !== 'function')
+            return;
+        try {
+            this.authentication = this.moduleRef.get(token, {
+                strict: false,
+            });
+        }
+        catch {
+            this.authentication = undefined;
+        }
+    }
+    /**
+     * A provider registered by any module: the injected one, else a non-strict lookup,
+     * memoized, so a global RBAC module or a root-level accessor is found too.
+     */
+    lookup(token, injected) {
+        if (injected)
+            return injected;
+        const memo = this.lookups.get(token);
+        if (memo)
+            return memo.value;
+        let value;
+        try {
+            value = this.moduleRef?.get(token, { strict: false });
+        }
+        catch {
+            value = undefined;
+        }
+        this.lookups.set(token, { value });
+        return value;
+    }
+    /** @internal The nestjs-context accessor, when one is registered. */
+    contextAccessor() {
+        return this.lookup(CONTEXT_ACCESSOR, this.context);
+    }
+    /** The persisted permission seam, when an RBAC adapter registered one. */
+    permissions() {
+        return this.lookup(PERMISSION_PROVIDER, this.permissionProvider);
+    }
+    /** The persisted role seam, when an RBAC adapter registered one. */
+    roles() {
+        return this.lookup(ROLE_PROVIDER, this.roleProvider);
+    }
+    /** The external decision point (Cerbos, OPA, …), when one is registered. */
+    decisions() {
+        return this.lookup(DECISION_PROVIDER, this.decisionProvider);
+    }
+    /**
+     * The user for a `Gate` call made without one:
+     *
+     * 1. `@nestjs/authentication`'s `AuthenticationContext.user`, when that optional peer is
+     *    installed and its scope is active (a call it handles, or `AuthenticationContext.run()`):
+     *    its answer is final, so a `null` there is a guest;
+     * 2. else, with no authentication scope at all, nestjs-context's user ref, hydrated by
+     *    `resolveUser` when configured (once per `type:id` per request);
+     * 3. else `null` (a guest).
+     */
+    async currentUser() {
+        const authenticated = this.authenticatedUser();
+        if (authenticated !== undefined)
+            return authenticated;
+        const context = this.contextAccessor();
+        if (!context)
+            return null;
+        const ref = context.userRef();
+        if (ref === undefined)
+            return null;
+        const resolveUser = this.resolveUser;
+        if (!resolveUser)
+            return ref;
+        const hydrate = async () => (await resolveUser(ref)) ?? null;
+        const store = this.requestStore();
+        if (!store)
+            return hydrate();
+        let users = store[REQUEST_USERS];
+        if (!(users instanceof Map)) {
+            users = new Map();
+            store[REQUEST_USERS] = users;
+        }
+        const key = `${ref.type}:${typeof ref.id}:${ref.id}`;
+        const cached = users.get(key);
+        if (cached)
+            return cached;
+        const pending = hydrate();
+        users.set(key, pending);
+        pending.catch(() => users.delete(key));
+        return pending;
+    }
+    /**
+     * `AuthenticationContext.user` (`null` for an anonymous call) when its scope is active;
+     * `undefined` without the package or outside its scope. A version that hides the scope is
+     * read as before: a user is an answer, `null` is not.
+     */
+    authenticatedUser() {
+        const authentication = this.authentication;
+        if (!authentication)
+            return undefined;
+        try {
+            const scope = authentication.scope;
+            if (scope && typeof scope === 'object' && 'current' in scope) {
+                return scope.current === undefined ? undefined : (authentication.user ?? null);
+            }
+            return authentication.user ?? undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /** The nestjs-context store for the current request, or `undefined` when there is none. */
+    requestStore() {
+        const context = this.contextAccessor();
+        if (!context || typeof context.get !== 'function')
+            return undefined;
+        let store;
+        try {
+            store = context.get();
+        }
+        catch {
+            store = undefined;
+        }
+        return store;
+    }
+    /**
+     * The per-request {@link PermissionCache} on the nestjs-context store, so every check
+     * in one request shares a single `getPermissions` and `getRoles` fetch per user.
+     * `undefined` without a store.
+     */
+    requestCache() {
+        const store = this.requestStore();
+        if (!store)
+            return undefined;
+        const existing = store[REQUEST_PERMISSION_CACHE];
+        if (existing instanceof PermissionCache)
+            return existing;
+        const cache = new PermissionCache();
+        store[REQUEST_PERMISSION_CACHE] = cache;
+        return cache;
+    }
+    /**
+     * The user's role names: the role resolver's (the user object) and the role provider's,
+     * the latter fetched through `cache` (the request's, by default).
+     */
+    async rolesOf(user, cache = this.requestCache()) {
+        const out = new Set();
+        if (user == null)
+            return out;
+        const fromResolver = await this.roleResolver(user);
+        if (Array.isArray(fromResolver)) {
+            for (const r of fromResolver)
+                if (typeof r === 'string')
+                    out.add(r);
+        }
+        const provider = this.roles();
+        if (provider) {
+            const fromProvider = await (cache ? cache.getRoles(provider, user) : provider.getRoles(user));
+            if (Array.isArray(fromProvider)) {
+                for (const r of fromProvider)
+                    if (typeof r === 'string')
+                        out.add(r);
+            }
+        }
+        return out;
+    }
+    /** True when the user holds any of `roles`. A guest holds none. */
+    async hasAnyRole(user, roles, cache) {
+        if (user == null || roles.length === 0)
+            return false;
+        const held = await this.rolesOf(user, cache ?? this.requestCache());
+        return roles.some((r) => held.has(r));
+    }
+    /** True when the user holds every one of `roles`. */
+    async hasAllRoles(user, roles) {
+        if (user == null || roles.length === 0)
+            return false;
+        const held = await this.rolesOf(user);
+        return roles.every((r) => held.has(r));
+    }
+    /**
+     * True when the permission seam grants `permission` to `user`. With `getPermissions`,
+     * wildcard grants apply (`posts.*` satisfies `posts.update`, `*` anything), fetched
+     * once per `cache` (the request's, by default). A set the provider marks
+     * `exhaustivePermissions` answers on its own; otherwise a miss still asks the
+     * exact-match `hasPermission`. A guest, or no seam, is never granted.
+     */
+    async grants(user, permission, resource, cache = this.requestCache()) {
+        if (user == null)
+            return false;
+        const provider = this.permissions();
+        if (!provider)
+            return false;
+        if (typeof provider.getPermissions === 'function') {
+            const satisfied = cache
+                ? await cache.satisfies(provider, user, permission)
+                : await (async () => {
+                    const granted = await provider.getPermissions?.(user);
+                    return granted == null ? undefined : permissionSatisfied(granted, permission);
+                })();
+            if (satisfied === true)
+                return true;
+            if (satisfied === false && provider.exhaustivePermissions === true)
+                return false;
+        }
+        return (await provider.hasPermission(user, permission, resource)) === true;
+    }
+};
+AuthzRbac = __decorate([
+    Injectable(),
+    __param(0, Optional()),
+    __param(0, Inject(AUTHZ_MODULE_OPTIONS)),
+    __param(1, InjectCapability('context', 'accessor')),
+    __param(2, Optional()),
+    __param(3, Optional()),
+    __param(3, Inject(PERMISSION_PROVIDER)),
+    __param(4, Optional()),
+    __param(4, Inject(ROLE_PROVIDER)),
+    __param(5, Optional()),
+    __param(5, Inject(DECISION_PROVIDER)),
+    __metadata("design:paramtypes", [Object, Object, ModuleRef, Object, Object, Object])
+], AuthzRbac);
+export { AuthzRbac };
+//# sourceMappingURL=rbac.js.map

package/dist/rbac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.js","sourceRoot":"","sources":["../src/rbac.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAqB,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,OAAO,EAAwC,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC/F,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,GACd,MAAM,aAAa,CAAC;AAGrB;;;GAGG;AACH,MAAM,wBAAwB,GAAG,MAAM,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;AAE/F,8FAA8F;AAC9F,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;AAazE;;;;;;;;;GASG;AAEI,IAAM,SAAS,GAAf,MAAM,SAAS;IAQwC;IAC7B;IAGZ;IACmC;IACI;IAbzC,YAAY,CAAe;IAC3B,WAAW,CAAoC;IAC/C,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;IACzD,cAAc,CAAwC;IAE9D,YAC4C,OAAuC,EACvB,OAAyB,EACtD,SAAqB,EAGjC,kBAAuC,EACJ,YAA2B,EACvB,gBAAmC;QANjC,YAAO,GAAP,OAAO,CAAkB;QACtD,cAAS,GAAT,SAAS,CAAY;QAGjC,uBAAkB,GAAlB,kBAAkB,CAAqB;QACJ,iBAAY,GAAZ,YAAY,CAAe;QACvB,qBAAgB,GAAhB,gBAAgB,CAAmB;QAE3F,IAAI,CAAC,YAAY,GAAG,OAAO,EAAE,YAAY,IAAI,mBAAmB,CAAC;QACjE,IAAI,CAAC,WAAW,GAAG,OAAO,EAAE,WAAW,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO;QACnD,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,wBAAwB,CAAC;YAC3C,KAAK,GAAI,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAyC;iBACvE,qBAAqB,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,UAAU;YAAE,OAAO;QACxC,IAAI,CAAC;YACH,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAA4C,EAAE;gBACrF,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAClC,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,MAAM,CAAI,KAAa,EAAE,QAAuB;QACtD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC,KAAsB,CAAC;QAC7C,IAAI,KAAoB,CAAC;QACzB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,CAAI,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,GAAG,SAAS,CAAC;QACpB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACnC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,qEAAqE;IACrE,eAAe;QACb,OAAO,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;IAED,0EAA0E;IAC1E,WAAW;QACT,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnE,CAAC;IAED,oEAAoE;IACpE,KAAK;QACH,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACvD,CAAC;IAED,4EAA4E;IAC5E,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,WAAW;QACf,MAAM,aAAa,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/C,IAAI,aAAa,KAAK,SAAS;YAAE,OAAO,aAAa,CAAC;QAEtD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACvC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QAC9B,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,WAAW;YAAE,OAAO,GAAG,CAAC;QAC7B,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE,CAAC,CAAC,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;QAE5E,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK;YAAE,OAAO,OAAO,EAAE,CAAC;QAC7B,IAAI,KAAK,GAAG,KAAK,CAAC,aAAa,CAA2C,CAAC;QAC3E,IAAI,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,EAAE,CAAC;YAC5B,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;YAClB,KAAK,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC;QAC/B,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC;QAC1B,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACvC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;OAIG;IACK,iBAAiB;QACvB,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QAC3C,IAAI,CAAC,cAAc;YAAE,OAAO,SAAS,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC;YACnC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;gBAC7D,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;YACjF,CAAC;YACD,OAAO,cAAc,CAAC,IAAI,IAAI,SAAS,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,2FAA2F;IACnF,YAAY;QAClB,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACvC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,UAAU;YAAE,OAAO,SAAS,CAAC;QACpE,IAAI,KAA+B,CAAC;QACpC,IAAI,CAAC;YACH,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,GAAG,SAAS,CAAC;QACpB,CAAC;QACD,OAAO,KAA4C,CAAC;IACtD,CAAC;IAED;;;;OAIG;IACH,YAAY;QACV,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,MAAM,QAAQ,GAAG,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACjD,IAAI,QAAQ,YAAY,eAAe;YAAE,OAAO,QAAQ,CAAC;QACzD,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,KAAK,CAAC,wBAAwB,CAAC,GAAG,KAAK,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CACX,IAAU,EACV,QAAqC,IAAI,CAAC,YAAY,EAAE;QAExD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;QAC9B,IAAI,IAAI,IAAI,IAAI;YAAE,OAAO,GAAG,CAAC;QAC7B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YAChC,KAAK,MAAM,CAAC,IAAI,YAAY;gBAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9F,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;gBAChC,KAAK,MAAM,CAAC,IAAI,YAAY;oBAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;wBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,UAAU,CACd,IAAU,EACV,KAAwB,EACxB,KAAmC;QAEnC,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QACpE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,WAAW,CAAC,IAAU,EAAE,KAAwB;QACpD,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACrD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CACV,IAAU,EACV,UAAkB,EAClB,QAAmB,EACnB,QAAqC,IAAI,CAAC,YAAY,EAAE;QAExD,IAAI,IAAI,IAAI,IAAI;YAAE,OAAO,KAAK,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5B,IAAI,OAAO,QAAQ,CAAC,cAAc,KAAK,UAAU,EAAE,CAAC;YAClD,MAAM,SAAS,GAAG,KAAK;gBACrB,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC;gBACnD,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;oBAChB,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,CAAC;oBACtD,OAAO,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;gBAChF,CAAC,CAAC,EAAE,CAAC;YACT,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YACpC,IAAI,SAAS,KAAK,KAAK,IAAI,QAAQ,CAAC,qBAAqB,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;QACnF,CAAC;QACD,OAAO,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,KAAK,IAAI,CAAC;IAC7E,CAAC;CACF,CAAA;AA9OY,SAAS;IADrB,UAAU,EAAE;IAQR,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,oBAAoB,CAAC,CAAA;IACxC,WAAA,gBAAgB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IACvC,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,MAAM,CAAC,mBAAmB,CAAC,CAAA;IAE3B,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,aAAa,CAAC,CAAA;IACjC,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,iBAAiB,CAAC,CAAA;qDALG,SAAS;GATzC,SAAS,CA8OrB"}

package/dist/resource-resolver.d.ts

@@ -1,29 +1,27 @@
 import type { ExecutionContext, Type } from '@nestjs/common';
+/** Per-call hints `byId(Resource, { param })` passes to the resolver. */
+export interface ResourceResolveHints {
+    /** The route param holding the id, when `byId` named one. */
+    param?: string;
+}
 /**
- * Resolves a resource instance for a `@Can(ability, Resource)` route so the guard
- * can pass it to the policy method. Apps register an implementation (typically
- * ORM-backed) via `AuthzModule.forRoot({ ... })` or as a provider bound to the
- * {@link RESOURCE_RESOLVER} token.
- *
- * Class-level abilities (no resource class on `@Can`) never call the resolver.
+ * Loads the resource a `byId(Resource)` argument resolver hands to the policy
+ * (`@Can(PostPolicy, 'update', byId(Post))`). Register one, typically ORM-backed, with
+ * `AuthzModule.forRoot({ resourceResolver })`. Return `undefined` for "not found":
+ * `byId` then refuses the call with a 403 before the policy runs.
  */
 export interface ResourceResolver {
-    /**
-     * Load the resource instance for `resource` in the given request context.
-     * Return `undefined` to signal "not found" — the guard treats a missing
-     * resource as a denial.
-     */
-    resolve(resource: Type<unknown>, ctx: ExecutionContext): Promise<object | undefined> | object | undefined;
+    resolve(resource: Type<unknown>, ctx: ExecutionContext, hints?: ResourceResolveHints): Promise<object | undefined> | object | undefined;
 }
 /**
- * Default resolver: reads the route `:id` param and produces a lightweight
- * `{ id }` shim of the requested resource class. This keeps the guard usable
- * out-of-the-box (e.g. ownership checks on `resource.id`) without an ORM, while
- * apps that need real entities register their own {@link ResourceResolver}.
+ * Default resolver: reads the route `:id` param and produces a lightweight `{ id }`
+ * object whose prototype is the resource class's, enough for ownership checks on
+ * `resource.id` without an ORM. Register your own {@link ResourceResolver} to load
+ * real entities.
  */
 export declare class IdParamResourceResolver implements ResourceResolver {
     private readonly param;
     constructor(param?: string);
-    resolve(resource: Type<unknown>, ctx: ExecutionContext): object | undefined;
+    resolve(resource: Type<unknown>, ctx: ExecutionContext, hints?: ResourceResolveHints): object | undefined;
 }
 //# sourceMappingURL=resource-resolver.d.ts.map

package/dist/resource-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-resolver.d.ts","sourceRoot":"","sources":["../src/resource-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,OAAO,CACL,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,EACvB,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,SAAS,CAAC;CACrD;AAED;;;;;GAKG;AACH,qBAAa,uBAAwB,YAAW,gBAAgB;IAClD,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,GAAE,MAAa;IAEjD,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS;CAU5E"}
+{"version":3,"file":"resource-resolver.d.ts","sourceRoot":"","sources":["../src/resource-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAE7D,yEAAyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CACL,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,EACvB,GAAG,EAAE,gBAAgB,EACrB,KAAK,CAAC,EAAE,oBAAoB,GAC3B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,SAAS,CAAC;CACrD;AAED;;;;;GAKG;AACH,qBAAa,uBAAwB,YAAW,gBAAgB;IAClD,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,GAAE,MAAa;IAEjD,OAAO,CACL,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,EACvB,GAAG,EAAE,gBAAgB,EACrB,KAAK,CAAC,EAAE,oBAAoB,GAC3B,MAAM,GAAG,SAAS;CAStB"}

package/dist/resource-resolver.js

@@ -1,21 +1,21 @@
 /**
- * Default resolver: reads the route `:id` param and produces a lightweight
- * `{ id }` shim of the requested resource class. This keeps the guard usable
- * out-of-the-box (e.g. ownership checks on `resource.id`) without an ORM, while
- * apps that need real entities register their own {@link ResourceResolver}.
+ * Default resolver: reads the route `:id` param and produces a lightweight `{ id }`
+ * object whose prototype is the resource class's, enough for ownership checks on
+ * `resource.id` without an ORM. Register your own {@link ResourceResolver} to load
+ * real entities.
  */
 export class IdParamResourceResolver {
     param;
     constructor(param = 'id') {
         this.param = param;
     }
-    resolve(resource, ctx) {
+    resolve(resource, ctx, hints) {
+        if (ctx.getType() !== 'http')
+            return undefined;
         const req = ctx.switchToHttp().getRequest();
-        const id = req?.params?.[this.param];
+        const id = req?.params?.[hints?.param ?? this.param];
         if (id === undefined)
             return undefined;
-        // Construct a shaped instance so `instance.constructor === resource`, which
-        // is how PolicyRegistry maps an instance back to its policy.
         const instance = Object.create(resource.prototype);
         instance.id = id;
         return instance;

package/dist/resource-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"resource-resolver.js","sourceRoot":"","sources":["../src/resource-resolver.ts"],"names":[],"mappings":"AAsBA;;;;;GAKG;AACH,MAAM,OAAO,uBAAuB;IACL;IAA7B,YAA6B,QAAgB,IAAI;QAApB,UAAK,GAAL,KAAK,CAAe;IAAG,CAAC;IAErD,OAAO,CAAC,QAAuB,EAAE,GAAqB;QACpD,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAwC,CAAC;QAClF,MAAM,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACvC,4EAA4E;QAC5E,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAA4B,CAAC;QAC9E,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC;QACjB,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}
+{"version":3,"file":"resource-resolver.js","sourceRoot":"","sources":["../src/resource-resolver.ts"],"names":[],"mappings":"AAsBA;;;;;GAKG;AACH,MAAM,OAAO,uBAAuB;IACL;IAA7B,YAA6B,QAAgB,IAAI;QAApB,UAAK,GAAL,KAAK,CAAe;IAAG,CAAC;IAErD,OAAO,CACL,QAAuB,EACvB,GAAqB,EACrB,KAA4B;QAE5B,IAAI,GAAG,CAAC,OAAO,EAAE,KAAK,MAAM;YAAE,OAAO,SAAS,CAAC;QAC/C,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAwC,CAAC;QAClF,MAAM,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAA4B,CAAC;QAC9E,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC;QACjB,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/runtime.d.ts

@@ -0,0 +1,31 @@
+import type { ExecutionContext } from '@nestjs/common';
+import type { DecisionProvider } from './decision-provider.js';
+import { type ResourceResolver } from './resource-resolver.js';
+import type { SuperAdminHook } from './types.js';
+/**
+ * What `@Can()` argument resolvers and policy base classes need from the app but
+ * cannot inject: the official resolvers run with only the `ExecutionContext`, and a
+ * policy base class cannot add constructor parameters to its subclasses. `AuthzModule`
+ * fills this in when it boots. One application per process is the expected case; with
+ * several, the last one to boot wins.
+ */
+interface AuthzRuntime {
+    resourceResolver: ResourceResolver;
+    superAdmin: SuperAdminHook | undefined;
+    /** The external decision point, looked up lazily (an adapter may register it late). */
+    decisionProvider: () => DecisionProvider | undefined;
+    getUser: (context: ExecutionContext) => unknown;
+}
+/** @internal Called by `AuthzModule` at boot, and by the testing helpers. */
+export declare function configureAuthzRuntime(patch: Partial<AuthzRuntime>): void;
+/** @internal Restore the defaults (tests). */
+export declare function resetAuthzRuntime(): void;
+/** @internal */
+export declare function authzRuntime(): Readonly<AuthzRuntime>;
+/**
+ * The user the official guard sees for this call: the `getUser` given to
+ * `AuthorizationModule.forRoot()`, else the official `defaultGetUser`. `null` for a guest.
+ */
+export declare function currentUserOf(context: ExecutionContext): Promise<unknown>;
+export {};
+//# sourceMappingURL=runtime.d.ts.map

package/dist/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAA2B,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACxF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD;;;;;;GAMG;AACH,UAAU,YAAY;IACpB,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,UAAU,EAAE,cAAc,GAAG,SAAS,CAAC;IACvC,uFAAuF;IACvF,gBAAgB,EAAE,MAAM,gBAAgB,GAAG,SAAS,CAAC;IACrD,OAAO,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC;CACjD;AAWD,6EAA6E;AAC7E,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,IAAI,CAKxE;AAED,8CAA8C;AAC9C,wBAAgB,iBAAiB,IAAI,IAAI,CAKxC;AAED,gBAAgB;AAChB,wBAAgB,YAAY,IAAI,QAAQ,CAAC,YAAY,CAAC,CAErD;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAG/E"}

package/dist/runtime.js

@@ -0,0 +1,40 @@
+import { defaultGetUser } from '@nestjs/authorization';
+import { IdParamResourceResolver } from './resource-resolver.js';
+const noDecisionProvider = () => undefined;
+const runtime = {
+    resourceResolver: new IdParamResourceResolver(),
+    superAdmin: undefined,
+    decisionProvider: noDecisionProvider,
+    getUser: defaultGetUser,
+};
+/** @internal Called by `AuthzModule` at boot, and by the testing helpers. */
+export function configureAuthzRuntime(patch) {
+    if (patch.resourceResolver)
+        runtime.resourceResolver = patch.resourceResolver;
+    if ('superAdmin' in patch)
+        runtime.superAdmin = patch.superAdmin;
+    if (patch.decisionProvider)
+        runtime.decisionProvider = patch.decisionProvider;
+    if (patch.getUser)
+        runtime.getUser = patch.getUser;
+}
+/** @internal Restore the defaults (tests). */
+export function resetAuthzRuntime() {
+    runtime.resourceResolver = new IdParamResourceResolver();
+    runtime.superAdmin = undefined;
+    runtime.decisionProvider = noDecisionProvider;
+    runtime.getUser = defaultGetUser;
+}
+/** @internal */
+export function authzRuntime() {
+    return runtime;
+}
+/**
+ * The user the official guard sees for this call: the `getUser` given to
+ * `AuthorizationModule.forRoot()`, else the official `defaultGetUser`. `null` for a guest.
+ */
+export async function currentUserOf(context) {
+    const user = await runtime.getUser(context);
+    return user === undefined || user === false ? null : user;
+}
+//# sourceMappingURL=runtime.js.map

package/dist/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGvD,OAAO,EAAE,uBAAuB,EAAyB,MAAM,wBAAwB,CAAC;AAkBxF,MAAM,kBAAkB,GAAG,GAAiC,EAAE,CAAC,SAAS,CAAC;AAEzE,MAAM,OAAO,GAAiB;IAC5B,gBAAgB,EAAE,IAAI,uBAAuB,EAAE;IAC/C,UAAU,EAAE,SAAS;IACrB,gBAAgB,EAAE,kBAAkB;IACpC,OAAO,EAAE,cAAc;CACxB,CAAC;AAEF,6EAA6E;AAC7E,MAAM,UAAU,qBAAqB,CAAC,KAA4B;IAChE,IAAI,KAAK,CAAC,gBAAgB;QAAE,OAAO,CAAC,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAC9E,IAAI,YAAY,IAAI,KAAK;QAAE,OAAO,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACjE,IAAI,KAAK,CAAC,gBAAgB;QAAE,OAAO,CAAC,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAC9E,IAAI,KAAK,CAAC,OAAO;QAAE,OAAO,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;AACrD,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,iBAAiB;IAC/B,OAAO,CAAC,gBAAgB,GAAG,IAAI,uBAAuB,EAAE,CAAC;IACzD,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;IAC/B,OAAO,CAAC,gBAAgB,GAAG,kBAAkB,CAAC;IAC9C,OAAO,CAAC,OAAO,GAAG,cAAc,CAAC;AACnC,CAAC;AAED,gBAAgB;AAChB,MAAM,UAAU,YAAY;IAC1B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAyB;IAC3D,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5D,CAAC"}

package/dist/tokens.d.ts

@@ -17,12 +17,8 @@ export declare const RESOURCE_RESOLVER: symbol;
  * or empty, the endpoint behaves exactly as before (class-level / ad-hoc only).
  */
 export declare const RESOURCE_HYDRATOR: symbol;
-/** Metadata key for `@Policy(Resource)` — stores the resource class on the policy. */
-export declare const POLICY_RESOURCE_METADATA = "nestjs-authz:policy-resource";
-/** Metadata key for `@Can(ability, Resource?)` — stores the ability descriptor on a route. */
-export declare const CAN_METADATA = "nestjs-authz:can";
-/** Metadata key for `@Roles(...roles)` — stores the allowed role names on a route. */
-export declare const ROLES_METADATA = "nestjs-authz:roles";
+/** Metadata key of the `@PolicyFor(Resource)` link on a policy class. */
+export { POLICY_RESOURCE_METADATA } from './links.js';
 /**
  * Cross-lib injection token for an optional {@link PermissionProvider} — the seam the
  * RBAC adapter (`@dudousxd/nestjs-authz-typeorm`) registers so that a model-less,
@@ -31,8 +27,8 @@ export declare const ROLES_METADATA = "nestjs-authz:roles";
  *
  * `Symbol.for(key)` uses the global symbol registry so an RBAC package registering
  * this same key resolves to the SAME symbol instance without importing core internals.
- * The token is consulted with `@Optional()` — when absent, the Gate behaves exactly
- * as before (backward-compatible: unknown abilities still throw).
+ * The token is consulted with `@Optional()` — when absent, an unknown string ability
+ * still throws.
  */
 export declare const PERMISSION_PROVIDER: symbol;
 /**

package/dist/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAEA,uEAAuE;AACvE,eAAO,MAAM,oBAAoB,QAAiC,CAAC;AAEnE,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,QAA2C,CAAC;AAE1E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,QAA2C,CAAC;AAE1E,sFAAsF;AACtF,eAAO,MAAM,wBAAwB,iCAAiC,CAAC;AAEvE,8FAA8F;AAC9F,eAAO,MAAM,YAAY,qBAAqB,CAAC;AAE/C,sFAAsF;AACtF,eAAO,MAAM,cAAc,uBAAuB,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,QAA6C,CAAC;AAE9E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa,QAAuC,CAAC;AAElE;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,QAA2C,CAAC;AAE1E;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,QAAoC,CAAC"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAEA,uEAAuE;AACvE,eAAO,MAAM,oBAAoB,QAAiC,CAAC;AAEnE,uFAAuF;AACvF,eAAO,MAAM,iBAAiB,QAA2C,CAAC;AAE1E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,QAA2C,CAAC;AAE1E,yEAAyE;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAEtD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,QAA6C,CAAC;AAE9E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa,QAAuC,CAAC;AAElE;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,QAA2C,CAAC;AAE1E;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,QAAoC,CAAC"}

package/dist/tokens.js

@@ -18,12 +18,8 @@ export const RESOURCE_RESOLVER = capability('authz', 'resource-resolver');
  * or empty, the endpoint behaves exactly as before (class-level / ad-hoc only).
  */
 export const RESOURCE_HYDRATOR = capability('authz', 'resource-hydrator');
-/** Metadata key for `@Policy(Resource)` — stores the resource class on the policy. */
-export const POLICY_RESOURCE_METADATA = 'nestjs-authz:policy-resource';
-/** Metadata key for `@Can(ability, Resource?)` — stores the ability descriptor on a route. */
-export const CAN_METADATA = 'nestjs-authz:can';
-/** Metadata key for `@Roles(...roles)` — stores the allowed role names on a route. */
-export const ROLES_METADATA = 'nestjs-authz:roles';
+/** Metadata key of the `@PolicyFor(Resource)` link on a policy class. */
+export { POLICY_RESOURCE_METADATA } from './links.js';
 /**
  * Cross-lib injection token for an optional {@link PermissionProvider} — the seam the
  * RBAC adapter (`@dudousxd/nestjs-authz-typeorm`) registers so that a model-less,
@@ -32,8 +28,8 @@ export const ROLES_METADATA = 'nestjs-authz:roles';
  *
  * `Symbol.for(key)` uses the global symbol registry so an RBAC package registering
  * this same key resolves to the SAME symbol instance without importing core internals.
- * The token is consulted with `@Optional()` — when absent, the Gate behaves exactly
- * as before (backward-compatible: unknown abilities still throw).
+ * The token is consulted with `@Optional()` — when absent, an unknown string ability
+ * still throws.
  */
 export const PERMISSION_PROVIDER = capability('authz', 'permission-provider');
 /**

package/dist/tokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAE1D,uEAAuE;AACvE,MAAM,CAAC,MAAM,oBAAoB,GAAG,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAEnE,uFAAuF;AACvF,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;AAE1E;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;AAE1E,sFAAsF;AACtF,MAAM,CAAC,MAAM,wBAAwB,GAAG,8BAA8B,CAAC;AAEvE,8FAA8F;AAC9F,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAE/C,sFAAsF;AACtF,MAAM,CAAC,MAAM,cAAc,GAAG,oBAAoB,CAAC;AAEnD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,UAAU,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;AAElE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;AAE1E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC"}
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAE1D,uEAAuE;AACvE,MAAM,CAAC,MAAM,oBAAoB,GAAG,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAEnE,uFAAuF;AACvF,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;AAE1E;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;AAE1E,yEAAyE;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAEtD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,UAAU,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;AAElE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;AAE1E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC"}