@dudousxd/nestjs-authz 0.9.0 → 0.9.2

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @dudousxd/nestjs-authz
 
+## 0.9.2
+
+### Patch Changes
+
+- [#70](https://github.com/DavideCarvalho/nestjs-authz/pull/70) [`416f0bd`](https://github.com/DavideCarvalho/nestjs-authz/commit/416f0bd7d9340f6f3314017d4925cb89834c4342) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - README fixes: the codegen README no longer describes the removed `PostPolicy` → `Post` name guess and lists `@PolicyFor` among the names that must not be aliased; the core README covers the dropped `DecisionProvider` deny message and the expected boot error under `unannotated: 'allow'`.
+
+## 0.9.1
+
+### Patch Changes
+
+- [#68](https://github.com/DavideCarvalho/nestjs-authz/pull/68) [`febcbc8`](https://github.com/DavideCarvalho/nestjs-authz/commit/febcbc8d2ac290d0f155ea505d2668ef28a4ce17) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Depend on `@dudousxd/nestjs-diagnostics` `>=0.7.0 <1.0.0` instead of the exact `0.7.1`, so an app on diagnostics 0.8.0 shares one copy (and one channel and capability registry) instead of installing a second one.
+
 ## 0.9.0
 
 ### Minor Changes

package/README.md

@@ -189,6 +189,7 @@ decorators are gone: move each one to its official form.
 | `gate.allows()` user from nestjs-context | `AuthenticationContext.user` inside its scope (`null` there is a guest), nestjs-context outside it |
 | a persisted permission named like a policy ability grants it | the policy decides (only `superAdmin` bypasses it), in checks and in `scope()` |
 | `DecisionProvider` / `superAdmin` see a guest as `undefined` | `null` |
+| a `DecisionProvider` deny `message` (`{ allowed: false, message }`) is the 403's message | dropped: the 403 is the official `{ statusCode: 403, message: 'Forbidden' }`. `@nestjs/authorization` has no deny-with-reason (a policy returns `true` or denies; an exception it throws counts as a failure, not a denial). To show a reason, throw your own `ForbiddenException(reason)` from the ability. A route then gets your body, but no `denied` event is emitted and `AuthorizationService.can()` throws instead of returning `false`. |
 | `DecisionProvider` asked by the Gate on every check | asked by `AuthzPolicy.before()` on routes, and by `Gate` string abilities |
 | `import … from '@dudousxd/nestjs-authz-inertia/client'` | `import … from '@dudousxd/nestjs-authz-client'` (the subpath is removed) |
 
@@ -223,6 +224,18 @@ has no such option):
    and 403 for a user, same `denied` event. A route with no requirement is let through. The app
    fails to start if the official global guard is still on, because it would keep denying them.
 
+   **The boot log has one expected ERROR in this mode.** `@nestjs/authorization` checks at
+   startup that a guard enforces each `@Can()`, and it recognizes only its own
+   `AuthorizationGuard`. It does not see `AuthzGuard`, so it logs:
+
+   ```text
+   ERROR [Authorization] @Can() is not enforced on PostController.update, … : AuthorizationModule has
+   globalGuard: false, and these handlers have no @UseGuards(AuthorizationGuard).
+   ```
+
+   That is safe: `AuthzGuard` enforces those handlers, and `AuthzModule` logs a line right after
+   it naming them. The error goes away at step 4.
+
 2. **Drop the 0.8 guard and move the old decorators.** Remove `RolesGuard` / `CanGuard` from
    `APP_GUARD` and `@UseGuards()`, and rewrite each string `@Can` / `@Policy(Post)` with the table
    above (`@Can('page.documents')` → `@Can(GatePolicy, 'allows', ability('page.documents'))`).

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export declare const VERSION = "0.9.0";
+export declare const VERSION = "0.9.2";
 export { AuthzModule } from './module.js';
 export { AuthzGuard } from './authz.guard.js';
 export { Gate, BoundGate } from './gate.js';

package/dist/index.js

@@ -1,7 +1,7 @@
 // Rewritten from this package's package.json by `scripts/sync-version.mjs`, which the root
 // `version-packages` script runs right after `changeset version`. The build is plain `tsc`
 // and injects nothing, so the literal below is what ships in dist.
-export const VERSION = '0.9.0';
+export const VERSION = '0.9.2';
 // Extras on top of @nestjs/authorization. Its own API (@Policy, @Can, Can.Anyone,
 // AuthorizationModule, AuthorizationService, AuthorizationGuard) is imported from there.
 export { AuthzModule } from './module.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dudousxd/nestjs-authz",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "description": "Extras on top of @nestjs/authorization: persisted RBAC policies, @Can helpers (byId, roles, permission), a Gate with batch checks and ad-hoc gates, super-admin, query scoping.",
   "license": "MIT",
   "repository": {
@@ -52,7 +52,7 @@
     "skills"
   ],
   "dependencies": {
-    "@dudousxd/nestjs-diagnostics": "0.7.1"
+    "@dudousxd/nestjs-diagnostics": ">=0.7.0 <1.0.0"
   },
   "peerDependencies": {
     "@dudousxd/nestjs-context": ">=0.1.0",