@dudousxd/nestjs-authz 0.9.2 → 0.11.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @dudousxd/nestjs-authz
 
+## 0.11.0
+
+### Minor Changes
+
+- [#74](https://github.com/DavideCarvalho/nestjs-authz/pull/74) [`35421dc`](https://github.com/DavideCarvalho/nestjs-authz/commit/35421dc5b09bd271d5087d26e8536191ef6ba342) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - **Breaking:** require Node.js 24 or newer (`engines.node` is now `>=24`; it was `>=22`, and `>=20` for `-client` and `-react`). CI tests on Node 24 and 26. No API changes: see the Upgrading page in the docs.
+
+## 0.10.0
+
+### Minor Changes
+
+- [#71](https://github.com/DavideCarvalho/nestjs-authz/pull/71) [`750a6b3`](https://github.com/DavideCarvalho/nestjs-authz/commit/750a6b3f80deea3803dec8df5f9f8cf67a046ac1) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Protect Aviary consoles with the Gate. `AuthzModule` now provides the console gate the durable, telescope, media and agent consoles use for `authorize: '<gate name>'`, and exports `authorizeByRoles({ roles })`, `authorizeByPermission(permission)`, `authorizeByToken({ token })` and the console access types (`ConsoleAuthorize`, `ConsoleAuthorizer`, `ConsoleAuthorizeResult`, `ConsoleAuthorizerClass`, `ConsolePolicyCheck`). See "Protecting Aviary consoles" in the docs.
+
 ## 0.9.2
 
 ### Patch Changes

package/README.md

@@ -37,7 +37,7 @@ See [`DESIGN.md`](https://github.com/DavideCarvalho/nestjs-authz/blob/main/DESIG
 pnpm add @nestjs/authorization @dudousxd/nestjs-authz
 ```
 
-Requires NestJS 12 and Node 22+. Two optional peers: `@nestjs/authentication` gives the `Gate`
+Requires NestJS 12 and Node 24+. Two optional peers: `@nestjs/authentication` gives the `Gate`
 its ambient user (`AuthenticationContext.user`); `@dudousxd/nestjs-context` gives it one too
 (outside an authentication scope), plus the per-request permission cache and
 tenant-scoped roles.

package/dist/console.d.ts

@@ -0,0 +1,89 @@
+import { type AuthorizationModuleOptions } from '@nestjs/authorization';
+import { type ExecutionContext, type Type } from '@nestjs/common';
+import { Gate } from './gate.js';
+import { AuthzRbac } from './rbac.js';
+import type { User } from './types.js';
+/** What a console `authorize` check answers. */
+export type ConsoleAuthorizeResult = boolean | {
+    allowed: true;
+} | {
+    allowed: false;
+    reason?: 'unauthenticated' | 'forbidden';
+} | {
+    redirectTo: string;
+};
+/** Class form: an `@Injectable()` provider (constructor injection works). */
+export interface ConsoleAuthorizer {
+    authorize(context: ExecutionContext): ConsoleAuthorizeResult | Promise<ConsoleAuthorizeResult>;
+}
+export type ConsoleAuthorizerClass = Type<ConsoleAuthorizer>;
+/** `@nestjs/authorization` policy check: `policy[ability](user)`. */
+export interface ConsolePolicyCheck {
+    policy: Type<unknown>;
+    ability: string;
+}
+/** The `authorize` option of every Aviary console. */
+export type ConsoleAuthorize = ((context: ExecutionContext) => ConsoleAuthorizeResult | Promise<ConsoleAuthorizeResult>) | ConsoleAuthorizerClass | (() => Promise<{
+    default: ConsoleAuthorizerClass;
+}>) | ConsolePolicyCheck | string;
+/**
+ * The token Aviary consoles resolve `authorize: '<gate name>'` through. `AuthzModule`
+ * provides it globally.
+ */
+export declare const CONSOLE_GATE: unique symbol;
+/**
+ * Answers console checks with the `Gate`, for the user the authorization guard sees:
+ * the official `getUser` (by default `request.user`), else the `Gate`'s ambient user
+ * (`@nestjs/authentication`'s `AuthenticationContext`, else nestjs-context's user ref).
+ */
+export declare class AuthzConsoleGate {
+    private readonly gate;
+    private readonly rbac;
+    private readonly official?;
+    private readonly logger;
+    constructor(gate: Gate, rbac: AuthzRbac, official?: AuthorizationModuleOptions | undefined);
+    /** The user of this call, or `null` for a guest. */
+    userOf(context: ExecutionContext): Promise<User>;
+    /**
+     * `gate.forUser(user).allows(name)`; a denied guest is `unauthenticated`. A name the `Gate`
+     * cannot resolve denies (fail-closed) and logs a warning, so a typo'd gate name shows up in
+     * the logs instead of becoming a 500.
+     */
+    allows(name: string, context: ExecutionContext): Promise<ConsoleAuthorizeResult>;
+    /** @internal Runs `test` for the call's user and turns the answer into a console result. */
+    check(context: ExecutionContext, test: (user: User) => Promise<boolean>): Promise<ConsoleAuthorizeResult>;
+}
+/**
+ * Allows a console to a user holding any of `roles` (persisted or on the user object, the
+ * same check as `@Roles()`; `superAdmin` applies). A guest is `unauthenticated`, a user
+ * without the role `forbidden`.
+ *
+ * ```ts
+ * DurableModule.forRoot({ authorize: authorizeByRoles({ roles: ['admin'] }) })
+ * ```
+ */
+export declare function authorizeByRoles(options: {
+    roles: readonly string[];
+}): ConsoleAuthorizerClass;
+/**
+ * Allows a console to a user granted `permission` (persisted, through roles or directly,
+ * wildcards apply; the same check as `@Permission()`; `superAdmin` applies).
+ * A guest is `unauthenticated`, a user without it `forbidden`.
+ *
+ * ```ts
+ * TelescopeModule.forRoot({ authorize: authorizeByPermission('telescope.view') })
+ * ```
+ */
+export declare function authorizeByPermission(permission: string): ConsoleAuthorizerClass;
+/**
+ * Allows a console to calls sending `Authorization: Bearer <token>` (compared in constant
+ * time). Anything else is `unauthenticated`. Throws when `token` is empty.
+ *
+ * ```ts
+ * authorize: authorizeByToken({ token: process.env.CONSOLE_TOKEN })
+ * ```
+ */
+export declare function authorizeByToken(options: {
+    token: string | undefined;
+}): (context: ExecutionContext) => ConsoleAuthorizeResult;
+//# sourceMappingURL=console.d.ts.map

package/dist/console.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"console.d.ts","sourceRoot":"","sources":["../src/console.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,0BAA0B,EAEhC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,gBAAgB,EAKrB,KAAK,IAAI,EACV,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAIvC,gDAAgD;AAChD,MAAM,MAAM,sBAAsB,GAC9B,OAAO,GACP;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACjB;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,CAAC,EAAE,iBAAiB,GAAG,WAAW,CAAA;CAAE,GAC5D;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3B,6EAA6E;AAC7E,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAChG;AACD,MAAM,MAAM,sBAAsB,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC;AAE7D,qEAAqE;AACrE,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,sDAAsD;AACtD,MAAM,MAAM,gBAAgB,GACxB,CAAC,CAAC,OAAO,EAAE,gBAAgB,KAAK,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC,GACzF,sBAAsB,GACtB,CAAC,MAAM,OAAO,CAAC;IAAE,OAAO,EAAE,sBAAsB,CAAA;CAAE,CAAC,CAAC,GACpD,kBAAkB,GAClB,MAAM,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,YAAY,eAA8C,CAAC;AAQxE;;;;GAIG;AACH,qBACa,gBAAgB;IAIzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAGrB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAP5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;gBAGtC,IAAI,EAAE,IAAI,EACV,IAAI,EAAE,SAAS,EAGf,QAAQ,CAAC,EAAE,0BAA0B,YAAA;IAGxD,oDAAoD;IAC9C,MAAM,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAUtD;;;;OAIG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IActF,4FAA4F;IACtF,KAAK,CACT,OAAO,EAAE,gBAAgB,EACzB,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,GACrC,OAAO,CAAC,sBAAsB,CAAC;CAKnC;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IAAE,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG,sBAAsB,CAoB9F;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,sBAAsB,CAmBhF;AAID;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IACxC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B,GAAG,CAAC,OAAO,EAAE,gBAAgB,KAAK,sBAAsB,CAexD"}

package/dist/console.js

@@ -0,0 +1,183 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { createHash, timingSafeEqual } from 'node:crypto';
+import { AUTHORIZATION_MODULE_OPTIONS, defaultGetUser, } from '@nestjs/authorization';
+import { Inject, Injectable, Logger, Optional, } from '@nestjs/common';
+import { AbilityNotResolvedException } from './errors/exceptions.js';
+import { Gate } from './gate.js';
+import { PermissionPolicy } from './policies/permission.policy.js';
+import { RolePolicy } from './policies/role.policy.js';
+import { AuthzRbac } from './rbac.js';
+/**
+ * The token Aviary consoles resolve `authorize: '<gate name>'` through. `AuthzModule`
+ * provides it globally.
+ */
+export const CONSOLE_GATE = Symbol.for('@dudousxd/aviary:console-gate');
+/** A fresh denial per call, so no caller can mutate a shared result. */
+const unauthenticated = () => ({
+    allowed: false,
+    reason: 'unauthenticated',
+});
+/**
+ * Answers console checks with the `Gate`, for the user the authorization guard sees:
+ * the official `getUser` (by default `request.user`), else the `Gate`'s ambient user
+ * (`@nestjs/authentication`'s `AuthenticationContext`, else nestjs-context's user ref).
+ */
+let AuthzConsoleGate = class AuthzConsoleGate {
+    gate;
+    rbac;
+    official;
+    logger = new Logger('AuthzConsoleGate');
+    constructor(gate, rbac, official) {
+        this.gate = gate;
+        this.rbac = rbac;
+        this.official = official;
+    }
+    /** The user of this call, or `null` for a guest. */
+    async userOf(context) {
+        const getUser = this.official?.getUser ?? defaultGetUser;
+        const user = await getUser(context);
+        // The official contract: only `undefined` means "not answered here, look further".
+        // `null` (and Passport's `false`) is an answer: a guest, never promoted to the ambient user.
+        if (user === null || user === false)
+            return null;
+        if (user !== undefined)
+            return user;
+        return (await this.rbac.currentUser()) ?? null;
+    }
+    /**
+     * `gate.forUser(user).allows(name)`; a denied guest is `unauthenticated`. A name the `Gate`
+     * cannot resolve denies (fail-closed) and logs a warning, so a typo'd gate name shows up in
+     * the logs instead of becoming a 500.
+     */
+    async allows(name, context) {
+        return this.check(context, async (user) => {
+            try {
+                return await this.gate.forUser(user).allows(name);
+            }
+            catch (error) {
+                if (!(error instanceof AbilityNotResolvedException))
+                    throw error;
+                this.logger.warn(`console authorize: gate "${name}" resolves to nothing (no \`gate.define('${name}', …)\`, policy or permission); denying.`);
+                return false;
+            }
+        });
+    }
+    /** @internal Runs `test` for the call's user and turns the answer into a console result. */
+    async check(context, test) {
+        const user = await this.userOf(context);
+        if (await test(user))
+            return true;
+        return user === null ? unauthenticated() : false;
+    }
+};
+AuthzConsoleGate = __decorate([
+    Injectable(),
+    __param(2, Optional()),
+    __param(2, Inject(AUTHORIZATION_MODULE_OPTIONS)),
+    __metadata("design:paramtypes", [Gate,
+        AuthzRbac, Object])
+], AuthzConsoleGate);
+export { AuthzConsoleGate };
+/**
+ * Allows a console to a user holding any of `roles` (persisted or on the user object, the
+ * same check as `@Roles()`; `superAdmin` applies). A guest is `unauthenticated`, a user
+ * without the role `forbidden`.
+ *
+ * ```ts
+ * DurableModule.forRoot({ authorize: authorizeByRoles({ roles: ['admin'] }) })
+ * ```
+ */
+export function authorizeByRoles(options) {
+    const roles = [...(options?.roles ?? [])];
+    if (roles.length === 0) {
+        throw new Error('authorizeByRoles: `roles` must name at least one role.');
+    }
+    let AuthorizeByRoles = class AuthorizeByRoles {
+        gate;
+        consoleGate;
+        constructor(gate, consoleGate) {
+            this.gate = gate;
+            this.consoleGate = consoleGate;
+        }
+        authorize(context) {
+            return this.consoleGate.check(context, (user) => this.gate.forUser(user).allows(RolePolicy, 'has', ...roles));
+        }
+    };
+    AuthorizeByRoles = __decorate([
+        Injectable(),
+        __param(0, Inject(Gate)),
+        __param(1, Inject(AuthzConsoleGate)),
+        __metadata("design:paramtypes", [Gate,
+            AuthzConsoleGate])
+    ], AuthorizeByRoles);
+    return AuthorizeByRoles;
+}
+/**
+ * Allows a console to a user granted `permission` (persisted, through roles or directly,
+ * wildcards apply; the same check as `@Permission()`; `superAdmin` applies).
+ * A guest is `unauthenticated`, a user without it `forbidden`.
+ *
+ * ```ts
+ * TelescopeModule.forRoot({ authorize: authorizeByPermission('telescope.view') })
+ * ```
+ */
+export function authorizeByPermission(permission) {
+    if (typeof permission !== 'string' || permission === '') {
+        throw new Error('authorizeByPermission: `permission` must be a non-empty string.');
+    }
+    let AuthorizeByPermission = class AuthorizeByPermission {
+        gate;
+        consoleGate;
+        constructor(gate, consoleGate) {
+            this.gate = gate;
+            this.consoleGate = consoleGate;
+        }
+        authorize(context) {
+            return this.consoleGate.check(context, (user) => this.gate.forUser(user).allows(PermissionPolicy, 'has', permission));
+        }
+    };
+    AuthorizeByPermission = __decorate([
+        Injectable(),
+        __param(0, Inject(Gate)),
+        __param(1, Inject(AuthzConsoleGate)),
+        __metadata("design:paramtypes", [Gate,
+            AuthzConsoleGate])
+    ], AuthorizeByPermission);
+    return AuthorizeByPermission;
+}
+const sha256 = (value) => createHash('sha256').update(value).digest();
+/**
+ * Allows a console to calls sending `Authorization: Bearer <token>` (compared in constant
+ * time). Anything else is `unauthenticated`. Throws when `token` is empty.
+ *
+ * ```ts
+ * authorize: authorizeByToken({ token: process.env.CONSOLE_TOKEN })
+ * ```
+ */
+export function authorizeByToken(options) {
+    const token = options?.token;
+    if (typeof token !== 'string' || token === '') {
+        throw new Error('authorizeByToken: `token` is empty. Set it (for example from an env var).');
+    }
+    const expected = sha256(token);
+    return (context) => {
+        const header = context.switchToHttp().getRequest()?.headers?.authorization;
+        const value = Array.isArray(header) ? header[0] : header;
+        const match = typeof value === 'string' ? /^Bearer\s+(.+)$/i.exec(value.trim()) : null;
+        if (!match?.[1])
+            return unauthenticated();
+        return timingSafeEqual(sha256(match[1]), expected) ? true : unauthenticated();
+    };
+}
+//# sourceMappingURL=console.js.map

package/dist/console.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"console.js","sourceRoot":"","sources":["../src/console.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EACL,4BAA4B,EAE5B,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,MAAM,EACN,UAAU,EACV,MAAM,EACN,QAAQ,GAET,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAgCtC;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;AAExE,wEAAwE;AACxE,MAAM,eAAe,GAAG,GAA2B,EAAE,CAAC,CAAC;IACrD,OAAO,EAAE,KAAK;IACd,MAAM,EAAE,iBAAiB;CAC1B,CAAC,CAAC;AAEH;;;;GAIG;AAEI,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAIR;IACA;IAGA;IAPF,MAAM,GAAG,IAAI,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAEzD,YACmB,IAAU,EACV,IAAe,EAGf,QAAqC;QAJrC,SAAI,GAAJ,IAAI,CAAM;QACV,SAAI,GAAJ,IAAI,CAAW;QAGf,aAAQ,GAAR,QAAQ,CAA6B;IACrD,CAAC;IAEJ,oDAAoD;IACpD,KAAK,CAAC,MAAM,CAAC,OAAyB;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI,cAAc,CAAC;QACzD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QACpC,mFAAmF;QACnF,6FAA6F;QAC7F,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QACjD,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACpC,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,IAAI,CAAC;IACjD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,OAAyB;QAClD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACxC,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,CAAC,KAAK,YAAY,2BAA2B,CAAC;oBAAE,MAAM,KAAK,CAAC;gBACjE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,4BAA4B,IAAI,4CAA4C,IAAI,0CAA0C,CAC3H,CAAC;gBACF,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,KAAK,CACT,OAAyB,EACzB,IAAsC;QAEtC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAClC,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACnD,CAAC;CACF,CAAA;AAlDY,gBAAgB;IAD5B,UAAU,EAAE;IAOR,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,MAAM,CAAC,4BAA4B,CAAC,CAAA;qCAHd,IAAI;QACJ,SAAS;GALvB,gBAAgB,CAkD5B;;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAqC;IACpE,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IAED,IACM,gBAAgB,GADtB,MACM,gBAAgB;QAEa;QACY;QAF7C,YACiC,IAAU,EACE,WAA6B;YADzC,SAAI,GAAJ,IAAI,CAAM;YACE,gBAAW,GAAX,WAAW,CAAkB;QACvE,CAAC;QAEJ,SAAS,CAAC,OAAyB;YACjC,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAC9C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,CAC5D,CAAC;QACJ,CAAC;KACF,CAAA;IAXK,gBAAgB;QADrB,UAAU,EAAE;QAGR,WAAA,MAAM,CAAC,IAAI,CAAC,CAAA;QACZ,WAAA,MAAM,CAAC,gBAAgB,CAAC,CAAA;yCADY,IAAI;YACe,gBAAgB;OAHtE,gBAAgB,CAWrB;IACD,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAkB;IACtD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IAED,IACM,qBAAqB,GAD3B,MACM,qBAAqB;QAEQ;QACY;QAF7C,YACiC,IAAU,EACE,WAA6B;YADzC,SAAI,GAAJ,IAAI,CAAM;YACE,gBAAW,GAAX,WAAW,CAAkB;QACvE,CAAC;QAEJ,SAAS,CAAC,OAAyB;YACjC,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAC9C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,gBAAgB,EAAE,KAAK,EAAE,UAAU,CAAC,CACpE,CAAC;QACJ,CAAC;KACF,CAAA;IAXK,qBAAqB;QAD1B,UAAU,EAAE;QAGR,WAAA,MAAM,CAAC,IAAI,CAAC,CAAA;QACZ,WAAA,MAAM,CAAC,gBAAgB,CAAC,CAAA;yCADY,IAAI;YACe,gBAAgB;OAHtE,qBAAqB,CAW1B;IACD,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;AAEtF;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAEhC;IACC,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO,CAAC,OAAO,EAAE,EAAE;QACjB,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAE5C,EAAE,OAAO,EAAE,aAAa,CAAC;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACzD,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACvF,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,eAAe,EAAE,CAAC;QAC1C,OAAO,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;IAChF,CAAC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export declare const VERSION = "0.9.2";
+export declare const VERSION = "0.11.0";
 export { AuthzModule } from './module.js';
 export { AuthzGuard } from './authz.guard.js';
 export { Gate, BoundGate } from './gate.js';
@@ -24,6 +24,8 @@ export type { DecisionProvider, DecisionRequest, DecisionVerdict, } from './deci
 export { authzDecisionChannel, publishAuthzDecision } from './diagnostics.js';
 export type { AuthzDecisionDiagnostic, AuthzDecisionReason, AuthzDecisionSource, } from './diagnostics.js';
 export { AuthzDecisionPublisher } from './decisions.js';
+export { AuthzConsoleGate, CONSOLE_GATE, authorizeByPermission, authorizeByRoles, authorizeByToken, } from './console.js';
+export type { ConsoleAuthorize, ConsoleAuthorizeResult, ConsoleAuthorizer, ConsoleAuthorizerClass, ConsolePolicyCheck, } from './console.js';
 export { createCanController, DEFAULT_CAN_ENDPOINT_PATH } from './can-endpoint.controller.js';
 export type { CanRequestBody, CanResponseBody, CanBatchRequestBody, CanBatchResultItem, } from './can-endpoint.controller.js';
 export { IdParamResourceResolver } from './resource-resolver.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,OAAO,UAAU,CAAC;AAK/B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC5C,YAAY,EACV,aAAa,EACb,YAAY,EACZ,SAAS,EACT,gBAAgB,EAChB,WAAW,GACZ,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,UAAU,GACX,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,IAAI,EACJ,KAAK,EACL,UAAU,EACV,WAAW,EACX,OAAO,EACP,kBAAkB,GACnB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAGnE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC1F,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,YAAY,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvD,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,4BAA4B,EAC5B,wBAAwB,EACxB,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,YAAY,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC9E,YAAY,EACV,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAGxD,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAC9F,YAAY,EACV,cAAc,EACd,eAAe,EACf,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACrF,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAGpF,OAAO,EACL,GAAG,EACH,EAAE,EACF,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,EAAE,EACF,QAAQ,EACR,SAAS,EACT,KAAK,GACN,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,QAAQ,EACR,cAAc,EACd,eAAe,EACf,UAAU,EACV,WAAW,EACX,SAAS,EACT,SAAS,EACT,aAAa,EACb,WAAW,GACZ,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,cAAc,EACd,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,kBAAkB,EAClB,uBAAuB,EACvB,yBAAyB,EACzB,wBAAwB,EACxB,iBAAiB,EACjB,MAAM,EACN,cAAc,EACd,YAAY,EACZ,QAAQ,EACR,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,IAAI,GACL,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,OAAO,WAAW,CAAC;AAKhC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC5C,YAAY,EACV,aAAa,EACb,YAAY,EACZ,SAAS,EACT,gBAAgB,EAChB,WAAW,GACZ,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,UAAU,GACX,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,IAAI,EACJ,KAAK,EACL,UAAU,EACV,WAAW,EACX,OAAO,EACP,kBAAkB,GACnB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAGnE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC1F,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,YAAY,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvD,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,4BAA4B,EAC5B,wBAAwB,EACxB,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,YAAY,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC9E,YAAY,EACV,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAGxD,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,gBAAgB,EAChB,sBAAsB,EACtB,iBAAiB,EACjB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAC9F,YAAY,EACV,cAAc,EACd,eAAe,EACf,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,YAAY,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACrF,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAGpF,OAAO,EACL,GAAG,EACH,EAAE,EACF,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,EAAE,EACF,QAAQ,EACR,SAAS,EACT,KAAK,GACN,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,QAAQ,EACR,cAAc,EACd,eAAe,EACf,UAAU,EACV,WAAW,EACX,SAAS,EACT,SAAS,EACT,aAAa,EACb,WAAW,GACZ,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,cAAc,EACd,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,kBAAkB,EAClB,uBAAuB,EACvB,yBAAyB,EACzB,wBAAwB,EACxB,iBAAiB,EACjB,MAAM,EACN,cAAc,EACd,YAAY,EACZ,QAAQ,EACR,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,IAAI,GACL,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,7 +1,7 @@
 // Rewritten from this package's package.json by `scripts/sync-version.mjs`, which the root
 // `version-packages` script runs right after `changeset version`. The build is plain `tsc`
 // and injects nothing, so the literal below is what ships in dist.
-export const VERSION = '0.9.2';
+export const VERSION = '0.11.0';
 // Extras on top of @nestjs/authorization. Its own API (@Policy, @Can, Can.Anyone,
 // AuthorizationModule, AuthorizationService, AuthorizationGuard) is imported from there.
 export { AuthzModule } from './module.js';
@@ -29,6 +29,8 @@ export { normalizeVerdict } from './decision-provider.js';
 // Decisions
 export { authzDecisionChannel, publishAuthzDecision } from './diagnostics.js';
 export { AuthzDecisionPublisher } from './decisions.js';
+// Aviary console access (`authorize` on the durable/telescope/media/agent consoles)
+export { AuthzConsoleGate, CONSOLE_GATE, authorizeByPermission, authorizeByRoles, authorizeByToken, } from './console.js';
 // Client endpoint
 export { createCanController, DEFAULT_CAN_ENDPOINT_PATH } from './can-endpoint.controller.js';
 export { IdParamResourceResolver } from './resource-resolver.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,2FAA2F;AAC3F,mEAAmE;AACnE,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,kFAAkF;AAClF,yFAAyF;AAEzF,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,kEAAkE;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAS5C,mDAAmD;AACnD,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,UAAU,GACX,MAAM,qBAAqB,CAAC;AAE7B,kCAAkC;AAClC,OAAO,EACL,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,IAAI,EACJ,KAAK,EACL,UAAU,EACV,WAAW,EACX,OAAO,EACP,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAEnE,yBAAyB;AACzB,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC1F,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhD,gCAAgC;AAChC,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,4BAA4B,EAC5B,wBAAwB,EACxB,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,aAAa;AACb,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,4EAA4E;AAC5E,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAO1D,YAAY;AACZ,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAM9E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAExD,kBAAkB;AAClB,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAQ9F,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAIjE,gBAAgB;AAChB,OAAO,EACL,GAAG,EACH,EAAE,EACF,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,EAAE,EACF,QAAQ,EACR,SAAS,EACT,KAAK,GACN,MAAM,YAAY,CAAC;AAapB,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,cAAc,EACd,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,2FAA2F;AAC3F,mEAAmE;AACnE,MAAM,CAAC,MAAM,OAAO,GAAG,QAAQ,CAAC;AAEhC,kFAAkF;AAClF,yFAAyF;AAEzF,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,kEAAkE;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAS5C,mDAAmD;AACnD,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,UAAU,GACX,MAAM,qBAAqB,CAAC;AAE7B,kCAAkC;AAClC,OAAO,EACL,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,IAAI,EACJ,KAAK,EACL,UAAU,EACV,WAAW,EACX,OAAO,EACP,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAEnE,yBAAyB;AACzB,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC1F,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGhD,gCAAgC;AAChC,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,4BAA4B,EAC5B,wBAAwB,EACxB,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,aAAa;AACb,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,4EAA4E;AAC5E,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAO1D,YAAY;AACZ,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAM9E,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAExD,oFAAoF;AACpF,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,cAAc,CAAC;AAStB,kBAAkB;AAClB,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAQ9F,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAIjE,gBAAgB;AAChB,OAAO,EACL,GAAG,EACH,EAAE,EACF,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,EAAE,EACF,QAAQ,EACR,SAAS,EACT,KAAK,GACN,MAAM,YAAY,CAAC;AAapB,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,cAAc,EACd,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC"}

package/dist/module.d.ts

@@ -11,7 +11,8 @@ import type { AuthzModuleAsyncOptions, AuthzModuleOptions } from './types.js';
  * ```
  *
  * Registers `RolePolicy`, `PermissionPolicy` and `GatePolicy` (official policies), the
- * `Gate`, the resource resolver `byId()` uses, and the allow+deny decision event.
+ * `Gate`, the resource resolver `byId()` uses, the allow+deny decision event, and the
+ * console gate Aviary consoles resolve `authorize: '<gate name>'` through.
  * It needs the official module to be global (its default).
  */
 export declare class AuthzModule {

package/dist/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,KAAK,aAAa,EAQnB,MAAM,gBAAgB,CAAC;AAexB,OAAO,KAAK,EACV,uBAAuB,EACvB,kBAAkB,EAInB,MAAM,YAAY,CAAC;AAwDpB;;;;;;;;;;;;;GAaG;AACH,qBACa,WAAW;IACtB,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,kBAAuB,GAAG,aAAa;IAe/D,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,uBAAuB,GAAG,aAAa;IAepE,OAAO,CAAC,MAAM,CAAC,MAAM;IA2BrB;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,MAAM;IAWrB;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,WAAW;IAa1B,OAAO,CAAC,MAAM,CAAC,qBAAqB;CAsBrC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,KAAK,aAAa,EAQnB,MAAM,gBAAgB,CAAC;AAgBxB,OAAO,KAAK,EACV,uBAAuB,EACvB,kBAAkB,EAInB,MAAM,YAAY,CAAC;AA0DpB;;;;;;;;;;;;;;GAcG;AACH,qBACa,WAAW;IACtB,MAAM,CAAC,OAAO,CAAC,OAAO,GAAE,kBAAuB,GAAG,aAAa;IAe/D,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,uBAAuB,GAAG,aAAa;IAepE,OAAO,CAAC,MAAM,CAAC,MAAM;IA8BrB;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,MAAM;IAWrB;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,WAAW;IAa1B,OAAO,CAAC,MAAM,CAAC,qBAAqB;CAsBrC"}

package/dist/module.js

@@ -16,6 +16,7 @@ import { Inject, Injectable, Module, Optional, } from '@nestjs/common';
 import { APP_GUARD, APP_INTERCEPTOR, DiscoveryModule } from '@nestjs/core';
 import { AuthzGuard, AuthzGuardStartupCheck } from './authz.guard.js';
 import { DEFAULT_CAN_ENDPOINT_PATH, createCanController } from './can-endpoint.controller.js';
+import { AuthzConsoleGate, CONSOLE_GATE } from './console.js';
 import { AuthzDecisionPublisher } from './decisions.js';
 import { Gate } from './gate.js';
 import { OFFICIAL_CAN_ANYONE_METADATA } from './official.js';
@@ -83,6 +84,8 @@ const EXPORTS = [
     AUTHZ_MODULE_OPTIONS,
     RESOURCE_RESOLVER,
     RESOURCE_HYDRATOR,
+    AuthzConsoleGate,
+    CONSOLE_GATE,
 ];
 /**
  * The extras on top of `@nestjs/authorization`. Import it next to the official module:
@@ -95,7 +98,8 @@ const EXPORTS = [
  * ```
  *
  * Registers `RolePolicy`, `PermissionPolicy` and `GatePolicy` (official policies), the
- * `Gate`, the resource resolver `byId()` uses, and the allow+deny decision event.
+ * `Gate`, the resource resolver `byId()` uses, the allow+deny decision event, and the
+ * console gate Aviary consoles resolve `authorize: '<gate name>'` through.
  * It needs the official module to be global (its default).
  */
 let AuthzModule = AuthzModule_1 = class AuthzModule {
@@ -135,6 +139,9 @@ let AuthzModule = AuthzModule_1 = class AuthzModule {
             RolePolicy,
             PermissionPolicy,
             GatePolicy,
+            AuthzConsoleGate,
+            // Aviary consoles resolve `authorize: '<gate name>'` through this token.
+            { provide: CONSOLE_GATE, useExisting: AuthzConsoleGate },
             {
                 provide: RESOURCE_RESOLVER,
                 useFactory: (options) => options?.resourceResolver ?? new IdParamResourceResolver(options?.idParam),

package/dist/module.js.map

@@ -1 +1 @@
-{"version":3,"file":"module.js","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EACL,4BAA4B,EAE5B,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,MAAM,EACN,UAAU,EACV,MAAM,EAEN,QAAQ,GAGT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAC9F,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,uBAAuB,EAAyB,MAAM,wBAAwB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AASzF;;;;GAIG;AACH,IACM,qBAAqB,GAD3B,MACM,qBAAqB;IAEqB;IAC3B;IAC0C;IAG1C;IANnB,YAC8C,QAA0B,EACrD,IAAe,EAC2B,OAA4B,EAGtE,QAAqC;QALV,aAAQ,GAAR,QAAQ,CAAkB;QACrD,SAAI,GAAJ,IAAI,CAAW;QAC2B,YAAO,GAAP,OAAO,CAAqB;QAGtE,aAAQ,GAAR,QAAQ,CAA6B;IACrD,CAAC;IAEJ,YAAY;QACV,qBAAqB,CAAC;YACpB,gBAAgB,EAAE,IAAI,CAAC,QAAQ;YAC/B,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU;YACpC,gBAAgB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAC7C,+EAA+E;YAC/E,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI,cAAc;SAClD,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAnBK,qBAAqB;IAD1B,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,iBAAiB,CAAC,CAAA;IAEzB,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,oBAAoB,CAAC,CAAA;IACxC,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,MAAM,CAAC,4BAA4B,CAAC,CAAA;6CAHd,SAAS;GAH9B,qBAAqB,CAmB1B;AAED,+FAA+F;AAC/F,MAAM,cAAc,GAAG,CAAC,aAAa,EAAE,YAAY,CAAU,CAAC;AAE9D,SAAS,mBAAmB,CAAC,OAA2B;IACtD,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,IAAI,OAAO,EAAE,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,kBAAkB,GAAG,yKAAyK,CAC/L,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,OAAO,GAAG;IACd,IAAI;IACJ,UAAU;IACV,WAAW;IACX,SAAS;IACT,UAAU;IACV,gBAAgB;IAChB,UAAU;IACV,oBAAoB;IACpB,iBAAiB;IACjB,iBAAiB;CAClB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AAEI,IAAM,WAAW,mBAAjB,MAAM,WAAW;IACtB,MAAM,CAAC,OAAO,CAAC,UAA8B,EAAE;QAC7C,OAAO;YACL,MAAM,EAAE,aAAW;YACnB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,eAAe,CAAC;YAC1B,WAAW,EAAE,aAAW,CAAC,WAAW,CAAC,OAAO,CAAC;YAC7C,SAAS,EAAE;gBACT,EAAE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,OAAO,EAAE;gBACpD,GAAG,aAAW,CAAC,MAAM,EAAE;gBACvB,GAAG,aAAW,CAAC,MAAM,CAAC,OAAO,CAAC;aAC/B;YACD,OAAO,EAAE,OAAO;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,OAAgC;QAClD,OAAO;YACL,MAAM,EAAE,aAAW;YACnB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,eAAe,EAAE,GAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAqB,CAAC;YAC3E,WAAW,EAAE,aAAW,CAAC,WAAW,CAAC,OAAO,CAAC;YAC7C,SAAS,EAAE;gBACT,GAAG,aAAW,CAAC,qBAAqB,CAAC,OAAO,CAAC;gBAC7C,GAAG,aAAW,CAAC,MAAM,EAAE;gBACvB,GAAG,aAAW,CAAC,MAAM,CAAC,OAAO,CAAC;aAC/B;YACD,OAAO,EAAE,OAAO;SACjB,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,MAAM;QACnB,OAAO;YACL,WAAW;YACX,SAAS;YACT,IAAI;YACJ,UAAU;YACV,gBAAgB;YAChB,UAAU;YACV;gBACE,OAAO,EAAE,iBAAiB;gBAC1B,UAAU,EAAE,CAAC,OAA4B,EAAoB,EAAE,CAC7D,OAAO,EAAE,gBAAgB,IAAI,IAAI,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC;gBAC5E,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;aAC1D;YACD;gBACE,OAAO,EAAE,iBAAiB;gBAC1B,UAAU,EAAE,CAAC,OAA4B,EAAiC,EAAE,CAC1E,OAAO,EAAE,eAAe;gBAC1B,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;aAC1D;YACD,UAAU;YACV,qBAAqB;YACrB,sBAAsB;YACtB,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,sBAAsB,EAAE;SAClE,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,MAAM,CAAC,OAAiC;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC;QAC3C,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,+DAA+D,MAAM,CAAC,IAAI,CAAC,GAAG,CAC/E,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,EAAE,CAAC;QAC/B,OAAO,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;IACnF,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,WAAW,CAAC,OAAiC;QAC1D,MAAM,EAAE,WAAW,EAAE,UAAU,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC;QACjD,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,yBAAyB,CAAC;QACvF,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC7C,OAAO,CAAC,cAAc,CAAC,4BAA4B,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QACvE,kFAAkF;QAClF,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACjD,QAAQ,CAAC,UAAU,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,CAAC,UAAU,CAAC,CAAC;IACtB,CAAC;IAEO,MAAM,CAAC,qBAAqB,CAAC,OAAgC;QACnE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAC/B,IAAI,UAAU,EAAE,CAAC;YACf,OAAO;gBACL;oBACE,OAAO,EAAE,oBAAoB;oBAC7B,UAAU,EAAE,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;oBACxF,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAyB;iBACvD;aACF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAoC,CAAC;QAC7F,OAAO;YACL,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF;gBACE,OAAO,EAAE,oBAAoB;gBAC7B,UAAU,EAAE,KAAK,EAAE,CAA4B,EAAE,EAAE,CACjD,mBAAmB,CAAC,MAAM,CAAC,CAAC,kBAAkB,EAAE,CAAC;gBACnD,MAAM,EAAE,CAAC,OAAO,CAAC;aAClB;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AAjHY,WAAW;IADvB,MAAM,CAAC,EAAE,CAAC;GACE,WAAW,CAiHvB"}
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,OAAO,EACL,4BAA4B,EAE5B,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,MAAM,EACN,UAAU,EACV,MAAM,EAEN,QAAQ,GAGT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAC9F,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,uBAAuB,EAAyB,MAAM,wBAAwB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AASzF;;;;GAIG;AACH,IACM,qBAAqB,GAD3B,MACM,qBAAqB;IAEqB;IAC3B;IAC0C;IAG1C;IANnB,YAC8C,QAA0B,EACrD,IAAe,EAC2B,OAA4B,EAGtE,QAAqC;QALV,aAAQ,GAAR,QAAQ,CAAkB;QACrD,SAAI,GAAJ,IAAI,CAAW;QAC2B,YAAO,GAAP,OAAO,CAAqB;QAGtE,aAAQ,GAAR,QAAQ,CAA6B;IACrD,CAAC;IAEJ,YAAY;QACV,qBAAqB,CAAC;YACpB,gBAAgB,EAAE,IAAI,CAAC,QAAQ;YAC/B,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU;YACpC,gBAAgB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAC7C,+EAA+E;YAC/E,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI,cAAc;SAClD,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAnBK,qBAAqB;IAD1B,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,iBAAiB,CAAC,CAAA;IAEzB,WAAA,QAAQ,EAAE,CAAA;IAAE,WAAA,MAAM,CAAC,oBAAoB,CAAC,CAAA;IACxC,WAAA,QAAQ,EAAE,CAAA;IACV,WAAA,MAAM,CAAC,4BAA4B,CAAC,CAAA;6CAHd,SAAS;GAH9B,qBAAqB,CAmB1B;AAED,+FAA+F;AAC/F,MAAM,cAAc,GAAG,CAAC,aAAa,EAAE,YAAY,CAAU,CAAC;AAE9D,SAAS,mBAAmB,CAAC,OAA2B;IACtD,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,IAAI,OAAO,EAAE,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,kBAAkB,GAAG,yKAAyK,CAC/L,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,OAAO,GAAG;IACd,IAAI;IACJ,UAAU;IACV,WAAW;IACX,SAAS;IACT,UAAU;IACV,gBAAgB;IAChB,UAAU;IACV,oBAAoB;IACpB,iBAAiB;IACjB,iBAAiB;IACjB,gBAAgB;IAChB,YAAY;CACb,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AAEI,IAAM,WAAW,mBAAjB,MAAM,WAAW;IACtB,MAAM,CAAC,OAAO,CAAC,UAA8B,EAAE;QAC7C,OAAO;YACL,MAAM,EAAE,aAAW;YACnB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,eAAe,CAAC;YAC1B,WAAW,EAAE,aAAW,CAAC,WAAW,CAAC,OAAO,CAAC;YAC7C,SAAS,EAAE;gBACT,EAAE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,OAAO,EAAE;gBACpD,GAAG,aAAW,CAAC,MAAM,EAAE;gBACvB,GAAG,aAAW,CAAC,MAAM,CAAC,OAAO,CAAC;aAC/B;YACD,OAAO,EAAE,OAAO;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,OAAgC;QAClD,OAAO;YACL,MAAM,EAAE,aAAW;YACnB,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,eAAe,EAAE,GAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAqB,CAAC;YAC3E,WAAW,EAAE,aAAW,CAAC,WAAW,CAAC,OAAO,CAAC;YAC7C,SAAS,EAAE;gBACT,GAAG,aAAW,CAAC,qBAAqB,CAAC,OAAO,CAAC;gBAC7C,GAAG,aAAW,CAAC,MAAM,EAAE;gBACvB,GAAG,aAAW,CAAC,MAAM,CAAC,OAAO,CAAC;aAC/B;YACD,OAAO,EAAE,OAAO;SACjB,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,MAAM;QACnB,OAAO;YACL,WAAW;YACX,SAAS;YACT,IAAI;YACJ,UAAU;YACV,gBAAgB;YAChB,UAAU;YACV,gBAAgB;YAChB,yEAAyE;YACzE,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE;YACxD;gBACE,OAAO,EAAE,iBAAiB;gBAC1B,UAAU,EAAE,CAAC,OAA4B,EAAoB,EAAE,CAC7D,OAAO,EAAE,gBAAgB,IAAI,IAAI,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC;gBAC5E,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;aAC1D;YACD;gBACE,OAAO,EAAE,iBAAiB;gBAC1B,UAAU,EAAE,CAAC,OAA4B,EAAiC,EAAE,CAC1E,OAAO,EAAE,eAAe;gBAC1B,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;aAC1D;YACD,UAAU;YACV,qBAAqB;YACrB,sBAAsB;YACtB,EAAE,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,sBAAsB,EAAE;SAClE,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,MAAM,CAAC,OAAiC;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,IAAI,MAAM,CAAC;QAC3C,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,+DAA+D,MAAM,CAAC,IAAI,CAAC,GAAG,CAC/E,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,EAAE,CAAC;QAC/B,OAAO,CAAC,sBAAsB,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;IACnF,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,WAAW,CAAC,OAAiC;QAC1D,MAAM,EAAE,WAAW,EAAE,UAAU,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC;QACjD,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,yBAAyB,CAAC;QACvF,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC7C,OAAO,CAAC,cAAc,CAAC,4BAA4B,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QACvE,kFAAkF;QAClF,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACjD,QAAQ,CAAC,UAAU,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,CAAC,UAAU,CAAC,CAAC;IACtB,CAAC;IAEO,MAAM,CAAC,qBAAqB,CAAC,OAAgC;QACnE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAC/B,IAAI,UAAU,EAAE,CAAC;YACf,OAAO;gBACL;oBACE,OAAO,EAAE,oBAAoB;oBAC7B,UAAU,EAAE,KAAK,EAAE,GAAG,IAAe,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;oBACxF,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAyB;iBACvD;aACF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAoC,CAAC;QAC7F,OAAO;YACL,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF;gBACE,OAAO,EAAE,oBAAoB;gBAC7B,UAAU,EAAE,KAAK,EAAE,CAA4B,EAAE,EAAE,CACjD,mBAAmB,CAAC,MAAM,CAAC,CAAC,kBAAkB,EAAE,CAAC;gBACnD,MAAM,EAAE,CAAC,OAAO,CAAC;aAClB;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AApHY,WAAW;IADvB,MAAM,CAAC,EAAE,CAAC;GACE,WAAW,CAoHvB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dudousxd/nestjs-authz",
-  "version": "0.9.2",
+  "version": "0.11.0",
   "description": "Extras on top of @nestjs/authorization: persisted RBAC policies, @Can helpers (byId, roles, permission), a Gate with batch checks and ad-hoc gates, super-admin, query scoping.",
   "license": "MIT",
   "repository": {
@@ -81,7 +81,7 @@
     "@nestjs/testing": "12.0.1",
     "@tanstack/intent": "0.4.0",
     "@types/express": "4.17.25",
-    "@types/node": "22.20.5",
+    "@types/node": "24.19.2",
     "@types/supertest": "6.0.3",
     "express": "4.22.2",
     "reflect-metadata": "0.2.2",
@@ -91,7 +91,7 @@
     "vitest": "3.2.7"
   },
   "engines": {
-    "node": ">=22"
+    "node": ">=24"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json --incremental false",

package/skills/authz-rbac-seams/SKILL.md

@@ -85,6 +85,16 @@ with its links and assignments, `listRoleAssignments({ tenantId?, role?, user?,
 raw `{ userType, userId, role, source, tenantId }` rows (`tenantId: null` = global only, a string =
 that tenant's scoped rows only), and `removeUser(user)` drops all of a user's assignments.
 
+Tenant scope: role assignments can be global or per tenant (`assignRole(user, role, { tenantId })`;
+MikroORM needs `createAuthzEntitySchemas({}, { tenantScoped: true })`, Prisma a `tenantId` column
+plus `tenantScoped: true`). Each `AuthzRbacModule` picks the tenant of a check: its `tenant`
+resolver (`(user) => id | null | undefined`) first; then, with tenancy on (`tenancy: 'inherit'`
+follows `ContextModule.forRoot({ tenancy: { enabled: true } })`; `false` opts out), the context
+tenant from `Context.setTenant`; with tenancy off, TypeORM/Drizzle read `Context.tenantId()` and
+MikroORM/Prisma check global assignments only. `tenancy: { roles: { owner: 'org_admin' } }` maps
+the caller's `tenant.role` to authz roles in that tenant only (context user only). No tenant,
+`allTenants` or no request = global assignments only.
+
 ## Core patterns
 
 ### A hand-rolled PermissionProvider

package/skills/authz-setup/SKILL.md

@@ -28,7 +28,7 @@ frontend glue. It never authenticates.
 pnpm add @nestjs/authorization @dudousxd/nestjs-authz
 ```
 
-NestJS 12, Node 22+. Peers: `@nestjs/common`, `@nestjs/core`, `@nestjs/authorization`,
+NestJS 12, Node 24+. Peers: `@nestjs/common`, `@nestjs/core`, `@nestjs/authorization`,
 `reflect-metadata`, `rxjs`; optional `@nestjs/authentication` and `@dudousxd/nestjs-context`.
 
 ```ts