@elsikora/nestjs-crud-automator 4.1.0 → 4.2.0-dev.1

package/README.md

@@ -976,6 +976,16 @@ Custom `@ApiMethod(...)` actions pass through unchanged after the namespace. For
 
 The runtime resolves a `principal`, dispatches to the selected mode, and stores a unified `authorizationDecision` on the request. Hooks mode traces matched rules and resolved permissions; IAM mode traces attachments, documents, statements, boundaries, and final decision type. For out-of-band checks, inject `ApiAuthorizationSimulator` and call `evaluate(...)` with the same controller authorization metadata you use at runtime.
 
+Custom handlers can inject that evaluated decision without accepting the raw request. The decorator returns the exact guard-attached object and fails closed with `403 Forbidden` when a securable route did not produce one:
+
+```typescript
+public async publish(
+	@ApiAuthorizationDecision<PostEntity>() authorizationDecision: IApiAuthorizationDecision<PostEntity>,
+): Promise<PostEntity> {
+	return await this.service.publish(authorizationDecision.principal.id);
+}
+```
+
 Important IAM details from the current implementation:
 
 - `resource.id` and `resource.operatorId` are safe planner-friendly paths for `GET` and `GET_LIST` when declared in `resourceDefinition.fields`

package/dist/cjs/decorator/api/authorization/decision.decorator.d.ts

@@ -0,0 +1,9 @@
+import { IApiBaseEntity } from '../../../interface/api-base-entity.interface';
+import { TApiAuthorizationRuleTransformPayload } from '../../../type/class/api/authorization/rule/transform-payload.type';
+/**
+ * Injects the authorization decision attached to the current HTTP request by the Automator authorization guard.
+ * @template E - Authorized entity type.
+ * @template R - Authorized route result payload type.
+ * @returns {ParameterDecorator} Parameter decorator that fails closed when the request has no authorization decision.
+ */
+export declare function ApiAuthorizationDecision<E extends IApiBaseEntity, R extends TApiAuthorizationRuleTransformPayload<E> = TApiAuthorizationRuleTransformPayload<E>>(): ParameterDecorator;

package/dist/cjs/decorator/api/authorization/decision.decorator.js

@@ -0,0 +1,26 @@
+'use strict';
+
+var common = require('@nestjs/common');
+var resolveFromRequest_utility = require('../../../utility/authorization/decision/resolve-from-request.utility.js');
+
+/**
+ * Injects the authorization decision attached to the current HTTP request by the Automator authorization guard.
+ * @template E - Authorized entity type.
+ * @template R - Authorized route result payload type.
+ * @returns {ParameterDecorator} Parameter decorator that fails closed when the request has no authorization decision.
+ */
+// Nest's ParameterDecorator cannot carry its factory output type, so these generics bind the factory contract used by each decorator application.
+// eslint-disable-next-line @elsikora/typescript/no-unnecessary-type-parameters
+function ApiAuthorizationDecision() {
+    return common.createParamDecorator((_data, context) => {
+        const request = context.switchToHttp().getRequest();
+        const decision = resolveFromRequest_utility.AuthorizationDecisionResolveFromRequest(request);
+        if (!decision) {
+            throw new common.ForbiddenException();
+        }
+        return decision;
+    })();
+}
+
+exports.ApiAuthorizationDecision = ApiAuthorizationDecision;
+//# sourceMappingURL=decision.decorator.js.map

package/dist/cjs/decorator/api/authorization/decision.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision.decorator.js","sources":["../../../../../../src/decorator/api/authorization/decision.decorator.ts"],"sourcesContent":[null],"names":["createParamDecorator","AuthorizationDecisionResolveFromRequest","ForbiddenException"],"mappings":";;;;;AASA;;;;;AAKG;AACH;AACA;SACgB,wBAAwB,GAAA;AACvC,IAAA,OAAOA,2BAAoB,CAA6C,CAAC,KAAgB,EAAE,OAAyB,KAAqC;QACxJ,MAAM,OAAO,GAA8B,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAA6B;AACzG,QAAA,MAAM,QAAQ,GAAgDC,kEAAuC,CAAO,OAAO,CAAC;QAEpH,IAAI,CAAC,QAAQ,EAAE;YACd,MAAM,IAAIC,yBAAkB,EAAE;QAC/B;AAEA,QAAA,OAAO,QAAQ;IAChB,CAAC,CAAC,EAAE;AACL;;;;"}

package/dist/cjs/decorator/api/index.d.ts

@@ -1,4 +1,5 @@
 export { ApiAuthorizationPolicy } from './authorization-policy.decorator';
+export { ApiAuthorizationDecision } from './authorization/decision.decorator';
 export * from './controller';
 export * from './function';
 export { ApiMethod } from './method.decorator';

package/dist/cjs/index.js

@@ -78,6 +78,7 @@ require('./constant/utility/api/get-default-string-format-properties/customizer-
 var constant = require('./constant/utility/dto/constant.js');
 var generate_constant = require('./constant/utility/dto/generate.constant.js');
 var authorizationPolicy_decorator = require('./decorator/api/authorization-policy.decorator.js');
+var decision_decorator = require('./decorator/api/authorization/decision.decorator.js');
 var decorator = require('./decorator/api/controller/decorator.js');
 var observable_decorator = require('./decorator/api/controller/observable.decorator.js');
 var securable_decorator = require('./decorator/api/controller/securable.decorator.js');
@@ -378,6 +379,7 @@ exports.GET_DEFAULT_STRING_FORMAT_PROPERTIES_API_UTILITY_CONSTANT = constant$1.G
 exports.DTO_UTILITY_CONSTANT = constant.DTO_UTILITY_CONSTANT;
 exports.DTO_GENERATE_CONSTANT = generate_constant.DTO_GENERATE_CONSTANT;
 exports.ApiAuthorizationPolicy = authorizationPolicy_decorator.ApiAuthorizationPolicy;
+exports.ApiAuthorizationDecision = decision_decorator.ApiAuthorizationDecision;
 exports.ApiController = decorator.ApiController;
 exports.ApiControllerObservable = observable_decorator.ApiControllerObservable;
 exports.ApiControllerSecurable = securable_decorator.ApiControllerSecurable;

package/dist/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/dist/cjs/interface/class/api/authorization/decision/interface.d.ts

@@ -5,7 +5,8 @@ import { IApiAuthorizationPrincipal } from '../principal/interface';
 import { IApiAuthorizationRule } from '../rule/interface';
 import { IApiAuthorizationScope } from '../scope.interface';
 import { TApiAuthorizationRuleResultTransform } from '../../../../../type/class/api/authorization/rule/result-transform.type';
-export interface IApiAuthorizationDecision<E extends IApiBaseEntity, R> {
+import { TApiAuthorizationRuleTransformPayload } from '../../../../../type/class/api/authorization/rule/transform-payload.type';
+export interface IApiAuthorizationDecision<E extends IApiBaseEntity, R = TApiAuthorizationRuleTransformPayload<E>> {
     action: string;
     appliedRules: Array<IApiAuthorizationRule<E, R>>;
     effect: EApiPolicyEffect;

package/dist/esm/decorator/api/authorization/decision.decorator.d.ts

@@ -0,0 +1,9 @@
+import { IApiBaseEntity } from '../../../interface/api-base-entity.interface';
+import { TApiAuthorizationRuleTransformPayload } from '../../../type/class/api/authorization/rule/transform-payload.type';
+/**
+ * Injects the authorization decision attached to the current HTTP request by the Automator authorization guard.
+ * @template E - Authorized entity type.
+ * @template R - Authorized route result payload type.
+ * @returns {ParameterDecorator} Parameter decorator that fails closed when the request has no authorization decision.
+ */
+export declare function ApiAuthorizationDecision<E extends IApiBaseEntity, R extends TApiAuthorizationRuleTransformPayload<E> = TApiAuthorizationRuleTransformPayload<E>>(): ParameterDecorator;

package/dist/esm/decorator/api/authorization/decision.decorator.js

@@ -0,0 +1,24 @@
+import { createParamDecorator, ForbiddenException } from '@nestjs/common';
+import { AuthorizationDecisionResolveFromRequest } from '../../../utility/authorization/decision/resolve-from-request.utility.js';
+
+/**
+ * Injects the authorization decision attached to the current HTTP request by the Automator authorization guard.
+ * @template E - Authorized entity type.
+ * @template R - Authorized route result payload type.
+ * @returns {ParameterDecorator} Parameter decorator that fails closed when the request has no authorization decision.
+ */
+// Nest's ParameterDecorator cannot carry its factory output type, so these generics bind the factory contract used by each decorator application.
+// eslint-disable-next-line @elsikora/typescript/no-unnecessary-type-parameters
+function ApiAuthorizationDecision() {
+    return createParamDecorator((_data, context) => {
+        const request = context.switchToHttp().getRequest();
+        const decision = AuthorizationDecisionResolveFromRequest(request);
+        if (!decision) {
+            throw new ForbiddenException();
+        }
+        return decision;
+    })();
+}
+
+export { ApiAuthorizationDecision };
+//# sourceMappingURL=decision.decorator.js.map

package/dist/esm/decorator/api/authorization/decision.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision.decorator.js","sources":["../../../../../../src/decorator/api/authorization/decision.decorator.ts"],"sourcesContent":[null],"names":[],"mappings":";;;AASA;;;;;AAKG;AACH;AACA;SACgB,wBAAwB,GAAA;AACvC,IAAA,OAAO,oBAAoB,CAA6C,CAAC,KAAgB,EAAE,OAAyB,KAAqC;QACxJ,MAAM,OAAO,GAA8B,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAA6B;AACzG,QAAA,MAAM,QAAQ,GAAgD,uCAAuC,CAAO,OAAO,CAAC;QAEpH,IAAI,CAAC,QAAQ,EAAE;YACd,MAAM,IAAI,kBAAkB,EAAE;QAC/B;AAEA,QAAA,OAAO,QAAQ;IAChB,CAAC,CAAC,EAAE;AACL;;;;"}

package/dist/esm/decorator/api/index.d.ts

@@ -1,4 +1,5 @@
 export { ApiAuthorizationPolicy } from './authorization-policy.decorator';
+export { ApiAuthorizationDecision } from './authorization/decision.decorator';
 export * from './controller';
 export * from './function';
 export { ApiMethod } from './method.decorator';

package/dist/esm/index.js

@@ -76,6 +76,7 @@ import './constant/utility/api/get-default-string-format-properties/customizer-m
 export { DTO_UTILITY_CONSTANT } from './constant/utility/dto/constant.js';
 export { DTO_GENERATE_CONSTANT } from './constant/utility/dto/generate.constant.js';
 export { ApiAuthorizationPolicy } from './decorator/api/authorization-policy.decorator.js';
+export { ApiAuthorizationDecision } from './decorator/api/authorization/decision.decorator.js';
 export { ApiController } from './decorator/api/controller/decorator.js';
 export { ApiControllerObservable } from './decorator/api/controller/observable.decorator.js';
 export { ApiControllerSecurable } from './decorator/api/controller/securable.decorator.js';

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/dist/esm/interface/class/api/authorization/decision/interface.d.ts

@@ -5,7 +5,8 @@ import { IApiAuthorizationPrincipal } from '../principal/interface';
 import { IApiAuthorizationRule } from '../rule/interface';
 import { IApiAuthorizationScope } from '../scope.interface';
 import { TApiAuthorizationRuleResultTransform } from '../../../../../type/class/api/authorization/rule/result-transform.type';
-export interface IApiAuthorizationDecision<E extends IApiBaseEntity, R> {
+import { TApiAuthorizationRuleTransformPayload } from '../../../../../type/class/api/authorization/rule/transform-payload.type';
+export interface IApiAuthorizationDecision<E extends IApiBaseEntity, R = TApiAuthorizationRuleTransformPayload<E>> {
     action: string;
     appliedRules: Array<IApiAuthorizationRule<E, R>>;
     effect: EApiPolicyEffect;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@elsikora/nestjs-crud-automator",
-	"version": "4.1.0",
+	"version": "4.2.0-dev.1",
 	"description": "A library for automating the creation of CRUD operations in NestJS.",
 	"keywords": [
 		"NestJS",