@generazioneai/authz 0.0.3 → 0.0.5

package/dist/enforce/index.d.ts

@@ -0,0 +1,4 @@
+export * from './prisma-extension';
+export * from './run-unscoped';
+export * from './scoped-repository';
+//# sourceMappingURL=index.d.ts.map

package/dist/enforce/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/enforce/index.ts"],"names":[],"mappings":"AACA,cAAc,oBAAoB,CAAC;AACnC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC"}

package/dist/enforce/index.js

@@ -0,0 +1,21 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// @generazioneai/authz/enforce — Step 3 query-level enforcement (no NestJS runtime dep).
+__exportStar(require("./prisma-extension"), exports);
+__exportStar(require("./run-unscoped"), exports);
+__exportStar(require("./scoped-repository"), exports);
+//# sourceMappingURL=index.js.map

package/dist/enforce/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/enforce/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yFAAyF;AACzF,qDAAmC;AACnC,iDAA+B;AAC/B,sDAAoC"}

package/dist/enforce/prisma-extension.d.ts

@@ -0,0 +1,25 @@
+import type { ResourceRegistry } from '../resource-registry';
+export type EnforceMode = 'off' | 'shadow' | 'enforce';
+export interface AuthzExtensionOptions {
+    mode?: EnforceMode;
+    /** called in shadow mode with what WOULD be restricted (metrics/logging). */
+    onShadow?: (info: {
+        model: string;
+        operation: string;
+        subject: string;
+    }) => void;
+}
+export declare function createAuthzPrismaExtension(registry: ResourceRegistry, opts?: AuthzExtensionOptions): {
+    name: string;
+    query: {
+        $allModels: {
+            $allOperations({ model, operation, args, query }: {
+                model: string;
+                operation: string;
+                args: any;
+                query: (a: any) => Promise<unknown>;
+            }): Promise<unknown>;
+        };
+    };
+};
+//# sourceMappingURL=prisma-extension.d.ts.map

package/dist/enforce/prisma-extension.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prisma-extension.d.ts","sourceRoot":"","sources":["../../src/enforce/prisma-extension.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,QAAQ,GAAG,SAAS,CAAC;AAiBvD,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CAClF;AAED,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,GAAE,qBAA0B;;;;8DAOvC;gBAAE,KAAK,EAAE,MAAM,CAAC;gBAAC,SAAS,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,GAAG,CAAC;gBAAC,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;aAAE;;;EAyCnJ"}

package/dist/enforce/prisma-extension.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAuthzPrismaExtension = createAuthzPrismaExtension;
+// Step 3 — Prisma Client extension that enforces the request's CASL ability on EVERY
+// query (the safety net: impossible to bypass from inside the service). Reads the ability
+// from ALS, looks up the model's Subject in the registry, and ANDs accessibleBy(ability,
+// action)[Subject] into the where (reads/updates/deletes) or stamps tenancy on creates.
+//
+// Mode (AUTHZ_ENFORCE_MODE, default 'off'):
+//   off     → passthrough (no behaviour change — safe to ship).
+//   shadow  → compute but DON'T apply; log would-restrict (readiness measurement).
+//   enforce → apply (fail-closed: no ALS context / no ability → throw).
+const prisma_1 = require("@casl/prisma");
+const als_1 = require("../context/als");
+const READ = new Set(['findUnique', 'findUniqueOrThrow', 'findFirst', 'findFirstOrThrow', 'findMany', 'count', 'aggregate', 'groupBy']);
+const UPDATE = new Set(['update', 'updateMany', 'upsert']);
+const DELETE = new Set(['delete', 'deleteMany']);
+const CREATE = new Set(['create', 'createMany', 'createManyAndReturn']);
+function opToAction(op) {
+    if (READ.has(op))
+        return 'read';
+    if (CREATE.has(op))
+        return 'create';
+    if (UPDATE.has(op))
+        return 'update';
+    if (DELETE.has(op))
+        return 'delete';
+    return 'manage';
+}
+const lowerFirst = (s) => (s ? s.charAt(0).toLowerCase() + s.slice(1) : s);
+function createAuthzPrismaExtension(registry, opts = {}) {
+    const mode = opts.mode ?? process.env.AUTHZ_ENFORCE_MODE ?? 'off';
+    return {
+        name: 'skillera-authz-enforce',
+        query: {
+            $allModels: {
+                async $allOperations({ model, operation, args, query }) {
+                    if (mode === 'off')
+                        return query(args);
+                    const ctx = als_1.authzAls.getStore();
+                    if (!ctx) {
+                        if (mode === 'enforce')
+                            throw new Error(`[authz] UNSCOPED_QUERY ${model}.${operation} — no request context`);
+                        return query(args);
+                    }
+                    if (ctx.unscoped)
+                        return query(args); // runUnscoped escape hatch (system tasks)
+                    if (!ctx.ability) {
+                        if (mode === 'enforce')
+                            throw new Error(`[authz] no ability in context for ${model}.${operation}`);
+                        return query(args);
+                    }
+                    const manifest = registry.get(model) ?? registry.byPrismaModel(lowerFirst(model));
+                    if (!manifest)
+                        return query(args); // unmanaged model → not scoped
+                    const subject = manifest.subject;
+                    const action = opToAction(operation);
+                    if (mode === 'shadow') {
+                        opts.onShadow?.({ model, operation, subject });
+                        return query(args);
+                    }
+                    // enforce
+                    if (CREATE.has(operation)) {
+                        const t = manifest.tenancy;
+                        if (t && t.kind === 'single' && ctx.tenantId && args?.data) {
+                            const stamp = (d) => ({ [t.field]: ctx.tenantId, ...d });
+                            args = { ...args, data: Array.isArray(args.data) ? args.data.map(stamp) : stamp(args.data) };
+                        }
+                        return query(args);
+                    }
+                    const scopeWhere = (0, prisma_1.accessibleBy)(ctx.ability, action)[subject];
+                    args = { ...args, where: args?.where ? { AND: [args.where, scopeWhere] } : scopeWhere };
+                    return query(args);
+                },
+            },
+        },
+    };
+}
+//# sourceMappingURL=prisma-extension.js.map

package/dist/enforce/prisma-extension.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prisma-extension.js","sourceRoot":"","sources":["../../src/enforce/prisma-extension.ts"],"names":[],"mappings":";;AAoCA,gEAgDC;AApFD,qFAAqF;AACrF,0FAA0F;AAC1F,yFAAyF;AACzF,wFAAwF;AACxF,EAAE;AACF,4CAA4C;AAC5C,gEAAgE;AAChE,mFAAmF;AACnF,wEAAwE;AACxE,yCAA4C;AAC5C,wCAA0C;AAK1C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,mBAAmB,EAAE,WAAW,EAAE,kBAAkB,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;AACxI,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC3D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;AACjD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAExE,SAAS,UAAU,CAAC,EAAU;IAC5B,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAAE,OAAO,MAAM,CAAC;IAChC,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAAE,OAAO,QAAQ,CAAC;IACpC,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAAE,OAAO,QAAQ,CAAC;IACpC,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAAE,OAAO,QAAQ,CAAC;IACpC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAQnF,SAAgB,0BAA0B,CAAC,QAA0B,EAAE,OAA8B,EAAE;IACrG,MAAM,IAAI,GAAgB,IAAI,CAAC,IAAI,IAAK,OAAO,CAAC,GAAG,CAAC,kBAAkC,IAAI,KAAK,CAAC;IAEhG,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,KAAK,EAAE;YACL,UAAU,EAAE;gBACV,KAAK,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAwF;oBAC1I,IAAI,IAAI,KAAK,KAAK;wBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;oBAEvC,MAAM,GAAG,GAAG,cAAQ,CAAC,QAAQ,EAAE,CAAC;oBAChC,IAAI,CAAC,GAAG,EAAE,CAAC;wBACT,IAAI,IAAI,KAAK,SAAS;4BAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,KAAK,IAAI,SAAS,uBAAuB,CAAC,CAAC;wBAC7G,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;oBACrB,CAAC;oBACD,IAAI,GAAG,CAAC,QAAQ;wBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,0CAA0C;oBAChF,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;wBACjB,IAAI,IAAI,KAAK,SAAS;4BAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC;wBACnG,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;oBACrB,CAAC;oBAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;oBAClF,IAAI,CAAC,QAAQ;wBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,+BAA+B;oBAClE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;oBACjC,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;oBAErC,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;wBACtB,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;wBAC/C,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;oBACrB,CAAC;oBAED,UAAU;oBACV,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;wBAC1B,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC;wBAC3B,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC;4BAC3D,MAAM,KAAK,GAAG,CAAC,CAA0B,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;4BAClF,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC/F,CAAC;wBACD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;oBACrB,CAAC;oBAED,MAAM,UAAU,GAAI,IAAA,qBAAY,EAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAA6B,CAAC,OAAO,CAAC,CAAC;oBAC3F,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;oBACxF,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;gBACrB,CAAC;aACF;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/enforce/run-unscoped.d.ts

@@ -0,0 +1,2 @@
+export declare function runUnscoped<T>(reason: string, fn: () => T): T;
+//# sourceMappingURL=run-unscoped.d.ts.map

package/dist/enforce/run-unscoped.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-unscoped.d.ts","sourceRoot":"","sources":["../../src/enforce/run-unscoped.ts"],"names":[],"mappings":"AAMA,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAI7D"}

package/dist/enforce/run-unscoped.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runUnscoped = runUnscoped;
+// Step 3 DEC-S3.17 — escape hatch for legitimate system work that must bypass scoping
+// (seeds, cross-tenant admin jobs, the snapshot builder itself). Sets ctx.unscoped so the
+// Prisma extension lets queries through. Requires an explicit reason (lint-enforced, Step 8).
+const als_1 = require("../context/als");
+const authz_context_1 = require("../context/authz-context");
+function runUnscoped(reason, fn) {
+    const current = als_1.authzAls.getStore();
+    const ctx = { ...(current ?? authz_context_1.EMPTY_CTX), unscoped: true, unscopedReason: reason };
+    return als_1.authzAls.run(ctx, fn);
+}
+//# sourceMappingURL=run-unscoped.js.map

package/dist/enforce/run-unscoped.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-unscoped.js","sourceRoot":"","sources":["../../src/enforce/run-unscoped.ts"],"names":[],"mappings":";;AAMA,kCAIC;AAVD,sFAAsF;AACtF,0FAA0F;AAC1F,8FAA8F;AAC9F,wCAA0C;AAC1C,4DAAwE;AAExE,SAAgB,WAAW,CAAI,MAAc,EAAE,EAAW;IACxD,MAAM,OAAO,GAAG,cAAQ,CAAC,QAAQ,EAAE,CAAC;IACpC,MAAM,GAAG,GAAiB,EAAE,GAAG,CAAC,OAAO,IAAI,yBAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;IAChG,OAAO,cAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAC/B,CAAC"}

package/dist/enforce/scoped-repository.d.ts

@@ -0,0 +1,10 @@
+import type { AuthzContext } from '../context/authz-context';
+export declare class ScopedRepository<TDelegate> {
+    private readonly delegate;
+    constructor(delegate: TDelegate);
+    /** Current request context (throws if missing — enforcement is never accidental). */
+    protected ctx(): AuthzContext;
+    /** The underlying (extension-scoped) Prisma delegate. */
+    get scoped(): TDelegate;
+}
+//# sourceMappingURL=scoped-repository.d.ts.map

package/dist/enforce/scoped-repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoped-repository.d.ts","sourceRoot":"","sources":["../../src/enforce/scoped-repository.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE7D,qBAAa,gBAAgB,CAAC,SAAS;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,SAAS;IAEhD,qFAAqF;IACrF,SAAS,CAAC,GAAG,IAAI,YAAY;IAM7B,yDAAyD;IACzD,IAAI,MAAM,IAAI,SAAS,CAGtB;CACF"}

package/dist/enforce/scoped-repository.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScopedRepository = void 0;
+// Step 3 DX wrapper — services inject a ScopedRepository instead of the raw Prisma
+// delegate. The Prisma extension already enforces scope on every query; this surface
+// makes the intent explicit and asserts a request context is present.
+const als_1 = require("../context/als");
+class ScopedRepository {
+    constructor(delegate) {
+        this.delegate = delegate;
+    }
+    /** Current request context (throws if missing — enforcement is never accidental). */
+    ctx() {
+        const c = als_1.authzAls.getStore();
+        if (!c)
+            throw new Error('[authz] ScopedRepository used outside a request context');
+        return c;
+    }
+    /** The underlying (extension-scoped) Prisma delegate. */
+    get scoped() {
+        this.ctx();
+        return this.delegate;
+    }
+}
+exports.ScopedRepository = ScopedRepository;
+//# sourceMappingURL=scoped-repository.js.map

package/dist/enforce/scoped-repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoped-repository.js","sourceRoot":"","sources":["../../src/enforce/scoped-repository.ts"],"names":[],"mappings":";;;AAAA,mFAAmF;AACnF,qFAAqF;AACrF,sEAAsE;AACtE,wCAA0C;AAG1C,MAAa,gBAAgB;IAC3B,YAA6B,QAAmB;QAAnB,aAAQ,GAAR,QAAQ,CAAW;IAAG,CAAC;IAEpD,qFAAqF;IAC3E,GAAG;QACX,MAAM,CAAC,GAAG,cAAQ,CAAC,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACnF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,yDAAyD;IACzD,IAAI,MAAM;QACR,IAAI,CAAC,GAAG,EAAE,CAAC;QACX,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;CACF;AAfD,4CAeC"}

package/dist/nest/authorize.decorator.d.ts

@@ -0,0 +1,3 @@
+import { type CustomDecorator } from '@nestjs/common';
+export declare function Authorize(action: string, subject: string): CustomDecorator;
+//# sourceMappingURL=authorize.decorator.d.ts.map

package/dist/nest/authorize.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.decorator.d.ts","sourceRoot":"","sources":["../../src/nest/authorize.decorator.ts"],"names":[],"mappings":"AAMA,OAAO,EAAe,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGnE,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,eAAe,CAE1E"}

package/dist/nest/authorize.decorator.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Authorize = Authorize;
+// Step 6 — declare the permission a route requires. Read by GlobalAuthzGuard.
+//
+//   @Authorize('read', 'JuridicalIndividual')
+//   @Get() findAll() { ... }
+//
+// Mode-gated by the guard (AUTHZ_ENFORCE_MODE): in 'off' this metadata is inert.
+const common_1 = require("@nestjs/common");
+const global_authz_guard_1 = require("./global-authz.guard");
+function Authorize(action, subject) {
+    return (0, common_1.SetMetadata)(global_authz_guard_1.AUTHZ_REQUIREMENT_KEY, { action, subject });
+}
+//# sourceMappingURL=authorize.decorator.js.map

package/dist/nest/authorize.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.decorator.js","sourceRoot":"","sources":["../../src/nest/authorize.decorator.ts"],"names":[],"mappings":";;AASA,8BAEC;AAXD,8EAA8E;AAC9E,EAAE;AACF,8CAA8C;AAC9C,6BAA6B;AAC7B,EAAE;AACF,iFAAiF;AACjF,2CAAmE;AACnE,6DAAoF;AAEpF,SAAgB,SAAS,CAAC,MAAc,EAAE,OAAe;IACvD,OAAO,IAAA,oBAAW,EAAC,0CAAqB,EAAE,EAAE,MAAM,EAAE,OAAO,EAA6B,CAAC,CAAC;AAC5F,CAAC"}

package/dist/nest/authz-context.interceptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authz-context.interceptor.d.ts","sourceRoot":"","sources":["../../src/nest/authz-context.interceptor.ts"],"names":[],"mappings":"AAMA,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAKlC,qBACa,uBAAwB,YAAW,eAAe;IAC7D,SAAS,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC;CAyB7E"}
+{"version":3,"file":"authz-context.interceptor.d.ts","sourceRoot":"","sources":["../../src/nest/authz-context.interceptor.ts"],"names":[],"mappings":"AAMA,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,UAAU,EAAuB,MAAM,MAAM,CAAC;AAKvD,qBACa,uBAAwB,YAAW,eAAe;IAC7D,SAAS,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC;CA0B7E"}

package/dist/nest/authz-context.interceptor.js

@@ -37,7 +37,10 @@ let AuthzContextInterceptor = class AuthzContextInterceptor {
             },
             ability: null,
         };
-        return new rxjs_1.Observable((subscriber) => als_1.authzAls.run(ctx, () => next.handle().subscribe(subscriber)));
+        // Run the whole handler inside ALS so downstream signed .send() calls — even those
+        // after an await — see the context. The callback returns a promise (lastValueFrom)
+        // so the store stays bound across awaits; a sync subscribe loses it at the first await.
+        return (0, rxjs_1.from)(als_1.authzAls.run(ctx, () => (0, rxjs_1.lastValueFrom)(next.handle())));
     }
 };
 exports.AuthzContextInterceptor = AuthzContextInterceptor;

package/dist/nest/authz-context.interceptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"authz-context.interceptor.js","sourceRoot":"","sources":["../../src/nest/authz-context.interceptor.ts"],"names":[],"mappings":";;;;;;;;;AAAA,6DAA6D;AAC7D,EAAE;AACF,0FAA0F;AAC1F,yFAAyF;AACzF,6FAA6F;AAC7F,4FAA4F;AAC5F,2CAKwB;AACxB,+BAAkC;AAClC,wCAA0C;AAKnC,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAClC,SAAS,CAAC,OAAyB,EAAE,IAAiB;QACpD,IAAI,OAAO,CAAC,OAAO,EAAE,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QAEvD,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAsB,CAAC;QACpE,IAAI,CAAC,GAAG,EAAE,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,4CAA4C;QAEpF,MAAM,GAAG,GAAiB;YACxB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;YAChD,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,iBAAiB;YAC/C,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,SAAS,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,0BAA0B,EAAE,EAAE,EAAE;YAC1F,YAAY,EAAE;gBACZ,QAAQ,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,oBAAoB,EAAE,EAAE,EAAE;gBAC5D,QAAQ,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,oBAAoB,EAAE,EAAE,EAAE;aAC7D;YACD,OAAO,EAAE,IAA0C;SACpD,CAAC;QAEF,OAAO,IAAI,iBAAU,CAAC,CAAC,UAAU,EAAE,EAAE,CACnC,cAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAC7D,CAAC;IACJ,CAAC;CACF,CAAA;AA1BY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;GACA,uBAAuB,CA0BnC"}
+{"version":3,"file":"authz-context.interceptor.js","sourceRoot":"","sources":["../../src/nest/authz-context.interceptor.ts"],"names":[],"mappings":";;;;;;;;;AAAA,6DAA6D;AAC7D,EAAE;AACF,0FAA0F;AAC1F,yFAAyF;AACzF,6FAA6F;AAC7F,4FAA4F;AAC5F,2CAKwB;AACxB,+BAAuD;AACvD,wCAA0C;AAKnC,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAClC,SAAS,CAAC,OAAyB,EAAE,IAAiB;QACpD,IAAI,OAAO,CAAC,OAAO,EAAE,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QAEvD,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAsB,CAAC;QACpE,IAAI,CAAC,GAAG,EAAE,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,4CAA4C;QAEpF,MAAM,GAAG,GAAiB;YACxB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;YAChD,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,iBAAiB;YAC/C,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,SAAS,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,0BAA0B,EAAE,EAAE,EAAE;YAC1F,YAAY,EAAE;gBACZ,QAAQ,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,oBAAoB,EAAE,EAAE,EAAE;gBAC5D,QAAQ,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,oBAAoB,EAAE,EAAE,EAAE;aAC7D;YACD,OAAO,EAAE,IAA0C;SACpD,CAAC;QAEF,mFAAmF;QACnF,mFAAmF;QACnF,wFAAwF;QACxF,OAAO,IAAA,WAAI,EAAC,cAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,IAAA,oBAAa,EAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;CACF,CAAA;AA3BY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;GACA,uBAAuB,CA2BnC"}

package/dist/nest/global-authz.guard.d.ts

@@ -0,0 +1,34 @@
+import { type CanActivate, type ExecutionContext } from '@nestjs/common';
+import type { Reflector } from '@nestjs/core';
+import type { AuthzContext } from '../context/authz-context';
+export type EnforceMode = 'off' | 'shadow' | 'enforce';
+export declare const AUTHZ_REQUIREMENT_KEY = "skillera:authz:requirement";
+export declare const PUBLIC_KEY = "skillera:authz:public";
+export interface AuthzRequirement {
+    action: string;
+    subject: string;
+}
+/** Resolves the ability + context for an HTTP request (gateway-specific impl supplies it). */
+export interface AbilityResolver {
+    resolve(req: unknown): Promise<AuthzContext | null>;
+}
+export interface GlobalAuthzGuardOptions {
+    mode?: EnforceMode;
+    /**
+     * Fallback requirement source, consulted when a route has no @Authorize.
+     * Lets a host reuse pre-existing route metadata (e.g. the gateway's legacy
+     * @CheckPolicies) instead of re-decorating every endpoint. Returns null when
+     * the route genuinely has no requirement (→ default-deny still applies).
+     */
+    requirementResolver?: (context: ExecutionContext, reflector: Reflector) => AuthzRequirement | null;
+}
+export declare class GlobalAuthzGuard implements CanActivate {
+    private readonly reflector;
+    private readonly resolver;
+    private readonly logger;
+    private readonly mode;
+    private readonly requirementResolver?;
+    constructor(reflector: Reflector, resolver: AbilityResolver, opts?: GlobalAuthzGuardOptions | EnforceMode);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}
+//# sourceMappingURL=global-authz.guard.d.ts.map

package/dist/nest/global-authz.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"global-authz.guard.d.ts","sourceRoot":"","sources":["../../src/nest/global-authz.guard.ts"],"names":[],"mappings":"AAYA,OAAO,EAIL,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE7D,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,QAAQ,GAAG,SAAS,CAAC;AACvD,eAAO,MAAM,qBAAqB,+BAA+B,CAAC;AAClE,eAAO,MAAM,UAAU,0BAA0B,CAAC;AAElD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,8FAA8F;AAC9F,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,SAAS,KAAK,gBAAgB,GAAG,IAAI,CAAC;CACpG;AAED,qBACa,gBAAiB,YAAW,WAAW;IAMhD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAN3B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IACpD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAc;IACnC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAiD;gBAGnE,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,eAAe,EAC1C,IAAI,GAAE,uBAAuB,GAAG,WAAgB;IAQ5C,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CAwC/D"}

package/dist/nest/global-authz.guard.js

@@ -0,0 +1,82 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GlobalAuthzGuard = exports.PUBLIC_KEY = exports.AUTHZ_REQUIREMENT_KEY = void 0;
+// Step 6 — gateway route-level enforcement (default-deny).
+//
+// Resolves the request's CASL ability (via a pluggable AbilityResolver — at the gateway,
+// that fetches the user's permission snapshot from Redis/skillID), then checks the route's
+// @Authorize(action, subject) requirement. Runs the rest of the request inside authzAls.run
+// so the signing client / downstream propagation see the context.
+//
+// Mode (AUTHZ_ENFORCE_MODE, default 'off'):
+//   off     → allow (no resolution, zero behaviour change).
+//   shadow  → resolve + log would-deny, but ALLOW.
+//   enforce → default-deny: a route with no @Authorize and no @Public → 403; otherwise
+//             allow iff ability.can(action, subject).
+const common_1 = require("@nestjs/common");
+const als_1 = require("../context/als");
+exports.AUTHZ_REQUIREMENT_KEY = 'skillera:authz:requirement';
+exports.PUBLIC_KEY = 'skillera:authz:public';
+let GlobalAuthzGuard = class GlobalAuthzGuard {
+    constructor(reflector, resolver, opts = {}) {
+        this.reflector = reflector;
+        this.resolver = resolver;
+        this.logger = new common_1.Logger('GlobalAuthz');
+        // Back-compat: a bare mode string is still accepted.
+        const o = typeof opts === 'string' ? { mode: opts } : opts;
+        this.mode = o.mode ?? process.env.AUTHZ_ENFORCE_MODE ?? 'off';
+        this.requirementResolver = o.requirementResolver;
+    }
+    async canActivate(context) {
+        if (this.mode === 'off' || context.getType() !== 'http')
+            return true;
+        const isPublic = this.reflector.getAllAndOverride(exports.PUBLIC_KEY, [context.getHandler(), context.getClass()]);
+        if (isPublic)
+            return true;
+        const requirement = this.reflector.getAllAndOverride(exports.AUTHZ_REQUIREMENT_KEY, [
+            context.getHandler(),
+            context.getClass(),
+        ]) ?? this.requirementResolver?.(context, this.reflector) ?? undefined;
+        const req = context.switchToHttp().getRequest();
+        const ctx = await this.resolver.resolve(req);
+        // Make the ability/context available downstream (signing client, etc.) for this request.
+        if (ctx) {
+            const als = als_1.authzAls.getStore();
+            if (als)
+                Object.assign(als, ctx);
+            else
+                req._authzCtx = ctx;
+        }
+        // Default-deny: a protected route MUST declare @Authorize (or @Public).
+        if (!requirement) {
+            if (this.mode === 'shadow') {
+                this.logger.warn(`shadow would-deny: ${req?.method} ${req?.url} has no @Authorize`);
+                return true;
+            }
+            throw new common_1.ForbiddenException('authz: endpoint has no permission requirement (@Authorize) declared');
+        }
+        const allowed = !!ctx?.ability?.can(requirement.action, requirement.subject);
+        if (allowed)
+            return true;
+        if (this.mode === 'shadow') {
+            this.logger.warn(`shadow would-deny ${requirement.action}:${requirement.subject} for user=${ctx?.userId ?? '?'} (${req?.method} ${req?.url})`);
+            return true;
+        }
+        throw new common_1.ForbiddenException(`authz: missing permission ${requirement.action}:${requirement.subject}`);
+    }
+};
+exports.GlobalAuthzGuard = GlobalAuthzGuard;
+exports.GlobalAuthzGuard = GlobalAuthzGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [Function, Object, Object])
+], GlobalAuthzGuard);
+//# sourceMappingURL=global-authz.guard.js.map

package/dist/nest/global-authz.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"global-authz.guard.js","sourceRoot":"","sources":["../../src/nest/global-authz.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2DAA2D;AAC3D,EAAE;AACF,yFAAyF;AACzF,2FAA2F;AAC3F,4FAA4F;AAC5F,kEAAkE;AAClE,EAAE;AACF,4CAA4C;AAC5C,4DAA4D;AAC5D,mDAAmD;AACnD,uFAAuF;AACvF,sDAAsD;AACtD,2CAMwB;AAExB,wCAA0C;AAI7B,QAAA,qBAAqB,GAAG,4BAA4B,CAAC;AACrD,QAAA,UAAU,GAAG,uBAAuB,CAAC;AAwB3C,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAK3B,YACmB,SAAoB,EACpB,QAAyB,EAC1C,OAA8C,EAAE;QAF/B,cAAS,GAAT,SAAS,CAAW;QACpB,aAAQ,GAAR,QAAQ,CAAiB;QAN3B,WAAM,GAAG,IAAI,eAAM,CAAC,aAAa,CAAC,CAAC;QASlD,qDAAqD;QACrD,MAAM,CAAC,GAA4B,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACpF,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAK,OAAO,CAAC,GAAG,CAAC,kBAAkC,IAAI,KAAK,CAAC;QAC/E,IAAI,CAAC,mBAAmB,GAAG,CAAC,CAAC,mBAAmB,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QAErE,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,kBAAU,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACnH,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE1B,MAAM,WAAW,GACf,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAmB,6BAAqB,EAAE;YACxE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;QAEzE,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAE7C,yFAAyF;QACzF,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,GAAG,GAAG,cAAQ,CAAC,QAAQ,EAAE,CAAC;YAChC,IAAI,GAAG;gBAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;;gBAC3B,GAAoC,CAAC,SAAS,GAAG,GAAG,CAAC;QAC7D,CAAC;QAED,wEAAwE;QACxE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,GAAG,EAAE,MAAM,IAAI,GAAG,EAAE,GAAG,oBAAoB,CAAC,CAAC;gBACpF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,2BAAkB,CAAC,qEAAqE,CAAC,CAAC;QACtG,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;QAC7E,IAAI,OAAO;YAAE,OAAO,IAAI,CAAC;QAEzB,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,WAAW,CAAC,MAAM,IAAI,WAAW,CAAC,OAAO,aAAa,GAAG,EAAE,MAAM,IAAI,GAAG,KAAK,GAAG,EAAE,MAAM,IAAI,GAAG,EAAE,GAAG,GAAG,CAAC,CAAC;YAC/I,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,2BAAkB,CAAC,6BAA6B,WAAW,CAAC,MAAM,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IACzG,CAAC;CACF,CAAA;AAxDY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;;GACA,gBAAgB,CAwD5B"}

package/dist/nest/index.d.ts

@@ -3,4 +3,7 @@ export * from './nats-scoped-client.proxy';
 export * from './internal-auth.interceptor';
 export * from './authz-context.middleware';
 export * from './authz-context.interceptor';
+export * from './global-authz.guard';
+export * from './public.decorator';
+export * from './authorize.decorator';
 //# sourceMappingURL=index.d.ts.map

package/dist/nest/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/nest/index.ts"],"names":[],"mappings":"AAGA,cAAc,gCAAgC,CAAC;AAC/C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/nest/index.ts"],"names":[],"mappings":"AAGA,cAAc,gCAAgC,CAAC;AAC/C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC"}

package/dist/nest/index.js

@@ -22,4 +22,7 @@ __exportStar(require("./nats-scoped-client.proxy"), exports);
 __exportStar(require("./internal-auth.interceptor"), exports);
 __exportStar(require("./authz-context.middleware"), exports);
 __exportStar(require("./authz-context.interceptor"), exports);
+__exportStar(require("./global-authz.guard"), exports);
+__exportStar(require("./public.decorator"), exports);
+__exportStar(require("./authorize.decorator"), exports);
 //# sourceMappingURL=index.js.map

package/dist/nest/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/nest/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yFAAyF;AACzF,mFAAmF;AACnF,iCAAiC;AACjC,iEAA+C;AAC/C,6DAA2C;AAC3C,8DAA4C;AAC5C,6DAA2C;AAC3C,8DAA4C"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/nest/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yFAAyF;AACzF,mFAAmF;AACnF,iCAAiC;AACjC,iEAA+C;AAC/C,6DAA2C;AAC3C,8DAA4C;AAC5C,6DAA2C;AAC3C,8DAA4C;AAC5C,uDAAqC;AACrC,qDAAmC;AACnC,wDAAsC"}

package/dist/nest/internal-auth.interceptor.d.ts

@@ -1,9 +1,15 @@
 import { type CallHandler, type ExecutionContext, type NestInterceptor } from '@nestjs/common';
 import type { Reflector } from '@nestjs/core';
 import { Observable } from 'rxjs';
+import type { AuthzContext } from '../context/authz-context';
 import { type VerificationKey } from '../nats/internal-token';
 import type { ReplayCache } from '../nats/replay-cache';
+import type { AbilityRule, SnapshotEnvelope } from '../snapshot/snapshot.envelope';
 export type InternalAuthMode = 'off' | 'shadow' | 'enforce';
+/** Step 4 — fetch a snapshot envelope by the JWT `snap` claim. */
+export interface SnapshotFetcher {
+    getBySnapId(snapId: string): Promise<SnapshotEnvelope | null>;
+}
 export interface InternalAuthOptions {
     jwks: VerificationKey;
     replay: ReplayCache;
@@ -14,6 +20,14 @@ export interface InternalAuthOptions {
     mode?: InternalAuthMode;
     /** Compare the token cmd against the NATS subject. Default true. */
     strictCmd?: boolean;
+    /**
+     * Step 4 runtime hydration. When both are provided and the token carries a `snap`
+     * claim, the verified context's ability is rehydrated from the Redis snapshot so the
+     * Prisma extension can scope queries. `hydrate` is injected (createPrismaAbility) so
+     * this module stays free of a static @casl/prisma dependency.
+     */
+    snapshotStore?: SnapshotFetcher;
+    hydrate?: (rules: AbilityRule[]) => AuthzContext['ability'];
 }
 export declare class InternalAuthInterceptor implements NestInterceptor {
     private readonly opts;
@@ -23,6 +37,12 @@ export declare class InternalAuthInterceptor implements NestInterceptor {
     intercept(context: ExecutionContext, next: CallHandler): Observable<unknown>;
     /** Returns the ALS context on success; in shadow mode returns null on failure (pass). */
     private verify;
+    /**
+     * Step 4 — rehydrate the ability from the Redis snapshot named by the `snap` claim.
+     * Missing/evicted snapshot in enforce → throw (fail-closed: the gateway must rebuild);
+     * in shadow → leave ability null (the request runs unscoped, logged elsewhere).
+     */
+    private hydrateSnapshot;
     private stripToken;
     private tryGetSubject;
 }

package/dist/nest/internal-auth.interceptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"internal-auth.interceptor.d.ts","sourceRoot":"","sources":["../../src/nest/internal-auth.interceptor.ts"],"names":[],"mappings":"AAcA,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAQ,MAAM,MAAM,CAAC;AAIxC,OAAO,EAOL,KAAK,eAAe,EACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAGxD,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE5D,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,EAAE,WAAW,CAAC;IACpB,0DAA0D;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,SAAS,CAAC;IACrB,qEAAqE;IACrE,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,oEAAoE;IACpE,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AA8BD,qBACa,uBAAwB,YAAW,eAAe;IAIjD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IACrD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAmB;gBAEX,IAAI,EAAE,mBAAmB;IAKtD,SAAS,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC;IA8B5E,yFAAyF;YAC3E,MAAM;IAmCpB,OAAO,CAAC,UAAU;IAKlB,OAAO,CAAC,aAAa;CAItB"}
+{"version":3,"file":"internal-auth.interceptor.d.ts","sourceRoot":"","sources":["../../src/nest/internal-auth.interceptor.ts"],"names":[],"mappings":"AAcA,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAuB,MAAM,MAAM,CAAC;AAGvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAOL,KAAK,eAAe,EACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAGnF,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE5D,kEAAkE;AAClE,MAAM,WAAW,eAAe;IAC9B,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,EAAE,WAAW,CAAC;IACpB,0DAA0D;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,SAAS,CAAC;IACrB,qEAAqE;IACrE,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,oEAAoE;IACpE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,eAAe,CAAC;IAChC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,YAAY,CAAC,SAAS,CAAC,CAAC;CAC7D;AA8BD,qBACa,uBAAwB,YAAW,eAAe;IAIjD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IACrD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAmB;gBAEX,IAAI,EAAE,mBAAmB;IAKtD,SAAS,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC;IAgC5E,yFAAyF;YAC3E,MAAM;IAqCpB;;;;OAIG;YACW,eAAe;IAsB7B,OAAO,CAAC,UAAU;IAKlB,OAAO,CAAC,aAAa;CAItB"}

package/dist/nest/internal-auth.interceptor.js

@@ -84,7 +84,11 @@ let InternalAuthInterceptor = class InternalAuthInterceptor {
             return next.handle();
         }
         return (0, rxjs_1.from)(this.verify(context)).pipe((0, operators_1.mergeMap)((authCtx) => authCtx
-            ? new rxjs_1.Observable((subscriber) => als_1.authzAls.run(authCtx, () => next.handle().subscribe(subscriber)))
+            ? // Run the WHOLE handler inside the ALS context. The callback must return a
+                // promise (lastValueFrom) so the store stays bound across every await — a
+                // sync `run(ctx, () => obs.subscribe())` loses context at the first await,
+                // leaving the Prisma extension unscoped (request/response RPC: single value).
+                (0, rxjs_1.from)(als_1.authzAls.run(authCtx, () => (0, rxjs_1.lastValueFrom)(next.handle())))
             : next.handle()));
     }
     /** Returns the ALS context on success; in shadow mode returns null on failure (pass). */
@@ -110,7 +114,9 @@ let InternalAuthInterceptor = class InternalAuthInterceptor {
             }
             if (!first)
                 throw new internal_token_1.InternalAuthError('replay', `jti '${claims.jti}' already used`);
-            return claimsToContext(claims);
+            const authCtx = claimsToContext(claims);
+            await this.hydrateSnapshot(authCtx, claims);
+            return authCtx;
         }
         catch (e) {
             const reason = e instanceof internal_token_1.InternalAuthError ? e.reason : 'sig';
@@ -122,6 +128,36 @@ let InternalAuthInterceptor = class InternalAuthInterceptor {
             throw new microservices_1.RpcException({ code: 'INTERNAL_AUTH', reason, message: e.message });
         }
     }
+    /**
+     * Step 4 — rehydrate the ability from the Redis snapshot named by the `snap` claim.
+     * Missing/evicted snapshot in enforce → throw (fail-closed: the gateway must rebuild);
+     * in shadow → leave ability null (the request runs unscoped, logged elsewhere).
+     */
+    async hydrateSnapshot(ctx, claims) {
+        if (!this.opts.snapshotStore || !this.opts.hydrate)
+            return; // hydration not wired
+        if (!claims.snap) {
+            if (this.mode === 'enforce')
+                throw new internal_token_1.InternalAuthError('missing', 'token has no snap claim');
+            return;
+        }
+        const env = await this.opts.snapshotStore.getBySnapId(claims.snap);
+        if (!env) {
+            if (this.mode === 'enforce')
+                throw new internal_token_1.InternalAuthError('backend', `snapshot '${claims.snap}' not found (evicted/expired)`);
+            this.logger.warn(`shadow: snapshot '${claims.snap}' not found — running unscoped`);
+            return;
+        }
+        if (claims.ph && env.permHash !== claims.ph) {
+            // Stale token vs rebuilt snapshot; treat as a revocation signal.
+            if (this.mode === 'enforce')
+                throw new internal_token_1.InternalAuthError('hash', 'permHash mismatch (snapshot rebuilt/revoked)');
+            this.logger.warn(`shadow: permHash mismatch snap='${claims.snap}'`);
+        }
+        ctx.ability = this.opts.hydrate(env.rules);
+        ctx.connected = env.connected;
+        ctx.accreditedAs = env.accreditedAs;
+    }
     stripToken(context) {
         const data = context.switchToRpc().getData();
         if (data && internal_token_1.INTERNAL_JWT_FIELD in data)

package/dist/nest/internal-auth.interceptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"internal-auth.interceptor.js","sourceRoot":"","sources":["../../src/nest/internal-auth.interceptor.ts"],"names":[],"mappings":";AAAA,uFAAuF;AACvF,yFAAyF;AACzF,eAAe;AACf,EAAE;AACF,mDAAmD;AACnD,qGAAqG;AACrG,EAAE;AACF,6DAA6D;AAC7D,0FAA0F;AAC1F,8FAA8F;AAC9F,0FAA0F;AAC1F,4EAA4E;AAC5E,8FAA8F;;;;;;;;;;;;AAE9F,2CAMwB;AACxB,yDAAqD;AAErD,+BAAwC;AACxC,8CAA0C;AAC1C,wCAA0C;AAE1C,2DAQgC;AAEhC,iFAAwE;AAgBxE,SAAS,YAAY,CAAC,OAA2B;IAC/C,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,GAAG,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,gCAAgC;IAClC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,MAAsB;IAC7C,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,GAAG;QAClB,qBAAqB,EAAE,MAAM,CAAC,EAAE;QAChC,QAAQ,EAAE,MAAM,CAAC,GAAG;QACpB,MAAM,EAAE,MAAM,CAAC,IAAI;QACnB,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,+EAA+E;QAC/E,SAAS,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,0BAA0B,EAAE,EAAE,EAAE;QAC1F,YAAY,EAAE;YACZ,QAAQ,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,oBAAoB,EAAE,EAAE,EAAE;YAC5D,QAAQ,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,oBAAoB,EAAE,EAAE,EAAE;SAC7D;QACD,OAAO,EAAE,IAA0C;KACpD,CAAC;AACJ,CAAC;AAGM,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAIlC,YAA6B,IAAyB;QAAzB,SAAI,GAAJ,IAAI,CAAqB;QAHrC,WAAM,GAAG,IAAI,eAAM,CAAC,cAAc,CAAC,CAAC;QAInD,IAAI,CAAC,IAAI;YACP,IAAI,CAAC,IAAI,IAAK,OAAO,CAAC,GAAG,CAAC,wBAA6C,IAAI,KAAK,CAAC;IACrF,CAAC;IAED,SAAS,CAAC,OAAyB,EAAE,IAAiB;QACpD,IAAI,OAAO,CAAC,OAAO,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,aAAa;QAEpE,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACxB,yEAAyE;YACzE,gFAAgF;YAChF,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACzB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,qDAAsB,EAAE;YAClF,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QACH,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACzB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,CAAC;QAED,OAAO,IAAA,WAAI,EAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACpC,IAAA,oBAAQ,EAAC,CAAC,OAAO,EAAE,EAAE,CACnB,OAAO;YACL,CAAC,CAAC,IAAI,iBAAU,CAAC,CAAC,UAAU,EAAE,EAAE,CAC5B,cAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CACjE;YACH,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAClB,CACF,CAAC;IACJ,CAAC;IAED,yFAAyF;IACjF,KAAK,CAAC,MAAM,CAAC,OAAyB;QAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAyC,CAAC;QAClE,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QAElD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,IAAK,IAAI,CAAC,mCAAkB,CAAwB,CAAC;YACrE,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,kCAAiB,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAC;YAE/E,MAAM,MAAM,GAAG,MAAM,IAAA,oCAAmB,EAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAErF,OAAQ,IAAgC,CAAC,mCAAkB,CAAC,CAAC;YAC7D,IAAA,+BAAc,EAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;YACnC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,KAAK,IAAI,GAAG;gBAAE,IAAA,0BAAS,EAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAEjE,IAAI,KAAc,CAAC;YACnB,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,IAAI,kCAAiB,CAAC,SAAS,EAAE,+BAAgC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YAChG,CAAC;YACD,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,kCAAiB,CAAC,QAAQ,EAAE,QAAQ,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC;YAEtF,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,MAAM,GAAG,CAAC,YAAY,kCAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YACjE,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,MAAM,SAAS,GAAG,IAAI,GAAG,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7F,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,qCAAqC;gBAC/D,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,4BAAY,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,OAAyB;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,EAAyC,CAAC;QACpF,IAAI,IAAI,IAAI,mCAAkB,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC,mCAAkB,CAAC,CAAC;IAC1E,CAAC;IAEO,aAAa,CAAC,GAAgD;QACpE,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,EAA+C,CAAC;QAC1E,OAAO,OAAO,GAAG,EAAE,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,CAAC;CACF,CAAA;AApFY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;;GACA,uBAAuB,CAoFnC"}
+{"version":3,"file":"internal-auth.interceptor.js","sourceRoot":"","sources":["../../src/nest/internal-auth.interceptor.ts"],"names":[],"mappings":";AAAA,uFAAuF;AACvF,yFAAyF;AACzF,eAAe;AACf,EAAE;AACF,mDAAmD;AACnD,qGAAqG;AACrG,EAAE;AACF,6DAA6D;AAC7D,0FAA0F;AAC1F,8FAA8F;AAC9F,0FAA0F;AAC1F,4EAA4E;AAC5E,8FAA8F;;;;;;;;;;;;AAE9F,2CAMwB;AACxB,yDAAqD;AAErD,+BAAuD;AACvD,8CAA0C;AAC1C,wCAA0C;AAE1C,2DAQgC;AAGhC,iFAAwE;AA6BxE,SAAS,YAAY,CAAC,OAA2B;IAC/C,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,GAAG,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,gCAAgC;IAClC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,MAAsB;IAC7C,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,GAAG;QAClB,qBAAqB,EAAE,MAAM,CAAC,EAAE;QAChC,QAAQ,EAAE,MAAM,CAAC,GAAG;QACpB,MAAM,EAAE,MAAM,CAAC,IAAI;QACnB,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,+EAA+E;QAC/E,SAAS,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,0BAA0B,EAAE,EAAE,EAAE;QAC1F,YAAY,EAAE;YACZ,QAAQ,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,oBAAoB,EAAE,EAAE,EAAE;YAC5D,QAAQ,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,oBAAoB,EAAE,EAAE,EAAE;SAC7D;QACD,OAAO,EAAE,IAA0C;KACpD,CAAC;AACJ,CAAC;AAGM,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAIlC,YAA6B,IAAyB;QAAzB,SAAI,GAAJ,IAAI,CAAqB;QAHrC,WAAM,GAAG,IAAI,eAAM,CAAC,cAAc,CAAC,CAAC;QAInD,IAAI,CAAC,IAAI;YACP,IAAI,CAAC,IAAI,IAAK,OAAO,CAAC,GAAG,CAAC,wBAA6C,IAAI,KAAK,CAAC;IACrF,CAAC;IAED,SAAS,CAAC,OAAyB,EAAE,IAAiB;QACpD,IAAI,OAAO,CAAC,OAAO,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,aAAa;QAEpE,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACxB,yEAAyE;YACzE,gFAAgF;YAChF,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACzB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,qDAAsB,EAAE;YAClF,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QACH,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACzB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,CAAC;QAED,OAAO,IAAA,WAAI,EAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACpC,IAAA,oBAAQ,EAAC,CAAC,OAAO,EAAE,EAAE,CACnB,OAAO;YACL,CAAC,CAAC,2EAA2E;gBAC3E,0EAA0E;gBAC1E,2EAA2E;gBAC3E,8EAA8E;gBAC9E,IAAA,WAAI,EAAC,cAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAA,oBAAa,EAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACjE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAClB,CACF,CAAC;IACJ,CAAC;IAED,yFAAyF;IACjF,KAAK,CAAC,MAAM,CAAC,OAAyB;QAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAyC,CAAC;QAClE,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QAElD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,IAAK,IAAI,CAAC,mCAAkB,CAAwB,CAAC;YACrE,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,kCAAiB,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAC;YAE/E,MAAM,MAAM,GAAG,MAAM,IAAA,oCAAmB,EAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAErF,OAAQ,IAAgC,CAAC,mCAAkB,CAAC,CAAC;YAC7D,IAAA,+BAAc,EAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;YACnC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,KAAK,KAAK,IAAI,GAAG;gBAAE,IAAA,0BAAS,EAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAEjE,IAAI,KAAc,CAAC;YACnB,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,IAAI,kCAAiB,CAAC,SAAS,EAAE,+BAAgC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YAChG,CAAC;YACD,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,kCAAiB,CAAC,QAAQ,EAAE,QAAQ,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC;YAEtF,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5C,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,MAAM,GAAG,CAAC,YAAY,kCAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YACjE,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,MAAM,SAAS,GAAG,IAAI,GAAG,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7F,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,qCAAqC;gBAC/D,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,4BAAY,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,eAAe,CAAC,GAAiB,EAAE,MAAsB;QACrE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,sBAAsB;QAClF,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,kCAAiB,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;YAC/F,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACnE,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,kCAAiB,CAAC,SAAS,EAAE,aAAa,MAAM,CAAC,IAAI,+BAA+B,CAAC,CAAC;YAC7H,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,MAAM,CAAC,IAAI,gCAAgC,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QACD,IAAI,MAAM,CAAC,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;YAC5C,iEAAiE;YACjE,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,kCAAiB,CAAC,MAAM,EAAE,8CAA8C,CAAC,CAAC;YACjH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;QACtE,CAAC;QACD,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;QAC9B,GAAG,CAAC,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC;IACtC,CAAC;IAEO,UAAU,CAAC,OAAyB;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,EAAyC,CAAC;QACpF,IAAI,IAAI,IAAI,mCAAkB,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC,mCAAkB,CAAC,CAAC;IAC1E,CAAC;IAEO,aAAa,CAAC,GAAgD;QACpE,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,EAA+C,CAAC;QAC1E,OAAO,OAAO,GAAG,EAAE,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,CAAC;CACF,CAAA;AAnHY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;;GACA,uBAAuB,CAmHnC"}

package/dist/nest/public.decorator.d.ts

@@ -0,0 +1,3 @@
+import { type CustomDecorator } from '@nestjs/common';
+export declare function Public(): CustomDecorator;
+//# sourceMappingURL=public.decorator.d.ts.map

package/dist/nest/public.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public.decorator.d.ts","sourceRoot":"","sources":["../../src/nest/public.decorator.ts"],"names":[],"mappings":"AACA,OAAO,EAAe,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAGnE,wBAAgB,MAAM,IAAI,eAAe,CAExC"}

package/dist/nest/public.decorator.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Public = Public;
+// Step 6 — opt a route out of default-deny (login, health, public pages).
+const common_1 = require("@nestjs/common");
+const global_authz_guard_1 = require("./global-authz.guard");
+function Public() {
+    return (0, common_1.SetMetadata)(global_authz_guard_1.PUBLIC_KEY, true);
+}
+//# sourceMappingURL=public.decorator.js.map

package/dist/nest/public.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public.decorator.js","sourceRoot":"","sources":["../../src/nest/public.decorator.ts"],"names":[],"mappings":";;AAIA,wBAEC;AAND,0EAA0E;AAC1E,2CAAmE;AACnE,6DAAkD;AAElD,SAAgB,MAAM;IACpB,OAAO,IAAA,oBAAW,EAAC,+BAAU,EAAE,IAAI,CAAC,CAAC;AACvC,CAAC"}