@grantjs/server 1.0.0 → 1.1.0

package/dist/nest.cjs

@@ -1,154 +1,174 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const common = require("@nestjs/common");
-const debug = require("./debug-Crb5gNDM.cjs");
-const grantClient = require("./grant-client-DywfJN5P.cjs");
-const GRANT_OPTIONS_KEY = "grant:options";
+const require_grant_client = require("./grant-client-f6IKMyk5.cjs");
+const require_debug = require("./debug-DInHA4QB.cjs");
+let _nestjs_common = require("@nestjs/common");
+//#region src/nest/grant.decorator.ts
+/**
+* Metadata key for Grant options (resource, action) on route handlers.
+* Used by GrantGuard when options are not passed in the constructor.
+*/
+var GRANT_OPTIONS_KEY = "grant:options";
 function Grant(resourceOrOptions, action) {
-  const options = typeof resourceOrOptions === "string" && action !== void 0 ? { resource: resourceOrOptions, action } : resourceOrOptions;
-  return common.SetMetadata(GRANT_OPTIONS_KEY, options);
+	return (0, _nestjs_common.SetMetadata)(GRANT_OPTIONS_KEY, typeof resourceOrOptions === "string" && action !== void 0 ? {
+		resource: resourceOrOptions,
+		action
+	} : resourceOrOptions);
 }
-var __getOwnPropDesc$1 = Object.getOwnPropertyDescriptor;
-var __decorateClass$1 = (decorators, target, key, kind) => {
-  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc$1(target, key) : target;
-  for (var i = decorators.length - 1, decorator; i >= 0; i--)
-    if (decorator = decorators[i])
-      result = decorator(result) || result;
-  return result;
-};
-const GRANT_CLIENT = "GrantClient";
-exports.GrantModule = class GrantModule {
-  static forRoot(config) {
-    const client = new grantClient.GrantClient(config);
-    return {
-      module: exports.GrantModule,
-      providers: [
-        { provide: grantClient.GrantClient, useValue: client },
-        { provide: GRANT_CLIENT, useValue: client }
-      ],
-      exports: [grantClient.GrantClient, GRANT_CLIENT]
-    };
-  }
-};
-exports.GrantModule = __decorateClass$1([
-  common.Global(),
-  common.Module({})
-], exports.GrantModule);
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __decorateClass = (decorators, target, key, kind) => {
-  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
-  for (var i = decorators.length - 1, decorator; i >= 0; i--)
-    if (decorator = decorators[i])
-      result = decorator(result) || result;
-  return result;
+//#endregion
+//#region \0@oxc-project+runtime@0.127.0/helpers/decorate.js
+function __decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+//#endregion
+//#region src/nest/grant.module.ts
+var _GrantModule;
+var GRANT_CLIENT = "GrantClient";
+var GrantModule = _GrantModule = class GrantModule {
+	static forRoot(config) {
+		const client = new require_grant_client.GrantClient(config);
+		return {
+			module: _GrantModule,
+			providers: [{
+				provide: require_grant_client.GrantClient,
+				useValue: client
+			}, {
+				provide: GRANT_CLIENT,
+				useValue: client
+			}],
+			exports: [require_grant_client.GrantClient, GRANT_CLIENT]
+		};
+	}
 };
-var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
-const GRANT_GUARD = "GrantGuard";
+GrantModule = _GrantModule = __decorate([(0, _nestjs_common.Global)(), (0, _nestjs_common.Module)({})], GrantModule);
+//#endregion
+//#region \0@oxc-project+runtime@0.127.0/helpers/decorateMetadata.js
+function __decorateMetadata(k, v) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.127.0/helpers/decorateParam.js
+function __decorateParam(paramIndex, decorator) {
+	return function(target, key) {
+		decorator(target, key, paramIndex);
+	};
+}
+//#endregion
+//#region src/nest/grant.guard.ts
+var _ref;
+/** Injection token for GrantGuard. Use with @UseGuards(GRANT_GUARD) so Nest resolves the guard from the container (with GrantClient injected). */
+var GRANT_GUARD = "GrantGuard";
+/**
+* NestJS guard that checks Grant authorization before allowing access to a route.
+*
+* Use in one of two ways:
+*
+* 1. With decorator (resource/action from metadata):
+*    - Import GrantModule.forRoot() in AppModule. In a feature module, add
+*      `{ provide: GRANT_GUARD, useClass: GrantGuard }` and use @Grant + @UseGuards(GRANT_GUARD).
+*    - Using the GRANT_GUARD token ensures Nest resolves the guard from the container (GrantClient injected).
+*
+* 2. With explicit options (supports resourceResolver):
+*    - @UseGuards(new GrantGuard(grantClient, { resource: 'Document', action: 'Update', resourceResolver: async ({ request }) => ... }))
+*
+* On success, the authorization result is attached to the request as request.authorization.
+* On failure, throws UnauthorizedException (401), ForbiddenException (403), or NotFoundException (404).
+*/
 function isGrantGuardOptions(x) {
-  return typeof x === "object" && x !== null && "resource" in x && "action" in x && typeof x.resource === "string" && typeof x.action === "string";
+	return typeof x === "object" && x !== null && "resource" in x && "action" in x && typeof x.resource === "string" && typeof x.action === "string";
 }
-exports.GrantGuard = class GrantGuard {
-  constructor(client, reflectorOrOptions) {
-    __publicField(this, "explicitOptions");
-    __publicField(this, "reflector");
-    this.client = client;
-    if (reflectorOrOptions && isGrantGuardOptions(reflectorOrOptions)) {
-      this.explicitOptions = reflectorOrOptions;
-    } else {
-      this.reflector = reflectorOrOptions;
-    }
-  }
-  getOptionsFromContext(context) {
-    const handler = context.getHandler();
-    const clazz = context.getClass();
-    if (this.reflector) {
-      const fromHandler = this.reflector.get(GRANT_OPTIONS_KEY, handler);
-      const fromClass = this.reflector.get(GRANT_OPTIONS_KEY, clazz);
-      if (fromHandler) return fromHandler;
-      if (fromClass) return fromClass;
-    }
-    if (typeof Reflect !== "undefined" && typeof Reflect.getMetadata === "function") {
-      const fromHandler = Reflect.getMetadata(GRANT_OPTIONS_KEY, handler);
-      const fromClass = Reflect.getMetadata(GRANT_OPTIONS_KEY, clazz);
-      if (fromHandler) return fromHandler;
-      if (fromClass) return fromClass;
-    }
-    return void 0;
-  }
-  async canActivate(context) {
-    const request = context.switchToHttp().getRequest();
-    const options = this.explicitOptions ?? this.getOptionsFromContext(context);
-    if (options?.resource && options?.action) {
-      debug.debugGrant("Nest", {
-        resource: options.resource,
-        action: options.action,
-        hasReflector: !!this.reflector,
-        handler: context.getHandler()?.name,
-        controller: context.getClass()?.name
-      });
-    }
-    if (!options || !options.resource || !options.action) {
-      throw new common.ForbiddenException(
-        "Grant options (resource, action) required. Use @Grant() or pass options to GrantGuard."
-      );
-    }
-    if (!this.client) {
-      throw new common.ForbiddenException(
-        "GrantGuard: GrantClient not injected. Import GrantModule.forRoot() in AppModule and register GrantGuard as a provider."
-      );
-    }
-    const token = await grantClient.extractTokenFromRequest(request, this.client.config);
-    if (!token) {
-      throw new common.UnauthorizedException({ error: "Unauthorized", code: "UNAUTHENTICATED" });
-    }
-    let resolvedResource = null;
-    const opts = options;
-    if (opts.resourceResolver) {
-      resolvedResource = await opts.resourceResolver({
-        resourceSlug: options.resource,
-        request
-      });
-      if (!resolvedResource) {
-        throw new common.NotFoundException({ error: "Resource not found", code: "NOT_FOUND" });
-      }
-    }
-    const result = await this.client.isAuthorized(
-      options.resource,
-      options.action,
-      {
-        context: {
-          resource: resolvedResource ?? void 0
-        }
-      },
-      request
-    );
-    debug.debugGrant("Nest", {
-      resource: options.resource,
-      action: options.action,
-      authorized: result.authorized,
-      ...result.authorized ? {} : { reason: result.reason }
-    });
-    if (!result.authorized) {
-      throw new common.ForbiddenException({
-        error: "Forbidden",
-        code: "FORBIDDEN",
-        reason: result.reason
-      });
-    }
-    request.authorization = result;
-    return true;
-  }
+var GrantGuard = class GrantGuard {
+	constructor(client, reflectorOrOptions) {
+		require_grant_client._defineProperty(this, "explicitOptions", void 0);
+		require_grant_client._defineProperty(this, "reflector", void 0);
+		this.client = client;
+		if (reflectorOrOptions && isGrantGuardOptions(reflectorOrOptions)) this.explicitOptions = reflectorOrOptions;
+		else this.reflector = reflectorOrOptions;
+	}
+	getOptionsFromContext(context) {
+		const handler = context.getHandler();
+		const clazz = context.getClass();
+		if (this.reflector) {
+			const fromHandler = this.reflector.get(GRANT_OPTIONS_KEY, handler);
+			const fromClass = this.reflector.get(GRANT_OPTIONS_KEY, clazz);
+			if (fromHandler) return fromHandler;
+			if (fromClass) return fromClass;
+		}
+		if (typeof Reflect !== "undefined" && typeof Reflect.getMetadata === "function") {
+			const fromHandler = Reflect.getMetadata(GRANT_OPTIONS_KEY, handler);
+			const fromClass = Reflect.getMetadata(GRANT_OPTIONS_KEY, clazz);
+			if (fromHandler) return fromHandler;
+			if (fromClass) return fromClass;
+		}
+	}
+	async canActivate(context) {
+		const request = context.switchToHttp().getRequest();
+		const options = this.explicitOptions ?? this.getOptionsFromContext(context);
+		if (options?.resource && options?.action) require_debug.debugGrant("Nest", {
+			resource: options.resource,
+			action: options.action,
+			hasReflector: !!this.reflector,
+			handler: context.getHandler()?.name,
+			controller: context.getClass()?.name
+		});
+		if (!options || !options.resource || !options.action) throw new _nestjs_common.ForbiddenException("Grant options (resource, action) required. Use @Grant() or pass options to GrantGuard.");
+		if (!this.client) throw new _nestjs_common.ForbiddenException("GrantGuard: GrantClient not injected. Import GrantModule.forRoot() in AppModule and register GrantGuard as a provider.");
+		if (!await require_grant_client.extractTokenFromRequest(request, this.client.config)) throw new _nestjs_common.UnauthorizedException({
+			error: "Unauthorized",
+			code: "UNAUTHENTICATED"
+		});
+		let resolvedResource = null;
+		const opts = options;
+		if (opts.resourceResolver) {
+			resolvedResource = await opts.resourceResolver({
+				resourceSlug: options.resource,
+				request
+			});
+			if (!resolvedResource) throw new _nestjs_common.NotFoundException({
+				error: "Resource not found",
+				code: "NOT_FOUND"
+			});
+		}
+		const result = await this.client.isAuthorized(options.resource, options.action, { context: { resource: resolvedResource ?? void 0 } }, request);
+		require_debug.debugGrant("Nest", {
+			resource: options.resource,
+			action: options.action,
+			authorized: result.authorized,
+			...result.authorized ? {} : { reason: result.reason }
+		});
+		if (!result.authorized) throw new _nestjs_common.ForbiddenException({
+			error: "Forbidden",
+			code: "FORBIDDEN",
+			reason: result.reason
+		});
+		request.authorization = result;
+		return true;
+	}
 };
-exports.GrantGuard = __decorateClass([
-  common.Injectable(),
-  __decorateParam(0, common.Inject(GRANT_CLIENT))
-], exports.GrantGuard);
-exports.GrantClient = grantClient.GrantClient;
+GrantGuard = __decorate([
+	(0, _nestjs_common.Injectable)(),
+	__decorateParam(0, (0, _nestjs_common.Inject)(GRANT_CLIENT)),
+	__decorateMetadata("design:paramtypes", [typeof (_ref = typeof require_grant_client.GrantClient !== "undefined" && require_grant_client.GrantClient) === "function" ? _ref : Object, Object])
+], GrantGuard);
+//#endregion
 exports.GRANT_CLIENT = GRANT_CLIENT;
 exports.GRANT_GUARD = GRANT_GUARD;
 exports.GRANT_OPTIONS_KEY = GRANT_OPTIONS_KEY;
 exports.Grant = Grant;
-//# sourceMappingURL=nest.cjs.map
+exports.GrantClient = require_grant_client.GrantClient;
+Object.defineProperty(exports, "GrantGuard", {
+	enumerable: true,
+	get: function() {
+		return GrantGuard;
+	}
+});
+Object.defineProperty(exports, "GrantModule", {
+	enumerable: true,
+	get: function() {
+		return GrantModule;
+	}
+});
+
+//# sourceMappingURL=nest.cjs.map

package/dist/nest.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"nest.cjs","sources":["../src/nest/grant.decorator.ts","../src/nest/grant.module.ts","../src/nest/grant.guard.ts"],"sourcesContent":["import { SetMetadata } from '@nestjs/common';\n\n/**\n * Metadata key for Grant options (resource, action) on route handlers.\n * Used by GrantGuard when options are not passed in the constructor.\n */\nexport const GRANT_OPTIONS_KEY = 'grant:options';\n\n/**\n * Options for the Grant guard (resource, action; resourceResolver only via guard constructor).\n */\nexport interface GrantOptions {\n  /** The resource slug to check (e.g., \"Organization\", \"Project\", \"Document\") */\n  resource: string;\n  /** The action to check (e.g., \"Query\", \"Create\", \"Update\", \"Delete\") */\n  action: string;\n}\n\n/**\n * Decorator to require a Grant permission on a route.\n * Use with GrantGuard (injected) so the guard reads resource/action from this metadata.\n *\n * @example\n * ```ts\n * @Get()\n * @Grant('Document', 'Query')\n * @UseGuards(GrantGuard)\n * list() { ... }\n *\n * @Post()\n * @Grant('Document', 'Create')\n * @UseGuards(GrantGuard)\n * create(@Body() dto: CreateDocumentDto) { ... }\n * ```\n *\n * For dynamic resource resolution (resourceResolver), use the guard with explicit options:\n * `@UseGuards(new GrantGuard(grantClient, { resource: 'Document', action: 'Update', resourceResolver: ... }))`\n */\nexport function Grant(resource: string, action: string): ReturnType<typeof SetMetadata>;\nexport function Grant(options: GrantOptions): ReturnType<typeof SetMetadata>;\nexport function Grant(\n  resourceOrOptions: string | GrantOptions,\n  action?: string\n): ReturnType<typeof SetMetadata> {\n  const options: GrantOptions =\n    typeof resourceOrOptions === 'string' && action !== undefined\n      ? { resource: resourceOrOptions, action }\n      : (resourceOrOptions as GrantOptions);\n  return SetMetadata(GRANT_OPTIONS_KEY, options);\n}\n","import { DynamicModule, Global, Module } from '@nestjs/common';\n\nimport { GrantClient } from '../grant-client';\n\nimport type { GrantServerConfig } from '../types';\n\nexport const GRANT_CLIENT = 'GrantClient';\n\n/**\n * NestJS module that provides GrantClient for injection.\n *\n * @example\n * ```ts\n * // app.module.ts\n * import { GrantModule } from '@grantjs/server/nest';\n *\n * @Module({\n *   imports: [\n *     GrantModule.forRoot({\n *       apiUrl: process.env.GRANT_API_URL!,\n *       getToken: (req) => req.headers?.authorization?.replace?.('Bearer ', '') ?? null,\n *     }),\n *   ],\n * })\n * export class AppModule {}\n * ```\n *\n * Then inject GrantClient in controllers and use with GrantGuard.\n */\n@Global()\n@Module({})\nexport class GrantModule {\n  static forRoot(config: GrantServerConfig): DynamicModule {\n    const client = new GrantClient(config);\n    return {\n      module: GrantModule,\n      providers: [\n        { provide: GrantClient, useValue: client },\n        { provide: GRANT_CLIENT, useValue: client },\n      ],\n      exports: [GrantClient, GRANT_CLIENT],\n    };\n  }\n}\n","import {\n  CanActivate,\n  ExecutionContext,\n  ForbiddenException,\n  Inject,\n  Injectable,\n  NotFoundException,\n  UnauthorizedException,\n} from '@nestjs/common';\nimport { Reflector } from '@nestjs/core';\n\nimport { GrantClient } from '../grant-client';\nimport { debugGrant } from '../utils/debug';\nimport { extractTokenFromRequest } from '../utils/token-extractor';\n\nimport { GRANT_OPTIONS_KEY } from './grant.decorator';\nimport { GRANT_CLIENT } from './grant.module';\n\n/** Injection token for GrantGuard. Use with @UseGuards(GRANT_GUARD) so Nest resolves the guard from the container (with GrantClient injected). */\nexport const GRANT_GUARD = 'GrantGuard';\n\nimport type { ResourceResolver, AuthorizationResult } from '../types';\nimport type { GrantOptions } from './grant.decorator';\n\n/**\n * Extended request type with Grant authorization result (for use in controllers).\n */\nexport interface AuthorizedRequest {\n  authorization?: AuthorizationResult;\n}\n\n/**\n * Guard options when using explicit options (includes optional resourceResolver).\n */\nexport interface GrantGuardOptions {\n  resource: string;\n  action: string;\n  resourceResolver?: ResourceResolver;\n}\n\n/**\n * NestJS guard that checks Grant authorization before allowing access to a route.\n *\n * Use in one of two ways:\n *\n * 1. With decorator (resource/action from metadata):\n *    - Import GrantModule.forRoot() in AppModule. In a feature module, add\n *      `{ provide: GRANT_GUARD, useClass: GrantGuard }` and use @Grant + @UseGuards(GRANT_GUARD).\n *    - Using the GRANT_GUARD token ensures Nest resolves the guard from the container (GrantClient injected).\n *\n * 2. With explicit options (supports resourceResolver):\n *    - @UseGuards(new GrantGuard(grantClient, { resource: 'Document', action: 'Update', resourceResolver: async ({ request }) => ... }))\n *\n * On success, the authorization result is attached to the request as request.authorization.\n * On failure, throws UnauthorizedException (401), ForbiddenException (403), or NotFoundException (404).\n */\nfunction isGrantGuardOptions(x: unknown): x is GrantGuardOptions {\n  return (\n    typeof x === 'object' &&\n    x !== null &&\n    'resource' in x &&\n    'action' in x &&\n    typeof (x as GrantGuardOptions).resource === 'string' &&\n    typeof (x as GrantGuardOptions).action === 'string'\n  );\n}\n\n@Injectable()\nexport class GrantGuard implements CanActivate {\n  private readonly explicitOptions?: GrantGuardOptions;\n  private readonly reflector?: Reflector;\n\n  constructor(\n    @Inject(GRANT_CLIENT) private readonly client: GrantClient,\n    reflectorOrOptions?: Reflector | GrantGuardOptions\n  ) {\n    if (reflectorOrOptions && isGrantGuardOptions(reflectorOrOptions)) {\n      this.explicitOptions = reflectorOrOptions;\n    } else {\n      this.reflector = reflectorOrOptions as Reflector | undefined;\n    }\n  }\n\n  private getOptionsFromContext(context: ExecutionContext): GrantOptions | undefined {\n    const handler = context.getHandler();\n    const clazz = context.getClass();\n    // Prefer Reflector when available (Nest DI)\n    if (this.reflector) {\n      const fromHandler = this.reflector.get<GrantOptions>(GRANT_OPTIONS_KEY, handler);\n      const fromClass = this.reflector.get<GrantOptions>(GRANT_OPTIONS_KEY, clazz);\n      if (fromHandler) return fromHandler;\n      if (fromClass) return fromClass;\n    }\n    // Fallback: read metadata via Reflect (works when Reflector is not injected, e.g. ESM/CJS boundary)\n    if (typeof Reflect !== 'undefined' && typeof Reflect.getMetadata === 'function') {\n      const fromHandler = Reflect.getMetadata(GRANT_OPTIONS_KEY, handler) as\n        | GrantOptions\n        | undefined;\n      const fromClass = Reflect.getMetadata(GRANT_OPTIONS_KEY, clazz) as GrantOptions | undefined;\n      if (fromHandler) return fromHandler;\n      if (fromClass) return fromClass;\n    }\n    return undefined;\n  }\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const request = context.switchToHttp().getRequest();\n\n    const options = this.explicitOptions ?? this.getOptionsFromContext(context);\n\n    if (options?.resource && options?.action) {\n      debugGrant('Nest', {\n        resource: options.resource,\n        action: options.action,\n        hasReflector: !!this.reflector,\n        handler: context.getHandler()?.name,\n        controller: context.getClass()?.name,\n      });\n    }\n\n    if (!options || !options.resource || !options.action) {\n      throw new ForbiddenException(\n        'Grant options (resource, action) required. Use @Grant() or pass options to GrantGuard.'\n      );\n    }\n\n    if (!this.client) {\n      throw new ForbiddenException(\n        'GrantGuard: GrantClient not injected. Import GrantModule.forRoot() in AppModule and register GrantGuard as a provider.'\n      );\n    }\n\n    const token = await extractTokenFromRequest(request, this.client.config);\n    if (!token) {\n      throw new UnauthorizedException({ error: 'Unauthorized', code: 'UNAUTHENTICATED' });\n    }\n\n    let resolvedResource: Record<string, unknown> | null = null;\n\n    const opts = options as GrantGuardOptions;\n    if (opts.resourceResolver) {\n      resolvedResource = await opts.resourceResolver({\n        resourceSlug: options.resource,\n        request,\n      });\n      if (!resolvedResource) {\n        throw new NotFoundException({ error: 'Resource not found', code: 'NOT_FOUND' });\n      }\n    }\n\n    const result = await this.client.isAuthorized(\n      options.resource,\n      options.action,\n      {\n        context: {\n          resource: resolvedResource ?? undefined,\n        },\n      },\n      request\n    );\n\n    debugGrant('Nest', {\n      resource: options.resource,\n      action: options.action,\n      authorized: result.authorized,\n      ...(result.authorized ? {} : { reason: result.reason }),\n    });\n\n    if (!result.authorized) {\n      throw new ForbiddenException({\n        error: 'Forbidden',\n        code: 'FORBIDDEN',\n        reason: result.reason,\n      });\n    }\n\n    (request as AuthorizedRequest).authorization = result;\n    return true;\n  }\n}\n"],"names":["SetMetadata","GrantModule","GrantClient","__decorateClass","Global","Module","GrantGuard","debugGrant","ForbiddenException","extractTokenFromRequest","UnauthorizedException","NotFoundException","Injectable"],"mappings":";;;;;;;;AAMO,MAAM,oBAAoB;AAkC1B,SAAS,MACd,mBACA,QACgC;AAChC,QAAM,UACJ,OAAO,sBAAsB,YAAY,WAAW,SAChD,EAAE,UAAU,mBAAmB,OAAA,IAC9B;AACP,SAAOA,OAAAA,YAAY,mBAAmB,OAAO;AAC/C;;;;;;;;;AC3CO,MAAM,eAAe;AAyBfC,QAAAA,cAAN,kBAAkB;AAAA,EACvB,OAAO,QAAQ,QAA0C;AACvD,UAAM,SAAS,IAAIC,YAAAA,YAAY,MAAM;AACrC,WAAO;AAAA,MACL,QAAQD,QAAAA;AAAAA,MACR,WAAW;AAAA,QACT,EAAE,SAASC,YAAAA,aAAa,UAAU,OAAA;AAAA,QAClC,EAAE,SAAS,cAAc,UAAU,OAAA;AAAA,MAAO;AAAA,MAE5C,SAAS,CAACA,YAAAA,aAAa,YAAY;AAAA,IAAA;AAAA,EAEvC;AACF;AAZaD,QAAAA,cAANE,kBAAA;AAAA,EAFNC,cAAA;AAAA,EACAC,OAAAA,OAAO,CAAA,CAAE;AAAA,GACGJ,mBAAA;;;;;;;;;;ACZN,MAAM,cAAc;AAqC3B,SAAS,oBAAoB,GAAoC;AAC/D,SACE,OAAO,MAAM,YACb,MAAM,QACN,cAAc,KACd,YAAY,KACZ,OAAQ,EAAwB,aAAa,YAC7C,OAAQ,EAAwB,WAAW;AAE/C;AAGaK,QAAAA,aAAN,iBAAwC;AAAA,EAI7C,YACyC,QACvC,oBACA;AANe;AACA;AAGwB,SAAA,SAAA;AAGvC,QAAI,sBAAsB,oBAAoB,kBAAkB,GAAG;AACjE,WAAK,kBAAkB;AAAA,IACzB,OAAO;AACL,WAAK,YAAY;AAAA,IACnB;AAAA,EACF;AAAA,EAEQ,sBAAsB,SAAqD;AACjF,UAAM,UAAU,QAAQ,WAAA;AACxB,UAAM,QAAQ,QAAQ,SAAA;AAEtB,QAAI,KAAK,WAAW;AAClB,YAAM,cAAc,KAAK,UAAU,IAAkB,mBAAmB,OAAO;AAC/E,YAAM,YAAY,KAAK,UAAU,IAAkB,mBAAmB,KAAK;AAC3E,UAAI,YAAa,QAAO;AACxB,UAAI,UAAW,QAAO;AAAA,IACxB;AAEA,QAAI,OAAO,YAAY,eAAe,OAAO,QAAQ,gBAAgB,YAAY;AAC/E,YAAM,cAAc,QAAQ,YAAY,mBAAmB,OAAO;AAGlE,YAAM,YAAY,QAAQ,YAAY,mBAAmB,KAAK;AAC9D,UAAI,YAAa,QAAO;AACxB,UAAI,UAAW,QAAO;AAAA,IACxB;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,YAAY,SAA6C;AAC7D,UAAM,UAAU,QAAQ,aAAA,EAAe,WAAA;AAEvC,UAAM,UAAU,KAAK,mBAAmB,KAAK,sBAAsB,OAAO;AAE1E,QAAI,SAAS,YAAY,SAAS,QAAQ;AACxCC,YAAAA,WAAW,QAAQ;AAAA,QACjB,UAAU,QAAQ;AAAA,QAClB,QAAQ,QAAQ;AAAA,QAChB,cAAc,CAAC,CAAC,KAAK;AAAA,QACrB,SAAS,QAAQ,WAAA,GAAc;AAAA,QAC/B,YAAY,QAAQ,YAAY;AAAA,MAAA,CACjC;AAAA,IACH;AAEA,QAAI,CAAC,WAAW,CAAC,QAAQ,YAAY,CAAC,QAAQ,QAAQ;AACpD,YAAM,IAAIC,OAAAA;AAAAA,QACR;AAAA,MAAA;AAAA,IAEJ;AAEA,QAAI,CAAC,KAAK,QAAQ;AAChB,YAAM,IAAIA,OAAAA;AAAAA,QACR;AAAA,MAAA;AAAA,IAEJ;AAEA,UAAM,QAAQ,MAAMC,YAAAA,wBAAwB,SAAS,KAAK,OAAO,MAAM;AACvE,QAAI,CAAC,OAAO;AACV,YAAM,IAAIC,OAAAA,sBAAsB,EAAE,OAAO,gBAAgB,MAAM,mBAAmB;AAAA,IACpF;AAEA,QAAI,mBAAmD;AAEvD,UAAM,OAAO;AACb,QAAI,KAAK,kBAAkB;AACzB,yBAAmB,MAAM,KAAK,iBAAiB;AAAA,QAC7C,cAAc,QAAQ;AAAA,QACtB;AAAA,MAAA,CACD;AACD,UAAI,CAAC,kBAAkB;AACrB,cAAM,IAAIC,OAAAA,kBAAkB,EAAE,OAAO,sBAAsB,MAAM,aAAa;AAAA,MAChF;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,KAAK,OAAO;AAAA,MAC/B,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,QACE,SAAS;AAAA,UACP,UAAU,oBAAoB;AAAA,QAAA;AAAA,MAChC;AAAA,MAEF;AAAA,IAAA;AAGFJ,UAAAA,WAAW,QAAQ;AAAA,MACjB,UAAU,QAAQ;AAAA,MAClB,QAAQ,QAAQ;AAAA,MAChB,YAAY,OAAO;AAAA,MACnB,GAAI,OAAO,aAAa,CAAA,IAAK,EAAE,QAAQ,OAAO,OAAA;AAAA,IAAO,CACtD;AAED,QAAI,CAAC,OAAO,YAAY;AACtB,YAAM,IAAIC,OAAAA,mBAAmB;AAAA,QAC3B,OAAO;AAAA,QACP,MAAM;AAAA,QACN,QAAQ,OAAO;AAAA,MAAA,CAChB;AAAA,IACH;AAEC,YAA8B,gBAAgB;AAC/C,WAAO;AAAA,EACT;AACF;AA/GaF,QAAAA,aAAN,gBAAA;AAAA,EADNM,kBAAA;AAAA,EAMI,iCAAO,YAAY,CAAA;AAAA,GALXN,kBAAA;;;;;;"}
+{"version":3,"file":"nest.cjs","names":[],"sources":["../src/nest/grant.decorator.ts","../src/nest/grant.module.ts","../src/nest/grant.guard.ts"],"sourcesContent":["import { SetMetadata } from '@nestjs/common';\n\n/**\n * Metadata key for Grant options (resource, action) on route handlers.\n * Used by GrantGuard when options are not passed in the constructor.\n */\nexport const GRANT_OPTIONS_KEY = 'grant:options';\n\n/**\n * Options for the Grant guard (resource, action; resourceResolver only via guard constructor).\n */\nexport interface GrantOptions {\n  /** The resource slug to check (e.g., \"Organization\", \"Project\", \"Document\") */\n  resource: string;\n  /** The action to check (e.g., \"Query\", \"Create\", \"Update\", \"Delete\") */\n  action: string;\n}\n\n/**\n * Decorator to require a Grant permission on a route.\n * Use with GrantGuard (injected) so the guard reads resource/action from this metadata.\n *\n * @example\n * ```ts\n * @Get()\n * @Grant('Document', 'Query')\n * @UseGuards(GrantGuard)\n * list() { ... }\n *\n * @Post()\n * @Grant('Document', 'Create')\n * @UseGuards(GrantGuard)\n * create(@Body() dto: CreateDocumentDto) { ... }\n * ```\n *\n * For dynamic resource resolution (resourceResolver), use the guard with explicit options:\n * `@UseGuards(new GrantGuard(grantClient, { resource: 'Document', action: 'Update', resourceResolver: ... }))`\n */\nexport function Grant(resource: string, action: string): ReturnType<typeof SetMetadata>;\nexport function Grant(options: GrantOptions): ReturnType<typeof SetMetadata>;\nexport function Grant(\n  resourceOrOptions: string | GrantOptions,\n  action?: string\n): ReturnType<typeof SetMetadata> {\n  const options: GrantOptions =\n    typeof resourceOrOptions === 'string' && action !== undefined\n      ? { resource: resourceOrOptions, action }\n      : (resourceOrOptions as GrantOptions);\n  return SetMetadata(GRANT_OPTIONS_KEY, options);\n}\n","import { DynamicModule, Global, Module } from '@nestjs/common';\n\nimport { GrantClient } from '../grant-client';\nimport type { GrantServerConfig } from '../types';\n\nexport const GRANT_CLIENT = 'GrantClient';\n\n/**\n * NestJS module that provides GrantClient for injection.\n *\n * @example\n * ```ts\n * // app.module.ts\n * import { GrantModule } from '@grantjs/server/nest';\n *\n * @Module({\n *   imports: [\n *     GrantModule.forRoot({\n *       apiUrl: process.env.GRANT_API_URL!,\n *       getToken: (req) => req.headers?.authorization?.replace?.('Bearer ', '') ?? null,\n *     }),\n *   ],\n * })\n * export class AppModule {}\n * ```\n *\n * Then inject GrantClient in controllers and use with GrantGuard.\n */\n@Global()\n@Module({})\nexport class GrantModule {\n  static forRoot(config: GrantServerConfig): DynamicModule {\n    const client = new GrantClient(config);\n    return {\n      module: GrantModule,\n      providers: [\n        { provide: GrantClient, useValue: client },\n        { provide: GRANT_CLIENT, useValue: client },\n      ],\n      exports: [GrantClient, GRANT_CLIENT],\n    };\n  }\n}\n","import {\n  CanActivate,\n  ExecutionContext,\n  ForbiddenException,\n  Inject,\n  Injectable,\n  NotFoundException,\n  UnauthorizedException,\n} from '@nestjs/common';\nimport { Reflector } from '@nestjs/core';\n\nimport { GrantClient } from '../grant-client';\nimport { debugGrant } from '../utils/debug';\nimport { extractTokenFromRequest } from '../utils/token-extractor';\nimport { GRANT_OPTIONS_KEY } from './grant.decorator';\nimport { GRANT_CLIENT } from './grant.module';\n\n/** Injection token for GrantGuard. Use with @UseGuards(GRANT_GUARD) so Nest resolves the guard from the container (with GrantClient injected). */\nexport const GRANT_GUARD = 'GrantGuard';\n\nimport type { AuthorizationResult, ResourceResolver } from '../types';\nimport type { GrantOptions } from './grant.decorator';\n\n/**\n * Extended request type with Grant authorization result (for use in controllers).\n */\nexport interface AuthorizedRequest {\n  authorization?: AuthorizationResult;\n}\n\n/**\n * Guard options when using explicit options (includes optional resourceResolver).\n */\nexport interface GrantGuardOptions {\n  resource: string;\n  action: string;\n  resourceResolver?: ResourceResolver;\n}\n\n/**\n * NestJS guard that checks Grant authorization before allowing access to a route.\n *\n * Use in one of two ways:\n *\n * 1. With decorator (resource/action from metadata):\n *    - Import GrantModule.forRoot() in AppModule. In a feature module, add\n *      `{ provide: GRANT_GUARD, useClass: GrantGuard }` and use @Grant + @UseGuards(GRANT_GUARD).\n *    - Using the GRANT_GUARD token ensures Nest resolves the guard from the container (GrantClient injected).\n *\n * 2. With explicit options (supports resourceResolver):\n *    - @UseGuards(new GrantGuard(grantClient, { resource: 'Document', action: 'Update', resourceResolver: async ({ request }) => ... }))\n *\n * On success, the authorization result is attached to the request as request.authorization.\n * On failure, throws UnauthorizedException (401), ForbiddenException (403), or NotFoundException (404).\n */\nfunction isGrantGuardOptions(x: unknown): x is GrantGuardOptions {\n  return (\n    typeof x === 'object' &&\n    x !== null &&\n    'resource' in x &&\n    'action' in x &&\n    typeof (x as GrantGuardOptions).resource === 'string' &&\n    typeof (x as GrantGuardOptions).action === 'string'\n  );\n}\n\n@Injectable()\nexport class GrantGuard implements CanActivate {\n  private readonly explicitOptions?: GrantGuardOptions;\n  private readonly reflector?: Reflector;\n\n  constructor(\n    @Inject(GRANT_CLIENT) private readonly client: GrantClient,\n    reflectorOrOptions?: Reflector | GrantGuardOptions\n  ) {\n    if (reflectorOrOptions && isGrantGuardOptions(reflectorOrOptions)) {\n      this.explicitOptions = reflectorOrOptions;\n    } else {\n      this.reflector = reflectorOrOptions as Reflector | undefined;\n    }\n  }\n\n  private getOptionsFromContext(context: ExecutionContext): GrantOptions | undefined {\n    const handler = context.getHandler();\n    const clazz = context.getClass();\n    // Prefer Reflector when available (Nest DI)\n    if (this.reflector) {\n      const fromHandler = this.reflector.get<GrantOptions>(GRANT_OPTIONS_KEY, handler);\n      const fromClass = this.reflector.get<GrantOptions>(GRANT_OPTIONS_KEY, clazz);\n      if (fromHandler) return fromHandler;\n      if (fromClass) return fromClass;\n    }\n    // Fallback: read metadata via Reflect (works when Reflector is not injected, e.g. ESM/CJS boundary)\n    if (typeof Reflect !== 'undefined' && typeof Reflect.getMetadata === 'function') {\n      const fromHandler = Reflect.getMetadata(GRANT_OPTIONS_KEY, handler) as\n        | GrantOptions\n        | undefined;\n      const fromClass = Reflect.getMetadata(GRANT_OPTIONS_KEY, clazz) as GrantOptions | undefined;\n      if (fromHandler) return fromHandler;\n      if (fromClass) return fromClass;\n    }\n    return undefined;\n  }\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const request = context.switchToHttp().getRequest();\n\n    const options = this.explicitOptions ?? this.getOptionsFromContext(context);\n\n    if (options?.resource && options?.action) {\n      debugGrant('Nest', {\n        resource: options.resource,\n        action: options.action,\n        hasReflector: !!this.reflector,\n        handler: context.getHandler()?.name,\n        controller: context.getClass()?.name,\n      });\n    }\n\n    if (!options || !options.resource || !options.action) {\n      throw new ForbiddenException(\n        'Grant options (resource, action) required. Use @Grant() or pass options to GrantGuard.'\n      );\n    }\n\n    if (!this.client) {\n      throw new ForbiddenException(\n        'GrantGuard: GrantClient not injected. Import GrantModule.forRoot() in AppModule and register GrantGuard as a provider.'\n      );\n    }\n\n    const token = await extractTokenFromRequest(request, this.client.config);\n    if (!token) {\n      throw new UnauthorizedException({ error: 'Unauthorized', code: 'UNAUTHENTICATED' });\n    }\n\n    let resolvedResource: Record<string, unknown> | null = null;\n\n    const opts = options as GrantGuardOptions;\n    if (opts.resourceResolver) {\n      resolvedResource = await opts.resourceResolver({\n        resourceSlug: options.resource,\n        request,\n      });\n      if (!resolvedResource) {\n        throw new NotFoundException({ error: 'Resource not found', code: 'NOT_FOUND' });\n      }\n    }\n\n    const result = await this.client.isAuthorized(\n      options.resource,\n      options.action,\n      {\n        context: {\n          resource: resolvedResource ?? undefined,\n        },\n      },\n      request\n    );\n\n    debugGrant('Nest', {\n      resource: options.resource,\n      action: options.action,\n      authorized: result.authorized,\n      ...(result.authorized ? {} : { reason: result.reason }),\n    });\n\n    if (!result.authorized) {\n      throw new ForbiddenException({\n        error: 'Forbidden',\n        code: 'FORBIDDEN',\n        reason: result.reason,\n      });\n    }\n\n    (request as AuthorizedRequest).authorization = result;\n    return true;\n  }\n}\n"],"mappings":";;;;;;;;;AAMA,IAAa,oBAAoB;AAkCjC,SAAgB,MACd,mBACA,QACgC;AAKhC,SAAA,GAAA,eAAA,aAAmB,mBAHjB,OAAO,sBAAsB,YAAY,WAAW,KAAA,IAChD;EAAE,UAAU;EAAmB;EAAQ,GACtC,kBACuC;;;;;;;;;;;;;AC3ChD,IAAa,eAAe;AAyBrB,IAAA,cAAA,eAAA,MAAM,YAAY;CACvB,OAAO,QAAQ,QAA0C;EACvD,MAAM,SAAS,IAAI,qBAAA,YAAY,OAAO;AACtC,SAAO;GACL,QAAA;GACA,WAAW,CACT;IAAE,SAAS,qBAAA;IAAa,UAAU;IAAQ,EAC1C;IAAE,SAAS;IAAc,UAAU;IAAQ,CAC5C;GACD,SAAS,CAAC,qBAAA,aAAa,aAAa;GACrC;;;qEAZI,GAAA,GAAA,eAAA,QACD,EAAE,CAAC,CAAA,EAAA,YAAA;;;;;;;;;;;;;;;;;ACXX,IAAa,cAAc;;;;;;;;;;;;;;;;;AAqC3B,SAAS,oBAAoB,GAAoC;AAC/D,QACE,OAAO,MAAM,YACb,MAAM,QACN,cAAc,KACd,YAAY,KACZ,OAAQ,EAAwB,aAAa,YAC7C,OAAQ,EAAwB,WAAW;;AAKxC,IAAA,aAAA,MAAM,WAAkC;CAI7C,YACE,QACA,oBACA;6CANF,mBAAA,KAAA,EAAiB;6CACjB,aAAA,KAAA,EAAiB;AAGwB,OAAA,SAAA;AAGvC,MAAI,sBAAsB,oBAAoB,mBAAmB,CAC/D,MAAK,kBAAkB;MAEvB,MAAK,YAAY;;CAIrB,sBAA8B,SAAqD;EACjF,MAAM,UAAU,QAAQ,YAAY;EACpC,MAAM,QAAQ,QAAQ,UAAU;AAEhC,MAAI,KAAK,WAAW;GAClB,MAAM,cAAc,KAAK,UAAU,IAAkB,mBAAmB,QAAQ;GAChF,MAAM,YAAY,KAAK,UAAU,IAAkB,mBAAmB,MAAM;AAC5E,OAAI,YAAa,QAAO;AACxB,OAAI,UAAW,QAAO;;AAGxB,MAAI,OAAO,YAAY,eAAe,OAAO,QAAQ,gBAAgB,YAAY;GAC/E,MAAM,cAAc,QAAQ,YAAY,mBAAmB,QAAQ;GAGnE,MAAM,YAAY,QAAQ,YAAY,mBAAmB,MAAM;AAC/D,OAAI,YAAa,QAAO;AACxB,OAAI,UAAW,QAAO;;;CAK1B,MAAM,YAAY,SAA6C;EAC7D,MAAM,UAAU,QAAQ,cAAc,CAAC,YAAY;EAEnD,MAAM,UAAU,KAAK,mBAAmB,KAAK,sBAAsB,QAAQ;AAE3E,MAAI,SAAS,YAAY,SAAS,OAChC,eAAA,WAAW,QAAQ;GACjB,UAAU,QAAQ;GAClB,QAAQ,QAAQ;GAChB,cAAc,CAAC,CAAC,KAAK;GACrB,SAAS,QAAQ,YAAY,EAAE;GAC/B,YAAY,QAAQ,UAAU,EAAE;GACjC,CAAC;AAGJ,MAAI,CAAC,WAAW,CAAC,QAAQ,YAAY,CAAC,QAAQ,OAC5C,OAAM,IAAI,eAAA,mBACR,yFACD;AAGH,MAAI,CAAC,KAAK,OACR,OAAM,IAAI,eAAA,mBACR,yHACD;AAIH,MAAI,CAAC,MADe,qBAAA,wBAAwB,SAAS,KAAK,OAAO,OAAO,CAEtE,OAAM,IAAI,eAAA,sBAAsB;GAAE,OAAO;GAAgB,MAAM;GAAmB,CAAC;EAGrF,IAAI,mBAAmD;EAEvD,MAAM,OAAO;AACb,MAAI,KAAK,kBAAkB;AACzB,sBAAmB,MAAM,KAAK,iBAAiB;IAC7C,cAAc,QAAQ;IACtB;IACD,CAAC;AACF,OAAI,CAAC,iBACH,OAAM,IAAI,eAAA,kBAAkB;IAAE,OAAO;IAAsB,MAAM;IAAa,CAAC;;EAInF,MAAM,SAAS,MAAM,KAAK,OAAO,aAC/B,QAAQ,UACR,QAAQ,QACR,EACE,SAAS,EACP,UAAU,oBAAoB,KAAA,GAC/B,EACF,EACD,QACD;AAED,gBAAA,WAAW,QAAQ;GACjB,UAAU,QAAQ;GAClB,QAAQ,QAAQ;GAChB,YAAY,OAAO;GACnB,GAAI,OAAO,aAAa,EAAE,GAAG,EAAE,QAAQ,OAAO,QAAQ;GACvD,CAAC;AAEF,MAAI,CAAC,OAAO,WACV,OAAM,IAAI,eAAA,mBAAmB;GAC3B,OAAO;GACP,MAAM;GACN,QAAQ,OAAO;GAChB,CAAC;AAGH,UAA8B,gBAAgB;AAC/C,SAAO;;;;iCA9GE;+CAMD,aAAa,CAAA"}