@klerick/acl-json-api-nestjs 0.1.0

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@klerick/acl-json-api-nestjs",
+  "version": "0.1.0",
+  "dependencies": {
+    "@casl/ability": "^6.0.0"
+  },
+  "type": "commonjs",
+  "main": "./src/index.js",
+  "typings": "./src/index.d.ts",
+  "peerDependencies": {
+    "@klerick/json-api-nestjs": "^10.0.0-beta.6"
+  },
+  "exports": {
+    "./package.json": "./package.json",
+    ".": {
+      "types": "./src/index.d.ts",
+      "default": "./src/index.js"
+    }
+  },
+  "types": "./src/index.d.ts",
+  "license": "MIT",
+  "contributors": [
+    {
+      "email": "klerick666@gmain.com",
+      "name": "Aleksandr Kharkovey"
+    }
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/klerick/nestjs-json-api.git"
+  },
+  "engines": {
+    "node": ">= 20.0.0"
+  },
+  "files": [
+    "**/*"
+  ],
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * NestJS ACL Permissions Module
+ * CASL-based access control for JSON API controllers
+ */
+export { AclPermissionsModule } from './lib/nestjs-acl-permissions.module';
+export { AclAction, AclRule, AclRulesLoader, AclSubject } from './lib/types';
+export { ExtendAbility } from './lib/factories';
+export { wrapperJsonApiController } from './lib/wrappers';

package/src/index.js

@@ -0,0 +1,15 @@
+"use strict";
+/**
+ * NestJS ACL Permissions Module
+ * CASL-based access control for JSON API controllers
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.wrapperJsonApiController = exports.ExtendAbility = exports.AclPermissionsModule = void 0;
+// Main module
+var nestjs_acl_permissions_module_1 = require("./lib/nestjs-acl-permissions.module");
+Object.defineProperty(exports, "AclPermissionsModule", { enumerable: true, get: function () { return nestjs_acl_permissions_module_1.AclPermissionsModule; } });
+var factories_1 = require("./lib/factories");
+Object.defineProperty(exports, "ExtendAbility", { enumerable: true, get: function () { return factories_1.ExtendAbility; } });
+var wrappers_1 = require("./lib/wrappers");
+Object.defineProperty(exports, "wrapperJsonApiController", { enumerable: true, get: function () { return wrappers_1.wrapperJsonApiController; } });
+//# sourceMappingURL=index.js.map

package/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../libs/acl-permissions/nestjs-acl-permissions/src/index.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,cAAc;AACd,qFAA2E;AAAlE,qIAAA,oBAAoB,OAAA;AAG7B,6CAAgD;AAAvC,0GAAA,aAAa,OAAA;AACtB,2CAA0D;AAAjD,oHAAA,wBAAwB,OAAA"}

package/src/lib/constants/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Token for injecting ACL module options
+ */
+export declare const ACL_MODULE_OPTIONS: unique symbol;
+/**
+ * Metadata key for @AclController decorator
+ */
+export declare const ACL_CONTROLLER_METADATA: unique symbol;
+/**
+ * Key for storing ACL data in context
+ */
+export declare const ACL_CONTEXT_KEY: unique symbol;
+export declare const MODULE_REF_PROPS: unique symbol;
+export declare const ORIGINAL_ORM_SERVICE: unique symbol;

package/src/lib/constants/index.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ORIGINAL_ORM_SERVICE = exports.MODULE_REF_PROPS = exports.ACL_CONTEXT_KEY = exports.ACL_CONTROLLER_METADATA = exports.ACL_MODULE_OPTIONS = void 0;
+/**
+ * Token for injecting ACL module options
+ */
+exports.ACL_MODULE_OPTIONS = Symbol('ACL_MODULE_OPTIONS');
+/**
+ * Metadata key for @AclController decorator
+ */
+exports.ACL_CONTROLLER_METADATA = Symbol('ACL_CONTROLLER_METADATA');
+/**
+ * Key for storing ACL data in context
+ */
+exports.ACL_CONTEXT_KEY = Symbol('ACL_CONTEXT_KEY');
+exports.MODULE_REF_PROPS = Symbol('MODULE_REF_PROPS');
+exports.ORIGINAL_ORM_SERVICE = Symbol('ORIGINAL_ORM_SERVICE');
+//# sourceMappingURL=index.js.map

package/src/lib/constants/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../libs/acl-permissions/nestjs-acl-permissions/src/lib/constants/index.ts"],"names":[],"mappings":";;;AAAA;;GAEG;AACU,QAAA,kBAAkB,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAC;AAE/D;;GAEG;AACU,QAAA,uBAAuB,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAC;AACzE;;GAEG;AACU,QAAA,eAAe,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAG5C,QAAA,gBAAgB,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC;AAC9C,QAAA,oBAAoB,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAC"}

package/src/lib/decorators/acl-controller.decorator.d.ts

@@ -0,0 +1,4 @@
+import type { AnyEntity } from '@klerick/json-api-nestjs-shared';
+import type { JsonBaseController } from '@klerick/json-api-nestjs';
+import type { AclControllerOptions } from '../types';
+export declare function AclController<E extends AnyEntity = AnyEntity, Controller = JsonBaseController<E, 'id'>>(options: AclControllerOptions<E, Controller>): <T extends abstract new (...args: any[]) => any>(target: T) => T;

package/src/lib/decorators/acl-controller.decorator.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AclController = AclController;
+const common_1 = require("@nestjs/common");
+const constants_1 = require("../constants");
+const guards_1 = require("../guards");
+function AclController(options) {
+    return function (target) {
+        const metadata = {
+            subject: options.subject,
+            methods: (options.methods || {}),
+            enabled: options.enabled ?? true,
+        };
+        Reflect.defineMetadata(constants_1.ACL_CONTROLLER_METADATA, metadata, target);
+        (0, common_1.UseGuards)(guards_1.AclGuard)(target);
+        return target;
+    };
+}
+//# sourceMappingURL=acl-controller.decorator.js.map

package/src/lib/decorators/acl-controller.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl-controller.decorator.js","sourceRoot":"","sources":["../../../../../../../libs/acl-permissions/nestjs-acl-permissions/src/lib/decorators/acl-controller.decorator.ts"],"names":[],"mappings":";;AAQA,sCAiBC;AAvBD,2CAA2C;AAC3C,4CAAuD;AAGvD,sCAAqC;AAErC,SAAgB,aAAa,CAG3B,OAA4C;IAC5C,OAAO,UACL,MAAS;QAET,MAAM,QAAQ,GAA6B;YACzC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAgD;YAC/E,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI;SACjC,CAAC;QAEF,OAAO,CAAC,cAAc,CAAC,mCAAuB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAClE,IAAA,kBAAS,EAAC,iBAAQ,CAAC,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/src/lib/decorators/index.d.ts

@@ -0,0 +1 @@
+export { AclController } from './acl-controller.decorator';

package/src/lib/decorators/index.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AclController = void 0;
+var acl_controller_decorator_1 = require("./acl-controller.decorator");
+Object.defineProperty(exports, "AclController", { enumerable: true, get: function () { return acl_controller_decorator_1.AclController; } });
+//# sourceMappingURL=index.js.map

package/src/lib/decorators/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../libs/acl-permissions/nestjs-acl-permissions/src/lib/decorators/index.ts"],"names":[],"mappings":";;;AAAA,uEAA2D;AAAlD,yHAAA,aAAa,OAAA"}

package/src/lib/factories/ability-proxy.factory.d.ts

@@ -0,0 +1,17 @@
+import { ModuleRef } from '@nestjs/core';
+import type { AclModuleOptions } from '../types';
+import { ExtendAbility } from './ability.factory';
+import { FactoryProvider } from '@nestjs/common';
+/**
+ * Creates a Proxy for ExtendableAbility that lazily retrieves the actual ability
+ * from CLS (Continuation Local Storage) on each method/property access.
+ *
+ * This allows the provider to be a SINGLETON while still accessing request-specific
+ * ability instances without using Scope.REQUEST.
+ *
+ * @param moduleRef - NestJS ModuleRef for lazy dependency resolution
+ * @param options - ACL module options containing contextStore configuration
+ * @returns Proxy that acts as ExtendableAbility
+ */
+export declare function createAbilityProxy(moduleRef: ModuleRef, options: AclModuleOptions): ExtendAbility;
+export declare const AbilityProvider: FactoryProvider<ExtendAbility>;

package/src/lib/factories/ability-proxy.factory.js

@@ -0,0 +1,100 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AbilityProvider = void 0;
+exports.createAbilityProxy = createAbilityProxy;
+const core_1 = require("@nestjs/core");
+const ability_factory_1 = require("./ability.factory");
+const constants_1 = require("../constants");
+/**
+ * Creates a Proxy for ExtendableAbility that lazily retrieves the actual ability
+ * from CLS (Continuation Local Storage) on each method/property access.
+ *
+ * This allows the provider to be a SINGLETON while still accessing request-specific
+ * ability instances without using Scope.REQUEST.
+ *
+ * @param moduleRef - NestJS ModuleRef for lazy dependency resolution
+ * @param options - ACL module options containing contextStore configuration
+ * @returns Proxy that acts as ExtendableAbility
+ */
+function createAbilityProxy(moduleRef, options) {
+    let contextStore;
+    /**
+     * Lazily initializes and retrieves the context store
+     */
+    const getContextStore = () => {
+        if (!contextStore && options.contextStore) {
+            contextStore = moduleRef.get(options.contextStore, {
+                strict: false,
+            });
+        }
+        return contextStore;
+    };
+    /**
+     * Retrieves ExtendableAbility from CLS for the current request
+     * Throws descriptive error if ability is not found
+     */
+    const getAbility = () => {
+        const store = getContextStore();
+        if (!store) {
+            throw new Error('[ACL] contextStore is not configured. ' +
+                'Make sure you configured AclPermissionsModule.forRoot() with contextStore option. ' +
+                'Example: { contextStore: ClsService }');
+        }
+        const ability = store.get(constants_1.ACL_CONTEXT_KEY);
+        if (!ability) {
+            throw new Error('[ACL] ExtendAbility not found in context store. ' +
+                'Possible causes:\n' +
+                '  1. Service is called BEFORE AclGuard executed (ability not yet created)\n' +
+                '  2. No rules loaded for this action (check your RulesLoader.loadRules())\n' +
+                '  3. AclGuard was not applied to this controller (check @AclController or wrapperJsonApiController hook)\n' +
+                '  4. contextStore middleware is not mounted (check ClsModule configuration)');
+        }
+        return ability;
+    };
+    // Create Proxy that forwards all method/property access to the real ExtendableAbility
+    return new Proxy({}, {
+        get(target, prop) {
+            if (!Reflect.has(ability_factory_1.ExtendAbility.prototype, prop)) {
+                return undefined;
+            }
+            // Special handling for Symbol.toStringTag (used by Object.prototype.toString)
+            if (prop === Symbol.toStringTag) {
+                return 'ExtendableAbility';
+            }
+            // Special handling for typeof checks
+            if (prop === 'constructor') {
+                return ability_factory_1.ExtendAbility;
+            }
+            // Get the actual ability from CLS
+            const ability = getAbility();
+            // Get the property/method from the real ability
+            const value = Reflect.get(ability, prop, ability);
+            // If it's a function, bind it to the ability instance
+            if (typeof value === 'function') {
+                return value.bind(ability);
+            }
+            return value;
+        },
+        // Support for 'prop in ability' checks
+        has(target, prop) {
+            const ability = getAbility();
+            return Reflect.has(ability, prop);
+        },
+        // Support for Object.keys(), Object.getOwnPropertyNames(), etc.
+        ownKeys(target) {
+            const ability = getAbility();
+            return Reflect.ownKeys(ability);
+        },
+        // Support for Object.getOwnPropertyDescriptor()
+        getOwnPropertyDescriptor(target, prop) {
+            const ability = getAbility();
+            return Reflect.getOwnPropertyDescriptor(ability, prop);
+        },
+    });
+}
+exports.AbilityProvider = {
+    provide: ability_factory_1.ExtendAbility,
+    useFactory: createAbilityProxy,
+    inject: [core_1.ModuleRef, constants_1.ACL_MODULE_OPTIONS],
+};
+//# sourceMappingURL=ability-proxy.factory.js.map

package/src/lib/factories/ability-proxy.factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ability-proxy.factory.js","sourceRoot":"","sources":["../../../../../../../libs/acl-permissions/nestjs-acl-permissions/src/lib/factories/ability-proxy.factory.ts"],"names":[],"mappings":";;;AAkBA,gDAgGC;AAlHD,uCAAyC;AAEzC,uDAAkD;AAClD,4CAAmE;AAInE;;;;;;;;;;GAUG;AACH,SAAgB,kBAAkB,CAChC,SAAoB,EACpB,OAAyB;IAEzB,IAAI,YAAyC,CAAC;IAE9C;;OAEG;IACH,MAAM,eAAe,GAAG,GAAgC,EAAE;QACxD,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1C,YAAY,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE;gBACjD,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;QACL,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC,CAAC;IAEF;;;OAGG;IACH,MAAM,UAAU,GAAG,GAAkB,EAAE;QACrC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,wCAAwC;gBACtC,oFAAoF;gBACpF,uCAAuC,CAC1C,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAgB,2BAAe,CAAC,CAAC;QAE1D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,kDAAkD;gBAChD,oBAAoB;gBACpB,6EAA6E;gBAC7E,6EAA6E;gBAC7E,4GAA4G;gBAC5G,6EAA6E,CAChF,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,sFAAsF;IACtF,OAAO,IAAI,KAAK,CAAC,EAAmB,EAAE;QACpC,GAAG,CAAC,MAAM,EAAE,IAAqB;YAC/B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,+BAAa,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;gBAChD,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,8EAA8E;YAC9E,IAAI,IAAI,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;gBAChC,OAAO,mBAAmB,CAAC;YAC7B,CAAC;YAED,qCAAqC;YACrC,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;gBAC3B,OAAO,+BAAa,CAAC;YACvB,CAAC;YAED,kCAAkC;YAClC,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;YAC7B,gDAAgD;YAChD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YAElD,sDAAsD;YACtD,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;gBAChC,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7B,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAED,uCAAuC;QACvC,GAAG,CAAC,MAAM,EAAE,IAAI;YACd,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;YAC7B,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACpC,CAAC;QAED,gEAAgE;QAChE,OAAO,CAAC,MAAM;YACZ,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;YAC7B,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;QAED,gDAAgD;QAChD,wBAAwB,CAAC,MAAM,EAAE,IAAI;YACnC,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;YAC7B,OAAO,OAAO,CAAC,wBAAwB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACzD,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAEY,QAAA,eAAe,GAAmC;IAC7D,OAAO,EAAE,+BAAa;IACtB,UAAU,EAAE,kBAAkB;IAC9B,MAAM,EAAE,CAAC,gBAAS,EAAE,8BAAkB,CAAC;CACxC,CAAC"}

package/src/lib/factories/ability.factory.d.ts

@@ -0,0 +1,49 @@
+import { FactoryProvider } from '@nestjs/common';
+import { AbilityTuple, MongoQuery, PureAbility, RawRuleFrom } from '@casl/ability';
+import { RuleMaterializer } from '../services';
+import { AclInputData, AclRule } from '../types';
+import { Query, QueryOne } from '@klerick/json-api-nestjs';
+import { QueryField } from '@klerick/json-api-nestjs-shared';
+export type AbilityFactory = (subject: string, action: string, rules: AclRule[], context: Record<string, unknown>, helpers: Record<string, (...args: unknown[]) => unknown>) => ExtendAbility;
+export declare const ABILITY_FACTORY: unique symbol;
+export declare const AbilityFactoryProvider: FactoryProvider;
+export declare class ExtendAbility<A extends AbilityTuple = AbilityTuple, C extends MongoQuery = MongoQuery> extends PureAbility<A, C> {
+    private ruleMaterializer;
+    private currentSubject;
+    private currentAction;
+    private allRules;
+    private readonly context;
+    private readonly helpers;
+    private _hasFields;
+    private _hasConditions;
+    constructor(ruleMaterializer: RuleMaterializer, currentSubject: string, currentAction: string, allRules: RawRuleFrom<A, C>[], context: Record<string, unknown>, helpers: Record<string, (...args: unknown[]) => unknown>);
+    updateWithInput(input: AclInputData): void;
+    get hasConditions(): boolean;
+    get hasFields(): boolean;
+    get action(): string;
+    get subject(): string;
+    hasConditionsAndFields(): boolean;
+    getQueryObject<E extends object, IdKey extends string, Q extends QueryOne<E, IdKey> | Query<E, IdKey>>(): {
+        fields?: Q[QueryField.fields];
+        include?: Q[QueryField.include];
+        rulesForQuery?: Record<string, unknown>;
+    };
+    /**
+     * Process conditions recursively: extract fields, transform structure, transform operators for MikroORM
+     */
+    private processConditionsForQuery;
+    /**
+     * Transform CASL operators to MikroORM operators in field values
+     * $regex → $re, $all → $contains
+     */
+    private transformOperatorsInValue;
+    /**
+     * Check if MongoDB query is empty
+     */
+    private isEmptyQuery;
+    /**
+     * Splits rules into those with @input templates and without
+     * Rules with @input will be materialized lazily
+     */
+    private static splitRulesByInput;
+}

package/src/lib/factories/ability.factory.js

@@ -0,0 +1,235 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExtendAbility = exports.AbilityFactoryProvider = exports.ABILITY_FACTORY = void 0;
+const ability_1 = require("@casl/ability");
+const extra_1 = require("@casl/ability/extra");
+const services_1 = require("../services");
+const types_1 = require("../types");
+const core_1 = require("@nestjs/core");
+exports.ABILITY_FACTORY = Symbol('ABILITY_FACTORY');
+exports.AbilityFactoryProvider = {
+    provide: exports.ABILITY_FACTORY,
+    useFactory: function AbilityFactory(moduleRef) {
+        return function createEmptyAbility(subject, action, rules, context, helpers) {
+            return new ExtendAbility(moduleRef.get(services_1.RuleMaterializer), subject, action, rules, context, helpers);
+        };
+    },
+    inject: [core_1.ModuleRef],
+};
+class ExtendAbility extends ability_1.PureAbility {
+    ruleMaterializer;
+    currentSubject;
+    currentAction;
+    allRules;
+    context;
+    helpers;
+    _hasFields = undefined;
+    _hasConditions = undefined;
+    constructor(ruleMaterializer, currentSubject, currentAction, allRules, context, helpers) {
+        const { withoutInput } = ExtendAbility.splitRulesByInput(allRules);
+        const materialized = ruleMaterializer.materialize(withoutInput, context, helpers, undefined // NO @input
+        );
+        super(materialized, {
+            conditionsMatcher: ability_1.mongoQueryMatcher,
+            fieldMatcher: ability_1.fieldPatternMatcher,
+        });
+        this.ruleMaterializer = ruleMaterializer;
+        this.currentSubject = currentSubject;
+        this.currentAction = currentAction;
+        this.allRules = allRules;
+        this.context = context;
+        this.helpers = helpers;
+    }
+    updateWithInput(input) {
+        const materialized = this.ruleMaterializer.materialize(this.allRules, this.context, this.helpers, input);
+        this.update(materialized);
+    }
+    get hasConditions() {
+        if (this._hasConditions === undefined) {
+            this.hasConditionsAndFields();
+        }
+        return this._hasConditions;
+    }
+    get hasFields() {
+        if (this._hasFields === undefined) {
+            this.hasConditionsAndFields();
+        }
+        return this._hasFields;
+    }
+    get action() {
+        return this.currentAction;
+    }
+    get subject() {
+        return this.currentSubject;
+    }
+    hasConditionsAndFields() {
+        const rules = this.allRules;
+        for (let i = 0; i < rules.length; i++) {
+            if (rules[i].conditions !== undefined) {
+                this._hasConditions = true;
+            }
+            if (rules[i].fields !== undefined) {
+                this._hasFields = true;
+            }
+            if (this._hasConditions === true && this._hasFields === true)
+                return false;
+        }
+        // Set false if not found
+        if (this._hasConditions === undefined) {
+            this._hasConditions = false;
+        }
+        if (this._hasFields === undefined) {
+            this._hasFields = false;
+        }
+        return true;
+    }
+    getQueryObject() {
+        const fieldMap = new Map();
+        const includeSet = new Set();
+        const rulesForQuery = (0, extra_1.rulesToQuery)(this, this.currentAction, this.currentSubject, (rule) => {
+            const { conditions, inverted } = rule;
+            if (!conditions)
+                return {};
+            const transformed = this.processConditionsForQuery(conditions, fieldMap, includeSet);
+            return inverted ? { $not: transformed } : transformed;
+        });
+        // Build fields as object (not array)
+        let fields = undefined;
+        let include = undefined;
+        if (fieldMap.size > 0) {
+            fields = {};
+            Array.from(fieldMap.entries()).forEach(([key, valueSet]) => {
+                fields[key] = Array.from(valueSet);
+            });
+        }
+        if (includeSet.size > 0) {
+            include = Array.from(includeSet);
+        }
+        return {
+            ...(fields && { fields }),
+            ...(include && { include }),
+            // Return undefined if rulesForQuery is null or empty object
+            ...(rulesForQuery &&
+                !this.isEmptyQuery(rulesForQuery) && {
+                rulesForQuery,
+            }),
+        };
+    }
+    /**
+     * Process conditions recursively: extract fields, transform structure, transform operators for MikroORM
+     */
+    processConditionsForQuery(conditions, fieldMap, includeSet) {
+        const result = {};
+        for (const [fieldPath, value] of Object.entries(conditions)) {
+            // MongoDB operators at top level ($or, $and, $nor, etc.)
+            if (fieldPath.startsWith('$')) {
+                // Transform $nor → $not: { $or: [...] }
+                if (fieldPath === '$nor' && Array.isArray(value)) {
+                    result['$not'] = {
+                        $or: value.map((subCondition) => this.processConditionsForQuery(subCondition, fieldMap, includeSet)),
+                    };
+                    continue;
+                }
+                // For $or/$and, recursively process
+                if ((fieldPath === '$or' || fieldPath === '$and') && Array.isArray(value)) {
+                    result[fieldPath] = value.map((subCondition) => this.processConditionsForQuery(subCondition, fieldMap, includeSet));
+                    continue;
+                }
+                // Keep other operators as is
+                result[fieldPath] = value;
+                continue;
+            }
+            // Parse field path
+            const [firstPart, secondPart] = fieldPath.split('.');
+            if (!secondPart) {
+                // Target entity field: 'authorId'
+                const targetSet = fieldMap.get('target') || new Set();
+                targetSet.add(firstPart);
+                fieldMap.set('target', targetSet);
+                // Transform operators in field values
+                result[firstPart] = this.transformOperatorsInValue(value);
+            }
+            else {
+                // Relation field: 'profile.name'
+                const relationSet = fieldMap.get(firstPart) || new Set();
+                relationSet.add(secondPart);
+                fieldMap.set(firstPart, relationSet);
+                includeSet.add(firstPart);
+                // Transform: 'profile.name' → { profile: { name: value } }
+                // Merge multiple fields from same relation
+                if (!result[firstPart]) {
+                    result[firstPart] = {};
+                }
+                result[firstPart][secondPart] =
+                    this.transformOperatorsInValue(value);
+            }
+        }
+        return result;
+    }
+    /**
+     * Transform CASL operators to MikroORM operators in field values
+     * $regex → $re, $all → $contains
+     */
+    transformOperatorsInValue(value) {
+        if (value === null || typeof value !== 'object') {
+            return value;
+        }
+        if (Array.isArray(value)) {
+            return value.map((item) => this.transformOperatorsInValue(item));
+        }
+        const result = {};
+        for (const [key, val] of Object.entries(value)) {
+            // Transform $regex → $re
+            if (key === '$regex') {
+                result['$re'] = val;
+                continue;
+            }
+            // Transform $all → $contains
+            if (key === '$all') {
+                result['$contains'] = val;
+                continue;
+            }
+            // Recursively process other values
+            result[key] = this.transformOperatorsInValue(val);
+        }
+        return result;
+    }
+    /**
+     * Check if MongoDB query is empty
+     */
+    isEmptyQuery(query) {
+        const keys = Object.keys(query);
+        if (keys.length === 0)
+            return true;
+        // Check for {$or: [{}]} or {$and: [{}]} patterns
+        if (keys.length === 1 && (keys[0] === '$or' || keys[0] === '$and')) {
+            const value = query[keys[0]];
+            if (Array.isArray(value)) {
+                return value.every((item) => typeof item === 'object' &&
+                    item !== null &&
+                    Object.keys(item).length === 0);
+            }
+        }
+        return false;
+    }
+    /**
+     * Splits rules into those with @input templates and without
+     * Rules with @input will be materialized lazily
+     */
+    static splitRulesByInput(rules) {
+        const withoutInput = [];
+        const withInput = [];
+        for (const rule of rules) {
+            const jsonStr = JSON.stringify(rule);
+            if (jsonStr.includes(types_1.ACL_INPUT_TEMPLATE)) {
+                withInput.push(rule);
+            }
+            else {
+                withoutInput.push(rule);
+            }
+        }
+        return { withoutInput, withInput };
+    }
+}
+exports.ExtendAbility = ExtendAbility;
+//# sourceMappingURL=ability.factory.js.map

package/src/lib/factories/ability.factory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ability.factory.js","sourceRoot":"","sources":["../../../../../../../libs/acl-permissions/nestjs-acl-permissions/src/lib/factories/ability.factory.ts"],"names":[],"mappings":";;;AACA,2CAOuB;AACvB,+CAAmD;AACnD,0CAA+C;AAE/C,oCAAqE;AACrE,uCAAyC;AAY5B,QAAA,eAAe,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;AAC5C,QAAA,sBAAsB,GAAoB;IACrD,OAAO,EAAE,uBAAe;IACxB,UAAU,EAAE,SAAS,cAAc,CAAC,SAAoB;QACtD,OAAO,SAAS,kBAAkB,CAIhC,OAAe,EACf,MAAc,EACd,KAA0B,EAC1B,OAAgC,EAChC,OAAwD;YAExD,OAAO,IAAI,aAAa,CACtB,SAAS,CAAC,GAAG,CAAC,2BAAgB,CAAC,EAC/B,OAAO,EACP,MAAM,EACN,KAAK,EACL,OAAO,EACP,OAAO,CACR,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,CAAC,gBAAS,CAAC;CACpB,CAAC;AAEF,MAAa,aAGX,SAAQ,qBAAiB;IAKf;IACA;IACA;IACA;IAES;IACA;IAVX,UAAU,GAAwB,SAAS,CAAC;IAC5C,cAAc,GAAwB,SAAS,CAAC;IAExD,YACU,gBAAkC,EAClC,cAAsB,EACtB,aAAqB,EACrB,QAA6B,EAEpB,OAAgC,EAChC,OAAwD;QAEzE,MAAM,EAAE,YAAY,EAAE,GAAG,aAAa,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAEnE,MAAM,YAAY,GAAG,gBAAgB,CAAC,WAAW,CAC/C,YAAY,EACZ,OAAO,EACP,OAAO,EACP,SAAS,CAAC,YAAY;SACvB,CAAC;QAEF,KAAK,CAAC,YAAY,EAAE;YAClB,iBAAiB,EAAE,2BAAiB;YACpC,YAAY,EAAE,6BAAmB;SAClC,CAAC,CAAC;QApBK,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,mBAAc,GAAd,cAAc,CAAQ;QACtB,kBAAa,GAAb,aAAa,CAAQ;QACrB,aAAQ,GAAR,QAAQ,CAAqB;QAEpB,YAAO,GAAP,OAAO,CAAyB;QAChC,YAAO,GAAP,OAAO,CAAiD;IAe3E,CAAC;IAED,eAAe,CAAC,KAAmB;QACjC,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CAAC,WAAW,CACpD,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,OAAO,EACZ,KAAK,CACN,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC5B,CAAC;IAED,IAAI,aAAa;QACf,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAChC,CAAC;QACD,OAAO,IAAI,CAAC,cAAyB,CAAC;IACxC,CAAC;IAED,IAAI,SAAS;QACX,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAChC,CAAC;QACD,OAAO,IAAI,CAAC,UAAqB,CAAC;IACpC,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED,sBAAsB;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBACtC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC7B,CAAC;YACD,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAClC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;YACzB,CAAC;YACD,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI;gBAC1D,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,yBAAyB;QACzB,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC;QAC9B,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;QAC1B,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,cAAc;QASZ,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuB,CAAC;QAChD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QAErC,MAAM,aAAa,GAAG,IAAA,oBAAY,EAChC,IAAI,EACJ,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,cAAqB,EAC1B,CAAC,IAAI,EAAE,EAAE;YACP,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;YAEtC,IAAI,CAAC,UAAU;gBAAE,OAAO,EAAE,CAAC;YAE3B,MAAM,WAAW,GAAG,IAAI,CAAC,yBAAyB,CAChD,UAAU,EACV,QAAQ,EACR,UAAU,CACX,CAAC;YAEF,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;QACxD,CAAC,CACyB,CAAC;QAE7B,qCAAqC;QACrC,IAAI,MAAM,GAA0C,SAAS,CAAC;QAC9D,IAAI,OAAO,GAA2C,SAAS,CAAC;QAEhE,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,GAAG,EAAS,CAAC;YACnB,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE;gBACxD,MAAc,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,UAAU,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAQ,CAAC;QAC1C,CAAC;QAED,OAAO;YACL,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC;YACzB,GAAG,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,CAAC;YAC3B,4DAA4D;YAC5D,GAAG,CAAC,aAAa;gBACf,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,IAAI;gBACnC,aAAa;aACd,CAAC;SACL,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,yBAAyB,CAC/B,UAAmC,EACnC,QAAkC,EAClC,UAAuB;QAEvB,MAAM,MAAM,GAA4B,EAAE,CAAC;QAE3C,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5D,yDAAyD;YACzD,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9B,wCAAwC;gBACxC,IAAI,SAAS,KAAK,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBACjD,MAAM,CAAC,MAAM,CAAC,GAAG;wBACf,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAC9B,IAAI,CAAC,yBAAyB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC,CACnE;qBACF,CAAC;oBACF,SAAS;gBACX,CAAC;gBAED,oCAAoC;gBACpC,IAAI,CAAC,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC1E,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAC7C,IAAI,CAAC,yBAAyB,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC,CACnE,CAAC;oBACF,SAAS;gBACX,CAAC;gBAED,6BAA6B;gBAC7B,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;gBAC1B,SAAS;YACX,CAAC;YAED,mBAAmB;YACnB,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAErD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,kCAAkC;gBAClC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;gBACtD,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACzB,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;gBAElC,sCAAsC;gBACtC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;YAC5D,CAAC;iBAAM,CAAC;gBACN,iCAAiC;gBACjC,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;gBACzD,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAC5B,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;gBACrC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAE1B,2DAA2D;gBAC3D,2CAA2C;gBAC3C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;oBACvB,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;gBACzB,CAAC;gBACA,MAAM,CAAC,SAAS,CAA6B,CAAC,UAAU,CAAC;oBACxD,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACK,yBAAyB,CAAC,KAAc;QAC9C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,MAAM,GAA4B,EAAE,CAAC;QAE3C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,yBAAyB;YACzB,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACrB,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC;gBACpB,SAAS;YACX,CAAC;YAED,6BAA6B;YAC7B,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBACnB,MAAM,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC;gBAC1B,SAAS;YACX,CAAC;YAED,mCAAmC;YACnC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,KAA8B;QACjD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAEhC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEnC,iDAAiD;QACjD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC;YACnE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC,KAAK,CAChB,CAAC,IAAI,EAAE,EAAE,CACP,OAAO,IAAI,KAAK,QAAQ;oBACxB,IAAI,KAAK,IAAI;oBACb,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CACjC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,iBAAiB,CAI9B,KAA0B;QAK1B,MAAM,YAAY,GAAwB,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAwB,EAAE,CAAC;QAE1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAErC,IAAI,OAAO,CAAC,QAAQ,CAAC,0BAAkB,CAAC,EAAE,CAAC;gBACzC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;IACrC,CAAC;CACF;AA3SD,sCA2SC"}

package/src/lib/factories/index.d.ts

@@ -0,0 +1,2 @@
+export * from './ability.factory';
+export * from './ability-proxy.factory';

package/src/lib/factories/index.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./ability.factory"), exports);
+tslib_1.__exportStar(require("./ability-proxy.factory"), exports);
+//# sourceMappingURL=index.js.map

package/src/lib/factories/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../libs/acl-permissions/nestjs-acl-permissions/src/lib/factories/index.ts"],"names":[],"mappings":";;;AAAA,4DAAiC;AACjC,kEAAuC"}

package/src/lib/guards/acl.guard.d.ts

@@ -0,0 +1,21 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+/**
+ * Guard for ACL permission checking
+ *
+ * Thin wrapper that delegates all logic to AclAuthorizationService
+ *
+ * Applied automatically by @AclController decorator
+ *
+ * Lifecycle: Guards run BEFORE interceptors and pipes
+ *
+ * Benefits:
+ * - Fails fast (before handler execution)
+ * - Semantic correctness (Guard = authorization)
+ * - Supports onNoRules policy (deny/allow/warn)
+ */
+export declare class AclGuard implements CanActivate {
+    private readonly moduleRef;
+    private readonly reflector;
+    private readonly logger;
+    canActivate(executionContext: ExecutionContext): Promise<boolean>;
+}