@klerick/acl-json-api-nestjs 0.1.0

package/src/lib/guards/acl.guard.js

@@ -0,0 +1,68 @@
+"use strict";
+var AclGuard_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AclGuard = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const services_1 = require("../services");
+const constants_1 = require("../constants");
+/**
+ * Guard for ACL permission checking
+ *
+ * Thin wrapper that delegates all logic to AclAuthorizationService
+ *
+ * Applied automatically by @AclController decorator
+ *
+ * Lifecycle: Guards run BEFORE interceptors and pipes
+ *
+ * Benefits:
+ * - Fails fast (before handler execution)
+ * - Semantic correctness (Guard = authorization)
+ * - Supports onNoRules policy (deny/allow/warn)
+ */
+let AclGuard = AclGuard_1 = class AclGuard {
+    moduleRef;
+    reflector;
+    logger = new common_1.Logger(AclGuard_1.name);
+    async canActivate(executionContext) {
+        const controller = executionContext.getClass();
+        const handler = executionContext.getHandler();
+        const controllerName = controller.name;
+        const methodName = handler.name;
+        const metadata = this.reflector.get(constants_1.ACL_CONTROLLER_METADATA, controller);
+        if (!metadata) {
+            this.logger.debug(`No @AclController metadata found on ${controllerName}, allowing access`);
+            return true;
+        }
+        // If ACL is disabled for this controller
+        if (metadata.enabled === false) {
+            this.logger.debug(`ACL disabled for controller ${controllerName}, allowing access`);
+            return true;
+        }
+        // Check if ACL is enabled for this specific method
+        const isMethodEnabled = metadata.methods[methodName];
+        // If method configuration is explicitly false, allow access
+        if (isMethodEnabled === false) {
+            this.logger.debug(`ACL disabled for method ${controllerName}.${methodName}, allowing access`);
+            return true;
+        }
+        // Delegate all logic to authorization service
+        return this.moduleRef.get(services_1.AclAuthorizationService, {
+            strict: false,
+        }).authorize(controllerName, methodName, metadata);
+    }
+};
+exports.AclGuard = AclGuard;
+tslib_1.__decorate([
+    (0, common_1.Inject)(core_1.ModuleRef),
+    tslib_1.__metadata("design:type", core_1.ModuleRef)
+], AclGuard.prototype, "moduleRef", void 0);
+tslib_1.__decorate([
+    (0, common_1.Inject)(core_1.Reflector),
+    tslib_1.__metadata("design:type", core_1.Reflector)
+], AclGuard.prototype, "reflector", void 0);
+exports.AclGuard = AclGuard = AclGuard_1 = tslib_1.__decorate([
+    (0, common_1.Injectable)()
+], AclGuard);
+//# sourceMappingURL=acl.guard.js.map

package/src/lib/guards/acl.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl.guard.js","sourceRoot":"","sources":["../../../../../../../libs/acl-permissions/nestjs-acl-permissions/src/lib/guards/acl.guard.ts"],"names":[],"mappings":";;;;;AAAA,2CAA2F;AAC3F,uCAAoD;AACpD,0CAAsD;AAEtD,4CAAuD;AAEvD;;;;;;;;;;;;;GAaG;AAEI,IAAM,QAAQ,gBAAd,MAAM,QAAQ;IACiB,SAAS,CAAa;IACtB,SAAS,CAAa;IAEzC,MAAM,GAAG,IAAI,eAAM,CAAC,UAAQ,CAAC,IAAI,CAAC,CAAC;IAEpD,KAAK,CAAC,WAAW,CAAC,gBAAkC;QAElD,MAAM,UAAU,GAAG,gBAAgB,CAAC,QAAQ,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,EAAE,CAAC;QAC9C,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC;QACvC,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;QAEhC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CACjC,mCAAuB,EACvB,UAAU,CACX,CAAC;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,uCAAuC,cAAc,mBAAmB,CACzE,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,yCAAyC;QACzC,IAAI,QAAQ,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,+BAA+B,cAAc,mBAAmB,CACjE,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,mDAAmD;QACnD,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAErD,4DAA4D;QAC5D,IAAI,eAAe,KAAK,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,2BAA2B,cAAc,IAAI,UAAU,mBAAmB,CAC3E,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,8CAA8C;QAC9C,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,kCAAuB,EAAE;YACjD,MAAM,EAAE,KAAK;SACd,CAAC,CAAC,SAAS,CAAC,cAAc,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IACrD,CAAC;CACF,CAAA;AAjDY,4BAAQ;AACiB;IAAnC,IAAA,eAAM,EAAC,gBAAS,CAAC;sCAA8B,gBAAS;2CAAC;AACtB;IAAnC,IAAA,eAAM,EAAC,gBAAS,CAAC;sCAA8B,gBAAS;2CAAC;mBAF/C,QAAQ;IADpB,IAAA,mBAAU,GAAE;GACA,QAAQ,CAiDpB"}

package/src/lib/guards/index.d.ts

@@ -0,0 +1 @@
+export * from './acl.guard';

package/src/lib/guards/index.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./acl.guard"), exports);
+//# sourceMappingURL=index.js.map

package/src/lib/guards/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../libs/acl-permissions/nestjs-acl-permissions/src/lib/guards/index.ts"],"names":[],"mappings":";;;AAAA,sDAA4B"}

package/src/lib/nestjs-acl-permissions.module.d.ts

@@ -0,0 +1,9 @@
+import { DynamicModule, OnModuleInit } from '@nestjs/common';
+import type { AclModuleOptions } from './types';
+export declare class AclPermissionsModule implements OnModuleInit {
+    private readonly moduleRef;
+    private readonly options;
+    private readonly logger;
+    static forRoot(options: AclModuleOptions): DynamicModule;
+    onModuleInit(): void;
+}

package/src/lib/nestjs-acl-permissions.module.js

@@ -0,0 +1,56 @@
+"use strict";
+var AclPermissionsModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AclPermissionsModule = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const constants_1 = require("./constants");
+const services_1 = require("./services");
+const guards_1 = require("./guards");
+const factories_1 = require("./factories");
+let AclPermissionsModule = AclPermissionsModule_1 = class AclPermissionsModule {
+    moduleRef;
+    options;
+    logger = new common_1.Logger(AclPermissionsModule_1.name);
+    static forRoot(options) {
+        return {
+            module: AclPermissionsModule_1,
+            providers: [
+                {
+                    provide: constants_1.ACL_MODULE_OPTIONS,
+                    useValue: options,
+                },
+                guards_1.AclGuard,
+                services_1.AclAuthorizationService,
+                services_1.RuleMaterializer,
+                factories_1.AbilityFactoryProvider,
+                factories_1.AbilityProvider,
+            ],
+            exports: [guards_1.AclGuard, services_1.AclAuthorizationService, factories_1.AbilityProvider],
+        };
+    }
+    onModuleInit() {
+        try {
+            this.moduleRef.get(this.options.rulesLoader, { strict: false });
+            this.moduleRef.get(this.options.contextStore, { strict: false });
+        }
+        catch (error) {
+            this.logger.warn(`RulesLoader or ContextStore not found, ACL will not work`);
+            throw error;
+        }
+    }
+};
+exports.AclPermissionsModule = AclPermissionsModule;
+tslib_1.__decorate([
+    (0, common_1.Inject)(core_1.ModuleRef),
+    tslib_1.__metadata("design:type", core_1.ModuleRef)
+], AclPermissionsModule.prototype, "moduleRef", void 0);
+tslib_1.__decorate([
+    (0, common_1.Inject)(constants_1.ACL_MODULE_OPTIONS),
+    tslib_1.__metadata("design:type", Object)
+], AclPermissionsModule.prototype, "options", void 0);
+exports.AclPermissionsModule = AclPermissionsModule = AclPermissionsModule_1 = tslib_1.__decorate([
+    (0, common_1.Module)({})
+], AclPermissionsModule);
+//# sourceMappingURL=nestjs-acl-permissions.module.js.map

package/src/lib/nestjs-acl-permissions.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nestjs-acl-permissions.module.js","sourceRoot":"","sources":["../../../../../../libs/acl-permissions/nestjs-acl-permissions/src/lib/nestjs-acl-permissions.module.ts"],"names":[],"mappings":";;;;;AAAA,2CAMwB;AACxB,uCAAyC;AACzC,2CAAiD;AAEjD,yCAAuE;AACvE,qCAAoC;AACpC,2CAAsE;AAG/D,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IACK,SAAS,CAAa;IACb,OAAO,CAAoB;IACvD,MAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;IAChE,MAAM,CAAC,OAAO,CAAC,OAAyB;QACtC,OAAO;YACL,MAAM,EAAE,sBAAoB;YAC5B,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,8BAAkB;oBAC3B,QAAQ,EAAE,OAAO;iBAClB;gBACD,iBAAQ;gBACR,kCAAuB;gBACvB,2BAAgB;gBAChB,kCAAsB;gBACtB,2BAAe;aAChB;YACD,OAAO,EAAE,CAAC,iBAAQ,EAAE,kCAAuB,EAAE,2BAAe,CAAC;SAC9D,CAAC;IACJ,CAAC;IAED,YAAY;QACV,IAAI,CAAC;YACH,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAC,MAAM,EAAE,KAAK,EAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAC,MAAM,EAAE,KAAK,EAAC,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,0DAA0D,CAC3D,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF,CAAA;AAjCY,oDAAoB;AACK;IAAnC,IAAA,eAAM,EAAC,gBAAS,CAAC;sCAA8B,gBAAS;uDAAC;AACb;IAA5C,IAAA,eAAM,EAAC,8BAAkB,CAAC;;qDAA6C;+BAF7D,oBAAoB;IADhC,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,oBAAoB,CAiChC"}

package/src/lib/services/acl-authorization.service.d.ts

@@ -0,0 +1,10 @@
+import { AclControllerMetadata } from '../types';
+export declare class AclAuthorizationService {
+    private readonly moduleRef;
+    private readonly options;
+    private readonly abilityFactory;
+    private readonly logger;
+    authorize(controllerName: string, action: string, metaData: AclControllerMetadata): Promise<boolean>;
+    private getDefaultRulesForAction;
+    private getSubjectFromInput;
+}

package/src/lib/services/acl-authorization.service.js

@@ -0,0 +1,100 @@
+"use strict";
+var AclAuthorizationService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AclAuthorizationService = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const constants_1 = require("../constants");
+const utils_1 = require("../utils");
+const factories_1 = require("../factories");
+let AclAuthorizationService = AclAuthorizationService_1 = class AclAuthorizationService {
+    moduleRef;
+    options;
+    abilityFactory;
+    logger = new common_1.Logger(AclAuthorizationService_1.name);
+    async authorize(controllerName, action, metaData) {
+        const { subject: subjectForRules } = metaData;
+        const actionOptions = (0, utils_1.getActionOptions)(this.options, metaData.methods[action]);
+        const subject = this.getSubjectFromInput(subjectForRules);
+        const rulesLoader = this.moduleRef.get(this.options.rulesLoader, { strict: false });
+        const [rules, context, helpers] = await Promise.all([
+            rulesLoader.loadRules(subjectForRules, action),
+            rulesLoader.getContext(),
+            rulesLoader.getHelpers(),
+        ]);
+        const resultRules = Array.isArray(rules) && rules.length > 0
+            ? rules
+            : this.getDefaultRulesForAction(controllerName, action, subject, actionOptions);
+        const ability = this.abilityFactory(subject, action, resultRules, context, helpers);
+        if (!ability.can(action, subject)) {
+            this.logger.debug(`Access denied for ${controllerName}.${action} (action: ${action}, subject: ${subject})`);
+            throw new common_1.ForbiddenException([
+                {
+                    code: 'forbidden',
+                    message: `not allow "${action}"`,
+                    path: ['action'],
+                },
+            ], {
+                description: `Access denied for ${action} on ${subject}`,
+            });
+        }
+        const contextStore = this.moduleRef.get(this.options.contextStore, {
+            strict: false,
+        });
+        contextStore.set(constants_1.ACL_CONTEXT_KEY, ability);
+        return true;
+    }
+    getDefaultRulesForAction(controllerName, action, subject, actionOptions) {
+        if (actionOptions.defaultRules && actionOptions.defaultRules.length > 0) {
+            this.logger.debug(`No rules for ${controllerName}.${action}, applying defaultRules`);
+            return actionOptions.defaultRules;
+        }
+        const policy = actionOptions.onNoRules || 'deny';
+        if (policy === 'deny') {
+            this.logger.error(`No ACL rules defined for ${controllerName}.${action}, denying access (onNoRules: '${policy}')`);
+            throw new common_1.ForbiddenException([
+                {
+                    code: 'forbidden',
+                    message: `not allow access`,
+                    path: [],
+                },
+            ], {
+                description: `No ACL rules defined for ${controllerName}.${action}`,
+            });
+        }
+        this.logger.warn(`No ACL rules defined for ${controllerName}.${action}, allowing access with permissive rule (onNoRules: '${policy}')`);
+        return [
+            {
+                action,
+                subject,
+            },
+        ];
+    }
+    getSubjectFromInput(subject) {
+        if (typeof subject === 'string') {
+            return subject;
+        }
+        if (typeof subject === 'function' && subject.name) {
+            return subject.name;
+        }
+        throw new Error('Entity shouldbe class or string');
+    }
+};
+exports.AclAuthorizationService = AclAuthorizationService;
+tslib_1.__decorate([
+    (0, common_1.Inject)(core_1.ModuleRef),
+    tslib_1.__metadata("design:type", core_1.ModuleRef)
+], AclAuthorizationService.prototype, "moduleRef", void 0);
+tslib_1.__decorate([
+    (0, common_1.Inject)(constants_1.ACL_MODULE_OPTIONS),
+    tslib_1.__metadata("design:type", Object)
+], AclAuthorizationService.prototype, "options", void 0);
+tslib_1.__decorate([
+    (0, common_1.Inject)(factories_1.ABILITY_FACTORY),
+    tslib_1.__metadata("design:type", Function)
+], AclAuthorizationService.prototype, "abilityFactory", void 0);
+exports.AclAuthorizationService = AclAuthorizationService = AclAuthorizationService_1 = tslib_1.__decorate([
+    (0, common_1.Injectable)()
+], AclAuthorizationService);
+//# sourceMappingURL=acl-authorization.service.js.map

package/src/lib/services/acl-authorization.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl-authorization.service.js","sourceRoot":"","sources":["../../../../../../../libs/acl-permissions/nestjs-acl-permissions/src/lib/services/acl-authorization.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAAgF;AAChF,uCAAyC;AACzC,4CAAmE;AASnE,oCAA4C;AAC5C,4CAA+D;AAIxD,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IACE,SAAS,CAAa;IACb,OAAO,CAAoB;IAC9B,cAAc,CAAkB;IAEzD,MAAM,GAAG,IAAI,eAAM,CAAC,yBAAuB,CAAC,IAAI,CAAC,CAAC;IAEnE,KAAK,CAAC,SAAS,CACb,cAAsB,EACtB,MAAc,EACd,QAA+B;QAE/B,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,QAAQ,CAAC;QAE9C,MAAM,aAAa,GAAG,IAAA,wBAAgB,EACpC,IAAI,CAAC,OAAO,EACZ,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CACzB,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAE1D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CACpC,IAAI,CAAC,OAAO,CAAC,WAAW,EACxB,EAAE,MAAM,EAAE,KAAK,EAAE,CAClB,CAAC;QAEF,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAClD,WAAW,CAAC,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC;YAC9C,WAAW,CAAC,UAAU,EAAE;YACxB,WAAW,CAAC,UAAU,EAAE;SACzB,CAAC,CAAC;QAEH,MAAM,WAAW,GACf,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YACtC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAC3B,cAAc,EACd,MAAM,EACN,OAAO,EACP,aAAa,CACd,CAAC;QAER,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACpF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,qBAAqB,cAAc,IAAI,MAAM,aAAa,MAAM,cAAc,OAAO,GAAG,CACzF,CAAC;YACF,MAAM,IAAI,2BAAkB,CAC1B;gBACE;oBACE,IAAI,EAAE,WAAW;oBACjB,OAAO,EAAE,cAAc,MAAM,GAAG;oBAChC,IAAI,EAAE,CAAC,QAAQ,CAAC;iBACjB;aACF,EACD;gBACE,WAAW,EAAE,qBAAqB,MAAM,OAAO,OAAO,EAAE;aACzD,CACF,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE;YACjE,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QAEH,YAAY,CAAC,GAAG,CAAC,2BAAe,EAAE,OAAO,CAAC,CAAC;QAE3C,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,wBAAwB,CAC9B,cAAsB,EACtB,MAAc,EACd,OAAmB,EACnB,aAA4D;QAE5D,IAAI,aAAa,CAAC,YAAY,IAAI,aAAa,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxE,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,gBAAgB,cAAc,IAAI,MAAM,yBAAyB,CAClE,CAAC;YACF,OAAO,aAAa,CAAC,YAAY,CAAC;QACpC,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,IAAI,MAAM,CAAC;QAEjD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,4BAA4B,cAAc,IAAI,MAAM,iCAAiC,MAAM,IAAI,CAChG,CAAC;YACF,MAAM,IAAI,2BAAkB,CAC1B;gBACE;oBACE,IAAI,EAAE,WAAW;oBACjB,OAAO,EAAE,kBAAkB;oBAC3B,IAAI,EAAE,EAAE;iBACT;aACF,EACD;gBACE,WAAW,EAAE,4BAA4B,cAAc,IAAI,MAAM,EAAE;aACpE,CACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,4BAA4B,cAAc,IAAI,MAAM,uDAAuD,MAAM,IAAI,CACtH,CAAC;QACF,OAAO;YACL;gBACE,MAAM;gBACN,OAAO;aACR;SACF,CAAC;IACJ,CAAC;IAEO,mBAAmB,CAAC,OAAmB;QAC7C,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI,OAAO,OAAO,KAAK,UAAU,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YAClD,OAAO,OAAO,CAAC,IAAI,CAAC;QACtB,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;CACF,CAAA;AA3HY,0DAAuB;AACE;IAAnC,IAAA,eAAM,EAAC,gBAAS,CAAC;sCAA8B,gBAAS;0DAAC;AACb;IAA5C,IAAA,eAAM,EAAC,8BAAkB,CAAC;;wDAA6C;AAC9B;IAAzC,IAAA,eAAM,EAAC,2BAAe,CAAC;;+DAAkD;kCAH/D,uBAAuB;IADnC,IAAA,mBAAU,GAAE;GACA,uBAAuB,CA2HnC"}

package/src/lib/services/index.d.ts

@@ -0,0 +1,2 @@
+export * from './acl-authorization.service';
+export * from './rule-materializer.service';

package/src/lib/services/index.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./acl-authorization.service"), exports);
+tslib_1.__exportStar(require("./rule-materializer.service"), exports);
+//# sourceMappingURL=index.js.map

package/src/lib/services/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../libs/acl-permissions/nestjs-acl-permissions/src/lib/services/index.ts"],"names":[],"mappings":";;;AAAA,sEAA4C;AAC5C,sEAA2C"}

package/src/lib/services/rule-materializer.service.d.ts

@@ -0,0 +1,73 @@
+import { Logger } from '@nestjs/common';
+import { AbilityTuple, MongoQuery, RawRuleFrom } from '@casl/ability';
+import type { AclInputData } from '../types';
+/**
+ * Service for materializing ACL rules by interpolating template variables
+ *
+ * Converts rules with templates like { userId: '${@input.userId}' }
+ * into materialized rules with actual values like { userId: 123 }
+ *
+ * Uses Tagged Template Literals via Function for safe and efficient evaluation
+ */
+export declare class RuleMaterializer {
+    readonly logger: Logger;
+    private readonly QUOTE_PLACEHOLDER;
+    private readonly options;
+    private get strictMode();
+    /**
+     * Materializes ACL rules by replacing template variables with actual values
+     *
+     * @param rules - Array of rules with template strings
+     * @param context - Variables from getContext()
+     * @param helpers - Helper functions from getHelpers()
+     * @param input - External input data (available as @input in templates)
+     * @returns Materialized rules with interpolated values
+     *
+     * TODO: Support old/current values in addition to new input
+     * For patchOne operations, we need access to both:
+     * - @input.* - new values from request
+     * - @input.__current.* - old values from database
+     * This enables rules like "allow removing only self from array"
+     *
+     * @example
+     * ```typescript
+     * const rules = [{ conditions: { userId: '${@input.id}' } }];
+     * const context = { currentUserId: 123 };
+     * const helpers = {};
+     * const input = { id: 456 };
+     *
+     * const materialized = materializer.materialize(rules, context, helpers, input);
+     * // Result: [{ conditions: { userId: 456 } }]
+     * ```
+     */
+    materialize<A extends AbilityTuple = AbilityTuple, C extends MongoQuery = MongoQuery>(rules: RawRuleFrom<A, C>[], context: Record<string, any>, helpers: Record<string, Function>, input?: AclInputData): RawRuleFrom<A, C>[];
+    /**
+     * Escapes special characters for use in template literal
+     */
+    private escapeForTemplateLiteral;
+    /**
+     * Evaluates JSON template using Tagged Template Literals
+     *
+     * Uses a tagged function that correctly formats different types:
+     * - strings → wrapped in quotes
+     * - arrays → JSON.stringify
+     * - numbers/booleans → as-is
+     */
+    private evaluateTaggedTemplate;
+    /**
+     * Creates tagged template function that formats placeholders by type
+     *
+     * IMPORTANT: Values are already inside JSON string quotes from stringify
+     * We need to REMOVE the quotes and insert raw JSON values
+     */
+    private createTaggedFunction;
+    /**
+     * Creates strict Proxy that throws error on undefined property access
+     * Used in strict mode to catch template errors early
+     */
+    private createStrictProxy;
+    /**
+     * Handles interpolation errors based on strict mode
+     */
+    private handleError;
+}

package/src/lib/services/rule-materializer.service.js

@@ -0,0 +1,251 @@
+"use strict";
+var RuleMaterializer_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RuleMaterializer = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const types_1 = require("../types");
+const constants_1 = require("../constants");
+/**
+ * Service for materializing ACL rules by interpolating template variables
+ *
+ * Converts rules with templates like { userId: '${@input.userId}' }
+ * into materialized rules with actual values like { userId: 123 }
+ *
+ * Uses Tagged Template Literals via Function for safe and efficient evaluation
+ */
+let RuleMaterializer = RuleMaterializer_1 = class RuleMaterializer {
+    logger = new common_1.Logger(RuleMaterializer_1.name);
+    // Temporary placeholder to distinguish quotes inside strings from quotes around placeholders
+    // Example: {"name":"John"} has quotes inside, but {"name":"${userName}"} has placeholder quotes
+    QUOTE_PLACEHOLDER = '\u0000QUOTE\u0000';
+    options;
+    get strictMode() {
+        return !this.options ? true : !!this.options.strictInterpolation;
+    }
+    /**
+     * Materializes ACL rules by replacing template variables with actual values
+     *
+     * @param rules - Array of rules with template strings
+     * @param context - Variables from getContext()
+     * @param helpers - Helper functions from getHelpers()
+     * @param input - External input data (available as @input in templates)
+     * @returns Materialized rules with interpolated values
+     *
+     * TODO: Support old/current values in addition to new input
+     * For patchOne operations, we need access to both:
+     * - @input.* - new values from request
+     * - @input.__current.* - old values from database
+     * This enables rules like "allow removing only self from array"
+     *
+     * @example
+     * ```typescript
+     * const rules = [{ conditions: { userId: '${@input.id}' } }];
+     * const context = { currentUserId: 123 };
+     * const helpers = {};
+     * const input = { id: 456 };
+     *
+     * const materialized = materializer.materialize(rules, context, helpers, input);
+     * // Result: [{ conditions: { userId: 456 } }]
+     * ```
+     */
+    materialize(rules, context, helpers, input) {
+        // In strict mode, wrap input in Proxy to catch undefined property access
+        const inputData = input || {};
+        const wrappedInput = this.strictMode
+            ? this.createStrictProxy(inputData, types_1.ACL_INPUT_VAR)
+            : inputData;
+        // Build scope with context, helpers, and input (without @)
+        const scope = {
+            ...context,
+            ...helpers,
+            [types_1.ACL_INPUT_VAR]: wrappedInput, // 'input' not '@input'
+        };
+        try {
+            // Convert rules to JSON string
+            let jsonStr = JSON.stringify(rules, (k, v) => k === 'subject' && typeof v === 'function' ? v.name : v);
+            // Replace @input with input (@ is not valid in JS variable names)
+            jsonStr = jsonStr.replaceAll(types_1.ACL_INPUT_TEMPLATE, types_1.ACL_INPUT_VAR);
+            // Replace \" with ' inside ${...} template expressions
+            // JSON.stringify escapes quotes as \" but inside template expressions we need '
+            // Example: ${checkStatus(user.status, \"active\")} → ${checkStatus(user.status, 'active')}
+            jsonStr = jsonStr.replace(/\$\{([^}]+)\}/g, (match, expr) => {
+                const fixedExpr = expr.replace(/\\"/g, "'");
+                return `\${${fixedExpr}}`;
+            });
+            // Replace remaining \" with placeholder (outside of ${...})
+            // This helps distinguish quotes around placeholders from quotes inside string values
+            jsonStr = jsonStr.replace(/\\"/g, this.QUOTE_PLACEHOLDER);
+            // Escape backticks for template literal
+            jsonStr = this.escapeForTemplateLiteral(jsonStr);
+            this.logger.debug(`JSON template prepared: ${jsonStr.substring(0, 200)}...`);
+            // Evaluate using tagged template
+            const result = this.evaluateTaggedTemplate(jsonStr, scope);
+            // Parse back to object
+            const materialized = JSON.parse(result);
+            this.logger.debug(`Materialized ${rules.length} rule(s) successfully`);
+            return materialized;
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            this.handleError(errorMessage, scope);
+            throw error; // Re-throw after logging
+        }
+    }
+    /**
+     * Escapes special characters for use in template literal
+     */
+    escapeForTemplateLiteral(str) {
+        return (str
+            // Escape backticks only
+            // Don't escape $ because we WANT ${...} to work as template expressions
+            .replace(/`/g, '\\`'));
+    }
+    /**
+     * Evaluates JSON template using Tagged Template Literals
+     *
+     * Uses a tagged function that correctly formats different types:
+     * - strings → wrapped in quotes
+     * - arrays → JSON.stringify
+     * - numbers/booleans → as-is
+     */
+    evaluateTaggedTemplate(jsonTemplate, scope) {
+        const scopeKeys = Object.keys(scope);
+        const scopeValues = Object.values(scope);
+        // Tagged template function that handles type formatting
+        const taggedFunc = this.createTaggedFunction();
+        // Create function: taggedFunc`${userId}${groupIds}...`
+        // Example: new Function('tag', 'userId', 'groupIds', 'return tag`...${userId}...${groupIds}...`')
+        const functionBody = `return tag\`${jsonTemplate}\`;`;
+        // Debug logging
+        if (functionBody.length > 500) {
+            this.logger.debug(`Function body (first 500 chars): ${functionBody.substring(0, 500)}`);
+        }
+        else {
+            this.logger.debug(`Function body: ${functionBody}`);
+        }
+        const evalFn = new Function('tag', ...scopeKeys, functionBody);
+        // Execute with tagged function and scope values
+        const result = evalFn(taggedFunc, ...scopeValues);
+        return result;
+    }
+    /**
+     * Creates tagged template function that formats placeholders by type
+     *
+     * IMPORTANT: Values are already inside JSON string quotes from stringify
+     * We need to REMOVE the quotes and insert raw JSON values
+     */
+    createTaggedFunction() {
+        return (literals, ...placeholders) => {
+            let result = '';
+            const placeholdersLength = placeholders.length;
+            for (let i = 0; i < placeholdersLength; i++) {
+                let literal = literals[i];
+                // Restore placeholder back to \"
+                literal = literal.replace(new RegExp(this.QUOTE_PLACEHOLDER, 'g'), '\\"');
+                // Check if literal ends with opening quote: "
+                // If so, we need to remove it and the closing quote from next literal
+                const endsWithQuote = literal.endsWith('"');
+                if (endsWithQuote) {
+                    literal = literal.slice(0, -1); // Remove trailing "
+                }
+                result += literal;
+                const value = placeholders[i];
+                // Format value based on type
+                if (value === null) {
+                    result += 'null';
+                }
+                else if (value === undefined) {
+                    result += 'null'; // JSON doesn't have undefined
+                }
+                else if (typeof value === 'string') {
+                    // Escape quotes and special characters for JSON string
+                    const escaped = value
+                        .replace(/\\/g, '\\\\')
+                        .replace(/"/g, '\\"')
+                        .replace(/\n/g, '\\n')
+                        .replace(/\r/g, '\\r')
+                        .replace(/\t/g, '\\t');
+                    result += `"${escaped}"`;
+                }
+                else if (typeof value === 'number' || typeof value === 'boolean') {
+                    result += String(value);
+                }
+                else if (Array.isArray(value)) {
+                    result += JSON.stringify(value);
+                }
+                else if (value instanceof Date) {
+                    result += `"${value.toISOString()}"`;
+                }
+                else if (typeof value === 'object') {
+                    result += JSON.stringify(value);
+                }
+                else {
+                    // Fallback
+                    result += JSON.stringify(value);
+                }
+                // Handle closing quote if we removed opening quote
+                if (endsWithQuote && i + 1 < literals.length) {
+                    const nextLiteral = literals[i + 1];
+                    if (nextLiteral.startsWith('"')) {
+                        // Skip the closing quote
+                        literals = Object.assign([], literals, {
+                            [i + 1]: nextLiteral.slice(1),
+                        });
+                    }
+                }
+            }
+            // Add final literal (restore placeholder here too)
+            let finalLiteral = literals[literals.length - 1];
+            finalLiteral = finalLiteral.replace(new RegExp(this.QUOTE_PLACEHOLDER, 'g'), '\\"');
+            result += finalLiteral;
+            return result;
+        };
+    }
+    /**
+     * Creates strict Proxy that throws error on undefined property access
+     * Used in strict mode to catch template errors early
+     */
+    createStrictProxy(obj, name) {
+        return new Proxy(obj, {
+            get: (target, prop) => {
+                // Allow symbol properties (like Symbol.toStringTag, Symbol.iterator, etc.)
+                if (typeof prop === 'symbol') {
+                    return target[prop];
+                }
+                // Check if property exists
+                if (!(prop in target)) {
+                    throw new ReferenceError(`Property '${name}.${String(prop)}' is not defined in strict mode`);
+                }
+                const value = target[prop];
+                // If value is an object, wrap it in Proxy too (for nested access)
+                if (value && typeof value === 'object' && !Array.isArray(value)) {
+                    return this.createStrictProxy(value, `${name}.${String(prop)}`);
+                }
+                return value;
+            },
+        });
+    }
+    /**
+     * Handles interpolation errors based on strict mode
+     */
+    handleError(errorMessage, scope) {
+        const scopeInfo = `Available variables: ${Object.keys(scope).join(', ')}`;
+        const fullMessage = `Failed to materialize rules: ${errorMessage}. ${scopeInfo}`;
+        if (this.strictMode) {
+            this.logger.error(fullMessage);
+        }
+        else {
+            this.logger.warn(fullMessage);
+        }
+    }
+};
+exports.RuleMaterializer = RuleMaterializer;
+tslib_1.__decorate([
+    (0, common_1.Inject)(constants_1.ACL_MODULE_OPTIONS),
+    tslib_1.__metadata("design:type", Object)
+], RuleMaterializer.prototype, "options", void 0);
+exports.RuleMaterializer = RuleMaterializer = RuleMaterializer_1 = tslib_1.__decorate([
+    (0, common_1.Injectable)()
+], RuleMaterializer);
+//# sourceMappingURL=rule-materializer.service.js.map

package/src/lib/services/rule-materializer.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule-materializer.service.js","sourceRoot":"","sources":["../../../../../../../libs/acl-permissions/nestjs-acl-permissions/src/lib/services/rule-materializer.service.ts"],"names":[],"mappings":";;;;;AAAA,2CAA4D;AAG5D,oCAA6D;AAC7D,4CAAkD;AAGlD;;;;;;;GAOG;AAEI,IAAM,gBAAgB,wBAAtB,MAAM,gBAAgB;IACjB,MAAM,GAAG,IAAI,eAAM,CAAC,kBAAgB,CAAC,IAAI,CAAC,CAAC;IAErD,6FAA6F;IAC7F,gGAAgG;IAC/E,iBAAiB,GAAG,mBAAmB,CAAC;IACZ,OAAO,CAAoB;IAExE,IAAY,UAAU;QACpB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAA;IAClE,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IAGH,WAAW,CAIT,KAA0B,EAC1B,OAA4B,EAC5B,OAAiC,EACjC,KAAoB;QAGpB,yEAAyE;QACzE,MAAM,SAAS,GAAG,KAAK,IAAI,EAAE,CAAC;QAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU;YAClC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,qBAAa,CAAC;YAClD,CAAC,CAAC,SAAS,CAAC;QAEd,2DAA2D;QAC3D,MAAM,KAAK,GAAG;YACZ,GAAG,OAAO;YACV,GAAG,OAAO;YACV,CAAC,qBAAa,CAAC,EAAE,YAAY,EAAE,uBAAuB;SACvD,CAAC;QAEF,IAAI,CAAC;YAEH,+BAA+B;YAC/B,IAAI,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAEvG,kEAAkE;YAClE,OAAO,GAAG,OAAO,CAAC,UAAU,CAC1B,0BAAkB,EAClB,qBAAa,CACd,CAAC;YAEF,uDAAuD;YACvD,gFAAgF;YAChF,2FAA2F;YAC3F,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;gBAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;gBAC5C,OAAO,MAAM,SAAS,GAAG,CAAC;YAC5B,CAAC,CAAC,CAAC;YAEH,4DAA4D;YAC5D,qFAAqF;YACrF,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAE1D,wCAAwC;YACxC,OAAO,GAAG,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YAE7E,iCAAiC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAE3D,uBAAuB;YACvB,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAwB,CAAC;YAE/D,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,gBAAgB,KAAK,CAAC,MAAM,uBAAuB,CACpD,CAAC;YAEF,OAAO,YAAY,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,GAChB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACzD,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YACtC,MAAM,KAAK,CAAC,CAAC,yBAAyB;QACxC,CAAC;IACH,CAAC;IAED;;OAEG;IACK,wBAAwB,CAAC,GAAW;QAC1C,OAAO,CACL,GAAG;YACD,wBAAwB;YACxB,wEAAwE;aACvE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CACxB,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,sBAAsB,CAC5B,YAAoB,EACpB,KAA0B;QAE1B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEzC,wDAAwD;QACxD,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAE/C,uDAAuD;QACvD,kGAAkG;QAClG,MAAM,YAAY,GAAG,eAAe,YAAY,KAAK,CAAC;QAEtD,gBAAgB;QAChB,IAAI,YAAY,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,YAAY,EAAE,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,QAAQ,CACzB,KAAK,EACL,GAAG,SAAS,EACZ,YAAY,CACb,CAAC;QAEF,gDAAgD;QAChD,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,GAAG,WAAW,CAAC,CAAC;QAElD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACK,oBAAoB;QAI1B,OAAO,CAAC,QAA8B,EAAE,GAAG,YAAmB,EAAE,EAAE;YAChE,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,MAAM,kBAAkB,GAAG,YAAY,CAAC,MAAM,CAAC;YAE/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,kBAAkB,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5C,IAAI,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAE1B,iCAAiC;gBACjC,OAAO,GAAG,OAAO,CAAC,OAAO,CACvB,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,CAAC,EACvC,KAAK,CACN,CAAC;gBAEF,8CAA8C;gBAC9C,sEAAsE;gBACtE,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC5C,IAAI,aAAa,EAAE,CAAC;oBAClB,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB;gBACtD,CAAC;gBAED,MAAM,IAAI,OAAO,CAAC;gBAElB,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;gBAE9B,6BAA6B;gBAC7B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;oBACnB,MAAM,IAAI,MAAM,CAAC;gBACnB,CAAC;qBAAM,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBAC/B,MAAM,IAAI,MAAM,CAAC,CAAC,8BAA8B;gBAClD,CAAC;qBAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACrC,uDAAuD;oBACvD,MAAM,OAAO,GAAG,KAAK;yBAClB,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;yBACtB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;yBACpB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;yBACrB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;yBACrB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;oBACzB,MAAM,IAAI,IAAI,OAAO,GAAG,CAAC;gBAC3B,CAAC;qBAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;oBACnE,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC1B,CAAC;qBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBAChC,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;gBAClC,CAAC;qBAAM,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;oBACjC,MAAM,IAAI,IAAI,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC;gBACvC,CAAC;qBAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACrC,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;gBAClC,CAAC;qBAAM,CAAC;oBACN,WAAW;oBACX,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;gBAClC,CAAC;gBAED,mDAAmD;gBACnD,IAAI,aAAa,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;oBAC7C,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;oBACpC,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;wBAChC,yBAAyB;wBACzB,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE;4BACrC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;yBAC9B,CAAQ,CAAC;oBACZ,CAAC;gBACH,CAAC;YACH,CAAC;YAED,mDAAmD;YACnD,IAAI,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACjD,YAAY,GAAG,YAAY,CAAC,OAAO,CACjC,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,CAAC,EACvC,KAAK,CACN,CAAC;YACF,MAAM,IAAI,YAAY,CAAC;YAEvB,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,iBAAiB,CACvB,GAAM,EACN,IAAY;QAEZ,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE;YACpB,GAAG,EAAE,CAAC,MAAM,EAAE,IAAqB,EAAE,EAAE;gBACrC,2EAA2E;gBAC3E,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC7B,OAAO,MAAM,CAAC,IAAW,CAAC,CAAC;gBAC7B,CAAC;gBAED,2BAA2B;gBAC3B,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,EAAE,CAAC;oBACtB,MAAM,IAAI,cAAc,CACtB,aAAa,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,iCAAiC,CACnE,CAAC;gBACJ,CAAC;gBAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;gBAE3B,kEAAkE;gBAClE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBAChE,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAClE,CAAC;gBAED,OAAO,KAAK,CAAC;YACf,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,WAAW,CACjB,YAAoB,EACpB,KAA0B;QAE1B,MAAM,SAAS,GAAG,wBAAwB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1E,MAAM,WAAW,GAAG,gCAAgC,YAAY,KAAK,SAAS,EAAE,CAAC;QAEjF,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;CACF,CAAA;AAzSY,4CAAgB;AAMkB;IAA5C,IAAA,eAAM,EAAC,8BAAkB,CAAC;;iDAA6C;2BAN7D,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;GACA,gBAAgB,CAyS5B"}

package/src/lib/types/acl-context.types.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Interface for context storage (e.g., ClsService from nestjs-cls)
+ * Allows passing rules and data through the request pipeline
+ */
+export interface AclContextStore {
+    /**
+     * Set value in context
+     */
+    set<T = any>(key: any, value: T): void;
+    /**
+     * Get value from context
+     */
+    get<T = any>(key: any): T | undefined;
+}

package/src/lib/types/acl-context.types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=acl-context.types.js.map