@lark-apaas/nestjs-authzpaas 0.1.7 → 0.1.8

package/dist/index.cjs

@@ -41,11 +41,11 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // src/authzpaas.module.ts
-var import_common6 = require("@nestjs/common");
+var import_common7 = require("@nestjs/common");
 var import_core2 = require("@nestjs/core");
 
 // src/services/permission.service.ts
-var import_common4 = require("@nestjs/common");
+var import_common3 = require("@nestjs/common");
 var import_nestjs_authnpaas = require("@lark-apaas/nestjs-authnpaas");
 
 // src/const.ts
@@ -79,6 +79,11 @@ var AbilityFactory = class {
     for (const role of permissionData.roles) {
       can(role, ROLE_SUBJECT);
     }
+    if (permissionData.permissions) {
+      for (const { action, subject } of permissionData.permissions) {
+        can(action, subject);
+      }
+    }
     return build();
   }
 };
@@ -157,41 +162,471 @@ var PermissionDeniedException = class _PermissionDeniedException extends import_
     } else {
       message = or ? `\u7F3A\u5C11\u6743\u9650: \u9700\u8981\u6EE1\u8DB3\u4EE5\u4E0B\u4EFB\u4E00\u6743\u9650\u8981\u6C42: ${requiredPermissions.map(({ actions, subject }) => `\u5BF9 ${subject} \u6267\u884C\u4EE5\u4E0B\u4EFB\u4E00\u64CD\u4F5C [${actions.join(", ")}]`).join(", ")}` : `\u7F3A\u5C11\u6743\u9650: \u9700\u8981\u6EE1\u8DB3\u4EE5\u4E0B\u6240\u6709\u6743\u9650\u8981\u6C42: ${requiredPermissions.map(({ actions, subject }) => `\u5BF9 ${subject} \u6267\u884C\u6240\u6709\u64CD\u4F5C [${actions.join(", ")}]`).join(", ")}`;
     }
-    return new _PermissionDeniedException({
-      type: "PERMISSION_REQUIRED",
-      message,
-      requiredPermissions,
-      metadata: {
-        or
-      }
-    });
+    return new _PermissionDeniedException({
+      type: "PERMISSION_REQUIRED",
+      message,
+      requiredPermissions,
+      metadata: {
+        or
+      }
+    });
+  }
+};
+
+// src/services/permission.service.ts
+var import_nestjs_common = require("@lark-apaas/nestjs-common");
+function _ts_decorate2(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate2, "_ts_decorate");
+function _ts_metadata(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata, "_ts_metadata");
+function _ts_param(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param, "_ts_param");
+var PermissionService = class {
+  static {
+    __name(this, "PermissionService");
+  }
+  apiConfig;
+  abilityFactory;
+  client;
+  requestContextService;
+  permissionResolver;
+  constructor(apiConfig, abilityFactory, client, requestContextService, permissionResolver = null) {
+    this.apiConfig = apiConfig;
+    this.abilityFactory = abilityFactory;
+    this.client = client;
+    this.requestContextService = requestContextService;
+    this.permissionResolver = permissionResolver;
+  }
+  /**
+  * 获取用户权限数据
+  */
+  async getUserPermissions({ laneId }) {
+    const permissionData = await this.fetchFromApi({
+      laneId
+    });
+    const dataWithTimestamp = {
+      ...permissionData,
+      fetchedAt: /* @__PURE__ */ new Date()
+    };
+    return dataWithTimestamp;
+  }
+  /**
+  * 从内部 API 获取当前用户的权限数据
+  * 通过平台内部接口 /app/{appId}/inner/api/v1/permissions/roles 获取
+  */
+  async fetchFromApi(options) {
+    const { timeout = 5e3 } = this.apiConfig || {};
+    const { appId = "", userId = "" } = this.requestContextService.getContext() || {};
+    if (!appId) {
+      throw new PermissionDeniedException({
+        type: PermissionDeniedType.PERMISSION_CONFIG_QUERY_FAILED,
+        message: "appId is empty"
+      }, import_common3.HttpStatus.BAD_REQUEST);
+    }
+    const url = `/app/${appId}/inner/api/v1/permissions/roles`;
+    const requestHeaders = {
+      "Content-Type": "application/json",
+      ...options.laneId ? {
+        "x-tt-env": options.laneId
+      } : {}
+    };
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), timeout);
+    try {
+      const response = await this.client.post(url, {
+        userID: userId || ""
+      }, {
+        credentials: "include",
+        headers: requestHeaders,
+        signal: controller.signal
+      });
+      clearTimeout(timeoutId);
+      if (!response.ok) {
+        throw new Error(`Permission API returned ${response.status}: ${response.statusText}`);
+      }
+      let data;
+      try {
+        const responseText = await response.text();
+        data = JSON.parse(responseText);
+      } catch {
+        throw new Error("Permission API returned invalid JSON");
+      }
+      return {
+        userId,
+        roles: data.data?.roleList || [],
+        fetchedAt: /* @__PURE__ */ new Date()
+      };
+    } catch (error) {
+      clearTimeout(timeoutId);
+      const err = error instanceof Error ? error : new Error(String(error));
+      if (err.name === "AbortError") {
+        throw new PermissionDeniedException({
+          cause: err,
+          type: PermissionDeniedType.PERMISSION_CONFIG_QUERY_FAILED,
+          message: `Permission API request timeout after ${timeout}ms`
+        }, import_common3.HttpStatus.INTERNAL_SERVER_ERROR);
+      }
+      throw new PermissionDeniedException({
+        cause: err,
+        type: PermissionDeniedType.PERMISSION_CONFIG_QUERY_FAILED,
+        message: err.message
+      }, import_common3.HttpStatus.INTERNAL_SERVER_ERROR);
+    }
+  }
+  // /**
+  //  * 获取用户的 Ability 实例（带缓存）
+  //  * @param userId 用户ID
+  //  * @returns CASL Ability 实例
+  //  */
+  // private async getUserAbility(
+  //   userId?: string,
+  //   mockRoles?: string[]
+  // ): Promise<AppAbility> {
+  //   // 计算缓存 key
+  //   const key = this.buildCacheKey(userId, mockRoles);
+  //   // 尝试从缓存获取
+  //   const cached = this.cache.get(key);
+  //   if (cached) {
+  //     return cached.ability;
+  //   }
+  //   // 缓存未命中，调用 getUserPermissions 会创建并缓存
+  //   await this.getUserPermissions(userId, mockRoles);
+  //   // 再次从缓存获取（此时一定存在）
+  //   const newCached = this.cache.get(key);
+  //   return newCached!.ability;
+  // }
+  /**
+  * 检查角色要求
+  * 使用 CASL Ability 统一鉴权方式
+  * @param requirement 角色要求
+  * @param laneId 环境ID
+  * @returns 用户权限检查结果，包含结果和详细信息
+  * @throws PermissionDeniedException 当权限数据获取失败时
+  */
+  async checkRoles(requirement, laneId, userContext) {
+    const { userId = "" } = this.requestContextService.getContext() || {};
+    let permissionData = null;
+    if (!userContext || !userContext.roles) {
+      permissionData = await this.getUserPermissions({
+        laneId
+      });
+    } else {
+      permissionData = {
+        userId,
+        roles: userContext.roles || [],
+        fetchedAt: /* @__PURE__ */ new Date()
+      };
+    }
+    if (!permissionData) {
+      throw new PermissionDeniedException({
+        cause: new Error("Permission data fetch api is not configured"),
+        type: PermissionDeniedType.PERMISSION_CONFIG_QUERY_FAILED,
+        message: "Permission data fetch api is not configured"
+      }, import_common3.HttpStatus.BAD_REQUEST);
+    }
+    const ability = this.abilityFactory.createForUser(permissionData);
+    const { roles } = requirement;
+    if (!roles || roles.length === 0) {
+      return {
+        result: true
+      };
+    }
+    const hasRole = roles.some((role) => ability.can(role, ROLE_SUBJECT));
+    if (!hasRole) {
+      const userRoles = permissionData.roles;
+      return {
+        result: false,
+        details: `\u7528\u6237 ${userId}, \u7528\u6237\u89D2\u8272 [${userRoles.join(", ")}], \u9700\u8981 [${roles.join(", ")}]`
+      };
+    }
+    return {
+      result: true
+    };
+  }
+  /**
+  * 检查权限点位要求
+  * 通过 IPermissionResolver 解析用户角色对应的权限点位，然后检查是否满足要求
+  * @param requirement 权限点位要求
+  * @param laneId 环境ID
+  * @param userContext 用户上下文
+  * @returns 用户权限检查结果，包含结果和详细信息
+  * @throws PermissionDeniedException 当权限解析器未注入或权限数据获取失败时
+  */
+  async checkPermissions(requirement, laneId, userContext) {
+    if (!this.permissionResolver) {
+      throw new PermissionDeniedException({
+        cause: new Error("PermissionResolver is not registered. Provide permissionResolver in AuthZPaasModule options."),
+        type: PermissionDeniedType.PERMISSION_CONFIG_QUERY_FAILED,
+        message: "PermissionResolver is not registered. Provide permissionResolver in AuthZPaasModule options."
+      }, import_common3.HttpStatus.BAD_REQUEST);
+    }
+    const { userId = "" } = this.requestContextService.getContext() || {};
+    let permissionData = null;
+    if (!userContext || !userContext.roles) {
+      permissionData = await this.getUserPermissions({
+        laneId
+      });
+    } else {
+      permissionData = {
+        userId,
+        roles: userContext.roles || [],
+        fetchedAt: /* @__PURE__ */ new Date()
+      };
+    }
+    if (!permissionData) {
+      throw new PermissionDeniedException({
+        cause: new Error("Permission data fetch api is not configured"),
+        type: PermissionDeniedType.PERMISSION_CONFIG_QUERY_FAILED,
+        message: "Permission data fetch api is not configured"
+      }, import_common3.HttpStatus.BAD_REQUEST);
+    }
+    const { action, subject } = requirement;
+    if (!action || !subject) {
+      return {
+        result: true
+      };
+    }
+    const userPermissions = await this.permissionResolver.resolvePermissions(permissionData.roles);
+    permissionData.permissions = userPermissions;
+    const ability = this.abilityFactory.createForUser(permissionData);
+    const hasPermission = ability.can(action, subject);
+    if (!hasPermission) {
+      return {
+        result: false,
+        details: `\u7528\u6237 ${userId}, \u9700\u8981 can('${action}', '${subject}'), \u7528\u6237\u6743\u9650\u70B9\u4F4D [${userPermissions.map((p) => `${p.action}:${p.subject}`).join(", ")}]`
+      };
+    }
+    return {
+      result: true
+    };
+  }
+};
+PermissionService = _ts_decorate2([
+  (0, import_common3.Injectable)(),
+  (0, import_nestjs_authnpaas.Public)(),
+  _ts_param(0, (0, import_common3.Inject)(PERMISSION_API_CONFIG_TOKEN)),
+  _ts_param(2, (0, import_common3.Inject)(import_nestjs_common.PLATFORM_HTTP_CLIENT)),
+  _ts_param(4, (0, import_common3.Optional)()),
+  _ts_param(4, (0, import_common3.Inject)(PERMISSION_RESOLVER_TOKEN)),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof PermissionApiConfig === "undefined" ? Object : PermissionApiConfig,
+    typeof AbilityFactory === "undefined" ? Object : AbilityFactory,
+    typeof import_nestjs_common.PlatformHttpClient === "undefined" ? Object : import_nestjs_common.PlatformHttpClient,
+    typeof import_nestjs_common.RequestContextService === "undefined" ? Object : import_nestjs_common.RequestContextService,
+    Object
+  ])
+], PermissionService);
+
+// src/guards/authzpaas.guard.ts
+var import_common4 = require("@nestjs/common");
+var import_core = require("@nestjs/core");
+var import_nestjs_common2 = require("@lark-apaas/nestjs-common");
+function _ts_decorate3(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate3, "_ts_decorate");
+function _ts_metadata2(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata2, "_ts_metadata");
+function _ts_param2(paramIndex, decorator) {
+  return function(target, key) {
+    decorator(target, key, paramIndex);
+  };
+}
+__name(_ts_param2, "_ts_param");
+var AuthZPaasGuard = class _AuthZPaasGuard {
+  static {
+    __name(this, "AuthZPaasGuard");
+  }
+  reflector;
+  permissionService;
+  obs;
+  constructor(reflector, permissionService, obs) {
+    this.reflector = reflector;
+    this.permissionService = permissionService;
+    this.obs = obs;
+  }
+  logger = new import_common4.Logger(_AuthZPaasGuard.name);
+  /**
+  * 验证权限点位要求是否有效
+  * @param requirements 权限点位要求
+  * @returns 是否有效
+  */
+  isValidPermissionRequirement(requirements) {
+    return Boolean(requirements && requirements.action && requirements.subject);
+  }
+  /**
+  * 验证角色要求是否有效
+  * @param requirements 角色要求
+  * @returns 是否有效
+  */
+  isValidRoleRequirement(requirements) {
+    return Boolean(requirements && requirements.roles && requirements.roles.length > 0);
+  }
+  async canActivate(context) {
+    const http = context.switchToHttp();
+    const request = http.getRequest();
+    const laneId = request.headers["x-tt-env"];
+    const baseUrl = `${request.protocol}://${request.get("host")}`;
+    const userContext = request.userContext;
+    userContext.baseUrl = baseUrl;
+    const checkRoleRequirement = this.reflector.getAllAndOverride(ROLES_KEY, [
+      context.getHandler(),
+      context.getClass()
+    ]);
+    if (this.isValidRoleRequirement(checkRoleRequirement)) {
+      const spanName = checkRoleRequirement.roles.join(" or ");
+      const logAttrs = {
+        source_type: "platform",
+        paas_attributes_module: "permission"
+      };
+      return this.obs.trace(spanName, async (span) => {
+        span.setAttributes({
+          module: "permission"
+        });
+        const elapsed = (0, import_nestjs_common2.createTimer)();
+        try {
+          const checkResult = await this.permissionService.checkRoles(checkRoleRequirement, laneId, userContext);
+          const durationMs = elapsed();
+          span.setAttribute("duration_ms", durationMs);
+          if (!checkResult.result) {
+            this.logger.warn(JSON.stringify({
+              role: spanName,
+              duration_ms: durationMs,
+              result: "no_auth",
+              result_detail: checkResult.details
+            }), {
+              ...logAttrs,
+              duration_ms: durationMs
+            });
+          } else {
+            this.logger.log(JSON.stringify({
+              role: spanName,
+              duration_ms: durationMs,
+              result: "has_auth"
+            }), {
+              ...logAttrs,
+              duration_ms: durationMs
+            });
+          }
+          return checkResult.result;
+        } catch (error) {
+          const durationMs = elapsed();
+          span.setAttribute("duration_ms", durationMs);
+          this.logger.error(JSON.stringify({
+            role: spanName,
+            duration_ms: durationMs,
+            result: "",
+            error_message: error.message
+          }), {
+            ...logAttrs,
+            duration_ms: durationMs
+          });
+          throw error;
+        }
+      });
+    }
+    const permissionRequirement = this.reflector.getAllAndOverride(PERMISSIONS_KEY, [
+      context.getHandler(),
+      context.getClass()
+    ]);
+    if (this.isValidPermissionRequirement(permissionRequirement)) {
+      const spanName = `${permissionRequirement.action}:${permissionRequirement.subject}`;
+      return this.obs.trace(spanName, async (span) => {
+        span.setAttributes({
+          module: "permission"
+        });
+        const startTime = Date.now();
+        try {
+          const checkResult = await this.permissionService.checkPermissions(permissionRequirement, laneId, userContext);
+          const endTime = Date.now();
+          if (!checkResult.result) {
+            this.logger.warn(JSON.stringify({
+              permission: spanName,
+              duration_ms: endTime - startTime,
+              result: "no_auth",
+              result_detail: checkResult.details
+            }), {
+              source_type: "platform",
+              paas_attributes_module: "permission"
+            });
+          } else {
+            this.logger.log(JSON.stringify({
+              permission: spanName,
+              duration_ms: endTime - startTime,
+              result: "has_auth"
+            }), {
+              source_type: "platform",
+              paas_attributes_module: "permission"
+            });
+          }
+          return checkResult.result;
+        } catch (error) {
+          const endTime = Date.now();
+          this.logger.error(JSON.stringify({
+            permission: spanName,
+            duration_ms: endTime - startTime,
+            result: "",
+            error_message: error.message
+          }), {
+            source_type: "platform",
+            paas_attributes_module: "permission"
+          });
+          throw error;
+        }
+      });
+    }
+    return true;
   }
 };
-
-// src/services/permission.service.ts
-var import_nestjs_common3 = require("@lark-apaas/nestjs-common");
+AuthZPaasGuard = _ts_decorate3([
+  (0, import_common4.Injectable)(),
+  _ts_param2(2, (0, import_common4.Inject)(import_nestjs_common2.OBSERVABLE_SERVICE)),
+  _ts_metadata2("design:type", Function),
+  _ts_metadata2("design:paramtypes", [
+    typeof import_core.Reflector === "undefined" ? Object : import_core.Reflector,
+    typeof PermissionService === "undefined" ? Object : PermissionService,
+    typeof import_nestjs_common2.ObservableService === "undefined" ? Object : import_nestjs_common2.ObservableService
+  ])
+], AuthZPaasGuard);
 
 // src/sdk/authorization.sdk.ts
-var import_common3 = require("@nestjs/common");
-var import_nestjs_common = require("@lark-apaas/nestjs-common");
-var import_nestjs_common2 = require("@lark-apaas/nestjs-common");
-function _ts_decorate2(decorators, target, key, desc) {
+var import_common5 = require("@nestjs/common");
+var import_nestjs_common3 = require("@lark-apaas/nestjs-common");
+var import_nestjs_common4 = require("@lark-apaas/nestjs-common");
+function _ts_decorate4(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate2, "_ts_decorate");
-function _ts_metadata(k, v) {
+__name(_ts_decorate4, "_ts_decorate");
+function _ts_metadata3(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata, "_ts_metadata");
-function _ts_param(paramIndex, decorator) {
+__name(_ts_metadata3, "_ts_metadata");
+function _ts_param3(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param, "_ts_param");
+__name(_ts_param3, "_ts_param");
 var SDK_MODULE = "permission";
 var LANG_CODE_MAP = {
   2052: "zh_cn",
@@ -218,9 +653,25 @@ function normalizeDeptList(list) {
 }
 __name(normalizeDeptList, "normalizeDeptList");
 function normalizeRoleMembers(members) {
-  if (!members) return members;
+  if (!members) return {
+    userList: [],
+    departmentList: [],
+    groupChatList: [],
+    allEmployees: false,
+    public: false,
+    presetGroup: {
+      isContainsAdmin: false
+    }
+  };
   return {
     ...members,
+    userList: members.userList || [],
+    groupChatList: members.groupChatList || [],
+    allEmployees: members.allEmployees ?? false,
+    public: members.public ?? false,
+    presetGroup: members.presetGroup ?? {
+      isContainsAdmin: false
+    },
     departmentList: normalizeDeptList(members.departmentList)
   };
 }
@@ -263,7 +714,7 @@ function normalizeSearchResponse(res) {
 }
 __name(normalizeSearchResponse, "normalizeSearchResponse");
 function throwPlatformError(message, httpStatus, platformCode) {
-  throw new import_common3.HttpException({
+  throw new import_common5.HttpException({
     statusCode: httpStatus,
     code: "PLATFORM_API_ERROR",
     message,
@@ -280,7 +731,7 @@ async function parseResponseWithRaw(response) {
     } catch {
     }
     const message = err?.error_msg || err?.msg || `\u5E73\u53F0 API \u8BF7\u6C42\u5931\u8D25 (${response.status})`;
-    const httpStatus = response.status >= 500 ? import_common3.HttpStatus.BAD_GATEWAY : response.status;
+    const httpStatus = response.status >= 500 ? import_common5.HttpStatus.BAD_GATEWAY : response.status;
     throwPlatformError(message, httpStatus, err?.status_code ?? err?.code);
   }
   if (!text) return {
@@ -290,7 +741,7 @@ async function parseResponseWithRaw(response) {
   const json = JSON.parse(text);
   if (json.status_code && json.status_code !== "0") {
     const message = json.error_msg || `\u5E73\u53F0\u4E1A\u52A1\u9519\u8BEF (${json.status_code})`;
-    throwPlatformError(message, import_common3.HttpStatus.BAD_GATEWAY, json.status_code);
+    throwPlatformError(message, import_common5.HttpStatus.BAD_GATEWAY, json.status_code);
   }
   return {
     data: json.data ?? json,
@@ -314,7 +765,7 @@ function traced(obs, logger, method, ctx, fn) {
   };
   return obs.trace(spanName, async (span) => {
     span.setAttributes(spanAttrs);
-    const elapsed = (0, import_nestjs_common.createTimer)();
+    const elapsed = (0, import_nestjs_common3.createTimer)();
     try {
       const { data, raw, logId } = await fn();
       const durationMs = elapsed();
@@ -341,7 +792,7 @@ function traced(obs, logger, method, ctx, fn) {
     } catch (error) {
       const durationMs = elapsed();
       const errMsg = error instanceof Error ? error.message : String(error);
-      const errorLogId = error instanceof import_common3.HttpException ? error.getResponse()?.["x-tt-logid"] ?? "" : "";
+      const errorLogId = error instanceof import_common5.HttpException ? error.getResponse()?.["x-tt-logid"] ?? "" : "";
       span.setAttributes({
         duration_ms: durationMs,
         success: false,
@@ -377,7 +828,7 @@ async function requestWithTrace(response) {
       logId
     };
   } catch (error) {
-    if (error instanceof import_common3.HttpException && logId) {
+    if (error instanceof import_common5.HttpException && logId) {
       const res = error.getResponse();
       res["x-tt-logid"] = logId;
     }
@@ -421,7 +872,7 @@ var RolesAPI = class RolesAPI2 {
       const { data, raw, logId } = await requestWithTrace(response);
       const roles = (data.roles || []).map((r) => ({
         ...r,
-        roleMembers: normalizeRoleMembers(r.roleMembers)
+        roleMembers: needMember ? normalizeRoleMembers(r.roleMembers) : void 0
       }));
       return {
         data: roles,
@@ -568,6 +1019,21 @@ var MembersAPI = class MembersAPI2 {
       const result = await requestWithTrace(response);
       if (result.data?.members) {
         result.data.members = normalizeRoleMembers(result.data.members);
+      } else {
+        result.data = {
+          members: {
+            userList: [],
+            departmentList: [],
+            groupChatList: [],
+            allEmployees: false,
+            public: false,
+            presetGroup: {
+              isContainsAdmin: false
+            }
+          },
+          total: 0,
+          hasMore: false
+        };
       }
       return result;
     });
@@ -648,454 +1114,131 @@ var SearchAPI = class SearchAPI2 {
         enableChatSearch: true,
         include_external_user: params.includeExternalUser ?? true,
         include_external_group: params.includeExternalGroup ?? true,
-        pageSize: params.pageSize ?? 20,
-        page: params.page ?? 1
-      },
-      userID: params.userID ?? (this.getUserId() || void 0)
-    };
-    return traced(this.obs, this.logger, "search.search", {
-      httpMethod: "POST",
-      path: this.basePath,
-      params: body
-    }, async () => {
-      const response = await this.client.post(this.basePath, body);
-      const result = await requestWithTrace(response);
-      result.data = normalizeSearchResponse(result?.data);
-      return result;
-    });
-  }
-};
-var AuthorizationSDK = class _AuthorizationSDK {
-  static {
-    __name(this, "AuthorizationSDK");
-  }
-  requestContextService;
-  roles;
-  members;
-  search;
-  logger = new import_common3.Logger(_AuthorizationSDK.name);
-  constructor(client, obs, requestContextService) {
-    this.requestContextService = requestContextService;
-    const getAppId = /* @__PURE__ */ __name(() => {
-      const { appId = "" } = this.requestContextService.getContext() || {};
-      return appId;
-    }, "getAppId");
-    const getUserId = /* @__PURE__ */ __name(() => {
-      const { userId = "" } = this.requestContextService.getContext() || {};
-      return userId;
-    }, "getUserId");
-    this.roles = new RolesAPI(client, getAppId, getUserId, obs, this.logger);
-    this.members = new MembersAPI(client, getAppId, getUserId, obs, this.logger);
-    this.search = new SearchAPI(client, getAppId, getUserId, obs, this.logger);
-  }
-};
-AuthorizationSDK = _ts_decorate2([
-  (0, import_common3.Injectable)(),
-  _ts_param(0, (0, import_common3.Inject)(import_nestjs_common.PLATFORM_HTTP_CLIENT)),
-  _ts_param(1, (0, import_common3.Inject)(import_nestjs_common.OBSERVABLE_SERVICE)),
-  _ts_metadata("design:type", Function),
-  _ts_metadata("design:paramtypes", [
-    typeof import_nestjs_common.PlatformHttpClient === "undefined" ? Object : import_nestjs_common.PlatformHttpClient,
-    typeof ObservableService === "undefined" ? Object : ObservableService,
-    typeof import_nestjs_common2.RequestContextService === "undefined" ? Object : import_nestjs_common2.RequestContextService
-  ])
-], AuthorizationSDK);
-
-// src/services/permission.service.ts
-function _ts_decorate3(decorators, target, key, desc) {
-  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-  return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-__name(_ts_decorate3, "_ts_decorate");
-function _ts_metadata2(k, v) {
-  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-__name(_ts_metadata2, "_ts_metadata");
-function _ts_param2(paramIndex, decorator) {
-  return function(target, key) {
-    decorator(target, key, paramIndex);
-  };
-}
-__name(_ts_param2, "_ts_param");
-var PermissionService = class {
-  static {
-    __name(this, "PermissionService");
-  }
-  abilityFactory;
-  authorizationSDK;
-  requestContextService;
-  permissionResolver;
-  constructor(abilityFactory, authorizationSDK, requestContextService, permissionResolver = null) {
-    this.abilityFactory = abilityFactory;
-    this.authorizationSDK = authorizationSDK;
-    this.requestContextService = requestContextService;
-    this.permissionResolver = permissionResolver;
-  }
-  /**
-  * 获取用户权限数据
-  */
-  async getUserPermissions({ laneId }) {
-    const permissionData = await this.fetchFromApi({
-      laneId
-    });
-    const dataWithTimestamp = {
-      ...permissionData,
-      fetchedAt: /* @__PURE__ */ new Date()
-    };
-    return dataWithTimestamp;
-  }
-  /**
-  * 从 AuthorizationSDK 获取权限数据
-  * 通过 roles.list() 获取用户关联的角色列表
-  */
-  async fetchFromApi(_options) {
-    const { userId = "" } = this.requestContextService.getContext() || {};
-    try {
-      const roles = await this.authorizationSDK.roles.list({
-        userID: userId || void 0
-      });
-      return {
-        userId,
-        roles: roles.map((role) => role.bizID).filter((id) => !!id),
-        fetchedAt: /* @__PURE__ */ new Date()
-      };
-    } catch (error) {
-      const err = error instanceof Error ? error : new Error(String(error));
-      throw new PermissionDeniedException({
-        cause: err,
-        type: PermissionDeniedType.PERMISSION_CONFIG_QUERY_FAILED,
-        message: err.message
-      }, import_common4.HttpStatus.INTERNAL_SERVER_ERROR);
-    }
-  }
-  // /**
-  //  * 获取用户的 Ability 实例（带缓存）
-  //  * @param userId 用户ID
-  //  * @returns CASL Ability 实例
-  //  */
-  // private async getUserAbility(
-  //   userId?: string,
-  //   mockRoles?: string[]
-  // ): Promise<AppAbility> {
-  //   // 计算缓存 key
-  //   const key = this.buildCacheKey(userId, mockRoles);
-  //   // 尝试从缓存获取
-  //   const cached = this.cache.get(key);
-  //   if (cached) {
-  //     return cached.ability;
-  //   }
-  //   // 缓存未命中，调用 getUserPermissions 会创建并缓存
-  //   await this.getUserPermissions(userId, mockRoles);
-  //   // 再次从缓存获取（此时一定存在）
-  //   const newCached = this.cache.get(key);
-  //   return newCached!.ability;
-  // }
-  /**
-  * 检查角色要求
-  * 使用 CASL Ability 统一鉴权方式
-  * @param requirement 角色要求
-  * @param laneId 环境ID
-  * @returns 用户权限检查结果，包含结果和详细信息
-  * @throws PermissionDeniedException 当权限数据获取失败时
-  */
-  async checkRoles(requirement, laneId, userContext) {
-    const { userId = "" } = this.requestContextService.getContext() || {};
-    let permissionData = null;
-    if (!userContext || !userContext.roles) {
-      permissionData = await this.getUserPermissions({
-        laneId
-      });
-    } else {
-      permissionData = {
-        userId,
-        roles: userContext.roles || [],
-        fetchedAt: /* @__PURE__ */ new Date()
-      };
-    }
-    if (!permissionData) {
-      throw new PermissionDeniedException({
-        cause: new Error("Permission data fetch api is not configured"),
-        type: PermissionDeniedType.PERMISSION_CONFIG_QUERY_FAILED,
-        message: "Permission data fetch api is not configured"
-      }, import_common4.HttpStatus.BAD_REQUEST);
-    }
-    const ability = this.abilityFactory.createForUser(permissionData);
-    const { roles } = requirement;
-    if (!roles || roles.length === 0) {
-      return {
-        result: true
-      };
-    }
-    const hasRole = roles.some((role) => ability.can(role, ROLE_SUBJECT));
-    if (!hasRole) {
-      const userRoles = permissionData.roles;
-      return {
-        result: false,
-        details: `\u7528\u6237 ${userId}, \u7528\u6237\u89D2\u8272 [${userRoles.join(", ")}], \u9700\u8981 [${roles.join(", ")}]`
-      };
-    }
-    return {
-      result: true
+        pageSize: params.pageSize ?? 20,
+        page: params.page ?? 1
+      },
+      userID: params.userID ?? (this.getUserId() || void 0)
     };
+    return traced(this.obs, this.logger, "search.search", {
+      httpMethod: "POST",
+      path: this.basePath,
+      params: body
+    }, async () => {
+      const response = await this.client.post(this.basePath, body);
+      const result = await requestWithTrace(response);
+      result.data = normalizeSearchResponse(result?.data);
+      return result;
+    });
   }
-  /**
-  * 检查权限点位要求
-  * 通过 IPermissionResolver 解析用户角色对应的权限点位，然后检查是否满足要求
-  * @param requirement 权限点位要求
-  * @param laneId 环境ID
-  * @param userContext 用户上下文
-  * @returns 用户权限检查结果，包含结果和详细信息
-  * @throws PermissionDeniedException 当权限解析器未注入或权限数据获取失败时
-  */
-  async checkPermissions(requirement, laneId, userContext) {
-    if (!this.permissionResolver) {
-      throw new PermissionDeniedException({
-        cause: new Error("PermissionResolver is not registered. Provide permissionResolver in AuthZPaasModule options."),
-        type: PermissionDeniedType.PERMISSION_CONFIG_QUERY_FAILED,
-        message: "PermissionResolver is not registered. Provide permissionResolver in AuthZPaasModule options."
-      }, import_common4.HttpStatus.BAD_REQUEST);
-    }
-    const { userId = "" } = this.requestContextService.getContext() || {};
-    let permissionData = null;
-    if (!userContext || !userContext.roles) {
-      permissionData = await this.getUserPermissions({
-        laneId
-      });
-    } else {
-      permissionData = {
-        userId,
-        roles: userContext.roles || [],
-        fetchedAt: /* @__PURE__ */ new Date()
-      };
-    }
-    if (!permissionData) {
-      throw new PermissionDeniedException({
-        cause: new Error("Permission data fetch api is not configured"),
-        type: PermissionDeniedType.PERMISSION_CONFIG_QUERY_FAILED,
-        message: "Permission data fetch api is not configured"
-      }, import_common4.HttpStatus.BAD_REQUEST);
-    }
-    const { permissions } = requirement;
-    if (!permissions || permissions.length === 0) {
-      return {
-        result: true
-      };
-    }
-    const userPermissions = await this.permissionResolver.resolvePermissions(permissionData.roles);
-    const hasAllPermissions = permissions.every((p) => userPermissions.includes(p));
-    if (!hasAllPermissions) {
-      const missingPermissions = permissions.filter((p) => !userPermissions.includes(p));
-      return {
-        result: false,
-        details: `\u7528\u6237 ${userId}, \u7528\u6237\u6743\u9650 [${userPermissions.join(", ")}], \u7F3A\u5C11 [${missingPermissions.join(", ")}]`
-      };
-    }
-    return {
-      result: true
-    };
+};
+var AuthorizationSDK = class _AuthorizationSDK {
+  static {
+    __name(this, "AuthorizationSDK");
+  }
+  requestContextService;
+  roles;
+  members;
+  search;
+  logger = new import_common5.Logger(_AuthorizationSDK.name);
+  constructor(client, obs, requestContextService) {
+    this.requestContextService = requestContextService;
+    const getAppId = /* @__PURE__ */ __name(() => {
+      const { appId = "" } = this.requestContextService.getContext() || {};
+      return appId;
+    }, "getAppId");
+    const getUserId = /* @__PURE__ */ __name(() => {
+      const { userId = "" } = this.requestContextService.getContext() || {};
+      return userId;
+    }, "getUserId");
+    this.roles = new RolesAPI(client, getAppId, getUserId, obs, this.logger);
+    this.members = new MembersAPI(client, getAppId, getUserId, obs, this.logger);
+    this.search = new SearchAPI(client, getAppId, getUserId, obs, this.logger);
   }
 };
-PermissionService = _ts_decorate3([
-  (0, import_common4.Injectable)(),
-  (0, import_nestjs_authnpaas.Public)(),
-  _ts_param2(3, (0, import_common4.Optional)()),
-  _ts_param2(3, (0, import_common4.Inject)(PERMISSION_RESOLVER_TOKEN)),
-  _ts_metadata2("design:type", Function),
-  _ts_metadata2("design:paramtypes", [
-    typeof AbilityFactory === "undefined" ? Object : AbilityFactory,
-    typeof AuthorizationSDK === "undefined" ? Object : AuthorizationSDK,
-    typeof import_nestjs_common3.RequestContextService === "undefined" ? Object : import_nestjs_common3.RequestContextService,
-    Object
+AuthorizationSDK = _ts_decorate4([
+  (0, import_common5.Injectable)(),
+  _ts_param3(0, (0, import_common5.Inject)(import_nestjs_common3.PLATFORM_HTTP_CLIENT)),
+  _ts_param3(1, (0, import_common5.Inject)(import_nestjs_common3.OBSERVABLE_SERVICE)),
+  _ts_metadata3("design:type", Function),
+  _ts_metadata3("design:paramtypes", [
+    typeof import_nestjs_common3.PlatformHttpClient === "undefined" ? Object : import_nestjs_common3.PlatformHttpClient,
+    typeof ObservableService === "undefined" ? Object : ObservableService,
+    typeof import_nestjs_common4.RequestContextService === "undefined" ? Object : import_nestjs_common4.RequestContextService
   ])
-], PermissionService);
+], AuthorizationSDK);
 
-// src/guards/authzpaas.guard.ts
-var import_common5 = require("@nestjs/common");
-var import_core = require("@nestjs/core");
-var import_nestjs_common4 = require("@lark-apaas/nestjs-common");
-function _ts_decorate4(decorators, target, key, desc) {
+// src/controllers/platform-permission.controller.ts
+var import_common6 = require("@nestjs/common");
+function _ts_decorate5(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate4, "_ts_decorate");
-function _ts_metadata3(k, v) {
+__name(_ts_decorate5, "_ts_decorate");
+function _ts_metadata4(k, v) {
   if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
-__name(_ts_metadata3, "_ts_metadata");
-function _ts_param3(paramIndex, decorator) {
+__name(_ts_metadata4, "_ts_metadata");
+function _ts_param4(paramIndex, decorator) {
   return function(target, key) {
     decorator(target, key, paramIndex);
   };
 }
-__name(_ts_param3, "_ts_param");
-var AuthZPaasGuard = class _AuthZPaasGuard {
+__name(_ts_param4, "_ts_param");
+var PlatformPermissionController = class {
   static {
-    __name(this, "AuthZPaasGuard");
+    __name(this, "PlatformPermissionController");
   }
-  reflector;
   permissionService;
-  obs;
-  constructor(reflector, permissionService, obs) {
-    this.reflector = reflector;
+  permissionResolver;
+  constructor(permissionService, permissionResolver = null) {
     this.permissionService = permissionService;
-    this.obs = obs;
-  }
-  logger = new import_common5.Logger(_AuthZPaasGuard.name);
-  /**
-  * 验证权限点位要求是否有效
-  * @param requirements 权限点位要求
-  * @returns 是否有效
-  */
-  isValidPermissionRequirement(requirements) {
-    return Boolean(requirements && requirements.permissions && requirements.permissions.length > 0);
-  }
-  /**
-  * 验证角色要求是否有效
-  * @param requirements 角色要求
-  * @returns 是否有效
-  */
-  isValidRoleRequirement(requirements) {
-    return Boolean(requirements && requirements.roles && requirements.roles.length > 0);
+    this.permissionResolver = permissionResolver;
   }
-  async canActivate(context) {
-    const http = context.switchToHttp();
-    const request = http.getRequest();
-    const laneId = request.headers["x-tt-env"];
-    const baseUrl = `${request.protocol}://${request.get("host")}`;
-    const userContext = request.userContext;
-    userContext.baseUrl = baseUrl;
-    const checkRoleRequirement = this.reflector.getAllAndOverride(ROLES_KEY, [
-      context.getHandler(),
-      context.getClass()
-    ]);
-    if (this.isValidRoleRequirement(checkRoleRequirement)) {
-      const spanName = checkRoleRequirement.roles.join(" or ");
-      const logAttrs = {
-        source_type: "platform",
-        paas_attributes_module: "permission"
-      };
-      return this.obs.trace(spanName, async (span) => {
-        span.setAttributes({
-          module: "permission"
-        });
-        const elapsed = (0, import_nestjs_common4.createTimer)();
-        try {
-          const checkResult = await this.permissionService.checkRoles(checkRoleRequirement, laneId, userContext);
-          const durationMs = elapsed();
-          span.setAttribute("duration_ms", durationMs);
-          if (!checkResult.result) {
-            this.logger.warn(JSON.stringify({
-              role: spanName,
-              duration_ms: durationMs,
-              result: "no_auth",
-              result_detail: checkResult.details
-            }), {
-              ...logAttrs,
-              duration_ms: durationMs
-            });
-          } else {
-            this.logger.log(JSON.stringify({
-              role: spanName,
-              duration_ms: durationMs,
-              result: "has_auth"
-            }), {
-              ...logAttrs,
-              duration_ms: durationMs
-            });
-          }
-          return checkResult.result;
-        } catch (error) {
-          const durationMs = elapsed();
-          span.setAttribute("duration_ms", durationMs);
-          this.logger.error(JSON.stringify({
-            role: spanName,
-            duration_ms: durationMs,
-            result: "",
-            error_message: error.message
-          }), {
-            ...logAttrs,
-            duration_ms: durationMs
-          });
-          throw error;
-        }
-      });
+  async getUserPoints(req) {
+    if (!this.permissionResolver) {
+      return [];
     }
-    const permissionRequirement = this.reflector.getAllAndOverride(PERMISSIONS_KEY, [
-      context.getHandler(),
-      context.getClass()
-    ]);
-    if (this.isValidPermissionRequirement(permissionRequirement)) {
-      const spanName = permissionRequirement.permissions.join(" and ");
-      return this.obs.trace(spanName, async (span) => {
-        span.setAttributes({
-          module: "permission"
-        });
-        const startTime = Date.now();
-        try {
-          const checkResult = await this.permissionService.checkPermissions(permissionRequirement, laneId, userContext);
-          const endTime = Date.now();
-          if (!checkResult.result) {
-            this.logger.warn(JSON.stringify({
-              permission: spanName,
-              duration_ms: endTime - startTime,
-              result: checkResult.result ? "has_auth" : "no_auth",
-              result_detail: checkResult.details
-            }), {
-              source_type: "platform",
-              paas_attributes_module: "permission"
-            });
-          } else {
-            this.logger.log(JSON.stringify({
-              permission: spanName,
-              duration_ms: endTime - startTime,
-              result: checkResult.result ? "has_auth" : "no_auth"
-            }), {
-              source_type: "platform",
-              paas_attributes_module: "permission"
-            });
-          }
-          return checkResult.result;
-        } catch (error) {
-          const endTime = Date.now();
-          this.logger.error(JSON.stringify({
-            permission: spanName,
-            duration_ms: endTime - startTime,
-            result: "",
-            error_message: error.message
-          }), {
-            source_type: "platform",
-            paas_attributes_module: "permission"
-          });
-          throw error;
-        }
-      });
+    const userContext = req.userContext;
+    let roleKeys;
+    if (userContext?.roles) {
+      roleKeys = userContext.roles;
+    } else {
+      const permissionData = await this.permissionService.getUserPermissions({});
+      roleKeys = permissionData?.roles || [];
     }
-    return true;
+    return this.permissionResolver.resolvePermissions(roleKeys);
   }
 };
-AuthZPaasGuard = _ts_decorate4([
-  (0, import_common5.Injectable)(),
-  _ts_param3(2, (0, import_common5.Inject)(import_nestjs_common4.OBSERVABLE_SERVICE)),
-  _ts_metadata3("design:type", Function),
-  _ts_metadata3("design:paramtypes", [
-    typeof import_core.Reflector === "undefined" ? Object : import_core.Reflector,
+_ts_decorate5([
+  (0, import_common6.Get)("user-points"),
+  _ts_param4(0, (0, import_common6.Req)()),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
+    typeof Request === "undefined" ? Object : Request
+  ]),
+  _ts_metadata4("design:returntype", Promise)
+], PlatformPermissionController.prototype, "getUserPoints", null);
+PlatformPermissionController = _ts_decorate5([
+  (0, import_common6.Controller)("api/sdk_innerapi/permission"),
+  _ts_param4(1, (0, import_common6.Optional)()),
+  _ts_param4(1, (0, import_common6.Inject)(PERMISSION_RESOLVER_TOKEN)),
+  _ts_metadata4("design:type", Function),
+  _ts_metadata4("design:paramtypes", [
     typeof PermissionService === "undefined" ? Object : PermissionService,
-    typeof import_nestjs_common4.ObservableService === "undefined" ? Object : import_nestjs_common4.ObservableService
+    Object
   ])
-], AuthZPaasGuard);
+], PlatformPermissionController);
 
 // src/authzpaas.module.ts
-function _ts_decorate5(decorators, target, key, desc) {
+function _ts_decorate6(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
   else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
   return c > 3 && r && Object.defineProperty(target, key, r), r;
 }
-__name(_ts_decorate5, "_ts_decorate");
+__name(_ts_decorate6, "_ts_decorate");
 var AuthZPaasModule = class _AuthZPaasModule {
   static {
     __name(this, "AuthZPaasModule");
@@ -1105,7 +1248,9 @@ var AuthZPaasModule = class _AuthZPaasModule {
     return {
       module: _AuthZPaasModule,
       global: true,
-      controllers: [],
+      controllers: [
+        PlatformPermissionController
+      ],
       providers: [
         // 配置提供者
         {
@@ -1186,7 +1331,9 @@ var AuthZPaasModule = class _AuthZPaasModule {
       module: _AuthZPaasModule,
       global: true,
       imports,
-      controllers: [],
+      controllers: [
+        PlatformPermissionController
+      ],
       providers: [
         // 异步配置提供者
         {
@@ -1237,12 +1384,12 @@ var AuthZPaasModule = class _AuthZPaasModule {
     };
   }
 };
-AuthZPaasModule = _ts_decorate5([
-  (0, import_common6.Module)({})
+AuthZPaasModule = _ts_decorate6([
+  (0, import_common7.Module)({})
 ], AuthZPaasModule);
 
 // src/decorators/can-role.decorator.ts
-var import_common7 = require("@nestjs/common");
+var import_common8 = require("@nestjs/common");
 var CanRole = /* @__PURE__ */ __name((role) => {
   let requirement;
   if (!Array.isArray(role) && typeof role === "string") {
@@ -1258,19 +1405,17 @@ var CanRole = /* @__PURE__ */ __name((role) => {
   } else {
     throw new Error("Invalid CanRole parameter: " + JSON.stringify(role));
   }
-  return (0, import_common7.SetMetadata)(ROLES_KEY, requirement);
+  return (0, import_common8.SetMetadata)(ROLES_KEY, requirement);
 }, "CanRole");
 
 // src/decorators/can.decorator.ts
-var import_common8 = require("@nestjs/common");
-var Can = /* @__PURE__ */ __name((permissions) => {
-  if (!Array.isArray(permissions) || !permissions.every((p) => typeof p === "string")) {
-    throw new Error("Invalid Can parameter: " + JSON.stringify(permissions));
-  }
+var import_common9 = require("@nestjs/common");
+var Can = /* @__PURE__ */ __name((action, subject) => {
   const requirement = {
-    permissions
+    action,
+    subject
   };
-  return (0, import_common8.SetMetadata)(PERMISSIONS_KEY, requirement);
+  return (0, import_common9.SetMetadata)(PERMISSIONS_KEY, requirement);
 }, "Can");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {