@marinoscar/platform-api 0.1.0-next.3 → 0.1.0-next.5

package/dist/sharing/jobs/grants-prune.handler.js

@@ -0,0 +1,181 @@
+"use strict";
+// =============================================================================
+// `sharing.grants.prune` job handler (issue #729, PP-7.2)
+// =============================================================================
+//
+// Grant hygiene, in CHUNKS, each chunk its own short system transaction:
+//
+//   1. RETENTION. Deletes grants revoked, or expired, more than
+//      `grants.retentionDays` ago (forRoot option, default 90). A revoked grant
+//      is kept until then for the audit trail and the owner's history.
+//   2. DANGLING GRANTS. A grant names its record polymorphically, with no
+//      foreign key, so a record an app deleted without calling
+//      `GrantsService.deleteForResources()` leaves its grants behind. For every
+//      registered resource type, the job walks the distinct record ids of its
+//      grants (keyset, `GRANTS_PRUNE_CHUNK` at a time), asks the type's
+//      `loadOwners` which still exist, and deletes the grants of the others.
+//      Grants of a type nobody registers any more are left alone: the type may
+//      come back, and its id is permanent.
+//
+// SYSTEM WORK (reason `retention`): it crosses organizations, so it runs on
+// the system bypass client, where `loadOwners` sees every organization too.
+//
+// SERVER-ONLY, PERMANENTLY: no `nodeResultSchema`/`persistNodeResult`. It
+// reads the app's tables mid-computation (`loadOwners`), one of the reasons
+// CLAUDE.md gives for a server-only job.
+//
+// IDEMPOTENT: a retry or a duplicate run deletes what is still due and
+// nothing else. Enqueued daily by `GrantsPruneTask` (enqueue only).
+//
+// THE TYPE STRING IS PERMANENT once jobs of it exist.
+// =============================================================================
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var GrantsPruneHandler_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GrantsPruneHandler = exports.GRANTS_PRUNE_CLOCK = exports.GRANTS_PRUNE_CHUNK = exports.GRANTS_PRUNE_JOB_TYPE = void 0;
+const common_1 = require("@nestjs/common");
+const resource_types_1 = require("../access/resource-types");
+const sharing_tx_1 = require("../data/sharing-tx");
+const ports_1 = require("../ports");
+const sharing_options_1 = require("../sharing.options");
+/**
+ * The job type. PERMANENT once rows of it exist.
+ *
+ * @stability stable
+ */
+exports.GRANTS_PRUNE_JOB_TYPE = 'sharing.grants.prune';
+/**
+ * How many grants (retention) or record ids (dangling) one chunk handles.
+ *
+ * @stability experimental
+ */
+exports.GRANTS_PRUNE_CHUNK = 500;
+/**
+ * Optional injection token of the prune job's clock (ms since epoch).
+ *
+ * @stability experimental
+ */
+exports.GRANTS_PRUNE_CLOCK = Symbol.for('@marinoscar/platform/sharing/GRANTS_PRUNE_CLOCK');
+/**
+ * Deletes old revoked or expired grants and dangling grants, in chunks.
+ *
+ * @stability experimental
+ */
+let GrantsPruneHandler = GrantsPruneHandler_1 = class GrantsPruneHandler {
+    data;
+    options;
+    jobs;
+    now;
+    /** The job type. */
+    type = exports.GRANTS_PRUNE_JOB_TYPE;
+    logger = new common_1.Logger(GrantsPruneHandler_1.name);
+    constructor(data, options, jobs, now = Date.now) {
+        this.data = data;
+        this.options = options;
+        this.jobs = jobs;
+        this.now = now;
+    }
+    /** Registers the handler with the app's queue, when the app bound one. */
+    onModuleInit() {
+        this.jobs?.registerHandler(this);
+    }
+    /**
+     * Runs one prune.
+     *
+     * @param job - the claimed job (its payload is unused: the job is global).
+     */
+    async process(job) {
+        const summary = await this.prune();
+        const dangling = Object.values(summary.dangling).reduce((sum, n) => sum + n, 0);
+        this.logger.log(`Job ${job.id}: pruned ${summary.expiredOrRevoked} revoked or expired grant(s) and ${dangling} dangling grant(s) in ${summary.chunks} chunk(s).`);
+    }
+    /**
+     * The prune itself (also callable directly, e.g. from a test).
+     *
+     * @returns what it deleted.
+     */
+    async prune() {
+        const summary = { expiredOrRevoked: 0, dangling: {}, chunks: 0 };
+        const cutoff = new Date(this.now() - this.options.grants.retentionDays * 86_400_000);
+        // 1. Retention.
+        for (;;) {
+            const { found, deleted } = await this.data.runAsSystem('retention', async (raw) => {
+                const tx = (0, sharing_tx_1.asSharingTx)(raw);
+                const rows = await tx.grant.findMany({
+                    where: { OR: [{ revokedAt: { lt: cutoff } }, { expiresAt: { lt: cutoff } }] },
+                    select: { id: true },
+                    orderBy: { id: 'asc' },
+                    take: exports.GRANTS_PRUNE_CHUNK,
+                });
+                if (rows.length === 0)
+                    return { found: 0, deleted: 0 };
+                const { count } = await tx.grant.deleteMany({ where: { id: { in: rows.map((row) => row.id) } } });
+                return { found: rows.length, deleted: count };
+            });
+            if (found > 0)
+                summary.chunks += 1;
+            summary.expiredOrRevoked += deleted;
+            if (found < exports.GRANTS_PRUNE_CHUNK)
+                break;
+        }
+        // 2. Dangling grants, per registered type.
+        for (const type of resource_types_1.resourceTypeRegistry.ids()) {
+            const rt = (0, resource_types_1.requireResourceType)(type);
+            let cursor = null;
+            let deletedForType = 0;
+            for (;;) {
+                const after = cursor;
+                const step = await this.data.runAsSystem('retention', async (raw) => {
+                    const tx = (0, sharing_tx_1.asSharingTx)(raw);
+                    const rows = await tx.grant.groupBy({
+                        by: ['resourceId'],
+                        where: { resourceType: type, ...(after ? { resourceId: { gt: after } } : {}) },
+                        orderBy: { resourceId: 'asc' },
+                        take: exports.GRANTS_PRUNE_CHUNK,
+                    });
+                    const ids = rows.map((row) => row.resourceId);
+                    if (ids.length === 0)
+                        return { ids, deleted: 0 };
+                    const owners = await rt.def.loadOwners(ids, raw);
+                    const missing = ids.filter((id) => !owners.has(id));
+                    if (missing.length === 0)
+                        return { ids, deleted: 0 };
+                    const { count } = await tx.grant.deleteMany({ where: { resourceType: type, resourceId: { in: missing } } });
+                    return { ids, deleted: count };
+                });
+                if (step.ids.length > 0)
+                    summary.chunks += 1;
+                deletedForType += step.deleted;
+                if (step.ids.length < exports.GRANTS_PRUNE_CHUNK)
+                    break;
+                cursor = step.ids[step.ids.length - 1];
+            }
+            if (deletedForType > 0)
+                summary.dangling[type] = deletedForType;
+        }
+        return summary;
+    }
+};
+exports.GrantsPruneHandler = GrantsPruneHandler;
+exports.GrantsPruneHandler = GrantsPruneHandler = GrantsPruneHandler_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(ports_1.SHARING_DATA)),
+    __param(1, (0, common_1.Inject)(sharing_options_1.SHARING_OPTIONS)),
+    __param(2, (0, common_1.Optional)()),
+    __param(2, (0, common_1.Inject)(ports_1.SHARING_JOBS)),
+    __param(3, (0, common_1.Optional)()),
+    __param(3, (0, common_1.Inject)(exports.GRANTS_PRUNE_CLOCK)),
+    __metadata("design:paramtypes", [Object, Object, Object, Function])
+], GrantsPruneHandler);
+//# sourceMappingURL=grants-prune.handler.js.map

package/dist/sharing/jobs/grants-prune.handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants-prune.handler.js","sourceRoot":"","sources":["../../../src/sharing/jobs/grants-prune.handler.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,0DAA0D;AAC1D,gFAAgF;AAChF,EAAE;AACF,yEAAyE;AACzE,EAAE;AACF,gEAAgE;AAChE,gFAAgF;AAChF,uEAAuE;AACvE,0EAA0E;AAC1E,+DAA+D;AAC/D,gFAAgF;AAChF,8EAA8E;AAC9E,wEAAwE;AACxE,6EAA6E;AAC7E,+EAA+E;AAC/E,2CAA2C;AAC3C,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,EAAE;AACF,0EAA0E;AAC1E,4EAA4E;AAC5E,yCAAyC;AACzC,EAAE;AACF,uEAAuE;AACvE,oEAAoE;AACpE,EAAE;AACF,sDAAsD;AACtD,gFAAgF;;;;;;;;;;;;;;;;AAEhF,2CAAoF;AAEpF,6DAAqF;AACrF,mDAAiD;AACjD,oCAAiJ;AACjJ,wDAAwF;AAExF;;;;GAIG;AACU,QAAA,qBAAqB,GAAG,sBAAsB,CAAC;AAE5D;;;;GAIG;AACU,QAAA,kBAAkB,GAAG,GAAG,CAAC;AAEtC;;;;GAIG;AACU,QAAA,kBAAkB,GAAkB,MAAM,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;AAgB/G;;;;GAIG;AAEI,IAAM,kBAAkB,0BAAxB,MAAM,kBAAkB;IAMY;IACG;IACS;IACM;IAR3D,oBAAoB;IACX,IAAI,GAAG,6BAAqB,CAAC;IACrB,MAAM,GAAG,IAAI,eAAM,CAAC,oBAAkB,CAAC,IAAI,CAAC,CAAC;IAE9D,YACyC,IAAqB,EAClB,OAAqC,EAC5B,IAAsB,EAChB,MAAoB,IAAI,CAAC,GAAG;QAH9C,SAAI,GAAJ,IAAI,CAAiB;QAClB,YAAO,GAAP,OAAO,CAA8B;QAC5B,SAAI,GAAJ,IAAI,CAAkB;QAChB,QAAG,GAAH,GAAG,CAAyB;IACpF,CAAC;IAEJ,0EAA0E;IAC1E,YAAY;QACV,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,GAAqB;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,OAAO,GAAG,CAAC,EAAE,YAAY,OAAO,CAAC,gBAAgB,oCAAoC,QAAQ,yBAAyB,OAAO,CAAC,MAAM,YAAY,CACjJ,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK;QACT,MAAM,OAAO,GAAuB,EAAE,gBAAgB,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QACrF,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,GAAG,UAAU,CAAC,CAAC;QAErF,gBAAgB;QAChB,SAAS,CAAC;YACR,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;gBAChF,MAAM,EAAE,GAAG,IAAA,wBAAW,EAAC,GAAG,CAAC,CAAC;gBAC5B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAiB;oBACnD,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE;oBAC7E,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;oBACpB,OAAO,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE;oBACtB,IAAI,EAAE,0BAAkB;iBACzB,CAAC,CAAC;gBACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;gBACvD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBAClG,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAChD,CAAC,CAAC,CAAC;YACH,IAAI,KAAK,GAAG,CAAC;gBAAE,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;YACnC,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC;YACpC,IAAI,KAAK,GAAG,0BAAkB;gBAAE,MAAM;QACxC,CAAC;QAED,2CAA2C;QAC3C,KAAK,MAAM,IAAI,IAAI,qCAAoB,CAAC,GAAG,EAAE,EAAE,CAAC;YAC9C,MAAM,EAAE,GAAG,IAAA,oCAAmB,EAAC,IAAI,CAAC,CAAC;YACrC,IAAI,MAAM,GAAkB,IAAI,CAAC;YACjC,IAAI,cAAc,GAAG,CAAC,CAAC;YACvB,SAAS,CAAC;gBACR,MAAM,KAAK,GAAkB,MAAM,CAAC;gBACpC,MAAM,IAAI,GAAuC,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;oBACtG,MAAM,EAAE,GAAG,IAAA,wBAAW,EAAC,GAAG,CAAC,CAAC;oBAC5B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAyB;wBAC1D,EAAE,EAAE,CAAC,YAAY,CAAC;wBAClB,KAAK,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;wBAC9E,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE;wBAC9B,IAAI,EAAE,0BAAkB;qBACzB,CAAC,CAAC;oBACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;oBAC9C,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;wBAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;oBACjD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBACjD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;oBACpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;wBAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;oBACrD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;oBAC5G,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;gBACjC,CAAC,CAAC,CAAC;gBACH,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;gBAC7C,cAAc,IAAI,IAAI,CAAC,OAAO,CAAC;gBAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,0BAAkB;oBAAE,MAAM;gBAChD,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;YAC1C,CAAC;YACD,IAAI,cAAc,GAAG,CAAC;gBAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC;QAClE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAA;AA1FY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;IAOR,WAAA,IAAA,eAAM,EAAC,oBAAY,CAAC,CAAA;IACpB,WAAA,IAAA,eAAM,EAAC,iCAAe,CAAC,CAAA;IACvB,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,oBAAY,CAAC,CAAA;IAChC,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,0BAAkB,CAAC,CAAA;;GAT9B,kBAAkB,CA0F9B"}

package/dist/sharing/jobs/grants-prune.task.d.ts

@@ -0,0 +1,14 @@
+import { type SharingJobsPort } from '../ports';
+/**
+ * Enqueues `sharing.grants.prune` once a day.
+ *
+ * @stability experimental
+ */
+export declare class GrantsPruneTask {
+    private readonly jobs?;
+    private readonly logger;
+    constructor(jobs?: SharingJobsPort | undefined);
+    /** The daily tick: enqueue only. */
+    handleCron(): Promise<void>;
+}
+//# sourceMappingURL=grants-prune.task.d.ts.map

package/dist/sharing/jobs/grants-prune.task.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants-prune.task.d.ts","sourceRoot":"","sources":["../../../src/sharing/jobs/grants-prune.task.ts"],"names":[],"mappings":"AAeA,OAAO,EAAgB,KAAK,eAAe,EAAE,MAAM,UAAU,CAAC;AAG9D;;;;GAIG;AACH,qBACa,eAAe;IAGoB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IAFpE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;gBAEI,IAAI,CAAC,EAAE,eAAe,YAAA;IAErF,oCAAoC;IAE9B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;CAIlC"}

package/dist/sharing/jobs/grants-prune.task.js

@@ -0,0 +1,63 @@
+"use strict";
+// =============================================================================
+// Daily grants prune scheduler (issue #729, PP-7.2)
+// =============================================================================
+//
+// ⚠ THIS TASK TOUCHES NO DATABASE BUT ITS OWN QUEUE. It enqueues one global
+// `sharing.grants.prune` job through the app's shared housekeeping helper
+// (`SharingJobsPort.enqueueHousekeepingJob`), and `GrantsPruneHandler` does
+// the deleting on a worker slot. Pinned by
+// `apps/api/test/conformance.spec.ts`, which scans this slice.
+// Without a jobs port bound, it does nothing.
+// =============================================================================
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var GrantsPruneTask_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GrantsPruneTask = void 0;
+const common_1 = require("@nestjs/common");
+const schedule_1 = require("@nestjs/schedule");
+const ports_1 = require("../ports");
+const grants_prune_handler_1 = require("./grants-prune.handler");
+/**
+ * Enqueues `sharing.grants.prune` once a day.
+ *
+ * @stability experimental
+ */
+let GrantsPruneTask = GrantsPruneTask_1 = class GrantsPruneTask {
+    jobs;
+    logger = new common_1.Logger(GrantsPruneTask_1.name);
+    constructor(jobs) {
+        this.jobs = jobs;
+    }
+    /** The daily tick: enqueue only. */
+    async handleCron() {
+        if (!this.jobs)
+            return;
+        await this.jobs.enqueueHousekeepingJob({ logger: this.logger, type: grants_prune_handler_1.GRANTS_PRUNE_JOB_TYPE, what: 'grants prune' });
+    }
+};
+exports.GrantsPruneTask = GrantsPruneTask;
+__decorate([
+    (0, schedule_1.Cron)(schedule_1.CronExpression.EVERY_DAY_AT_3AM),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], GrantsPruneTask.prototype, "handleCron", null);
+exports.GrantsPruneTask = GrantsPruneTask = GrantsPruneTask_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Optional)()),
+    __param(0, (0, common_1.Inject)(ports_1.SHARING_JOBS)),
+    __metadata("design:paramtypes", [Object])
+], GrantsPruneTask);
+//# sourceMappingURL=grants-prune.task.js.map

package/dist/sharing/jobs/grants-prune.task.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants-prune.task.js","sourceRoot":"","sources":["../../../src/sharing/jobs/grants-prune.task.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,oDAAoD;AACpD,gFAAgF;AAChF,EAAE;AACF,4EAA4E;AAC5E,0EAA0E;AAC1E,4EAA4E;AAC5E,2CAA2C;AAC3C,+DAA+D;AAC/D,8CAA8C;AAC9C,gFAAgF;;;;;;;;;;;;;;;;AAEhF,2CAAsE;AACtE,+CAAwD;AAExD,oCAA8D;AAC9D,iEAA+D;AAE/D;;;;GAIG;AAEI,IAAM,eAAe,uBAArB,MAAM,eAAe;IAGqC;IAF9C,MAAM,GAAG,IAAI,eAAM,CAAC,iBAAe,CAAC,IAAI,CAAC,CAAC;IAE3D,YAA+D,IAAsB;QAAtB,SAAI,GAAJ,IAAI,CAAkB;IAAG,CAAC;IAEzF,oCAAoC;IAE9B,AAAN,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO;QACvB,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,4CAAqB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;IACrH,CAAC;CACF,CAAA;AAXY,0CAAe;AAOpB;IADL,IAAA,eAAI,EAAC,yBAAc,CAAC,gBAAgB,CAAC;;;;iDAIrC;0BAVU,eAAe;IAD3B,IAAA,mBAAU,GAAE;IAIE,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,oBAAY,CAAC,CAAA;;GAHlC,eAAe,CAW3B"}

package/dist/sharing/links/link-grant.decorators.d.ts

@@ -0,0 +1,46 @@
+/**
+ * The metadata key `@LinkGrantResource` writes and `LinkGrantGuard` reads.
+ *
+ * @stability experimental
+ */
+export declare const LINK_GRANT_RESOURCE_KEY = "sharing:link-grant-resource";
+/**
+ * The request property `LinkGrantGuard` sets to the resolved link.
+ *
+ * @stability experimental
+ */
+export declare const LINK_GRANT_REQUEST_KEY = "linkGrant";
+/**
+ * Declares which links a `LinkGrantGuard` route accepts: links to records of
+ * `resourceType` whose role reaches the minimum role of `action`. A route
+ * behind the guard without it fails closed (500: a programming error).
+ *
+ * @param resourceType - the registered resource type the route serves.
+ * @param options - `action`: the type's action the route performs (default `read`;
+ *   none for the platform's any-type route).
+ * @returns the method (or class) decorator.
+ *
+ * @example
+ * ```ts
+ * @Get()
+ * @LinkGrantResource('media_item', { action: 'read' })
+ * get(@CurrentLinkGrant() link: ResolvedLinkGrant) { ... }
+ * ```
+ *
+ * @extensionPoint hook
+ * @stability experimental
+ */
+export declare function LinkGrantResource(resourceType: string, options?: {
+    action?: string;
+}): MethodDecorator & ClassDecorator;
+/**
+ * The link `LinkGrantGuard` resolved for this request. Outside a guarded
+ * route there is none, and the handler answers the same 404 as a bad link.
+ *
+ * @returns the parameter decorator.
+ *
+ * @extensionPoint hook
+ * @stability experimental
+ */
+export declare const CurrentLinkGrant: () => ParameterDecorator;
+//# sourceMappingURL=link-grant.decorators.d.ts.map

package/dist/sharing/links/link-grant.decorators.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-grant.decorators.d.ts","sourceRoot":"","sources":["../../../src/sharing/links/link-grant.decorators.ts"],"names":[],"mappings":"AAcA;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,gCAAgC,CAAC;AAErE;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,cAAc,CAAC;AAElD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,eAAe,GAAG,cAAc,CAM3H;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,kBAMpC,CAAC"}

package/dist/sharing/links/link-grant.decorators.js

@@ -0,0 +1,71 @@
+"use strict";
+// =============================================================================
+// The public-route decorators of link shares (issue #730)
+// =============================================================================
+//
+//   @LinkGrantResource(type, { action })   what a `LinkGrantGuard` route accepts
+//   @CurrentLinkGrant()                    the resolved link, in the handler
+//
+// See ./link-grant.guard.ts for the pattern.
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CurrentLinkGrant = exports.LINK_GRANT_REQUEST_KEY = exports.LINK_GRANT_RESOURCE_KEY = void 0;
+exports.LinkGrantResource = LinkGrantResource;
+const common_1 = require("@nestjs/common");
+const link_grants_service_1 = require("./link-grants.service");
+/**
+ * The metadata key `@LinkGrantResource` writes and `LinkGrantGuard` reads.
+ *
+ * @stability experimental
+ */
+exports.LINK_GRANT_RESOURCE_KEY = 'sharing:link-grant-resource';
+/**
+ * The request property `LinkGrantGuard` sets to the resolved link.
+ *
+ * @stability experimental
+ */
+exports.LINK_GRANT_REQUEST_KEY = 'linkGrant';
+/**
+ * Declares which links a `LinkGrantGuard` route accepts: links to records of
+ * `resourceType` whose role reaches the minimum role of `action`. A route
+ * behind the guard without it fails closed (500: a programming error).
+ *
+ * @param resourceType - the registered resource type the route serves.
+ * @param options - `action`: the type's action the route performs (default `read`;
+ *   none for the platform's any-type route).
+ * @returns the method (or class) decorator.
+ *
+ * @example
+ * ```ts
+ * @Get()
+ * @LinkGrantResource('media_item', { action: 'read' })
+ * get(@CurrentLinkGrant() link: ResolvedLinkGrant) { ... }
+ * ```
+ *
+ * @extensionPoint hook
+ * @stability experimental
+ */
+function LinkGrantResource(resourceType, options = {}) {
+    if (typeof resourceType !== 'string' || resourceType.length === 0)
+        throw new Error('@LinkGrantResource(type): the resource type is required.');
+    // The platform's own any-type route checks no action; an app route defaults to `read`.
+    const action = options.action ?? (resourceType === link_grants_service_1.ANY_LINK_RESOURCE_TYPE ? undefined : 'read');
+    const expectation = action === undefined ? { resourceType } : { resourceType, action };
+    return (0, common_1.SetMetadata)(exports.LINK_GRANT_RESOURCE_KEY, Object.freeze(expectation));
+}
+/**
+ * The link `LinkGrantGuard` resolved for this request. Outside a guarded
+ * route there is none, and the handler answers the same 404 as a bad link.
+ *
+ * @returns the parameter decorator.
+ *
+ * @extensionPoint hook
+ * @stability experimental
+ */
+exports.CurrentLinkGrant = (0, common_1.createParamDecorator)((_data, ctx) => {
+    const link = ctx.switchToHttp().getRequest()[exports.LINK_GRANT_REQUEST_KEY];
+    if (!link)
+        throw new common_1.NotFoundException('Link not found');
+    return link;
+});
+//# sourceMappingURL=link-grant.decorators.js.map

package/dist/sharing/links/link-grant.decorators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-grant.decorators.js","sourceRoot":"","sources":["../../../src/sharing/links/link-grant.decorators.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,0DAA0D;AAC1D,gFAAgF;AAChF,EAAE;AACF,iFAAiF;AACjF,6EAA6E;AAC7E,EAAE;AACF,6CAA6C;AAC7C,gFAAgF;;;AAwChF,8CAMC;AA5CD,2CAA6G;AAE7G,+DAAuH;AAEvH;;;;GAIG;AACU,QAAA,uBAAuB,GAAG,6BAA6B,CAAC;AAErE;;;;GAIG;AACU,QAAA,sBAAsB,GAAG,WAAW,CAAC;AAElD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAgB,iBAAiB,CAAC,YAAoB,EAAE,UAA+B,EAAE;IACvF,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC/I,uFAAuF;IACvF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,KAAK,4CAAsB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAChG,MAAM,WAAW,GAA8B,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;IAClH,OAAO,IAAA,oBAAW,EAAC,+BAAuB,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;GAQG;AACU,QAAA,gBAAgB,GAA6B,IAAA,6BAAoB,EAC5E,CAAC,KAAc,EAAE,GAAqB,EAAqB,EAAE;IAC3D,MAAM,IAAI,GAAI,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAA8B,CAAC,8BAAsB,CAAkC,CAAC;IACnI,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,0BAAiB,CAAC,gBAAgB,CAAC,CAAC;IACzD,OAAO,IAAI,CAAC;AACd,CAAC,CACF,CAAC"}

package/dist/sharing/links/link-grant.guard.d.ts

@@ -0,0 +1,47 @@
+import { type CanActivate, type ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { MetricsHostService } from '../../otel-core/index';
+import { LinkGrantsService } from './link-grants.service';
+import { LinkMissThrottle } from './link-miss-throttle';
+/**
+ * The span attribute set on a successful resolution (the grant id; nothing else of the link).
+ *
+ * @stability experimental
+ */
+export declare const LINK_GRANT_SPAN_ATTRIBUTE = "sharing.link.grant_id";
+/**
+ * A short, keyed, non-reversible tag of a client address for a log line.
+ *
+ * @param address - the client address.
+ * @returns 12 hex characters.
+ *
+ * @stability experimental
+ */
+export declare function addressTag(address: string): string;
+/**
+ * Authenticates a public route by the link token in `X-Link-Token`, for the
+ * resource type its `@LinkGrantResource` names, and hands the handler the
+ * resolved link (`@CurrentLinkGrant()`). Every failure is the same 404;
+ * repeated failures from one address become 429.
+ *
+ * @stability experimental
+ * @extensionPoint hook
+ */
+export declare class LinkGrantGuard implements CanActivate {
+    private readonly reflector;
+    private readonly links;
+    private readonly throttle;
+    private readonly metrics?;
+    private readonly logger;
+    constructor(reflector: Reflector, links: LinkGrantsService, throttle: LinkMissThrottle, metrics?: MetricsHostService | undefined);
+    /**
+     * @param context - the route's execution context.
+     * @returns `true` with `request.linkGrant` set.
+     * @throws NotFoundException 404 (`Link not found`) for every invalid link.
+     * @throws HttpException 429 `LINK_RESOLUTION_THROTTLED` for an address over its miss budget.
+     * @throws Error when the route declares no `@LinkGrantResource` (a programming error).
+     */
+    canActivate(context: ExecutionContext): Promise<boolean>;
+    private count;
+}
+//# sourceMappingURL=link-grant.guard.d.ts.map

package/dist/sharing/links/link-grant.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-grant.guard.d.ts","sourceRoot":"","sources":["../../../src/sharing/links/link-grant.guard.ts"],"names":[],"mappings":"AAwCA,OAAO,EAAgC,KAAK,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvG,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAIzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAI3D,OAAO,EAA0B,iBAAiB,EAAsD,MAAM,uBAAuB,CAAC;AACtI,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGxD;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,0BAA0B,CAAC;AAKjE;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAElD;AASD;;;;;;;;GAQG;AACH,qBACa,cAAe,YAAW,WAAW;IAI9C,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACb,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IANvC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgC;gBAGpC,SAAS,EAAE,SAAS,EACpB,KAAK,EAAE,iBAAiB,EACxB,QAAQ,EAAE,gBAAgB,EACd,OAAO,CAAC,EAAE,kBAAkB,YAAA;IAG3D;;;;;;OAMG;IACG,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAqC9D,OAAO,CAAC,KAAK;CAOd"}

package/dist/sharing/links/link-grant.guard.js

@@ -0,0 +1,163 @@
+"use strict";
+// =============================================================================
+// LinkGrantGuard: the public-route pattern of link shares (issue #730)
+// =============================================================================
+//
+// A public request has no principal and therefore no organization. The guard
+// makes one link token the request's whole authority, for one route:
+//
+//   @Controller('public/media')                  // app code
+//   @Public()                                    // deliberately public: the guard authenticates
+//   @UseGuards(LinkGrantGuard)
+//   export class PublicMediaController {
+//     @Get()
+//     @LinkGrantResource('media_item', { action: 'read' })
+//     get(@CurrentLinkGrant() link: ResolvedLinkGrant) {
+//       return this.links.withLinkScope(link, (tx) => this.media.publicView(tx, link.resourceId));
+//     }
+//   }
+//
+// THE ORDER:
+//   0. `Cache-Control: no-store` and `Referrer-Policy: no-referrer` on the
+//      reply, before anything can refuse (guards run before interceptors).
+//   1. A client address over its miss budget: 429 (`Retry-After`), even
+//      with a valid token.
+//   2. The token from the `X-Link-Token` HEADER only. A token in the path or
+//      the query string is never read (docs/API.md: tokens in the query
+//      string are not accepted); a browser keeps it in the URL fragment.
+//   3. `LinkGrantsService.resolve`: format, the one bypass lookup by hash,
+//      revoked, expired, the route's type, the type still granting the role
+//      to links, the action's minimum role, the record still in the grant's
+//      organization.
+//   4. Any failure: ONE miss for the address and the SAME 404 (`Link not
+//      found`) whatever the reason. Success: `request.linkGrant`.
+//
+// LOGS AND SPANS: a failure logs the reason enum and a keyed hash prefix of
+// the address, nothing else; never the token, its hash or the address. The
+// span carries `sharing.link.grant_id` on success only.
+// =============================================================================
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LinkGrantGuard = exports.LINK_GRANT_SPAN_ATTRIBUTE = void 0;
+exports.addressTag = addressTag;
+const node_crypto_1 = require("node:crypto");
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const api_1 = require("@opentelemetry/api");
+const sharing_1 = require("@marinoscar/platform-contract/sharing");
+const index_1 = require("../../otel-core/index");
+const errors_1 = require("../errors");
+const metrics_1 = require("../metrics");
+const link_grant_decorators_1 = require("./link-grant.decorators");
+const link_grants_service_1 = require("./link-grants.service");
+const link_miss_throttle_1 = require("./link-miss-throttle");
+const public_link_interceptor_1 = require("./public-link.interceptor");
+/**
+ * The span attribute set on a successful resolution (the grant id; nothing else of the link).
+ *
+ * @stability experimental
+ */
+exports.LINK_GRANT_SPAN_ATTRIBUTE = 'sharing.link.grant_id';
+/** The per-process key of the address tags in log lines: tags correlate within a process, and reveal nothing. */
+const ADDRESS_TAG_KEY = (0, node_crypto_1.randomBytes)(32);
+/**
+ * A short, keyed, non-reversible tag of a client address for a log line.
+ *
+ * @param address - the client address.
+ * @returns 12 hex characters.
+ *
+ * @stability experimental
+ */
+function addressTag(address) {
+    return (0, node_crypto_1.createHmac)('sha256', ADDRESS_TAG_KEY).update(address).digest('hex').slice(0, 12);
+}
+/**
+ * Authenticates a public route by the link token in `X-Link-Token`, for the
+ * resource type its `@LinkGrantResource` names, and hands the handler the
+ * resolved link (`@CurrentLinkGrant()`). Every failure is the same 404;
+ * repeated failures from one address become 429.
+ *
+ * @stability experimental
+ * @extensionPoint hook
+ */
+let LinkGrantGuard = class LinkGrantGuard {
+    reflector;
+    links;
+    throttle;
+    metrics;
+    logger = new common_1.Logger('LinkGrantGuard');
+    constructor(reflector, links, throttle, metrics) {
+        this.reflector = reflector;
+        this.links = links;
+        this.throttle = throttle;
+        this.metrics = metrics;
+    }
+    /**
+     * @param context - the route's execution context.
+     * @returns `true` with `request.linkGrant` set.
+     * @throws NotFoundException 404 (`Link not found`) for every invalid link.
+     * @throws HttpException 429 `LINK_RESOLUTION_THROTTLED` for an address over its miss budget.
+     * @throws Error when the route declares no `@LinkGrantResource` (a programming error).
+     */
+    async canActivate(context) {
+        const http = context.switchToHttp();
+        const request = http.getRequest();
+        (0, public_link_interceptor_1.setPublicLinkHeaders)(http.getResponse());
+        const expect = this.reflector.getAllAndOverride(link_grant_decorators_1.LINK_GRANT_RESOURCE_KEY, [
+            context.getHandler(),
+            context.getClass(),
+        ]);
+        if (!expect) {
+            throw new Error(`LinkGrantGuard: ${context.getClass().name}#${context.getHandler().name} declares no @LinkGrantResource(type).`);
+        }
+        const routeType = expect.resourceType === link_grants_service_1.ANY_LINK_RESOURCE_TYPE ? 'none' : expect.resourceType;
+        const address = request.ip ?? 'unknown';
+        const wait = this.throttle.retryAfterMs(address);
+        if (wait > 0) {
+            this.count('throttled', routeType);
+            this.logger.debug(`Link resolution refused: reason=throttled address=${addressTag(address)}`);
+            throw (0, errors_1.linkResolutionThrottled)(wait);
+        }
+        // The header only: never a path segment, never a query parameter.
+        const result = await this.links.resolve(request.headers?.[sharing_1.LINK_TOKEN_HEADER], expect);
+        if (!result.ok) {
+            this.throttle.recordMiss(address);
+            this.count((0, link_grants_service_1.linkFailureOutcome)(result.failure), result.resourceType ?? routeType);
+            this.logger.debug(`Link resolution refused: reason=${result.failure} address=${addressTag(address)}`);
+            throw (0, errors_1.linkNotFound)();
+        }
+        api_1.trace.getActiveSpan()?.setAttribute(exports.LINK_GRANT_SPAN_ATTRIBUTE, result.link.grantId);
+        this.count('ok', result.link.resourceType);
+        request[link_grant_decorators_1.LINK_GRANT_REQUEST_KEY] = result.link;
+        return true;
+    }
+    count(outcome, resourceType) {
+        try {
+            this.metrics?.add(metrics_1.SHARING_LINK_RESOLUTIONS_METRIC, 1, { outcome, resource_type: resourceType });
+        }
+        catch {
+            // Metrics never fail a request.
+        }
+    }
+};
+exports.LinkGrantGuard = LinkGrantGuard;
+exports.LinkGrantGuard = LinkGrantGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __param(3, (0, common_1.Optional)()),
+    __metadata("design:paramtypes", [core_1.Reflector,
+        link_grants_service_1.LinkGrantsService,
+        link_miss_throttle_1.LinkMissThrottle,
+        index_1.MetricsHostService])
+], LinkGrantGuard);
+//# sourceMappingURL=link-grant.guard.js.map

package/dist/sharing/links/link-grant.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-grant.guard.js","sourceRoot":"","sources":["../../../src/sharing/links/link-grant.guard.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,uEAAuE;AACvE,gFAAgF;AAChF,EAAE;AACF,6EAA6E;AAC7E,qEAAqE;AACrE,EAAE;AACF,6DAA6D;AAC7D,iGAAiG;AACjG,+BAA+B;AAC/B,yCAAyC;AACzC,aAAa;AACb,2DAA2D;AAC3D,yDAAyD;AACzD,mGAAmG;AACnG,QAAQ;AACR,MAAM;AACN,EAAE;AACF,aAAa;AACb,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AACxE,2BAA2B;AAC3B,6EAA6E;AAC7E,wEAAwE;AACxE,yEAAyE;AACzE,2EAA2E;AAC3E,4EAA4E;AAC5E,4EAA4E;AAC5E,qBAAqB;AACrB,yEAAyE;AACzE,kEAAkE;AAClE,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,wDAAwD;AACxD,gFAAgF;;;;;;;;;;;;;;;AAmChF,gCAEC;AAnCD,6CAAsD;AAEtD,2CAAuG;AACvG,uCAAyC;AACzC,4CAA2C;AAC3C,mEAA0E;AAE1E,iDAA2D;AAC3D,sCAAkE;AAClE,wCAAgG;AAChG,mEAA0F;AAC1F,+DAAsI;AACtI,6DAAwD;AACxD,uEAAiE;AAEjE;;;;GAIG;AACU,QAAA,yBAAyB,GAAG,uBAAuB,CAAC;AAEjE,iHAAiH;AACjH,MAAM,eAAe,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC;AAExC;;;;;;;GAOG;AACH,SAAgB,UAAU,CAAC,OAAe;IACxC,OAAO,IAAA,wBAAU,EAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC1F,CAAC;AASD;;;;;;;;GAQG;AAEI,IAAM,cAAc,GAApB,MAAM,cAAc;IAIN;IACA;IACA;IACY;IANd,MAAM,GAAG,IAAI,eAAM,CAAC,gBAAgB,CAAC,CAAC;IAEvD,YACmB,SAAoB,EACpB,KAAwB,EACxB,QAA0B,EACd,OAA4B;QAHxC,cAAS,GAAT,SAAS,CAAW;QACpB,UAAK,GAAL,KAAK,CAAmB;QACxB,aAAQ,GAAR,QAAQ,CAAkB;QACd,YAAO,GAAP,OAAO,CAAqB;IACxD,CAAC;IAEJ;;;;;;OAMG;IACH,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAe,CAAC;QAC/C,IAAA,8CAAoB,EAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAEzC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAwC,+CAAuB,EAAE;YAC9G,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,wCAAwC,CAAC,CAAC;QACnI,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,KAAK,4CAAsB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;QAChG,MAAM,OAAO,GAAG,OAAO,CAAC,EAAE,IAAI,SAAS,CAAC;QAExC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;YACb,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC9F,MAAM,IAAA,gCAAuB,EAAC,IAAI,CAAC,CAAC;QACtC,CAAC;QAED,kEAAkE;QAClE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,2BAAiB,CAAC,EAAE,MAAM,CAAC,CAAC;QACtF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,CAAC,KAAK,CAAC,IAAA,wCAAkB,EAAC,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,YAAY,IAAI,SAAS,CAAC,CAAC;YACjF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,MAAM,CAAC,OAAO,YAAY,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACtG,MAAM,IAAA,qBAAY,GAAE,CAAC;QACvB,CAAC;QAED,WAAK,CAAC,aAAa,EAAE,EAAE,YAAY,CAAC,iCAAyB,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpF,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3C,OAAO,CAAC,8CAAsB,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,OAAqC,EAAE,YAAoB;QACvE,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,yCAA+B,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC;QAClG,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;IACH,CAAC;CACF,CAAA;AA7DY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;IAQR,WAAA,IAAA,iBAAQ,GAAE,CAAA;qCAHiB,gBAAS;QACb,uCAAiB;QACd,qCAAgB;QACJ,0BAAkB;GAPhD,cAAc,CA6D1B"}

package/dist/sharing/links/link-grants.controller.d.ts

@@ -0,0 +1,14 @@
+import { Type } from '@nestjs/common';
+import type { ResolvedSharingModuleOptions } from '../sharing.options';
+/**
+ * Creates the `LinkGrantsController` class for one set of module options, its
+ * routes guarded by the app's access decorators. `SharingModule.forRoot()`
+ * calls it.
+ *
+ * @param options - the resolved module options.
+ * @returns the controller class.
+ *
+ * @stability experimental
+ */
+export declare function createLinkGrantsController(options: ResolvedSharingModuleOptions): Type<unknown>;
+//# sourceMappingURL=link-grants.controller.d.ts.map

package/dist/sharing/links/link-grants.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-grants.controller.d.ts","sourceRoot":"","sources":["../../../src/sharing/links/link-grants.controller.ts"],"names":[],"mappings":"AAYA,OAAO,EAAsC,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAO1E,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAMvE;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,4BAA4B,GAAG,IAAI,CAAC,OAAO,CAAC,CAoD/F"}