@mbc-cqrs-serverless/core 1.3.0 → 1.3.1

package/README.md

@@ -215,6 +215,43 @@ export class TodoDataSyncHandler implements IDataSyncHandler {
 }
 ```
 
+## Group-based roles
+
+`RolesGuard` checks direct roles from JWT `custom:roles` first, then roles from groups in `custom:groups` (tenant-scoped). Group → role mappings are **not** stored in the JWT; implement a resolver in your app.
+
+**JWT example:**
+
+```json
+{
+  "custom:roles": "[{\"tenant\":\"tenant-a\",\"role\":\"admin\"}]",
+  "custom:groups": "[{\"tenant\":\"tenant-a\",\"groups\":[\"sales-team\"]}]"
+}
+```
+
+**Resolver (one per app):**
+
+```typescript
+import {
+  GroupRoleResolver,
+  IGroupRoleResolver,
+} from '@mbc-cqrs-serverless/core';
+
+// Do not add @Injectable() — @GroupRoleResolver() already registers the provider.
+@GroupRoleResolver()
+export class AppGroupRoleResolver implements IGroupRoleResolver {
+  async resolveRoles({ tenantCode, groupIds, claims }) {
+    // Load roles from DynamoDB, RDS, config, etc.
+    return ['viewer', 'reporter'];
+  }
+}
+```
+
+Register the class in your NestJS module `providers`. `AuthModule` is imported automatically via core `AppModule.forRoot()` and exports `GroupRoleResolverRegistry` globally for `@Auth()` / `RolesGuard`.
+
+### Extending authorization
+
+`RolesGuard` evaluates `tenantRoles` from the JWT (not `getUserRole()`). The protected `getUserRole()` method is **deprecated** and not called by the default guard. Subclasses should override `verifyRole` or `resolveGroupRoles` for custom logic.
+
 ## Environment Variables
 
 | Variable | Description | Default |

package/dist/app.module.js

@@ -13,6 +13,7 @@ const core_1 = require("@nestjs/core");
 const app_controller_1 = require("./app.controller");
 const app_module_definition_1 = require("./app.module-definition");
 const app_service_1 = require("./app.service");
+const auth_1 = require("./auth");
 const data_sync_module_1 = require("./command-events/data-sync.module");
 const data_store_module_1 = require("./data-store/data-store.module");
 const env_validation_1 = require("./env.validation");
@@ -64,6 +65,7 @@ exports.AppModule = AppModule;
 exports.AppModule = AppModule = __decorate([
     (0, common_1.Module)({
         imports: [
+            auth_1.AuthModule,
             notification_module_1.NotificationModule,
             data_store_module_1.DataStoreModule,
             data_sync_module_1.DataSyncModule,

package/dist/app.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.module.js","sourceRoot":"","sources":["../src/app.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAsD;AACtD,2CAA6C;AAC7C,uCAAmD;AAEnD,qDAAgD;AAChD,mEAA+E;AAC/E,+CAA0C;AAC1C,wEAAkE;AAClE,sEAAgE;AAChE,qDAAoD;AACpD,qCAAsC;AACtC,6EAAwE;AACxE,uDAAkD;AAClD,kEAA6D;AAC7D,2EAAqE;AAa9D,IAAM,SAAS,GAAf,MAAM,SAAU,SAAQ,+CAAuB;IACpD,MAAM,CAAC,OAAO,CAAC,OAA4B;QACzC,MAAM,uBAAuB,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,MAAM,CAAA;QAC5E,MAAM,OAAO,GAAW;YACtB;gBACE,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,OAAO,CAAC,UAAU;aAC3B;SACF,CAAA;QACD,iCAAiC;QACjC,IAAI,uBAAuB,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,oBAAW;aACpB,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACrC,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAA;QAC3C,OAAO,CAAC,IAAI,CACV,qBAAY,CAAC,OAAO,CAAC;YACnB,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,IAAI;YACX,eAAe,EAAE,IAAI;YACrB,iBAAiB,EAAE;gBACjB,YAAY,EAAE,KAAK;gBACnB,UAAU,EAAE,IAAI;aACjB;YACD,QAAQ,EAAE,IAAA,kCAAiB,EAAC,OAAO,CAAC,MAAM,CAAC;SAC5C,CAAC,CACH,CAAA;QACD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QAChC,IAAI,uBAAuB,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,oBAAW,CAAC,CAAA;QAC3B,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,mBAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;QAE5C,OAAO;YACL,GAAG,MAAM;YACT,OAAO;SACR,CAAA;IACH,CAAC;CACF,CAAA;AA1CY,8BAAS;oBAAT,SAAS;IAXrB,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,wCAAkB;YAClB,mCAAe;YACf,iCAAc;YACd,yCAAkB;YAClB,0BAAW;SACZ;QACD,WAAW,EAAE,CAAC,8BAAa,CAAC;QAC5B,SAAS,EAAE,CAAC,wBAAU,EAAE,kCAAe,CAAC;KACzC,CAAC;GACW,SAAS,CA0CrB"}
+{"version":3,"file":"app.module.js","sourceRoot":"","sources":["../src/app.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAsD;AACtD,2CAA6C;AAC7C,uCAAmD;AAEnD,qDAAgD;AAChD,mEAA+E;AAC/E,+CAA0C;AAC1C,iCAAmC;AACnC,wEAAkE;AAClE,sEAAgE;AAChE,qDAAoD;AACpD,qCAAsC;AACtC,6EAAwE;AACxE,uDAAkD;AAClD,kEAA6D;AAC7D,2EAAqE;AAc9D,IAAM,SAAS,GAAf,MAAM,SAAU,SAAQ,+CAAuB;IACpD,MAAM,CAAC,OAAO,CAAC,OAA4B;QACzC,MAAM,uBAAuB,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,MAAM,CAAA;QAC5E,MAAM,OAAO,GAAW;YACtB;gBACE,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,OAAO,CAAC,UAAU;aAC3B;SACF,CAAA;QACD,iCAAiC;QACjC,IAAI,uBAAuB,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE,oBAAW;aACpB,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACrC,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAA;QAC3C,OAAO,CAAC,IAAI,CACV,qBAAY,CAAC,OAAO,CAAC;YACnB,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,IAAI;YACX,eAAe,EAAE,IAAI;YACrB,iBAAiB,EAAE;gBACjB,YAAY,EAAE,KAAK;gBACnB,UAAU,EAAE,IAAI;aACjB;YACD,QAAQ,EAAE,IAAA,kCAAiB,EAAC,OAAO,CAAC,MAAM,CAAC;SAC5C,CAAC,CACH,CAAA;QACD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QAChC,IAAI,uBAAuB,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,oBAAW,CAAC,CAAA;QAC3B,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,mBAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;QAE5C,OAAO;YACL,GAAG,MAAM;YACT,OAAO;SACR,CAAA;IACH,CAAC;CACF,CAAA;AA1CY,8BAAS;oBAAT,SAAS;IAZrB,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,iBAAU;YACV,wCAAkB;YAClB,mCAAe;YACf,iCAAc;YACd,yCAAkB;YAClB,0BAAW;SACZ;QACD,WAAW,EAAE,CAAC,8BAAa,CAAC;QAC5B,SAAS,EAAE,CAAC,wBAAU,EAAE,kCAAe,CAAC;KACzC,CAAC;GACW,SAAS,CA0CrB"}

package/dist/auth/auth.module.d.ts

@@ -0,0 +1,2 @@
+export declare class AuthModule {
+}

package/dist/auth/auth.module.js

@@ -0,0 +1,30 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthModule = void 0;
+const common_1 = require("@nestjs/common");
+const roles_guard_1 = require("../guard/roles.guard");
+const explorer_service_1 = require("../services/explorer.service");
+const authz_bootstrap_service_1 = require("./authz-bootstrap.service");
+const group_role_resolver_registry_1 = require("./group-role-resolver.registry");
+let AuthModule = class AuthModule {
+};
+exports.AuthModule = AuthModule;
+exports.AuthModule = AuthModule = __decorate([
+    (0, common_1.Global)(),
+    (0, common_1.Module)({
+        providers: [
+            explorer_service_1.ExplorerService,
+            group_role_resolver_registry_1.GroupRoleResolverRegistry,
+            authz_bootstrap_service_1.AuthzBootstrapService,
+            roles_guard_1.RolesGuard,
+        ],
+        exports: [group_role_resolver_registry_1.GroupRoleResolverRegistry, roles_guard_1.RolesGuard, explorer_service_1.ExplorerService],
+    })
+], AuthModule);
+//# sourceMappingURL=auth.module.js.map

package/dist/auth/auth.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.module.js","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAA+C;AAE/C,sDAAiD;AACjD,mEAA8D;AAC9D,uEAAiE;AACjE,iFAA0E;AAYnE,IAAM,UAAU,GAAhB,MAAM,UAAU;CAAG,CAAA;AAAb,gCAAU;qBAAV,UAAU;IAVtB,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACN,SAAS,EAAE;YACT,kCAAe;YACf,wDAAyB;YACzB,+CAAqB;YACrB,wBAAU;SACX;QACD,OAAO,EAAE,CAAC,wDAAyB,EAAE,wBAAU,EAAE,kCAAe,CAAC;KAClE,CAAC;GACW,UAAU,CAAG"}

package/dist/auth/authz-bootstrap.service.d.ts

@@ -0,0 +1,11 @@
+import { OnApplicationBootstrap } from '@nestjs/common';
+import { ModuleRef } from '@nestjs/core';
+import { ExplorerService } from '../services/explorer.service';
+import { GroupRoleResolverRegistry } from './group-role-resolver.registry';
+export declare class AuthzBootstrapService implements OnApplicationBootstrap {
+    private readonly explorerService;
+    private readonly moduleRef;
+    private readonly registry;
+    constructor(explorerService: ExplorerService, moduleRef: ModuleRef, registry: GroupRoleResolverRegistry);
+    onApplicationBootstrap(): void;
+}

package/dist/auth/authz-bootstrap.service.js

@@ -0,0 +1,47 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthzBootstrapService = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const explorer_service_1 = require("../services/explorer.service");
+const group_role_resolver_registry_1 = require("./group-role-resolver.registry");
+let AuthzBootstrapService = class AuthzBootstrapService {
+    constructor(explorerService, moduleRef, registry) {
+        this.explorerService = explorerService;
+        this.moduleRef = moduleRef;
+        this.registry = registry;
+    }
+    onApplicationBootstrap() {
+        const types = this.explorerService.exploreGroupRoleResolvers();
+        if (types.length > 1) {
+            throw new Error('Only one @GroupRoleResolver() is allowed per application');
+        }
+        if (types.length === 0) {
+            return;
+        }
+        const instance = this.moduleRef.get(types[0], {
+            strict: false,
+        });
+        if (!instance) {
+            throw new Error(`GroupRoleResolver ${types[0].name} was discovered but could not be resolved from DI`);
+        }
+        this.registry.set(instance);
+    }
+};
+exports.AuthzBootstrapService = AuthzBootstrapService;
+exports.AuthzBootstrapService = AuthzBootstrapService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [explorer_service_1.ExplorerService,
+        core_1.ModuleRef,
+        group_role_resolver_registry_1.GroupRoleResolverRegistry])
+], AuthzBootstrapService);
+//# sourceMappingURL=authz-bootstrap.service.js.map

package/dist/auth/authz-bootstrap.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-bootstrap.service.js","sourceRoot":"","sources":["../../src/auth/authz-bootstrap.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAmE;AACnE,uCAAwC;AAExC,mEAA8D;AAE9D,iFAA0E;AAGnE,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAChC,YACmB,eAAgC,EAChC,SAAoB,EACpB,QAAmC;QAFnC,oBAAe,GAAf,eAAe,CAAiB;QAChC,cAAS,GAAT,SAAS,CAAW;QACpB,aAAQ,GAAR,QAAQ,CAA2B;IACnD,CAAC;IAEJ,sBAAsB;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,yBAAyB,EAAE,CAAA;QAE9D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,0DAA0D,CAC3D,CAAA;QACH,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAM;QACR,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAqB,KAAK,CAAC,CAAC,CAAC,EAAE;YAChE,MAAM,EAAE,KAAK;SACd,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,qBAAqB,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,mDAAmD,CACtF,CAAA;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC7B,CAAC;CACF,CAAA;AAhCY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;qCAGyB,kCAAe;QACrB,gBAAS;QACV,wDAAyB;GAJ3C,qBAAqB,CAgCjC"}

package/dist/auth/group-role-resolver.interface.d.ts

@@ -0,0 +1,13 @@
+import { JwtClaims } from '../context/invoke';
+export interface TenantGroupMembership {
+    tenant: string;
+    groups: string[];
+}
+export interface ResolveGroupRolesInput {
+    tenantCode: string;
+    groupIds: string[];
+    claims?: JwtClaims;
+}
+export interface IGroupRoleResolver {
+    resolveRoles(input: ResolveGroupRolesInput): Promise<string[]>;
+}

package/dist/auth/group-role-resolver.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=group-role-resolver.interface.js.map

package/dist/auth/group-role-resolver.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-role-resolver.interface.js","sourceRoot":"","sources":["../../src/auth/group-role-resolver.interface.ts"],"names":[],"mappings":""}

package/dist/auth/group-role-resolver.registry.d.ts

@@ -0,0 +1,6 @@
+import { IGroupRoleResolver } from './group-role-resolver.interface';
+export declare class GroupRoleResolverRegistry {
+    private resolver?;
+    set(resolver: IGroupRoleResolver): void;
+    get(): IGroupRoleResolver | undefined;
+}

package/dist/auth/group-role-resolver.registry.js

@@ -0,0 +1,26 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GroupRoleResolverRegistry = void 0;
+const common_1 = require("@nestjs/common");
+let GroupRoleResolverRegistry = class GroupRoleResolverRegistry {
+    set(resolver) {
+        if (this.resolver) {
+            throw new Error('Only one @GroupRoleResolver() is allowed per application');
+        }
+        this.resolver = resolver;
+    }
+    get() {
+        return this.resolver;
+    }
+};
+exports.GroupRoleResolverRegistry = GroupRoleResolverRegistry;
+exports.GroupRoleResolverRegistry = GroupRoleResolverRegistry = __decorate([
+    (0, common_1.Injectable)()
+], GroupRoleResolverRegistry);
+//# sourceMappingURL=group-role-resolver.registry.js.map

package/dist/auth/group-role-resolver.registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-role-resolver.registry.js","sourceRoot":"","sources":["../../src/auth/group-role-resolver.registry.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAA2C;AAKpC,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IAGpC,GAAG,CAAC,QAA4B;QAC9B,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,0DAA0D,CAC3D,CAAA;QACH,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;IAED,GAAG;QACD,OAAO,IAAI,CAAC,QAAQ,CAAA;IACtB,CAAC;CACF,CAAA;AAfY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,GAAE;GACA,yBAAyB,CAerC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,4 @@
+export * from './auth.module';
+export * from './authz-bootstrap.service';
+export * from './group-role-resolver.interface';
+export * from './group-role-resolver.registry';

package/dist/auth/index.js

@@ -0,0 +1,21 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./auth.module"), exports);
+__exportStar(require("./authz-bootstrap.service"), exports);
+__exportStar(require("./group-role-resolver.interface"), exports);
+__exportStar(require("./group-role-resolver.registry"), exports);
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,gDAA6B;AAC7B,4DAAyC;AACzC,kEAA+C;AAC/C,iEAA8C"}

package/dist/context/invoke.d.ts

@@ -15,6 +15,7 @@ export interface JwtClaims {
     name: string;
     'custom:tenant'?: string;
     'custom:roles'?: string;
+    'custom:groups'?: string;
     exp: number;
     email: string;
     email_verified?: boolean;

package/dist/context/invoke.js.map

@@ -1 +1 @@
-{"version":3,"file":"invoke.js","sourceRoot":"","sources":["../../src/context/invoke.ts"],"names":[],"mappings":";;AAiFA,oDAoDC;AAED,kDAsBC;AA7JD,sEAAgE;AAChE,2CAAwE;AAExE,2CAAsC;AAEtC,wCAA8C;AA4E9C,SAAgB,oBAAoB,CAAC,GAAsB;IACzD,IAAI,2BAAiB,EAAE,CAAC;QACtB,OAAO,IAAA,qCAAgB,GAAE,CAAA;IAC3B,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAA;IACxD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAiC,CAAA;IACzD,IAAI,UAAU,GAAuB,SAAS,CAAA;IAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IAC9C,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;YACxD,MAAM,MAAM,GAAG,IAAA,sBAAS,EAAY,KAAK,CAAC,CAAA;YAC1C,UAAU,GAAG;gBACX,GAAG,EAAE;oBACH,MAAM;oBACN,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;iBAClC;aACF,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,8BAAqB,CAC7B,0CAA0C,CAC3C,CAAA;QACH,CAAC;IACH,CAAC;IACD,OAAO;QACL,KAAK,EAAE;YACL,QAAQ,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,EAAE;YAC7C,OAAO,EAAE,OAAO,CAAC,WAAW;YAC5B,OAAO;YACP,cAAc,EAAE;gBACd,UAAU,EAAE,OAAO,CAAC,QAAQ;gBAC5B,IAAI,EAAE;oBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,EAAE;oBAClD,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;iBACrC;gBACD,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;gBACtC,UAAU;aACX;SACF;QACD,OAAO,EAAE;YACP,YAAY,EACV,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;gBAC1B,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;gBAC9B,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;SAC9B;KACF,CAAA;AACH,CAAC;AAED,SAAgB,mBAAmB,CAAC,GAAY;IAC9C,OAAO,CACL,GAAG,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,IAAK,EAAgB,CACzE,CAAA;IACD,IAAI;IACJ,mDAAmD;IACnD,mDAAmD;IACnD,kCAAkC;IAClC,kCAAkC;IAClC,0DAA0D;IAC1D,wCAAwC;IACxC,wDAAwD;IACxD,uBAAuB;IACvB,6BAA6B;IAC7B,sBAAsB;IACtB,6BAA6B;IAC7B,qDAAqD;IACrD,uBAAuB;IACvB,+BAA+B;IAC/B,uBAAuB;IACvB,kDAAkD;IAClD,IAAI;AACN,CAAC"}
+{"version":3,"file":"invoke.js","sourceRoot":"","sources":["../../src/context/invoke.ts"],"names":[],"mappings":";;AAkFA,oDAoDC;AAED,kDAsBC;AA9JD,sEAAgE;AAChE,2CAAwE;AAExE,2CAAsC;AAEtC,wCAA8C;AA6E9C,SAAgB,oBAAoB,CAAC,GAAsB;IACzD,IAAI,2BAAiB,EAAE,CAAC;QACtB,OAAO,IAAA,qCAAgB,GAAE,CAAA;IAC3B,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAA;IACxD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAiC,CAAA;IACzD,IAAI,UAAU,GAAuB,SAAS,CAAA;IAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IAC9C,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;YACxD,MAAM,MAAM,GAAG,IAAA,sBAAS,EAAY,KAAK,CAAC,CAAA;YAC1C,UAAU,GAAG;gBACX,GAAG,EAAE;oBACH,MAAM;oBACN,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;iBAClC;aACF,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,8BAAqB,CAC7B,0CAA0C,CAC3C,CAAA;QACH,CAAC;IACH,CAAC;IACD,OAAO;QACL,KAAK,EAAE;YACL,QAAQ,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,EAAE;YAC7C,OAAO,EAAE,OAAO,CAAC,WAAW;YAC5B,OAAO;YACP,cAAc,EAAE;gBACd,UAAU,EAAE,OAAO,CAAC,QAAQ;gBAC5B,IAAI,EAAE;oBACJ,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,EAAE;oBAClD,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;iBACrC;gBACD,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;gBACtC,UAAU;aACX;SACF;QACD,OAAO,EAAE;YACP,YAAY,EACV,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;gBAC1B,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;gBAC9B,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;SAC9B;KACF,CAAA;AACH,CAAC;AAED,SAAgB,mBAAmB,CAAC,GAAY;IAC9C,OAAO,CACL,GAAG,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,IAAK,EAAgB,CACzE,CAAA;IACD,IAAI;IACJ,mDAAmD;IACnD,mDAAmD;IACnD,kCAAkC;IAClC,kCAAkC;IAClC,0DAA0D;IAC1D,wCAAwC;IACxC,wDAAwD;IACxD,uBAAuB;IACvB,6BAA6B;IAC7B,sBAAsB;IACtB,6BAA6B;IAC7B,qDAAqD;IACrD,uBAAuB;IACvB,+BAA+B;IAC/B,uBAAuB;IACvB,kDAAkD;IAClD,IAAI;AACN,CAAC"}

package/dist/context/user.d.ts

@@ -8,6 +8,10 @@ export declare class UserContext {
     userId: string;
     tenantRole: string;
     tenantCode: string;
+    /** Direct roles from custom:roles for the active tenant (excludes group-derived roles). */
+    tenantRoles: string[];
+    /** Group IDs from custom:groups for the active tenant. */
+    tenantGroupIds: string[];
     constructor(partial: Partial<UserContext>);
 }
 /**

package/dist/context/user.js

@@ -10,6 +10,52 @@ class UserContext {
     }
 }
 exports.UserContext = UserContext;
+function parseTenantGroups(raw, tenantCode) {
+    if (!tenantCode) {
+        return [];
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw || '[]');
+    }
+    catch {
+        return [];
+    }
+    if (!Array.isArray(parsed)) {
+        return [];
+    }
+    const memberships = parsed.map((membership) => ({
+        ...membership,
+        tenant: (membership.tenant || '').toLowerCase(),
+    }));
+    const match = memberships.find((membership) => membership.tenant === tenantCode);
+    const groups = match?.groups;
+    return Array.isArray(groups) ? groups : [];
+}
+function collectTenantRoles(roles, tenantCode) {
+    if (!tenantCode) {
+        return [];
+    }
+    const seen = new Set();
+    const result = [];
+    const add = (role) => {
+        if (!seen.has(role)) {
+            seen.add(role);
+            result.push(role);
+        }
+    };
+    for (const { tenant, role } of roles) {
+        if (tenant === tenantCode) {
+            add(role);
+        }
+    }
+    for (const { tenant, role } of roles) {
+        if (tenant === '') {
+            add(role);
+        }
+    }
+    return result;
+}
 /**
  * Extract user context from JWT claims and request headers.
  *
@@ -33,6 +79,8 @@ function getUserContext(ctx) {
     // 2. Otherwise, use header value (security check delegated to RolesGuard)
     // Note: tenantCode is normalized to lowercase for case-insensitive matching with role.tenant
     const tenantCode = (claims['custom:tenant'] || (ctx?.event?.headers || {})[constants_1.HEADER_TENANT_CODE])?.toLowerCase();
+    const tenantGroupIds = parseTenantGroups(claims['custom:groups'], tenantCode);
+    const tenantRoles = collectTenantRoles(roles, tenantCode);
     // Find tenantRole (case-insensitive matching - both tenantCode and role.tenant are lowercase)
     let tenantRole = '';
     for (const { tenant, role } of roles) {
@@ -47,6 +95,8 @@ function getUserContext(ctx) {
         userId,
         tenantRole,
         tenantCode,
+        tenantRoles,
+        tenantGroupIds,
     };
 }
 //# sourceMappingURL=user.js.map

package/dist/context/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","sourceRoot":"","sources":["../../src/context/user.ts"],"names":[],"mappings":";;;AA8BA,wCAqCC;AAjED,4CAAiD;AACjD,qCAA6E;AAO7E,MAAa,WAAW;IAKtB,YAAY,OAA6B;QACvC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAC9B,CAAC;CACF;AARD,kCAQC;AAED;;;;;;;;;GASG;AACH,SAAgB,cAAc,CAAC,GAA+B;IAC5D,IAAI,YAAY,IAAI,GAAG,EAAE,CAAC;QACxB,GAAG,GAAG,IAAA,6BAAoB,EAAC,GAAG,CAAC,CAAA;IACjC,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,4BAAmB,EAAC,GAAG,CAAC,CAAA;IAEvC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAA;IAEzB,cAAc;IACd,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,IAAI,CAC1C,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAA;IAEzE,wBAAwB;IACxB,oDAAoD;IACpD,0EAA0E;IAC1E,6FAA6F;IAC7F,MAAM,UAAU,GAAG,CACjB,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,8BAAkB,CAAC,CAC3E,EAAE,WAAW,EAAE,CAAA;IAEhB,8FAA8F;IAC9F,IAAI,UAAU,GAAG,EAAE,CAAA;IACnB,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC;QACrC,IAAI,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC3C,UAAU,GAAG,IAAI,CAAA;YACjB,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;gBAClB,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM;QACN,UAAU;QACV,UAAU;KACX,CAAA;AACH,CAAC"}
+{"version":3,"file":"user.js","sourceRoot":"","sources":["../../src/context/user.ts"],"names":[],"mappings":";;;AA8FA,wCA0CC;AArID,4CAAiD;AACjD,qCAA6E;AAO7E,MAAa,WAAW;IAStB,YAAY,OAA6B;QACvC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAC9B,CAAC;CACF;AAZD,kCAYC;AAED,SAAS,iBAAiB,CACxB,GAAuB,EACvB,UAA8B;IAE9B,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,CAAA;IACX,CAAC;IAED,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,WAAW,GAAI,MAAkC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC3E,GAAG,UAAU;QACb,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;KAChD,CAAC,CAAC,CAAA;IAEH,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAC5B,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,KAAK,UAAU,CACjD,CAAA;IACD,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,CAAA;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;AAC5C,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAmB,EACnB,UAA8B;IAE9B,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE;QAC3B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACd,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnB,CAAC;IACH,CAAC,CAAA;IACD,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC;QACrC,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC,CAAA;QACX,CAAC;IACH,CAAC;IACD,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC;QACrC,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAClB,GAAG,CAAC,IAAI,CAAC,CAAA;QACX,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,cAAc,CAAC,GAA+B;IAC5D,IAAI,YAAY,IAAI,GAAG,EAAE,CAAC;QACxB,GAAG,GAAG,IAAA,6BAAoB,EAAC,GAAG,CAAC,CAAA;IACjC,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,4BAAmB,EAAC,GAAG,CAAC,CAAA;IAEvC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAA;IAEzB,cAAc;IACd,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,IAAI,CAC1C,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAA;IAEzE,wBAAwB;IACxB,oDAAoD;IACpD,0EAA0E;IAC1E,6FAA6F;IAC7F,MAAM,UAAU,GAAG,CACjB,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,8BAAkB,CAAC,CAC3E,EAAE,WAAW,EAAE,CAAA;IAEhB,MAAM,cAAc,GAAG,iBAAiB,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,UAAU,CAAC,CAAA;IAC7E,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IAEzD,8FAA8F;IAC9F,IAAI,UAAU,GAAG,EAAE,CAAA;IACnB,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC;QACrC,IAAI,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC3C,UAAU,GAAG,IAAI,CAAA;YACjB,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;gBAClB,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM;QACN,UAAU;QACV,UAAU;QACV,WAAW;QACX,cAAc;KACf,CAAA;AACH,CAAC"}

package/dist/decorators/constants.d.ts

@@ -4,3 +4,4 @@ export declare const EVENT_FACTORY_METADATA = "__eventFactory__";
 export declare const DATA_SYNC_HANDLER_METADATA = "__dataSyncHandler__";
 export declare const ROLE_METADATA = "__allowedRoles__";
 export declare const NOTIFICATION_TRANSPORT_METADATA = "__notificationTransport__";
+export declare const GROUP_ROLE_RESOLVER_METADATA = "__groupRoleResolver__";

package/dist/decorators/constants.js

@@ -1,10 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.NOTIFICATION_TRANSPORT_METADATA = exports.ROLE_METADATA = exports.DATA_SYNC_HANDLER_METADATA = exports.EVENT_FACTORY_METADATA = exports.EVENT_HANDLER_METADATA = exports.EVENT_METADATA = void 0;
+exports.GROUP_ROLE_RESOLVER_METADATA = exports.NOTIFICATION_TRANSPORT_METADATA = exports.ROLE_METADATA = exports.DATA_SYNC_HANDLER_METADATA = exports.EVENT_FACTORY_METADATA = exports.EVENT_HANDLER_METADATA = exports.EVENT_METADATA = void 0;
 exports.EVENT_METADATA = '__event__';
 exports.EVENT_HANDLER_METADATA = '__eventHandler__';
 exports.EVENT_FACTORY_METADATA = '__eventFactory__';
 exports.DATA_SYNC_HANDLER_METADATA = '__dataSyncHandler__';
 exports.ROLE_METADATA = '__allowedRoles__';
 exports.NOTIFICATION_TRANSPORT_METADATA = '__notificationTransport__';
+exports.GROUP_ROLE_RESOLVER_METADATA = '__groupRoleResolver__';
 //# sourceMappingURL=constants.js.map

package/dist/decorators/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/decorators/constants.ts"],"names":[],"mappings":";;;AAAa,QAAA,cAAc,GAAG,WAAW,CAAA;AAC5B,QAAA,sBAAsB,GAAG,kBAAkB,CAAA;AAC3C,QAAA,sBAAsB,GAAG,kBAAkB,CAAA;AAC3C,QAAA,0BAA0B,GAAG,qBAAqB,CAAA;AAClD,QAAA,aAAa,GAAG,kBAAkB,CAAA;AAClC,QAAA,+BAA+B,GAAG,2BAA2B,CAAA"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/decorators/constants.ts"],"names":[],"mappings":";;;AAAa,QAAA,cAAc,GAAG,WAAW,CAAA;AAC5B,QAAA,sBAAsB,GAAG,kBAAkB,CAAA;AAC3C,QAAA,sBAAsB,GAAG,kBAAkB,CAAA;AAC3C,QAAA,0BAA0B,GAAG,qBAAqB,CAAA;AAClD,QAAA,aAAa,GAAG,kBAAkB,CAAA;AAClC,QAAA,+BAA+B,GAAG,2BAA2B,CAAA;AAC7D,QAAA,4BAA4B,GAAG,uBAAuB,CAAA"}

package/dist/decorators/group-role-resolver.decorator.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Marks a class as the application's `IGroupRoleResolver` (exactly one per app).
+ * Discovered at bootstrap and registered in `GroupRoleResolverRegistry`.
+ *
+ * Applies `@Injectable()` with default (singleton) scope. Do **not** add `@Injectable()`
+ * on the same class — a second decorator can override scope (e.g. `REQUEST`) and break
+ * bootstrap, which resolves one instance at application startup.
+ */
+export declare function GroupRoleResolver(): ClassDecorator;

package/dist/decorators/group-role-resolver.decorator.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GroupRoleResolver = GroupRoleResolver;
+const common_1 = require("@nestjs/common");
+const constants_1 = require("./constants");
+/**
+ * Marks a class as the application's `IGroupRoleResolver` (exactly one per app).
+ * Discovered at bootstrap and registered in `GroupRoleResolverRegistry`.
+ *
+ * Applies `@Injectable()` with default (singleton) scope. Do **not** add `@Injectable()`
+ * on the same class — a second decorator can override scope (e.g. `REQUEST`) and break
+ * bootstrap, which resolves one instance at application startup.
+ */
+function GroupRoleResolver() {
+    return (0, common_1.applyDecorators)((0, common_1.SetMetadata)(constants_1.GROUP_ROLE_RESOLVER_METADATA, true), (0, common_1.Injectable)());
+}
+//# sourceMappingURL=group-role-resolver.decorator.js.map

package/dist/decorators/group-role-resolver.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-role-resolver.decorator.js","sourceRoot":"","sources":["../../src/decorators/group-role-resolver.decorator.ts"],"names":[],"mappings":";;AAYA,8CAKC;AAjBD,2CAAyE;AAEzE,2CAA0D;AAE1D;;;;;;;GAOG;AACH,SAAgB,iBAAiB;IAC/B,OAAO,IAAA,wBAAe,EACpB,IAAA,oBAAW,EAAC,wCAA4B,EAAE,IAAI,CAAC,EAC/C,IAAA,mBAAU,GAAE,CACK,CAAA;AACrB,CAAC"}

package/dist/decorators/index.d.ts

@@ -4,6 +4,7 @@ export * from './context.decorator';
 export * from './data-sync-handler.decorator';
 export * from './event-factory.decorator';
 export * from './event-handler.decorator';
+export * from './group-role-resolver.decorator';
 export * from './notification-transport.decorator';
 export * from './roles.decorator';
 export * from './swagger-response.decorator';

package/dist/decorators/index.js

@@ -20,6 +20,7 @@ __exportStar(require("./context.decorator"), exports);
 __exportStar(require("./data-sync-handler.decorator"), exports);
 __exportStar(require("./event-factory.decorator"), exports);
 __exportStar(require("./event-handler.decorator"), exports);
+__exportStar(require("./group-role-resolver.decorator"), exports);
 __exportStar(require("./notification-transport.decorator"), exports);
 __exportStar(require("./roles.decorator"), exports);
 __exportStar(require("./swagger-response.decorator"), exports);

package/dist/decorators/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/decorators/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,mDAAgC;AAChC,8CAA2B;AAC3B,sDAAmC;AACnC,gEAA6C;AAC7C,4DAAyC;AACzC,4DAAyC;AACzC,qEAAkD;AAClD,oDAAiC;AACjC,+DAA4C"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/decorators/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,mDAAgC;AAChC,8CAA2B;AAC3B,sDAAmC;AACnC,gEAA6C;AAC7C,4DAAyC;AACzC,4DAAyC;AACzC,kEAA+C;AAC/C,qEAAkD;AAClD,oDAAiC;AACjC,+DAA4C"}

package/dist/guard/roles.guard.d.ts

@@ -1,10 +1,12 @@
 import { CanActivate, ExecutionContext, Logger } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
+import { GroupRoleResolverRegistry } from '../auth/group-role-resolver.registry';
 import { UserContext } from '../context';
 export declare class RolesGuard implements CanActivate {
     protected reflector: Reflector;
+    protected registry?: GroupRoleResolverRegistry;
     protected readonly logger: Logger;
-    constructor(reflector: Reflector);
+    constructor(reflector: Reflector, registry?: GroupRoleResolverRegistry);
     canActivate(context: ExecutionContext): Promise<boolean>;
     /**
      * Verify tenant access.
@@ -59,6 +61,14 @@ export declare class RolesGuard implements CanActivate {
      * This is a helper method that can be used by subclasses.
      */
     protected getAuthorizerClaims(context: ExecutionContext): import("../context").JwtClaims;
+    protected hasAnyRole(requiredRoles: string[], userRoles: string[]): boolean;
+    protected resolveGroupRoles(context: ExecutionContext, groupIds: string[]): Promise<string[]>;
     protected verifyRole(context: ExecutionContext): Promise<boolean>;
+    /**
+     * Returns the primary direct role string from JWT context.
+     *
+     * @deprecated Not invoked by `verifyRole`. For custom authorization, override
+     * `verifyRole`, `resolveGroupRoles`, or `canOverrideTenant` instead.
+     */
     protected getUserRole(context: ExecutionContext): Promise<string>;
 }

package/dist/guard/roles.guard.js

@@ -8,17 +8,22 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 var RolesGuard_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RolesGuard = void 0;
 const common_1 = require("@nestjs/common");
 const core_1 = require("@nestjs/core");
+const group_role_resolver_registry_1 = require("../auth/group-role-resolver.registry");
 const constants_1 = require("../constants");
 const context_1 = require("../context");
 const decorators_1 = require("../decorators");
 let RolesGuard = RolesGuard_1 = class RolesGuard {
-    constructor(reflector) {
+    constructor(reflector, registry) {
         this.reflector = reflector;
+        this.registry = registry;
         this.logger = new common_1.Logger(RolesGuard_1.name);
     }
     async canActivate(context) {
@@ -113,22 +118,51 @@ let RolesGuard = RolesGuard_1 = class RolesGuard {
         const invokeContext = (0, context_1.extractInvokeContext)(context);
         return (0, context_1.getAuthorizerClaims)(invokeContext);
     }
+    hasAnyRole(requiredRoles, userRoles) {
+        return requiredRoles.some((role) => userRoles.includes(role));
+    }
+    async resolveGroupRoles(context, groupIds) {
+        const resolver = this.registry?.get();
+        if (!resolver || !groupIds.length) {
+            return [];
+        }
+        const userContext = (0, context_1.getUserContext)(context);
+        const claims = this.getAuthorizerClaims(context);
+        try {
+            return await resolver.resolveRoles({
+                tenantCode: userContext.tenantCode,
+                groupIds,
+                claims,
+            });
+        }
+        catch (err) {
+            this.logger.error('GroupRoleResolver.resolveRoles failed', err);
+            throw err;
+        }
+    }
     async verifyRole(context) {
         const requiredRoles = this.reflector.getAllAndOverride(decorators_1.ROLE_METADATA, [context.getHandler(), context.getClass()]);
         if (!requiredRoles || !requiredRoles.length) {
             // all user can access
             return true;
         }
-        const userRole = await this.getUserRole(context);
-        if (!userRole) {
-            return false;
+        const userContext = (0, context_1.getUserContext)(context);
+        const { tenantRoles, tenantGroupIds } = userContext;
+        if (tenantRoles.includes(constants_1.ROLE_SYSTEM_ADMIN)) {
+            return true;
         }
-        if (userRole === constants_1.ROLE_SYSTEM_ADMIN) {
+        if (this.hasAnyRole(requiredRoles, tenantRoles)) {
             return true;
         }
-        return requiredRoles.includes(userRole);
+        const groupRoles = await this.resolveGroupRoles(context, tenantGroupIds);
+        return this.hasAnyRole(requiredRoles, groupRoles);
     }
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    /**
+     * Returns the primary direct role string from JWT context.
+     *
+     * @deprecated Not invoked by `verifyRole`. For custom authorization, override
+     * `verifyRole`, `resolveGroupRoles`, or `canOverrideTenant` instead.
+     */
     async getUserRole(context) {
         const userContext = (0, context_1.getUserContext)(context);
         return userContext.tenantRole;
@@ -137,6 +171,8 @@ let RolesGuard = RolesGuard_1 = class RolesGuard {
 exports.RolesGuard = RolesGuard;
 exports.RolesGuard = RolesGuard = RolesGuard_1 = __decorate([
     (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [core_1.Reflector])
+    __param(1, (0, common_1.Optional)()),
+    __metadata("design:paramtypes", [core_1.Reflector,
+        group_role_resolver_registry_1.GroupRoleResolverRegistry])
 ], RolesGuard);
 //# sourceMappingURL=roles.guard.js.map

package/dist/guard/roles.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"roles.guard.js","sourceRoot":"","sources":["../../src/guard/roles.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAKuB;AACvB,uCAAwC;AAExC,4CAIqB;AACrB,wCAKmB;AACnB,8CAA6C;AAGtC,IAAM,UAAU,kBAAhB,MAAM,UAAU;IAGrB,YAAsB,SAAoB;QAApB,cAAS,GAAT,SAAS,CAAW;QAFvB,WAAM,GAAG,IAAI,eAAM,CAAC,YAAU,CAAC,IAAI,CAAC,CAAA;IAEV,CAAC;IAE9C,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,eAAe;QACf,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;QACtD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,KAAK,CAAA;QACd,CAAC;QAED,yBAAyB;QACzB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;QAClD,OAAO,WAAW,CAAA;IACpB,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,YAAY,CAAC,OAAyB;QACpD,MAAM,WAAW,GAAG,IAAA,wBAAc,EAAC,OAAO,CAAC,CAAA;QAE3C,0BAA0B;QAC1B,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAA;QACd,CAAC;QAED,+EAA+E;QAC/E,IAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;QACrD,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;OAGG;IACO,gBAAgB,CACxB,OAAyB,EACzB,WAAwB;QAExB,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAA;QAChD,6DAA6D;QAC7D,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,UAAU,CAAA;IAC7D,CAAC;IAED;;;;;;;OAOG;IACO,iBAAiB,CACzB,OAAyB,EACzB,WAAwB;QAExB,gCAAgC;QAChC,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;YACjE,OAAO,IAAI,CAAA;QACb,CAAC;QAED,sCAAsC;QACtC,OAAO,IAAI,CAAC,mBAAmB,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;IACpE,CAAC;IAED;;;;;;;;;;;;OAYG;IACO,oBAAoB;QAC5B,OAAO,uCAA2B,CAAA;IACpC,CAAC;IAED;;;;;;;;;;;;OAYG;IACO,mBAAmB;QAC3B,OAAO,sCAA0B,CAAA;IACnC,CAAC;IAED;;;OAGG;IACO,mBAAmB,CAAC,OAAyB;QACrD,MAAM,aAAa,GAAG,IAAA,8BAAoB,EAAC,OAAO,CAAC,CAAA;QACnD,OAAO,IAAA,6BAAmB,EAAC,aAAa,CAAC,CAAA;IAC3C,CAAC;IAES,KAAK,CAAC,UAAU,CAAC,OAAyB;QAClD,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CACpD,0BAAa,EACb,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAA;QACD,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;YAC5C,sBAAsB;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAA;QACd,CAAC;QACD,IAAI,QAAQ,KAAK,6BAAiB,EAAE,CAAC;YACnC,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACzC,CAAC;IAED,6DAA6D;IACnD,KAAK,CAAC,WAAW,CAAC,OAAyB;QACnD,MAAM,WAAW,GAAG,IAAA,wBAAc,EAAC,OAAO,CAAC,CAAA;QAE3C,OAAO,WAAW,CAAC,UAAU,CAAA;IAC/B,CAAC;CACF,CAAA;AA9IY,gCAAU;qBAAV,UAAU;IADtB,IAAA,mBAAU,GAAE;qCAIsB,gBAAS;GAH/B,UAAU,CA8ItB"}
+{"version":3,"file":"roles.guard.js","sourceRoot":"","sources":["../../src/guard/roles.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAMuB;AACvB,uCAAwC;AAExC,uFAAgF;AAChF,4CAIqB;AACrB,wCAKmB;AACnB,8CAA6C;AAGtC,IAAM,UAAU,kBAAhB,MAAM,UAAU;IAGrB,YACY,SAAoB,EAClB,QAA8C;QADhD,cAAS,GAAT,SAAS,CAAW;QACR,aAAQ,GAAR,QAAQ,CAA4B;QAJzC,WAAM,GAAG,IAAI,eAAM,CAAC,YAAU,CAAC,IAAI,CAAC,CAAA;IAKpD,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,eAAe;QACf,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;QACtD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,KAAK,CAAA;QACd,CAAC;QAED,yBAAyB;QACzB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;QAClD,OAAO,WAAW,CAAA;IACpB,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,YAAY,CAAC,OAAyB;QACpD,MAAM,WAAW,GAAG,IAAA,wBAAc,EAAC,OAAO,CAAC,CAAA;QAE3C,0BAA0B;QAC1B,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAA;QACd,CAAC;QAED,+EAA+E;QAC/E,IAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;QACrD,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;OAGG;IACO,gBAAgB,CACxB,OAAyB,EACzB,WAAwB;QAExB,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAA;QAChD,6DAA6D;QAC7D,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,UAAU,CAAA;IAC7D,CAAC;IAED;;;;;;;OAOG;IACO,iBAAiB,CACzB,OAAyB,EACzB,WAAwB;QAExB,gCAAgC;QAChC,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;YACjE,OAAO,IAAI,CAAA;QACb,CAAC;QAED,sCAAsC;QACtC,OAAO,IAAI,CAAC,mBAAmB,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;IACpE,CAAC;IAED;;;;;;;;;;;;OAYG;IACO,oBAAoB;QAC5B,OAAO,uCAA2B,CAAA;IACpC,CAAC;IAED;;;;;;;;;;;;OAYG;IACO,mBAAmB;QAC3B,OAAO,sCAA0B,CAAA;IACnC,CAAC;IAED;;;OAGG;IACO,mBAAmB,CAAC,OAAyB;QACrD,MAAM,aAAa,GAAG,IAAA,8BAAoB,EAAC,OAAO,CAAC,CAAA;QACnD,OAAO,IAAA,6BAAmB,EAAC,aAAa,CAAC,CAAA;IAC3C,CAAC;IAES,UAAU,CAAC,aAAuB,EAAE,SAAmB;QAC/D,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;IAC/D,CAAC;IAES,KAAK,CAAC,iBAAiB,CAC/B,OAAyB,EACzB,QAAkB;QAElB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAA;QACrC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YAClC,OAAO,EAAE,CAAA;QACX,CAAC;QAED,MAAM,WAAW,GAAG,IAAA,wBAAc,EAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAA;QAEhD,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,YAAY,CAAC;gBACjC,UAAU,EAAE,WAAW,CAAC,UAAU;gBAClC,QAAQ;gBACR,MAAM;aACP,CAAC,CAAA;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAA;YAC/D,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAES,KAAK,CAAC,UAAU,CAAC,OAAyB;QAClD,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CACpD,0BAAa,EACb,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAA;QACD,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;YAC5C,sBAAsB;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,WAAW,GAAG,IAAA,wBAAc,EAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,GAAG,WAAW,CAAA;QAEnD,IAAI,WAAW,CAAC,QAAQ,CAAC,6BAAiB,CAAC,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,CAAA;QACb,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;QACxE,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,UAAU,CAAC,CAAA;IACnD,CAAC;IAED;;;;;OAKG;IACO,KAAK,CAAC,WAAW,CAAC,OAAyB;QACnD,MAAM,WAAW,GAAG,IAAA,wBAAc,EAAC,OAAO,CAAC,CAAA;QAE3C,OAAO,WAAW,CAAC,UAAU,CAAA;IAC/B,CAAC;CACF,CAAA;AArLY,gCAAU;qBAAV,UAAU;IADtB,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,iBAAQ,GAAE,CAAA;qCADU,gBAAS;QACG,wDAAyB;GALjD,UAAU,CAqLtB"}

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export * from './app.module';
+export * from './auth';
 export * from './bootstrap';
 export * from './command-events';
 export * from './commands';

package/dist/index.js

@@ -15,6 +15,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./app.module"), exports);
+__exportStar(require("./auth"), exports);
 __exportStar(require("./bootstrap"), exports);
 __exportStar(require("./command-events"), exports);
 __exportStar(require("./commands"), exports);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,+CAA4B;AAC5B,8CAA2B;AAC3B,mDAAgC;AAChC,6CAA0B;AAC1B,8CAA2B;AAC3B,4CAAyB;AACzB,+CAA4B;AAC5B,+CAA4B;AAC5B,mDAAgC;AAChC,2CAAwB;AACxB,+CAA4B;AAC5B,4CAAyB;AACzB,0CAAuB;AACvB,4CAAyB;AACzB,+CAA4B;AAC5B,kDAA+B;AAC/B,yCAAsB;AACtB,0CAAuB;AACvB,6CAA0B;AAC1B,8CAA2B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,+CAA4B;AAC5B,yCAAsB;AACtB,8CAA2B;AAC3B,mDAAgC;AAChC,6CAA0B;AAC1B,8CAA2B;AAC3B,4CAAyB;AACzB,+CAA4B;AAC5B,+CAA4B;AAC5B,mDAAgC;AAChC,2CAAwB;AACxB,+CAA4B;AAC5B,4CAAyB;AACzB,0CAAuB;AACvB,4CAAyB;AACzB,+CAA4B;AAC5B,kDAA+B;AAC/B,yCAAsB;AACtB,0CAAuB;AACvB,6CAA0B;AAC1B,8CAA2B"}

package/dist/services/explorer.service.d.ts

@@ -2,6 +2,7 @@ import { Type } from '@nestjs/common';
 import { InstanceWrapper } from '@nestjs/core/injector/instance-wrapper';
 import { Module } from '@nestjs/core/injector/module';
 import { ModulesContainer } from '@nestjs/core/injector/modules-container';
+import { IGroupRoleResolver } from '../auth/group-role-resolver.interface';
 import { IDataSyncHandler, IEventFactory, IEventHandler } from '../interfaces';
 export declare class ExplorerService {
     private readonly modulesContainer;
@@ -17,6 +18,7 @@ export declare class ExplorerService {
     exploreNotificationTransports(): {
         notificationTransports: Type<any>[];
     };
+    exploreGroupRoleResolvers(): Type<IGroupRoleResolver>[];
     flatMap<T>(modules: Module[], callback: (instance: InstanceWrapper) => Type<any> | undefined): Type<T>[];
     filterProvider(wrapper: InstanceWrapper, metadataKey: string, metadataValue?: string): Type<any> | undefined;
     extractMetadata(instance: Record<string, any>, metadataKey: string, metadataValue?: string): Type<any>;

package/dist/services/explorer.service.js

@@ -35,6 +35,10 @@ let ExplorerService = ExplorerService_1 = class ExplorerService {
         const notificationTransports = this.flatMap(modules, (instance) => this.filterProvider(instance, decorators_1.NOTIFICATION_TRANSPORT_METADATA));
         return { notificationTransports };
     }
+    exploreGroupRoleResolvers() {
+        const modules = [...this.modulesContainer.values()];
+        return this.flatMap(modules, (instance) => this.filterProvider(instance, decorators_1.GROUP_ROLE_RESOLVER_METADATA));
+    }
     flatMap(modules, callback) {
         const items = modules
             .map((module) => [...module.providers.values()].map(callback))

package/dist/services/explorer.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"explorer.service.js","sourceRoot":"","sources":["../../src/services/explorer.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAyD;AAGzD,+EAA0E;AAE1E,8CAKsB;AAIf,IAAM,eAAe,uBAArB,MAAM,eAAe;IAG1B,YAA6B,gBAAkC;QAAlC,qBAAgB,GAAhB,gBAAgB,CAAkB;QAF9C,WAAM,GAAG,IAAI,eAAM,CAAC,iBAAe,CAAC,IAAI,CAAC,CAAA;IAEQ,CAAC;IAEnE,OAAO;QACL,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAA;QAEnD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAgB,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAC/D,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,mCAAsB,CAAC,CACtD,CAAA;QACD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAgB,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CACtE,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,mCAAsB,CAAC,CACtD,CAAA;QACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;IAClC,CAAC;IAED,uBAAuB,CAAC,gBAAwB;QAC9C,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAA;QACnD,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CACnC,OAAO,EACP,CAAC,QAAQ,EAAE,EAAE,CACX,IAAI,CAAC,cAAc,CACjB,QAAQ,EACR,uCAA0B,EAC1B,gBAAgB,CACjB,CACJ,CAAA;QACD,OAAO,EAAE,gBAAgB,EAAE,CAAA;IAC7B,CAAC;IAED,6BAA6B;QAC3B,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAA;QACnD,MAAM,sBAAsB,GAAG,IAAI,CAAC,OAAO,CAAM,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CACrE,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,4CAA+B,CAAC,CAC/D,CAAA;QACD,OAAO,EAAE,sBAAsB,EAAE,CAAA;IACnC,CAAC;IAED,OAAO,CACL,OAAiB,EACjB,QAA8D;QAE9D,MAAM,KAAK,GAAG,OAAO;aAClB,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;aAC7D,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACpC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAc,CAAA;IAC1D,CAAC;IAED,cAAc,CACZ,OAAwB,EACxB,WAAmB,EACnB,aAAsB;QAEtB,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;QAC5B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,CAAC,CAAA;IACnE,CAAC;IAED,eAAe,CACb,QAA6B,EAC7B,WAAmB,EACnB,aAAsB;QAEtB,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC1B,OAAM;QACR,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAA;QACvE,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,IAAI,QAAQ,KAAK,aAAa,CAAC,EAAE,CAAC;YAC/D,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,OAAO,QAAQ,CAAC,WAAwB,CAAA;IAC1C,CAAC;CACF,CAAA;AA3EY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;qCAIoC,oCAAgB;GAHpD,eAAe,CA2E3B"}
+{"version":3,"file":"explorer.service.js","sourceRoot":"","sources":["../../src/services/explorer.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAyD;AAGzD,+EAA0E;AAG1E,8CAMsB;AAIf,IAAM,eAAe,uBAArB,MAAM,eAAe;IAG1B,YAA6B,gBAAkC;QAAlC,qBAAgB,GAAhB,gBAAgB,CAAkB;QAF9C,WAAM,GAAG,IAAI,eAAM,CAAC,iBAAe,CAAC,IAAI,CAAC,CAAA;IAEQ,CAAC;IAEnE,OAAO;QACL,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAA;QAEnD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAgB,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAC/D,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,mCAAsB,CAAC,CACtD,CAAA;QACD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAgB,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CACtE,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,mCAAsB,CAAC,CACtD,CAAA;QACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;IAClC,CAAC;IAED,uBAAuB,CAAC,gBAAwB;QAC9C,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAA;QACnD,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CACnC,OAAO,EACP,CAAC,QAAQ,EAAE,EAAE,CACX,IAAI,CAAC,cAAc,CACjB,QAAQ,EACR,uCAA0B,EAC1B,gBAAgB,CACjB,CACJ,CAAA;QACD,OAAO,EAAE,gBAAgB,EAAE,CAAA;IAC7B,CAAC;IAED,6BAA6B;QAC3B,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAA;QACnD,MAAM,sBAAsB,GAAG,IAAI,CAAC,OAAO,CAAM,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CACrE,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,4CAA+B,CAAC,CAC/D,CAAA;QACD,OAAO,EAAE,sBAAsB,EAAE,CAAA;IACnC,CAAC;IAED,yBAAyB;QACvB,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAA;QACnD,OAAO,IAAI,CAAC,OAAO,CAAqB,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAC5D,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,yCAA4B,CAAC,CAC5D,CAAA;IACH,CAAC;IAED,OAAO,CACL,OAAiB,EACjB,QAA8D;QAE9D,MAAM,KAAK,GAAG,OAAO;aAClB,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;aAC7D,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACpC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAc,CAAA;IAC1D,CAAC;IAED,cAAc,CACZ,OAAwB,EACxB,WAAmB,EACnB,aAAsB;QAEtB,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;QAC5B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,CAAC,CAAA;IACnE,CAAC;IAED,eAAe,CACb,QAA6B,EAC7B,WAAmB,EACnB,aAAsB;QAEtB,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC1B,OAAM;QACR,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAA;QACvE,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,IAAI,QAAQ,KAAK,aAAa,CAAC,EAAE,CAAC;YAC/D,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,OAAO,QAAQ,CAAC,WAAwB,CAAA;IAC1C,CAAC;CACF,CAAA;AAlFY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;qCAIoC,oCAAgB;GAHpD,eAAe,CAkF3B"}

package/dist/services/mocks/group-role-resolver.mock.d.ts

@@ -0,0 +1,4 @@
+import { IGroupRoleResolver } from '../../auth/group-role-resolver.interface';
+export declare class MockGroupRoleResolver implements IGroupRoleResolver {
+    resolveRoles(): Promise<any[]>;
+}

package/dist/services/mocks/group-role-resolver.mock.js

@@ -0,0 +1,20 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MockGroupRoleResolver = void 0;
+const decorators_1 = require("../../decorators");
+let MockGroupRoleResolver = class MockGroupRoleResolver {
+    async resolveRoles() {
+        return [];
+    }
+};
+exports.MockGroupRoleResolver = MockGroupRoleResolver;
+exports.MockGroupRoleResolver = MockGroupRoleResolver = __decorate([
+    (0, decorators_1.GroupRoleResolver)()
+], MockGroupRoleResolver);
+//# sourceMappingURL=group-role-resolver.mock.js.map

package/dist/services/mocks/group-role-resolver.mock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-role-resolver.mock.js","sourceRoot":"","sources":["../../../src/services/mocks/group-role-resolver.mock.ts"],"names":[],"mappings":";;;;;;;;;AACA,iDAAoD;AAG7C,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAChC,KAAK,CAAC,YAAY;QAChB,OAAO,EAAE,CAAA;IACX,CAAC;CACF,CAAA;AAJY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,8BAAiB,GAAE;GACP,qBAAqB,CAIjC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mbc-cqrs-serverless/core",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "CQRS and event base core",
   "keywords": [
     "mbc",
@@ -88,5 +88,5 @@
     "serverless-step-functions-local": "^0.5.1",
     "supertest": "^7.0.0"
   },
-  "gitHead": "3e6f1b6d57bf38433d5f63dfb9f5e03a4c9bb25d"
+  "gitHead": "9acc296b83e2120876c13dae8d44175345d3aa98"
 }