@mondart/nestjs-common-module-iam 1.0.0 → 3.0.0

package/dist/constants/iam-decorator-key.const.d.ts

@@ -1,5 +1,8 @@
-export declare const IAM_PUBLIC_ROUTE = "iamPublicRoute";
-export declare const IAM_ROUTE_USER_TYPE = "iamRouteUserType";
-export declare const IAM_PRIVATE_ROUTE = "iamPrivateRoute";
-export declare const IAM_OWN_ROUTE = "iamOwnRoute";
+export declare const IAM_PUBLIC_ROUTE = "iam_public_route";
+export declare const IAM_ROUTE_USER_TYPE = "iam_route_user_type";
+export declare const IAM_ENTITY_ACCESS_KEY = "iam_entity_access";
+export declare const IAM_ENTITY_SCOPE_KEY = "iam_entity_scope";
+export declare const IAM_REQUEST_USER_TYPE_KEY = "__iam_user_type";
+export declare const IAM_REQUEST_ENTITY_SCOPE_OPTIONS_KEY = "__iam_entity_scope_options";
+export declare const IAM_QUERY_SCOPE_WHERE_KEY = "iamWhere";
 //# sourceMappingURL=iam-decorator-key.const.d.ts.map

package/dist/constants/iam-decorator-key.const.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"iam-decorator-key.const.d.ts","sourceRoot":"","sources":["../../src/constants/iam-decorator-key.const.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gBAAgB,mBAAmB,CAAC;AACjD,eAAO,MAAM,mBAAmB,qBAAqB,CAAC;AACtD,eAAO,MAAM,iBAAiB,oBAAoB,CAAC;AACnD,eAAO,MAAM,aAAa,gBAAgB,CAAC"}
+{"version":3,"file":"iam-decorator-key.const.d.ts","sourceRoot":"","sources":["../../src/constants/iam-decorator-key.const.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AACnD,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAEzD,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AACzD,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAEvD,eAAO,MAAM,yBAAyB,oBAAoB,CAAC;AAC3D,eAAO,MAAM,oCAAoC,+BACnB,CAAC;AAE/B,eAAO,MAAM,yBAAyB,aAAa,CAAC"}

package/dist/constants/iam-decorator-key.const.js

@@ -1,8 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.IAM_OWN_ROUTE = exports.IAM_PRIVATE_ROUTE = exports.IAM_ROUTE_USER_TYPE = exports.IAM_PUBLIC_ROUTE = void 0;
-exports.IAM_PUBLIC_ROUTE = 'iamPublicRoute';
-exports.IAM_ROUTE_USER_TYPE = 'iamRouteUserType';
-exports.IAM_PRIVATE_ROUTE = 'iamPrivateRoute';
-exports.IAM_OWN_ROUTE = 'iamOwnRoute';
+exports.IAM_QUERY_SCOPE_WHERE_KEY = exports.IAM_REQUEST_ENTITY_SCOPE_OPTIONS_KEY = exports.IAM_REQUEST_USER_TYPE_KEY = exports.IAM_ENTITY_SCOPE_KEY = exports.IAM_ENTITY_ACCESS_KEY = exports.IAM_ROUTE_USER_TYPE = exports.IAM_PUBLIC_ROUTE = void 0;
+exports.IAM_PUBLIC_ROUTE = 'iam_public_route';
+exports.IAM_ROUTE_USER_TYPE = 'iam_route_user_type';
+exports.IAM_ENTITY_ACCESS_KEY = 'iam_entity_access';
+exports.IAM_ENTITY_SCOPE_KEY = 'iam_entity_scope';
+exports.IAM_REQUEST_USER_TYPE_KEY = '__iam_user_type';
+exports.IAM_REQUEST_ENTITY_SCOPE_OPTIONS_KEY = '__iam_entity_scope_options';
+exports.IAM_QUERY_SCOPE_WHERE_KEY = 'iamWhere';
 //# sourceMappingURL=iam-decorator-key.const.js.map

package/dist/constants/iam-decorator-key.const.js.map

@@ -1 +1 @@
-{"version":3,"file":"iam-decorator-key.const.js","sourceRoot":"","sources":["../../src/constants/iam-decorator-key.const.ts"],"names":[],"mappings":";;;AAAa,QAAA,gBAAgB,GAAG,gBAAgB,CAAC;AACpC,QAAA,mBAAmB,GAAG,kBAAkB,CAAC;AACzC,QAAA,iBAAiB,GAAG,iBAAiB,CAAC;AACtC,QAAA,aAAa,GAAG,aAAa,CAAC"}
+{"version":3,"file":"iam-decorator-key.const.js","sourceRoot":"","sources":["../../src/constants/iam-decorator-key.const.ts"],"names":[],"mappings":";;;AAAa,QAAA,gBAAgB,GAAG,kBAAkB,CAAC;AACtC,QAAA,mBAAmB,GAAG,qBAAqB,CAAC;AAE5C,QAAA,qBAAqB,GAAG,mBAAmB,CAAC;AAC5C,QAAA,oBAAoB,GAAG,kBAAkB,CAAC;AAE1C,QAAA,yBAAyB,GAAG,iBAAiB,CAAC;AAC9C,QAAA,oCAAoC,GAC/C,4BAA4B,CAAC;AAElB,QAAA,yBAAyB,GAAG,UAAU,CAAC"}

package/dist/decorators/allow-iam.decorator.d.ts

@@ -0,0 +1,3 @@
+import { IamUserTypeEnum } from '../enums/iam-user-type.enum';
+export declare const AllowIam: (...userTypes: IamUserTypeEnum[]) => import("@nestjs/common").CustomDecorator<string>;
+//# sourceMappingURL=allow-iam.decorator.d.ts.map

package/dist/decorators/allow-iam.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allow-iam.decorator.d.ts","sourceRoot":"","sources":["../../src/decorators/allow-iam.decorator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9D,eAAO,MAAM,QAAQ,GAAI,GAAG,WAAW,eAAe,EAAE,qDACX,CAAC"}

package/dist/decorators/allow-iam.decorator.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AllowIam = void 0;
+const iam_decorator_key_const_1 = require("../constants/iam-decorator-key.const");
+const common_1 = require("@nestjs/common");
+const AllowIam = (...userTypes) => (0, common_1.SetMetadata)(iam_decorator_key_const_1.IAM_ROUTE_USER_TYPE, userTypes);
+exports.AllowIam = AllowIam;
+//# sourceMappingURL=allow-iam.decorator.js.map

package/dist/decorators/allow-iam.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allow-iam.decorator.js","sourceRoot":"","sources":["../../src/decorators/allow-iam.decorator.ts"],"names":[],"mappings":";;;AAAA,kFAA2E;AAC3E,2CAA6C;AAGtC,MAAM,QAAQ,GAAG,CAAC,GAAG,SAA4B,EAAE,EAAE,CAC1D,IAAA,oBAAW,EAAC,6CAAmB,EAAE,SAAS,CAAC,CAAC;AADjC,QAAA,QAAQ,YACyB"}

package/dist/decorators/iam-entity-access.decorator.d.ts

@@ -0,0 +1,4 @@
+import { ApplyIamEntityScopeOptions, RequireIamEntityAccessOptions } from '../interfaces/iam-entity-access.interface';
+export declare const RequireIamEntityAccess: <T = any>(options: RequireIamEntityAccessOptions<T>) => import("@nestjs/common").CustomDecorator<string>;
+export declare const ApplyIamEntityScope: <T = any>(options: ApplyIamEntityScopeOptions<T>) => import("@nestjs/common").CustomDecorator<string>;
+//# sourceMappingURL=iam-entity-access.decorator.d.ts.map

package/dist/decorators/iam-entity-access.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iam-entity-access.decorator.d.ts","sourceRoot":"","sources":["../../src/decorators/iam-entity-access.decorator.ts"],"names":[],"mappings":"AACA,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC9B,MAAM,2CAA2C,CAAC;AAMnD,eAAO,MAAM,sBAAsB,GAAI,CAAC,GAAG,GAAG,EAC5C,SAAS,6BAA6B,CAAC,CAAC,CAAC,qDACK,CAAC;AAEjD,eAAO,MAAM,mBAAmB,GAAI,CAAC,GAAG,GAAG,EACzC,SAAS,0BAA0B,CAAC,CAAC,CAAC,qDACO,CAAC"}

package/dist/decorators/iam-entity-access.decorator.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApplyIamEntityScope = exports.RequireIamEntityAccess = void 0;
+const common_1 = require("@nestjs/common");
+const iam_decorator_key_const_1 = require("../constants/iam-decorator-key.const");
+const RequireIamEntityAccess = (options) => (0, common_1.SetMetadata)(iam_decorator_key_const_1.IAM_ENTITY_ACCESS_KEY, options);
+exports.RequireIamEntityAccess = RequireIamEntityAccess;
+const ApplyIamEntityScope = (options) => (0, common_1.SetMetadata)(iam_decorator_key_const_1.IAM_ENTITY_SCOPE_KEY, options);
+exports.ApplyIamEntityScope = ApplyIamEntityScope;
+//# sourceMappingURL=iam-entity-access.decorator.js.map

package/dist/decorators/iam-entity-access.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iam-entity-access.decorator.js","sourceRoot":"","sources":["../../src/decorators/iam-entity-access.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAA6C;AAK7C,kFAG8C;AAEvC,MAAM,sBAAsB,GAAG,CACpC,OAAyC,EACzC,EAAE,CAAC,IAAA,oBAAW,EAAC,+CAAqB,EAAE,OAAO,CAAC,CAAC;AAFpC,QAAA,sBAAsB,0BAEc;AAE1C,MAAM,mBAAmB,GAAG,CACjC,OAAsC,EACtC,EAAE,CAAC,IAAA,oBAAW,EAAC,8CAAoB,EAAE,OAAO,CAAC,CAAC;AAFnC,QAAA,mBAAmB,uBAEgB"}

package/dist/decorators/public-iam.decorators.d.ts

@@ -0,0 +1,2 @@
+export declare const PublicIam: () => import("@nestjs/common").CustomDecorator<string>;
+//# sourceMappingURL=public-iam.decorators.d.ts.map

package/dist/decorators/public-iam.decorators.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-iam.decorators.d.ts","sourceRoot":"","sources":["../../src/decorators/public-iam.decorators.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,SAAS,wDAA4C,CAAC"}

package/dist/decorators/public-iam.decorators.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PublicIam = void 0;
+const iam_decorator_key_const_1 = require("../constants/iam-decorator-key.const");
+const common_1 = require("@nestjs/common");
+const PublicIam = () => (0, common_1.SetMetadata)(iam_decorator_key_const_1.IAM_PUBLIC_ROUTE, true);
+exports.PublicIam = PublicIam;
+//# sourceMappingURL=public-iam.decorators.js.map

package/dist/decorators/public-iam.decorators.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-iam.decorators.js","sourceRoot":"","sources":["../../src/decorators/public-iam.decorators.ts"],"names":[],"mappings":";;;AAAA,kFAAwE;AACxE,2CAA6C;AAEtC,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,IAAA,oBAAW,EAAC,0CAAgB,EAAE,IAAI,CAAC,CAAC;AAAtD,QAAA,SAAS,aAA6C"}

package/dist/guards/iam-context.guard.d.ts

@@ -1,11 +1,10 @@
 import { CanActivate, ExecutionContext } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
-import { DataSource } from 'typeorm';
+import { IamEntityAccessService } from '../services/iam-entity-access.service';
 export declare class IamContextGuard implements CanActivate {
     private readonly reflector;
-    private readonly dataSource;
-    constructor(reflector: Reflector, dataSource: DataSource);
+    private readonly iamEntityAccessService;
+    constructor(reflector: Reflector, iamEntityAccessService: IamEntityAccessService);
     canActivate(context: ExecutionContext): Promise<boolean>;
-    private checkOwnership;
 }
 //# sourceMappingURL=iam-context.guard.d.ts.map

package/dist/guards/iam-context.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"iam-context.guard.d.ts","sourceRoot":"","sources":["../../src/guards/iam-context.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAKjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAiBzC,OAAO,EAAE,UAAU,EAAU,MAAM,SAAS,CAAC;AAE7C,qBACa,eAAgB,YAAW,WAAW;IAE/C,OAAO,CAAC,QAAQ,CAAC,SAAS;IAE1B,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAFV,SAAS,EAAE,SAAS,EAEpB,UAAU,EAAE,UAAU;IAGnC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;YAgEhD,cAAc;CA6C7B"}
+{"version":3,"file":"iam-context.guard.d.ts","sourceRoot":"","sources":["../../src/guards/iam-context.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,gBAAgB,EAGjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAWzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAM/E,qBACa,eAAgB,YAAW,WAAW;IAE/C,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,sBAAsB;gBADtB,SAAS,EAAE,SAAS,EACpB,sBAAsB,EAAE,sBAAsB;IAG3D,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CAoE/D"}

package/dist/guards/iam-context.guard.js

@@ -8,102 +8,53 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-var __param = (this && this.__param) || function (paramIndex, decorator) {
-    return function (target, key) { decorator(target, key, paramIndex); }
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.IamContextGuard = void 0;
 const common_1 = require("@nestjs/common");
 const core_1 = require("@nestjs/core");
 const nestjs_common_module_core_1 = require("@mondart/nestjs-common-module-core");
 const iam_decorator_key_const_1 = require("../constants/iam-decorator-key.const");
-const iam_user_type_enum_1 = require("../enums/iam-user-type.enum");
-const owns_entity_decorator_1 = require("../decorators/owns-entity.decorator");
-const constants_1 = require("@nestjs/common/constants");
-const typeorm_1 = require("@nestjs/typeorm");
-const typeorm_2 = require("typeorm");
+const iam_entity_access_service_1 = require("../services/iam-entity-access.service");
 let IamContextGuard = class IamContextGuard {
-    constructor(reflector, dataSource) {
+    constructor(reflector, iamEntityAccessService) {
         this.reflector = reflector;
-        this.dataSource = dataSource;
+        this.iamEntityAccessService = iamEntityAccessService;
     }
     async canActivate(context) {
         const request = context.switchToHttp().getRequest();
-        const iamContext = (0, nestjs_common_module_core_1.getIamContext)(request);
-        const iaPublicRoute = this.reflector.getAllAndOverride(iam_decorator_key_const_1.IAM_PUBLIC_ROUTE, [context.getHandler(), context.getClass()]);
-        if (iaPublicRoute)
+        const isPublicRoute = this.reflector.getAllAndOverride(iam_decorator_key_const_1.IAM_PUBLIC_ROUTE, [context.getHandler(), context.getClass()]);
+        if (isPublicRoute) {
             return true;
-        const userType = this.reflector.getAllAndOverride(iam_decorator_key_const_1.IAM_ROUTE_USER_TYPE, [
+        }
+        const iamContext = (0, nestjs_common_module_core_1.getIamContext)(request);
+        const allowedUserTypes = this.reflector.getAllAndOverride(iam_decorator_key_const_1.IAM_ROUTE_USER_TYPE, [
             context.getHandler(),
             context.getClass(),
         ]) || [];
-        if (iamContext.agentId) {
-            if (userType.includes(iam_user_type_enum_1.IamUserTypeEnum.AGENT)) {
-                return true;
-            }
-            else {
-                throw new common_1.ForbiddenException();
-            }
-        }
-        if (userType.includes(iam_user_type_enum_1.IamUserTypeEnum.USER) ||
-            userType.includes(iam_user_type_enum_1.IamUserTypeEnum.GUEST)) {
-            const options = this.reflector.getAllAndOverride(owns_entity_decorator_1.OWNS_ENTITY_KEY, [context.getHandler(), context.getClass()]);
-            if (options) {
-                const isOwner = await this.checkOwnership(options.entity.name, options.entityPropertyKey, options.requestEntityId(request), options.ownerPropertyKey, iamContext?.user?.contactId);
-                const controllerPath = this.reflector.getAllAndOverride(constants_1.PATH_METADATA, [
-                    context.getHandler(),
-                    context.getClass(),
-                ]) ?? '';
-                if (!isOwner) {
-                    throw new common_1.ForbiddenException(`You do not own this ${controllerPath}`);
-                }
-            }
-            return true;
-        }
-        else {
+        const currentUserType = this.iamEntityAccessService.resolveUserType(iamContext, allowedUserTypes);
+        request[iam_decorator_key_const_1.IAM_REQUEST_USER_TYPE_KEY] = currentUserType;
+        if (!allowedUserTypes.includes(currentUserType)) {
             throw new common_1.ForbiddenException();
         }
-        throw new common_1.UnauthorizedException();
-    }
-    async checkOwnership(entity, entityPropertyKey, entityId, ownerPropertyKey, ownerId) {
-        if (!entityId)
-            return true;
-        const queryRunner = this.dataSource.createQueryRunner();
-        await queryRunner.connect();
-        await queryRunner.startTransaction('READ UNCOMMITTED');
-        try {
-            const entityManager = queryRunner.manager;
-            const isExists = await entityManager.getRepository(entity).exists({
-                where: {
-                    [entityPropertyKey]: entityId,
-                },
-            });
-            if (!isExists) {
-                throw new common_1.NotFoundException(nestjs_common_module_core_1.MessageFormatter.replace(nestjs_common_module_core_1.SharedMessages.RESOURCE_NOT_FOUND, 'Cart'));
-            }
-            const isBlongeToOwner = await entityManager.getRepository(entity).exists({
-                where: {
-                    [entityPropertyKey]: entityId,
-                    [ownerPropertyKey]: ownerId || (0, typeorm_2.IsNull)(),
-                },
-            });
-            await queryRunner.commitTransaction();
-            return isBlongeToOwner;
+        const scopeOptions = this.reflector.getAllAndOverride(iam_decorator_key_const_1.IAM_ENTITY_SCOPE_KEY, [context.getHandler(), context.getClass()]);
+        if (scopeOptions) {
+            request[iam_decorator_key_const_1.IAM_REQUEST_ENTITY_SCOPE_OPTIONS_KEY] = scopeOptions;
         }
-        catch (err) {
-            await queryRunner.rollbackTransaction();
-            throw err;
+        const entityAccessOptions = this.reflector.getAllAndOverride(iam_decorator_key_const_1.IAM_ENTITY_ACCESS_KEY, [context.getHandler(), context.getClass()]);
+        if (!entityAccessOptions) {
+            return true;
         }
-        finally {
-            await queryRunner.release();
+        const hasAccess = await this.iamEntityAccessService.hasEntityAccess(entityAccessOptions, request, iamContext, currentUserType);
+        if (!hasAccess) {
+            throw new common_1.ForbiddenException(`You do not have access to this ${entityAccessOptions.resourceName ?? 'resource'}`);
         }
+        return true;
     }
 };
 exports.IamContextGuard = IamContextGuard;
 exports.IamContextGuard = IamContextGuard = __decorate([
     (0, common_1.Injectable)(),
-    __param(1, (0, typeorm_1.InjectDataSource)()),
     __metadata("design:paramtypes", [core_1.Reflector,
-        typeorm_2.DataSource])
+        iam_entity_access_service_1.IamEntityAccessService])
 ], IamContextGuard);
 //# sourceMappingURL=iam-context.guard.js.map

package/dist/guards/iam-context.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"iam-context.guard.js","sourceRoot":"","sources":["../../src/guards/iam-context.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,uCAAyC;AACzC,kFAI4C;AAC5C,kFAG8C;AAC9C,oEAA8D;AAC9D,+EAG6C;AAC7C,wDAAyD;AACzD,6CAAmD;AACnD,qCAA6C;AAGtC,IAAM,eAAe,GAArB,MAAM,eAAe;IAC1B,YACmB,SAAoB,EAEpB,UAAsB;QAFtB,cAAS,GAAT,SAAS,CAAW;QAEpB,eAAU,GAAV,UAAU,CAAY;IACtC,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QAEpD,MAAM,UAAU,GAAG,IAAA,yCAAa,EAAC,OAAO,CAAC,CAAC;QAE1C,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CACpD,0CAAgB,EAChB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QAEF,IAAI,aAAa;YAAE,OAAO,IAAI,CAAC;QAE/B,MAAM,QAAQ,GACZ,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAoB,6CAAmB,EAAE;YACvE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,IAAI,EAAE,CAAC;QAEX,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,IAAI,QAAQ,CAAC,QAAQ,CAAC,oCAAe,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7C,OAAO,IAAI,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,2BAAkB,EAAE,CAAC;YACjC,CAAC;QACH,CAAC;QAED,IACE,QAAQ,CAAC,QAAQ,CAAC,oCAAe,CAAC,IAAI,CAAC;YACvC,QAAQ,CAAC,QAAQ,CAAC,oCAAe,CAAC,KAAK,CAAC,EACxC,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC9C,uCAAe,EACf,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;YAEF,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CACvC,OAAO,CAAC,MAAM,CAAC,IAAI,EACnB,OAAO,CAAC,iBAAiB,EACzB,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,EAChC,OAAO,CAAC,gBAAgB,EACxB,UAAU,EAAE,IAAI,EAAE,SAAS,CAC5B,CAAC;gBAGF,MAAM,cAAc,GAClB,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAS,yBAAa,EAAE;oBACtD,OAAO,CAAC,UAAU,EAAE;oBACpB,OAAO,CAAC,QAAQ,EAAE;iBACnB,CAAC,IAAI,EAAE,CAAC;gBAEX,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,IAAI,2BAAkB,CAAC,uBAAuB,cAAc,EAAE,CAAC,CAAC;gBACxE,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,2BAAkB,EAAE,CAAC;QACjC,CAAC;QAED,MAAM,IAAI,8BAAqB,EAAE,CAAC;IACpC,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,MAAc,EACd,iBAAyB,EACzB,QAAyB,EACzB,gBAAwB,EACxB,OAAe;QAEf,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC;QAExD,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC;QAC5B,MAAM,WAAW,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;QAEvD,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,CAAC;YAE1C,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;gBAChE,KAAK,EAAE;oBACL,CAAC,iBAAiB,CAAC,EAAE,QAAQ;iBAC9B;aACF,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,0BAAiB,CACzB,4CAAgB,CAAC,OAAO,CAAC,0CAAc,CAAC,kBAAkB,EAAE,MAAM,CAAC,CACpE,CAAC;YACJ,CAAC;YAED,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;gBACvE,KAAK,EAAE;oBACL,CAAC,iBAAiB,CAAC,EAAE,QAAQ;oBAC7B,CAAC,gBAAgB,CAAC,EAAE,OAAO,IAAI,IAAA,gBAAM,GAAE;iBACxC;aACF,CAAC,CAAC;YAEH,MAAM,WAAW,CAAC,iBAAiB,EAAE,CAAC;YAEtC,OAAO,eAAe,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,WAAW,CAAC,mBAAmB,EAAE,CAAC;YACxC,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC;QAC9B,CAAC;IACH,CAAC;CACF,CAAA;AApHY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;IAIR,WAAA,IAAA,0BAAgB,GAAE,CAAA;qCADS,gBAAS;QAER,oBAAU;GAJ9B,eAAe,CAoH3B"}
+{"version":3,"file":"iam-context.guard.js","sourceRoot":"","sources":["../../src/guards/iam-context.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAKwB;AACxB,uCAAyC;AACzC,kFAAmE;AACnE,kFAO8C;AAE9C,qFAA+E;AAOxE,IAAM,eAAe,GAArB,MAAM,eAAe;IAC1B,YACmB,SAAoB,EACpB,sBAA8C;QAD9C,cAAS,GAAT,SAAS,CAAW;QACpB,2BAAsB,GAAtB,sBAAsB,CAAwB;IAC9D,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QAEpD,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CACpD,0CAAgB,EAChB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QAEF,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,UAAU,GAAG,IAAA,yCAAa,EAAC,OAAO,CAAC,CAAC;QAE1C,MAAM,gBAAgB,GACpB,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAoB,6CAAmB,EAAE;YACvE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,IAAI,EAAE,CAAC;QAEX,MAAM,eAAe,GAAG,IAAI,CAAC,sBAAsB,CAAC,eAAe,CACjE,UAAU,EACV,gBAAgB,CACjB,CAAC;QAEF,OAAO,CAAC,mDAAyB,CAAC,GAAG,eAAe,CAAC;QAErD,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,2BAAkB,EAAE,CAAC;QACjC,CAAC;QAED,MAAM,YAAY,GAChB,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC9B,8CAAoB,EACpB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QAEJ,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,CAAC,8DAAoC,CAAC,GAAG,YAAY,CAAC;QAC/D,CAAC;QAED,MAAM,mBAAmB,GACvB,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC9B,+CAAqB,EACrB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QAEJ,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,eAAe,CACjE,mBAAmB,EACnB,OAAO,EACP,UAAU,EACV,eAAe,CAChB,CAAC;QAEF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,2BAAkB,CAC1B,kCACE,mBAAmB,CAAC,YAAY,IAAI,UACtC,EAAE,CACH,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA1EY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;qCAGmB,gBAAS;QACI,kDAAsB;GAHtD,eAAe,CA0E3B"}

package/dist/helpers/user-owner.helper.d.ts

@@ -0,0 +1,12 @@
+import { AccessValueCast, EntityAccessBranch } from '../types/iam-entity-access.type';
+import { EntityFieldMatch } from '../interfaces/iam-entity-access.interface';
+export declare const byIam: <T = any>(field: keyof T & string, iamPath: string, cast?: AccessValueCast) => EntityAccessBranch<T>;
+export declare const byReq: <T = any>(field: keyof T & string, reqPath: string, cast?: AccessValueCast) => EntityAccessBranch<T>;
+export declare const matchIam: <T = any>(field: keyof T & string, iamPath: string, cast?: AccessValueCast) => EntityFieldMatch<T>;
+export declare const matchReq: <T = any>(field: keyof T & string, reqPath: string, cast?: AccessValueCast) => EntityFieldMatch<T>;
+export declare const allOf: <T = any>(...matches: EntityFieldMatch<T>[]) => EntityAccessBranch<T>;
+export declare const nullFields: <T = any>(...fields: (keyof T & string)[]) => EntityAccessBranch<T>;
+export declare const unowned: <T = any>(...fields: (keyof T & string)[]) => EntityAccessBranch<T>;
+export declare const userAuditAccess: <T = any>(createdField?: keyof T & string, updatedField?: keyof T & string) => EntityAccessBranch<T>[];
+export declare const agentAuditAccess: <T = any>(createdField?: keyof T & string, updatedField?: keyof T & string) => EntityAccessBranch<T>[];
+//# sourceMappingURL=user-owner.helper.d.ts.map

package/dist/helpers/user-owner.helper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-owner.helper.d.ts","sourceRoot":"","sources":["../../src/helpers/user-owner.helper.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,kBAAkB,EACnB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAK7E,eAAO,MAAM,KAAK,GAAI,CAAC,GAAG,GAAG,EAC3B,OAAO,MAAM,CAAC,GAAG,MAAM,EACvB,SAAS,MAAM,EACf,OAAO,eAAe,KACrB,kBAAkB,CAAC,CAAC,CAQrB,CAAC;AAKH,eAAO,MAAM,KAAK,GAAI,CAAC,GAAG,GAAG,EAC3B,OAAO,MAAM,CAAC,GAAG,MAAM,EACvB,SAAS,MAAM,EACf,OAAO,eAAe,KACrB,kBAAkB,CAAC,CAAC,CAQrB,CAAC;AAKH,eAAO,MAAM,QAAQ,GAAI,CAAC,GAAG,GAAG,EAC9B,OAAO,MAAM,CAAC,GAAG,MAAM,EACvB,SAAS,MAAM,EACf,OAAO,eAAe,KACrB,gBAAgB,CAAC,CAAC,CAInB,CAAC;AAEH,eAAO,MAAM,QAAQ,GAAI,CAAC,GAAG,GAAG,EAC9B,OAAO,MAAM,CAAC,GAAG,MAAM,EACvB,SAAS,MAAM,EACf,OAAO,eAAe,KACrB,gBAAgB,CAAC,CAAC,CAInB,CAAC;AAEH,eAAO,MAAM,KAAK,GAAI,CAAC,GAAG,GAAG,EAC3B,GAAG,SAAS,gBAAgB,CAAC,CAAC,CAAC,EAAE,KAChC,kBAAkB,CAAC,CAAC,CAErB,CAAC;AAKH,eAAO,MAAM,UAAU,GAAI,CAAC,GAAG,GAAG,EAChC,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,KAC9B,kBAAkB,CAAC,CAAC,CAErB,CAAC;AAKH,eAAO,MAAM,OAAO,GATO,CAAC,mBACf,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,KAC9B,kBAAkB,CAAC,CAAC,CAOU,CAAC;AAQlC,eAAO,MAAM,eAAe,GAAI,CAAC,GAAG,GAAG,EACrC,eAAc,MAAM,CAAC,GAAG,MAA4C,EACpE,eAAc,MAAM,CAAC,GAAG,MAA4C,KACnE,kBAAkB,CAAC,CAAC,CAAC,EAGvB,CAAC;AAKF,eAAO,MAAM,gBAAgB,GAAI,CAAC,GAAG,GAAG,EACtC,eAAc,MAAM,CAAC,GAAG,MAA6C,EACrE,eAAc,MAAM,CAAC,GAAG,MAA6C,KACpE,kBAAkB,CAAC,CAAC,CAAC,EAGvB,CAAC"}

package/dist/helpers/user-owner.helper.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.agentAuditAccess = exports.userAuditAccess = exports.unowned = exports.nullFields = exports.allOf = exports.matchReq = exports.matchIam = exports.byReq = exports.byIam = void 0;
+const byIam = (field, iamPath, cast) => ({
+    all: [
+        {
+            field,
+            valueFrom: `iam.${iamPath}`,
+            cast,
+        },
+    ],
+});
+exports.byIam = byIam;
+const byReq = (field, reqPath, cast) => ({
+    all: [
+        {
+            field,
+            valueFrom: `req.${reqPath}`,
+            cast,
+        },
+    ],
+});
+exports.byReq = byReq;
+const matchIam = (field, iamPath, cast) => ({
+    field,
+    valueFrom: `iam.${iamPath}`,
+    cast,
+});
+exports.matchIam = matchIam;
+const matchReq = (field, reqPath, cast) => ({
+    field,
+    valueFrom: `req.${reqPath}`,
+    cast,
+});
+exports.matchReq = matchReq;
+const allOf = (...matches) => ({
+    all: matches,
+});
+exports.allOf = allOf;
+const nullFields = (...fields) => ({
+    nullFields: fields,
+});
+exports.nullFields = nullFields;
+exports.unowned = exports.nullFields;
+const userAuditAccess = (createdField = 'createdByUser', updatedField = 'updatedByUser') => [
+    (0, exports.byIam)(createdField, 'userId', 'string'),
+    (0, exports.byIam)(updatedField, 'userId', 'string'),
+];
+exports.userAuditAccess = userAuditAccess;
+const agentAuditAccess = (createdField = 'createdByAdmin', updatedField = 'updatedByAdmin') => [
+    (0, exports.byIam)(createdField, 'agentId', 'string'),
+    (0, exports.byIam)(updatedField, 'agentId', 'string'),
+];
+exports.agentAuditAccess = agentAuditAccess;
+//# sourceMappingURL=user-owner.helper.js.map

package/dist/helpers/user-owner.helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-owner.helper.js","sourceRoot":"","sources":["../../src/helpers/user-owner.helper.ts"],"names":[],"mappings":";;;AASO,MAAM,KAAK,GAAG,CACnB,KAAuB,EACvB,OAAe,EACf,IAAsB,EACC,EAAE,CAAC,CAAC;IAC3B,GAAG,EAAE;QACH;YACE,KAAK;YACL,SAAS,EAAE,OAAO,OAAO,EAAqB;YAC9C,IAAI;SACL;KACF;CACF,CAAC,CAAC;AAZU,QAAA,KAAK,SAYf;AAKI,MAAM,KAAK,GAAG,CACnB,KAAuB,EACvB,OAAe,EACf,IAAsB,EACC,EAAE,CAAC,CAAC;IAC3B,GAAG,EAAE;QACH;YACE,KAAK;YACL,SAAS,EAAE,OAAO,OAAO,EAAqB;YAC9C,IAAI;SACL;KACF;CACF,CAAC,CAAC;AAZU,QAAA,KAAK,SAYf;AAKI,MAAM,QAAQ,GAAG,CACtB,KAAuB,EACvB,OAAe,EACf,IAAsB,EACD,EAAE,CAAC,CAAC;IACzB,KAAK;IACL,SAAS,EAAE,OAAO,OAAO,EAAqB;IAC9C,IAAI;CACL,CAAC,CAAC;AARU,QAAA,QAAQ,YAQlB;AAEI,MAAM,QAAQ,GAAG,CACtB,KAAuB,EACvB,OAAe,EACf,IAAsB,EACD,EAAE,CAAC,CAAC;IACzB,KAAK;IACL,SAAS,EAAE,OAAO,OAAO,EAAqB;IAC9C,IAAI;CACL,CAAC,CAAC;AARU,QAAA,QAAQ,YAQlB;AAEI,MAAM,KAAK,GAAG,CACnB,GAAG,OAA8B,EACV,EAAE,CAAC,CAAC;IAC3B,GAAG,EAAE,OAAO;CACb,CAAC,CAAC;AAJU,QAAA,KAAK,SAIf;AAKI,MAAM,UAAU,GAAG,CACxB,GAAG,MAA4B,EACR,EAAE,CAAC,CAAC;IAC3B,UAAU,EAAE,MAAM;CACnB,CAAC,CAAC;AAJU,QAAA,UAAU,cAIpB;AAKU,QAAA,OAAO,GAAG,kBAAU,CAAC;AAQ3B,MAAM,eAAe,GAAG,CAC7B,eAAiC,eAAmC,EACpE,eAAiC,eAAmC,EAC3C,EAAE,CAAC;IAC5B,IAAA,aAAK,EAAI,YAAY,EAAE,QAAQ,EAAE,QAAQ,CAAC;IAC1C,IAAA,aAAK,EAAI,YAAY,EAAE,QAAQ,EAAE,QAAQ,CAAC;CAC3C,CAAC;AANW,QAAA,eAAe,mBAM1B;AAKK,MAAM,gBAAgB,GAAG,CAC9B,eAAiC,gBAAoC,EACrE,eAAiC,gBAAoC,EAC5C,EAAE,CAAC;IAC5B,IAAA,aAAK,EAAI,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC;IAC3C,IAAA,aAAK,EAAI,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC;CAC5C,CAAC;AANW,QAAA,gBAAgB,oBAM3B"}

package/dist/iam-context.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"iam-context.module.d.ts","sourceRoot":"","sources":["../src/iam-context.module.ts"],"names":[],"mappings":"AAIA,qBAQa,gBAAgB;CAAG"}
+{"version":3,"file":"iam-context.module.d.ts","sourceRoot":"","sources":["../src/iam-context.module.ts"],"names":[],"mappings":"AAKA,qBASa,gBAAgB;CAAG"}

package/dist/iam-context.module.js

@@ -10,12 +10,14 @@ exports.IamContextModule = void 0;
 const common_1 = require("@nestjs/common");
 const iam_context_guard_1 = require("./guards/iam-context.guard");
 const core_1 = require("@nestjs/core");
+const iam_entity_access_service_1 = require("./services/iam-entity-access.service");
 let IamContextModule = class IamContextModule {
 };
 exports.IamContextModule = IamContextModule;
 exports.IamContextModule = IamContextModule = __decorate([
     (0, common_1.Module)({
         providers: [
+            iam_entity_access_service_1.IamEntityAccessService,
             {
                 provide: core_1.APP_GUARD,
                 useClass: iam_context_guard_1.IamContextGuard,

package/dist/iam-context.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"iam-context.module.js","sourceRoot":"","sources":["../src/iam-context.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,kEAA6D;AAC7D,uCAAyC;AAUlC,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;CAAG,CAAA;AAAnB,4CAAgB;2BAAhB,gBAAgB;IAR5B,IAAA,eAAM,EAAC;QACN,SAAS,EAAE;YACT;gBACE,OAAO,EAAE,gBAAS;gBAClB,QAAQ,EAAE,mCAAe;aAC1B;SACF;KACF,CAAC;GACW,gBAAgB,CAAG"}
+{"version":3,"file":"iam-context.module.js","sourceRoot":"","sources":["../src/iam-context.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,kEAA6D;AAC7D,uCAAyC;AACzC,oFAA8E;AAWvE,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;CAAG,CAAA;AAAnB,4CAAgB;2BAAhB,gBAAgB;IAT5B,IAAA,eAAM,EAAC;QACN,SAAS,EAAE;YACT,kDAAsB;YACtB;gBACE,OAAO,EAAE,gBAAS;gBAClB,QAAQ,EAAE,mCAAe;aAC1B;SACF;KACF,CAAC;GACW,gBAAgB,CAAG"}

package/dist/index.d.ts

@@ -1,9 +1,13 @@
-export * from './decorators/get-owner-id.decorator';
-export * from './decorators/iam-public.decorator';
-export * from './decorators/owns-entity.decorator';
-export * from './decorators/set-iam-route-user-type.decorator';
+export * from './decorators/public-iam.decorators';
+export * from './decorators/iam-entity-access.decorator';
+export * from './decorators/allow-iam.decorator';
 export * from './enums/iam-user-type.enum';
 export * from './guards/iam-context.guard';
-export * from './pipes/iam-paginate-query.pipe';
+export * from './helpers/user-owner.helper';
+export * from './interfaces/iam-entity-access.interface';
+export * from './types/iam-entity-access.type';
+export * from './pipes/iam-paginate-query-scope.pipe';
+export * from './pipes/iam-find-one-query-scope.pipe';
+export * from './services/iam-entity-access.service';
 export * from './iam-context.module';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,qCAAqC,CAAC;AACpD,cAAc,mCAAmC,CAAC;AAClD,cAAc,oCAAoC,CAAC;AACnD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iCAAiC,CAAC;AAChD,cAAc,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,kCAAkC,CAAC;AACjD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,0CAA0C,CAAC;AACzD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,uCAAuC,CAAC;AACtD,cAAc,uCAAuC,CAAC;AACtD,cAAc,sCAAsC,CAAC;AACrD,cAAc,sBAAsB,CAAC"}

package/dist/index.js

@@ -14,12 +14,16 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./decorators/get-owner-id.decorator"), exports);
-__exportStar(require("./decorators/iam-public.decorator"), exports);
-__exportStar(require("./decorators/owns-entity.decorator"), exports);
-__exportStar(require("./decorators/set-iam-route-user-type.decorator"), exports);
+__exportStar(require("./decorators/public-iam.decorators"), exports);
+__exportStar(require("./decorators/iam-entity-access.decorator"), exports);
+__exportStar(require("./decorators/allow-iam.decorator"), exports);
 __exportStar(require("./enums/iam-user-type.enum"), exports);
 __exportStar(require("./guards/iam-context.guard"), exports);
-__exportStar(require("./pipes/iam-paginate-query.pipe"), exports);
+__exportStar(require("./helpers/user-owner.helper"), exports);
+__exportStar(require("./interfaces/iam-entity-access.interface"), exports);
+__exportStar(require("./types/iam-entity-access.type"), exports);
+__exportStar(require("./pipes/iam-paginate-query-scope.pipe"), exports);
+__exportStar(require("./pipes/iam-find-one-query-scope.pipe"), exports);
+__exportStar(require("./services/iam-entity-access.service"), exports);
 __exportStar(require("./iam-context.module"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,sEAAoD;AACpD,oEAAkD;AAClD,qEAAmD;AACnD,iFAA+D;AAC/D,6DAA2C;AAC3C,6DAA2C;AAC3C,kEAAgD;AAChD,uDAAqC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,qEAAmD;AACnD,2EAAyD;AACzD,mEAAiD;AACjD,6DAA2C;AAC3C,6DAA2C;AAC3C,8DAA4C;AAC5C,2EAAyD;AACzD,iEAA+C;AAC/C,wEAAsD;AACtD,wEAAsD;AACtD,uEAAqD;AACrD,uDAAqC"}

package/dist/interfaces/iam-entity-access.interface.d.ts

@@ -0,0 +1,38 @@
+import { IamUserTypeEnum } from '../enums/iam-user-type.enum';
+import { AccessValueCast, AccessValueSource, EntityAccessBranch } from '../types/iam-entity-access.type';
+import { EntityTarget } from 'typeorm';
+export interface IamAccessValueContext {
+    req: any;
+    iamContext: any;
+    userType: IamUserTypeEnum;
+}
+export interface EntityFieldMatch<T = any> {
+    field: keyof T & string;
+    valueFrom: AccessValueSource;
+    cast?: AccessValueCast;
+}
+export interface RoleEntityAccess<T = any> {
+    anyOf: EntityAccessBranch<T>[];
+}
+export interface EntityAccessByRole<T = any> {
+    agent?: {
+        bypass?: boolean;
+        anyOf?: EntityAccessBranch<T>[];
+    };
+    user?: RoleEntityAccess<T>;
+    guest?: RoleEntityAccess<T>;
+}
+export interface RequireIamEntityAccessOptions<T = any> {
+    entity: EntityTarget<T>;
+    lookup: {
+        field: keyof T & string;
+        valueFrom: AccessValueSource;
+    };
+    access: EntityAccessByRole<T>;
+    resourceName?: string;
+}
+export interface ApplyIamEntityScopeOptions<T = any> {
+    access: EntityAccessByRole<T>;
+    withDeleted?: boolean;
+}
+//# sourceMappingURL=iam-entity-access.interface.d.ts.map

package/dist/interfaces/iam-entity-access.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iam-entity-access.interface.d.ts","sourceRoot":"","sources":["../../src/interfaces/iam-entity-access.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,GAAG,CAAC;IACT,UAAU,EAAE,GAAG,CAAC;IAChB,QAAQ,EAAE,eAAe,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC,GAAG,GAAG;IACvC,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;IACxB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC,GAAG,GAAG;IACvC,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,kBAAkB,CAAC,CAAC,GAAG,GAAG;IACzC,KAAK,CAAC,EAAE;QAKN,MAAM,CAAC,EAAE,OAAO,CAAC;QAKjB,KAAK,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;KACjC,CAAC;IAEF,IAAI,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAE3B,KAAK,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;CAC7B;AAQD,MAAM,WAAW,6BAA6B,CAAC,CAAC,GAAG,GAAG;IACpD,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IAExB,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC;QACxB,SAAS,EAAE,iBAAiB,CAAC;KAC9B,CAAC;IAEF,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAE9B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AASD,MAAM,WAAW,0BAA0B,CAAC,CAAC,GAAG,GAAG;IACjD,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAK9B,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB"}

package/dist/interfaces/iam-entity-access.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=iam-entity-access.interface.js.map

package/dist/interfaces/iam-entity-access.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iam-entity-access.interface.js","sourceRoot":"","sources":["../../src/interfaces/iam-entity-access.interface.ts"],"names":[],"mappings":""}

package/dist/pipes/iam-find-one-query-scope.pipe.d.ts

@@ -0,0 +1,10 @@
+import { PipeTransform } from '@nestjs/common';
+import { IamEntityAccessService } from '../services/iam-entity-access.service';
+import { IamScopedFindOneQuery } from '../types/iam-entity-access.type';
+export declare class IamFindOneQueryScopePipe<T = any> implements PipeTransform<Record<string, any>, IamScopedFindOneQuery<T>> {
+    private readonly request;
+    private readonly iamEntityAccessService;
+    constructor(request: any, iamEntityAccessService: IamEntityAccessService);
+    transform(value: Record<string, any>): IamScopedFindOneQuery<T>;
+}
+//# sourceMappingURL=iam-find-one-query-scope.pipe.d.ts.map

package/dist/pipes/iam-find-one-query-scope.pipe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iam-find-one-query-scope.pipe.d.ts","sourceRoot":"","sources":["../../src/pipes/iam-find-one-query-scope.pipe.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,aAAa,EAAS,MAAM,gBAAgB,CAAC;AAI1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAE/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAQxE,qBACa,wBAAwB,CAAC,CAAC,GAAG,GAAG,CAAE,YAAW,aAAa,CACrE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACnB,qBAAqB,CAAC,CAAC,CAAC,CACzB;IAGG,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,sBAAsB;gBADtB,OAAO,EAAE,GAAG,EACZ,sBAAsB,EAAE,sBAAsB;IAGjE,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,qBAAqB,CAAC,CAAC,CAAC;CA4BhE"}

package/dist/pipes/{iam-paginate-query.pipe.js → iam-find-one-query-scope.pipe.js}

@@ -12,36 +12,34 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.IamPaginateQueryPipe = void 0;
+exports.IamFindOneQueryScopePipe = void 0;
 const common_1 = require("@nestjs/common");
 const core_1 = require("@nestjs/core");
 const nestjs_common_module_core_1 = require("@mondart/nestjs-common-module-core");
-let IamPaginateQueryPipe = class IamPaginateQueryPipe {
-    constructor(request) {
+const iam_entity_access_service_1 = require("../services/iam-entity-access.service");
+const iam_decorator_key_const_1 = require("../constants/iam-decorator-key.const");
+let IamFindOneQueryScopePipe = class IamFindOneQueryScopePipe {
+    constructor(request, iamEntityAccessService) {
         this.request = request;
+        this.iamEntityAccessService = iamEntityAccessService;
     }
-    transform(value, metadata) {
-        const iamContext = (0, nestjs_common_module_core_1.getIamContext)(this.request);
-        if (!iamContext?.isAgent && iamContext?.user) {
-            const { storeId, contactId } = iamContext.user;
-            value.filter = {
-                contactId: `$eq:${contactId}`,
-                storeId: `$eq:${storeId}`,
-            };
-        }
-        if (!iamContext?.isAgent && !iamContext?.user) {
-            value.filter = {
-                contactId: `$null`,
-            };
+    transform(value) {
+        const query = (value ?? {});
+        const scopeOptions = this.request[iam_decorator_key_const_1.IAM_REQUEST_ENTITY_SCOPE_OPTIONS_KEY];
+        if (!scopeOptions) {
+            return query;
         }
-        value.withDeleted = true;
-        return value;
+        const iamContext = (0, nestjs_common_module_core_1.getIamContext)(this.request);
+        const currentUserType = this.request[iam_decorator_key_const_1.IAM_REQUEST_USER_TYPE_KEY];
+        const scopeWhere = this.iamEntityAccessService.buildScopeWhere(scopeOptions, this.request, iamContext, currentUserType);
+        query[iam_decorator_key_const_1.IAM_QUERY_SCOPE_WHERE_KEY] = scopeWhere;
+        return query;
     }
 };
-exports.IamPaginateQueryPipe = IamPaginateQueryPipe;
-exports.IamPaginateQueryPipe = IamPaginateQueryPipe = __decorate([
-    (0, common_1.Injectable)(),
+exports.IamFindOneQueryScopePipe = IamFindOneQueryScopePipe;
+exports.IamFindOneQueryScopePipe = IamFindOneQueryScopePipe = __decorate([
+    (0, common_1.Injectable)({ scope: common_1.Scope.REQUEST }),
     __param(0, (0, common_1.Inject)(core_1.REQUEST)),
-    __metadata("design:paramtypes", [Request])
-], IamPaginateQueryPipe);
-//# sourceMappingURL=iam-paginate-query.pipe.js.map
+    __metadata("design:paramtypes", [Object, iam_entity_access_service_1.IamEntityAccessService])
+], IamFindOneQueryScopePipe);
+//# sourceMappingURL=iam-find-one-query-scope.pipe.js.map

package/dist/pipes/iam-find-one-query-scope.pipe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iam-find-one-query-scope.pipe.js","sourceRoot":"","sources":["../../src/pipes/iam-find-one-query-scope.pipe.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA0E;AAC1E,uCAAuC;AACvC,kFAAmE;AAEnE,qFAA+E;AAG/E,kFAI8C;AAIvC,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IAInC,YAEmB,OAAY,EACZ,sBAA8C;QAD9C,YAAO,GAAP,OAAO,CAAK;QACZ,2BAAsB,GAAtB,sBAAsB,CAAwB;IAC9D,CAAC;IAEJ,SAAS,CAAC,KAA0B;QAClC,MAAM,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE,CAA6B,CAAC;QAExD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,8DAAoC,CAEzD,CAAC;QAEd,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,UAAU,GAAG,IAAA,yCAAa,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE/C,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAClC,mDAAyB,CACP,CAAC;QAErB,MAAM,UAAU,GAAG,IAAI,CAAC,sBAAsB,CAAC,eAAe,CAC5D,YAAY,EACZ,IAAI,CAAC,OAAO,EACZ,UAAU,EACV,eAAe,CAChB,CAAC;QAEF,KAAK,CAAC,mDAAyB,CAAC,GAAG,UAAU,CAAC;QAE9C,OAAO,KAAK,CAAC;IACf,CAAC;CACF,CAAA;AAtCY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,EAAC,EAAE,KAAK,EAAE,cAAK,CAAC,OAAO,EAAE,CAAC;IAMhC,WAAA,IAAA,eAAM,EAAC,cAAO,CAAC,CAAA;6CAEyB,kDAAsB;GAPtD,wBAAwB,CAsCpC"}

package/dist/pipes/iam-paginate-query-scope.pipe.d.ts

@@ -0,0 +1,11 @@
+import { PipeTransform } from '@nestjs/common';
+import { PaginateQuery } from 'nestjs-paginate';
+import { IamEntityAccessService } from '../services/iam-entity-access.service';
+import { IamScopedPaginateQuery } from '../types/iam-entity-access.type';
+export declare class IamPaginateQueryScopePipe<T = any> implements PipeTransform<PaginateQuery, IamScopedPaginateQuery<T>> {
+    private readonly request;
+    private readonly iamEntityAccessService;
+    constructor(request: any, iamEntityAccessService: IamEntityAccessService);
+    transform(value: PaginateQuery): IamScopedPaginateQuery<T>;
+}
+//# sourceMappingURL=iam-paginate-query-scope.pipe.d.ts.map

package/dist/pipes/iam-paginate-query-scope.pipe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iam-paginate-query-scope.pipe.d.ts","sourceRoot":"","sources":["../../src/pipes/iam-paginate-query-scope.pipe.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,aAAa,EAAS,MAAM,gBAAgB,CAAC;AAE1E,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAGhD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAE/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAQzE,qBACa,yBAAyB,CAAC,CAAC,GAAG,GAAG,CAAE,YAAW,aAAa,CACtE,aAAa,EACb,sBAAsB,CAAC,CAAC,CAAC,CAC1B;IAGG,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,sBAAsB;gBADtB,OAAO,EAAE,GAAG,EACZ,sBAAsB,EAAE,sBAAsB;IAGjE,SAAS,CAAC,KAAK,EAAE,aAAa,GAAG,sBAAsB,CAAC,CAAC,CAAC;CA+B3D"}