@neohm/nh-cli 1.4.0 → 1.4.1

package/README.md

@@ -19,7 +19,7 @@ differ only where the two packages do:
 | ------------------------ | ------------------------------------------ | ----------------------------------------- |
 | Import specifier         | `@neohm/nestend`                           | `@neohm/nestendx`                         |
 | What a row belongs to    | a tenant (`tenant_id` + `TenantEntity`)    | the user who created it (`created_by`)    |
-| Access check             | `validateAccess(scope, role)`              | `validateAccess(scope)` — there are no roles |
+| Access check             | `validateRole(role)` (scope checked first) | `validateAccess(scope)` — there are no roles |
 | Generated migration      | FK + index on `tenant_id`                  | no tenant column to key                   |
 
 Everything that does not write package-specific code — `sync`, `check`, `list`,
@@ -137,7 +137,7 @@ Generated controllers run under `@UsePipes(StrictValidationPipe)`, take ids
 with `ParseUUIDPipe`, and describe every route with `@ApiOperation`.
 
 Controllers hold no business logic. They authenticate with
-`AuthService.validateAccess()`, then delegate to the module's service — so the
+`AuthService.validateRole()` (`validateAccess()` under nhx), then delegate to the module's service — so the
 same operation is reusable from a job, a subscriber or another service, and the
 HTTP surface stays readable.
 
@@ -191,14 +191,15 @@ export enum RoleEnum {
 }
 ```
 
-The controller gates each endpoint at the lowest role that should reach it — a
-senior role satisfies a junior one in nestend's scoped RBAC:
+The controller gates each endpoint at the lowest role that should reach it. A role
+carries its scope, so `validateRole()` first checks the organization holds the
+role's scope, then that the caller holds the role or a more senior one:
 
 | Endpoint | Gate |
 | --- | --- |
-| `GET :id`, `POST list` | `validateAccess(ScopeEnum.BILLING, RoleEnum.BILLING_READER)` |
-| `POST` (upsert) | `validateAccess(ScopeEnum.BILLING, RoleEnum.BILLING_MANAGER)` |
-| `DELETE :id` | `validateAccess(ScopeEnum.BILLING, RoleEnum.BILLING_ADMIN)` |
+| `GET :id`, `POST list` | `validateRole(RoleEnum.BILLING_READER)` |
+| `POST` (upsert) | `validateRole(RoleEnum.BILLING_MANAGER)` |
+| `DELETE :id` | `validateRole(RoleEnum.BILLING_ADMIN)` |
 
 Under `nhx` the gate is `validateAccess(ScopeEnum.BILLING)`. The enums name the
 identifiers only: create the `sys_scopes` row and the three `sys_roles` rows

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neohm/nh-cli",
-  "version": "1.4.0",
+  "version": "1.4.1",
   "description": "nh / nhx — Command Line Interface for neohm. NestJS projects",
   "main": "src/index.js",
   "bin": {

package/src/lib/templates.js

@@ -178,28 +178,24 @@ function controller(
     );
   }
 
-  // Tenanted access takes the entity's scope and the lowest role that should
-  // reach the endpoint (a senior role satisfies a junior one); the B2C model
-  // has no roles, so the same call carries the scope alone.
+  // Tenanted access names the lowest role that should reach the endpoint: the
+  // role carries its scope, so validateRole() checks the organization holds the
+  // scope first, then the role (a senior role satisfies a junior one). The B2C
+  // model has no roles, so the check is the scope alone.
   const tenanted = current().tenantScoped;
   imports.push(
-    `import { ${scopeEnum} } from '../../global/enums/scope.enum';`,
+    tenanted
+      ? `import { ${roleEnum} } from '../../global/enums/role.enum';`
+      : `import { ${scopeEnum} } from '../../global/enums/scope.enum';`,
   );
-  if (tenanted)
-    imports.push(`import { ${roleEnum} } from '../../global/enums/role.enum';`);
-  const scopeRef = `${scopeEnum}.${a.scopeKey}`;
   const gate = (indent, level) => {
-    if (!tenanted) {
-      const call = `await this.authService.validateAccess(${scopeRef})`;
-      return `${indent}const { user } = ${call};`.length <= 80
-        ? call
-        : `await this.authService.validateAccess(\n${indent}  ${scopeRef},\n${indent})`;
-    }
-    const roleRef = `${roleEnum}.${a.roles[level].key}`;
-    const call = `await this.authService.validateAccess(${scopeRef}, ${roleRef})`;
+    const [method, arg] = tenanted
+      ? ['validateRole', `${roleEnum}.${a.roles[level].key}`]
+      : ['validateAccess', `${scopeEnum}.${a.scopeKey}`];
+    const call = `await this.authService.${method}(${arg})`;
     return `${indent}const { user } = ${call};`.length <= 80
       ? call
-      : `await this.authService.validateAccess(\n${indent}  ${scopeRef},\n${indent}  ${roleRef},\n${indent})`;
+      : `await this.authService.${method}(\n${indent}  ${arg},\n${indent})`;
   };
 
   const methods = [