@nextage/era-lib 1.0.218 → 1.0.219

package/build/utils/auth-directive.d.ts

@@ -0,0 +1,38 @@
+/*********************************************************************************************
+ *                                                                                           *
+ * The `@auth` directives of ERA - the framework directive, fed with the EFFECTIVE roles.     *
+ *                                                                                           *
+ * The framework directive checks `user.hasRole(requires)`, that is `roles[]`: the roles of   *
+ * the organization the user BELONGS to. On an organization reached through a grant those    *
+ * are the wrong roles. These directives keep the framework's check - authenticated, active,  *
+ * one of the required roles - and hand it the roles that actually hold, computed by the      *
+ * single rule in `scope.ts` (`effectiveRoles`).                                              *
+ *                                                                                           *
+ * Two of them, because the two kinds of service ask two different questions:                *
+ *                                                                                           *
+ *   tenantAuthDirective     - a request that works inside ONE organization, the selected one *
+ *                             or the user's own (app-srv): the roles there decide.           *
+ *   reachableAuthDirective  - a request whose operations NAME their organization in the     *
+ *                             arguments (auth-srv): the directive cannot know it, so it only *
+ *                             asks whether the role holds SOMEWHERE, and the operation       *
+ *                             decides on its own organization with `assertOrgRole`.          *
+ *                                                                                           *
+ *********************************************************************************************/
+/**
+ * `@auth` for a service whose requests work inside one organization: the roles that hold there.
+ */
+export declare const tenantAuthDirective: {
+    name: string;
+    typeDefs: string;
+    transformer: (schema: import("graphql").GraphQLSchema) => import("graphql").GraphQLSchema;
+};
+/**
+ * `@auth` for a service whose operations name their organization: the roles that hold on at
+ * least one reachable organization. The operation must still decide on its own organization.
+ */
+export declare const reachableAuthDirective: {
+    name: string;
+    typeDefs: string;
+    transformer: (schema: import("graphql").GraphQLSchema) => import("graphql").GraphQLSchema;
+};
+//# sourceMappingURL=auth-directive.d.ts.map

package/build/utils/auth-directive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-directive.d.ts","sourceRoot":"","sources":["../../src/utils/auth-directive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;+FAmB+F;AA2B/F;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;CAE/B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;CAElC,CAAC"}

package/build/utils/auth-directive.js

@@ -0,0 +1,54 @@
+"use strict";
+/*********************************************************************************************
+ *                                                                                           *
+ * The `@auth` directives of ERA - the framework directive, fed with the EFFECTIVE roles.     *
+ *                                                                                           *
+ * The framework directive checks `user.hasRole(requires)`, that is `roles[]`: the roles of   *
+ * the organization the user BELONGS to. On an organization reached through a grant those    *
+ * are the wrong roles. These directives keep the framework's check - authenticated, active,  *
+ * one of the required roles - and hand it the roles that actually hold, computed by the      *
+ * single rule in `scope.ts` (`effectiveRoles`).                                              *
+ *                                                                                           *
+ * Two of them, because the two kinds of service ask two different questions:                *
+ *                                                                                           *
+ *   tenantAuthDirective     - a request that works inside ONE organization, the selected one *
+ *                             or the user's own (app-srv): the roles there decide.           *
+ *   reachableAuthDirective  - a request whose operations NAME their organization in the     *
+ *                             arguments (auth-srv): the directive cannot know it, so it only *
+ *                             asks whether the role holds SOMEWHERE, and the operation       *
+ *                             decides on its own organization with `assertOrgRole`.          *
+ *                                                                                           *
+ *********************************************************************************************/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.reachableAuthDirective = exports.tenantAuthDirective = void 0;
+const nx_frame_be_1 = require("@nextage/nx-frame-be");
+const scope_1 = require("./scope");
+const tenant_1 = require("./tenant");
+/**
+ * A stand-in of the request user that answers `hasRole` with the given roles.
+ *
+ * The directive reads `id`, `active` and `hasRole` and nothing else; the user itself is left
+ * untouched, so every later check still sees its memberships, grants and roles.
+ *
+ * @param user  the authenticated user
+ * @param roles the roles that hold for this check
+ * @returns the user as the directive must see it
+ */
+function withRoles(user, roles) {
+    return {
+        id: user.id,
+        active: user.active,
+        roles,
+        hasRole: (role) => (Array.isArray(role) ? role : [role]).some(r => roles.includes(r))
+    };
+}
+/**
+ * `@auth` for a service whose requests work inside one organization: the roles that hold there.
+ */
+exports.tenantAuthDirective = (0, nx_frame_be_1.createAuthDirective)('auth', (context) => context.user ? withRoles(context.user, (0, tenant_1.tenantRoles)(context)) : null);
+/**
+ * `@auth` for a service whose operations name their organization: the roles that hold on at
+ * least one reachable organization. The operation must still decide on its own organization.
+ */
+exports.reachableAuthDirective = (0, nx_frame_be_1.createAuthDirective)('auth', (context) => context.user ? withRoles(context.user, (0, scope_1.reachableRoles)(context.user)) : null);
+//# sourceMappingURL=auth-directive.js.map

package/build/utils/auth-directive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-directive.js","sourceRoot":"","sources":["../../src/utils/auth-directive.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;+FAmB+F;;;AAE/F,sDAAgF;AAEhF,mCAAmE;AACnE,qCAAoE;AAEpE;;;;;;;;;GASG;AACH,SAAS,SAAS,CAAC,IAAc,EAAE,KAAe;IAEhD,OAAO;QACL,EAAE,EAAO,IAAI,CAAC,EAAE;QAChB,MAAM,EAAG,IAAI,CAAC,MAAM;QACpB,KAAK;QACL,OAAO,EAAE,CAAC,IAAuB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;KAC7F,CAAC;AAChB,CAAC;AAED;;GAEG;AACU,QAAA,mBAAmB,GAAG,IAAA,iCAAmB,EAAC,MAAM,EAAE,CAAC,OAAkB,EAAE,EAAE,CACpF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,IAAA,oBAAW,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACpE,CAAC;AAEF;;;GAGG;AACU,QAAA,sBAAsB,GAAG,IAAA,iCAAmB,EAAC,MAAM,EAAE,CAAC,OAAkB,EAAE,EAAE,CACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,IAAA,sBAAc,EAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAC5E,CAAC"}

package/build/utils/express.d.ts

@@ -49,9 +49,15 @@ export declare function sendErrorResponse(res: Response, err: any): void;
  */
 export declare function allowMethods(methods?: string[], message?: string): Handler;
 /**
+ * Authorizes a REST route: an authenticated user and, when `roles` is given, the roles it needs.
  *
- * @param {*} roles
- * @param {*} condition
+ * The roles are the ones of the REQUEST (`tenantRoles`): those that hold on the organization the
+ * request operates on, as on the GraphQL side - a grant decides on the organization it grants,
+ * and the membership role never travels to another one.
+ *
+ * @param roles     the roles the route requires, when any
+ * @param condition `'&&'` for all of them, anything else for any of them
+ * @returns the Express middleware
  */
 export declare function authHandler(roles?: string[], condition?: string): (req: Request, res: Response, next: NextFunction) => void;
 //# sourceMappingURL=express.d.ts.map

package/build/utils/express.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"express.d.ts","sourceRoot":"","sources":["../../src/utils/express.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEnE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAe,mBAAmB,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAA6B,0CAA0C,CAAC;AAIpG;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,EAAE,cAAc,IAAI,KAAK,MAAM,CAAC,eAAe,CAAC,EAAE,KAAK,OAAO,4BAAQ,IAE5H,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAYxD;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAE,MAAY,EAAE,OAAO,GAAE,MAAW,QAMzF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,GAAG,IAAI,CAoB/D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,OAAO,GAAE,MAAM,EAAO,EAAE,OAAO,GAAE,MAA6B,GAAG,OAAO,CAcpG;AAoBD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,CAAC,EAAE,MAAM,IAEtD,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAiCxD"}
+{"version":3,"file":"express.d.ts","sourceRoot":"","sources":["../../src/utils/express.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEnE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAe,mBAAmB,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAA6B,0CAA0C,CAAC;AAKpG;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,CAAC,EAAE,cAAc,IAAI,KAAK,MAAM,CAAC,eAAe,CAAC,EAAE,KAAK,OAAO,4BAAQ,IAE5H,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAYxD;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAE,MAAY,EAAE,OAAO,GAAE,MAAW,QAMzF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,GAAG,IAAI,CAoB/D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,OAAO,GAAE,MAAM,EAAO,EAAE,OAAO,GAAE,MAA6B,GAAG,OAAO,CAcpG;AAoBD;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,CAAC,EAAE,MAAM,IAEtD,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAmCxD"}

package/build/utils/express.js

@@ -12,6 +12,7 @@ const http_errors_1 = __importDefault(require("http-errors"));
 const express_validator_1 = require("express-validator");
 const nx_frame_be_1 = require("@nextage/nx-frame-be");
 const constants_1 = require("../constants");
+const tenant_1 = require("./tenant");
 /**
  *
  * @param schema
@@ -114,13 +115,20 @@ function normalizeAllowedMethods(methods) {
         .map(method => method.toUpperCase());
 }
 /**
+ * Authorizes a REST route: an authenticated user and, when `roles` is given, the roles it needs.
  *
- * @param {*} roles
- * @param {*} condition
+ * The roles are the ones of the REQUEST (`tenantRoles`): those that hold on the organization the
+ * request operates on, as on the GraphQL side - a grant decides on the organization it grants,
+ * and the membership role never travels to another one.
+ *
+ * @param roles     the roles the route requires, when any
+ * @param condition `'&&'` for all of them, anything else for any of them
+ * @returns the Express middleware
  */
 function authHandler(roles, condition) {
     return (req, res, next) => {
-        const user = (0, nx_frame_be_1.getAttr)(req, 'context.user');
+        const context = (0, nx_frame_be_1.getAttr)(req, 'context');
+        const user = context?.user;
         // On rejection we terminate the chain by WRITING the response body and returning.
         // We must NOT also `next(err)`/`throw`: the framework error classes carry the
         // code in `extensions.code` (GraphQL), not `.status`, so the REST error handler
@@ -130,14 +138,15 @@ function authHandler(roles, condition) {
         if (!user)
             return sendJSONResponse(res, 401, constants_1.RES_CODE.AUTH_REQUIRED);
         if (roles) {
+            const held = (0, tenant_1.tenantRoles)(context);
             let hasRoles = true;
             switch (condition) {
                 case '&&':
-                    hasRoles = roles.every(role => user.roles.indexOf(role) >= 0);
+                    hasRoles = roles.every(role => held.includes(role));
                     break;
                 case '||':
                 default:
-                    hasRoles = roles.some(role => user.roles.indexOf(role) >= 0);
+                    hasRoles = roles.some(role => held.includes(role));
                     break;
             }
             if (!hasRoles)

package/build/utils/express.js.map

@@ -1 +1 @@
-{"version":3,"file":"express.js","sourceRoot":"","sources":["../../src/utils/express.ts"],"names":[],"mappings":";;;;;AAcA,wCAcC;AASD,4CAMC;AAqBD,8CAoBC;AAaD,oCAcC;AAyBD,kCAmCC;AA3KD,8DAAuE;AAEvE,yDAA6E;AAG7E,sDAAgF;AAChF,4CAAwE;AAExE;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,MAAiC,EAAE,iBAAiB,CAAC,GAA4B,EAAE,GAAY,EAAE,EAAE,CAAC,GAAG;IAEpI,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAEzD,IAAA,+BAAW,EAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YAExC,MAAM,MAAM,GAAG,IAAA,oCAAgB,EAAC,GAAG,CAAC,CAAC;YAErC,IAAI,MAAM,CAAC,OAAO,EAAE;gBAClB,OAAO,IAAI,EAAE,CAAC;YAEhB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAAC,GAAa,EAAE,SAAiB,GAAG,EAAE,UAAkB,EAAE;IAExF,IAAI,CAAC,GAAG;QAAE,OAAO;IAEjB,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,iBAAiB,CAAC,GAAa,EAAE,GAAQ;IAEvD,sEAAsE;IACtE,wDAAwD;IACxD,IAAI,CAAC,GAAG,EAAE,UAAU;QAClB,OAAO,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAQ,CAAC,OAAO,CAAC,CAAC;IAEtD,QAAQ,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAE5B,KAAK,GAAG;YACN,OAAO,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAQ,CAAC,SAAS,CAAC,CAAC;QAExD,KAAK,GAAG;YACN,OAAO,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAQ,CAAC,aAAa,CAAC,CAAC;QAE5D,qEAAqE;QACrE,qEAAqE;QACrE;YACE,OAAO,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAQ,CAAC,cAAc,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,YAAY,CAAC,UAAoB,EAAE,EAAE,UAAkB,oBAAoB;IAEzF,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAE3D,OAAO,CAAC,OAAgB,EAAE,QAAkB,EAAE,IAAkB,EAAE,EAAE;QAElE,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAE9D,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACvD,OAAO,IAAI,CAAC,IAAA,qBAAS,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAAA,CAAC;AAEF;;;;;;;;GAQG;AACH,SAAS,uBAAuB,CAAC,OAAiB;IAEhD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACzB,OAAO,EAAE,CAAC;IAEZ,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC;SAC5C,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,SAAgB,WAAW,CAAC,KAAgB,EAAE,SAAkB;IAE9D,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAEzD,MAAM,IAAI,GAAG,IAAA,qBAAO,EAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAE1C,kFAAkF;QAClF,8EAA8E;QAC9E,gFAAgF;QAChF,uFAAuF;QACvF,gFAAgF;QAChF,gFAAgF;QAChF,IAAI,CAAC,IAAI;YACP,OAAO,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAQ,CAAC,aAAa,CAAC,CAAC;QAE5D,IAAI,KAAK,EAAE,CAAC;YAEV,IAAI,QAAQ,GAAG,IAAI,CAAC;YAEpB,QAAO,SAAS,EAAE,CAAC;gBACjB,KAAK,IAAI;oBACP,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;oBAC9D,MAAM;gBACR,KAAK,IAAI,CAAC;gBACV;oBACE,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;oBAC7D,MAAM;YACV,CAAC;YAED,IAAI,CAAC,QAAQ;gBACX,OAAO,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAQ,CAAC,SAAS,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"express.js","sourceRoot":"","sources":["../../src/utils/express.ts"],"names":[],"mappings":";;;;;AAeA,wCAcC;AASD,4CAMC;AAqBD,8CAoBC;AAaD,oCAcC;AA+BD,kCAqCC;AApLD,8DAAuE;AAEvE,yDAA6E;AAG7E,sDAAgF;AAChF,4CAAwE;AACxE,qCAAoE;AAEpE;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,MAAiC,EAAE,iBAAiB,CAAC,GAA4B,EAAE,GAAY,EAAE,EAAE,CAAC,GAAG;IAEpI,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAEzD,IAAA,+BAAW,EAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YAExC,MAAM,MAAM,GAAG,IAAA,oCAAgB,EAAC,GAAG,CAAC,CAAC;YAErC,IAAI,MAAM,CAAC,OAAO,EAAE;gBAClB,OAAO,IAAI,EAAE,CAAC;YAEhB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAAC,GAAa,EAAE,SAAiB,GAAG,EAAE,UAAkB,EAAE;IAExF,IAAI,CAAC,GAAG;QAAE,OAAO;IAEjB,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,iBAAiB,CAAC,GAAa,EAAE,GAAQ;IAEvD,sEAAsE;IACtE,wDAAwD;IACxD,IAAI,CAAC,GAAG,EAAE,UAAU;QAClB,OAAO,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAQ,CAAC,OAAO,CAAC,CAAC;IAEtD,QAAQ,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QAE5B,KAAK,GAAG;YACN,OAAO,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAQ,CAAC,SAAS,CAAC,CAAC;QAExD,KAAK,GAAG;YACN,OAAO,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAQ,CAAC,aAAa,CAAC,CAAC;QAE5D,qEAAqE;QACrE,qEAAqE;QACrE;YACE,OAAO,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAQ,CAAC,cAAc,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,YAAY,CAAC,UAAoB,EAAE,EAAE,UAAkB,oBAAoB;IAEzF,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAE3D,OAAO,CAAC,OAAgB,EAAE,QAAkB,EAAE,IAAkB,EAAE,EAAE;QAElE,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAE9D,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACvD,OAAO,IAAI,CAAC,IAAA,qBAAS,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QACvC,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAAA,CAAC;AAEF;;;;;;;;GAQG;AACH,SAAS,uBAAuB,CAAC,OAAiB;IAEhD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACzB,OAAO,EAAE,CAAC;IAEZ,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC;SAC5C,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,WAAW,CAAC,KAAgB,EAAE,SAAkB;IAE9D,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAEzD,MAAM,OAAO,GAAG,IAAA,qBAAO,EAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACxC,MAAM,IAAI,GAAM,OAAO,EAAE,IAAI,CAAC;QAE9B,kFAAkF;QAClF,8EAA8E;QAC9E,gFAAgF;QAChF,uFAAuF;QACvF,gFAAgF;QAChF,gFAAgF;QAChF,IAAI,CAAC,IAAI;YACP,OAAO,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAQ,CAAC,aAAa,CAAC,CAAC;QAE5D,IAAI,KAAK,EAAE,CAAC;YAEV,MAAM,IAAI,GAAK,IAAA,oBAAW,EAAC,OAAO,CAAC,CAAC;YACpC,IAAI,QAAQ,GAAG,IAAI,CAAC;YAEpB,QAAO,SAAS,EAAE,CAAC;gBACjB,KAAK,IAAI;oBACP,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;oBACpD,MAAM;gBACR,KAAK,IAAI,CAAC;gBACV;oBACE,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;oBACnD,MAAM;YACV,CAAC;YAED,IAAI,CAAC,QAAQ;gBACX,OAAO,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAQ,CAAC,SAAS,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAA;AACH,CAAC"}

package/build/utils/index.d.ts

@@ -1,3 +1,4 @@
+export * from './auth-directive';
 export * from './claims';
 export * from './claims.interfaces';
 export * from './domain';

package/build/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,qBAAqB,CAAC;AACpC,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,OAAO,CAAC;AACtB,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,SAAS,CAAC;AACxB,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,UAAU,CAAC;AACzB,cAAc,qBAAqB,CAAC;AACpC,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,OAAO,CAAC;AACtB,cAAc,iBAAiB,CAAC;AAChC,cAAc,kBAAkB,CAAC;AACjC,cAAc,SAAS,CAAC;AACxB,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC"}

package/build/utils/index.js

@@ -14,6 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./auth-directive"), exports);
 __exportStar(require("./claims"), exports);
 __exportStar(require("./claims.interfaces"), exports);
 __exportStar(require("./domain"), exports);

package/build/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAyB;AACzB,sDAAoC;AACpC,2CAAyB;AACzB,4CAA0B;AAC1B,2CAAyB;AACzB,wCAAsB;AACtB,kDAAgC;AAChC,mDAAiC;AACjC,0CAAwB;AACxB,qDAAmC;AACnC,kDAAgC;AAChC,4CAA0B;AAC1B,2CAAyB;AACzB,sDAAoC;AACpC,4DAA0C"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,mDAAiC;AACjC,2CAAyB;AACzB,sDAAoC;AACpC,2CAAyB;AACzB,4CAA0B;AAC1B,2CAAyB;AACzB,wCAAsB;AACtB,kDAAgC;AAChC,mDAAiC;AACjC,0CAAwB;AACxB,qDAAmC;AACnC,kDAAgC;AAChC,4CAA0B;AAC1B,2CAAyB;AACzB,sDAAoC;AACpC,4DAA0C"}

package/build/utils/scope.d.ts

@@ -50,6 +50,69 @@ export declare function resolveOrgScope(user?: BaseUser, orgId?: string): OrgSco
  * @throws `AppError('messages.authorization.missingRole')` when out of scope
  */
 export declare function assertOrgScope(user?: BaseUser, orgId?: string): OrgScope;
+/**
+ * The roles that apply to `user` while operating on the organization `orgId`.
+ *
+ * THE single definition of the EFFECTIVE ORGANIZATION ROLE. A user holds one organization-tier
+ * role in `roles[]`, and that role belongs to the organization they are a MEMBER of; a grant
+ * carries its own role, which belongs to the granted organization alone. Reading `roles[]` on a
+ * granted organization - what every check did - handed the membership role to an organization
+ * that never conferred it: a manager granted read-only access wrote and managed, and a member
+ * granted management could not.
+ *
+ * Built on `resolveOrgScope`, so the answer follows the same tiers:
+ *
+ *   PROVIDER (cross-tenant role) -> the user's roles, unchanged: the level reaches every tenant
+ *   MEMBER of `orgId`            -> the user's roles, unchanged: the membership role is theirs
+ *   GRANTED on `orgId`           -> the roles OUTSIDE the organization tier, plus the grant's role
+ *   unreachable `orgId`          -> the roles outside the organization tier, and no other
+ *
+ * System and application roles (`ADMIN`, `APP_CONFIG`, ...) are never narrowed: they are not a
+ * role on an organization, and they follow the user everywhere.
+ *
+ * @param user  the authenticated user (`NxContext.user`)
+ * @param orgId the organization being operated on
+ * @returns the roles that hold on that organization
+ */
+export declare function effectiveRoles(user?: BaseUser, orgId?: string): string[];
+/**
+ * Whether `user` reaches the organization `orgId` AND holds one of `roles` there.
+ *
+ * The question every per-organization capability asks - "may this user do THIS on THAT
+ * organization?" - answered with the effective role, never with `roles[]`.
+ *
+ * @param user  the authenticated user (`NxContext.user`)
+ * @param orgId the organization the operation targets
+ * @param roles the roles that grant the capability (any of them is enough)
+ * @returns `true` when the organization is reachable and one of the roles holds there
+ */
+export declare function hasOrgRole(user: BaseUser | undefined, orgId: string | undefined, roles: readonly string[]): boolean;
+/**
+ * Throwing variant of `hasOrgRole`, for the call sites that must simply deny.
+ *
+ * The error is the one of `assertOrgScope`, for the same reason: an organization out of reach,
+ * one that does not exist and one where the role does not hold are not told apart.
+ *
+ * @param user  the authenticated user (`NxContext.user`)
+ * @param orgId the organization the operation targets
+ * @param roles the roles that grant the capability
+ * @returns the scope through which the user reaches the organization
+ * @throws `AppError('messages.authorization.missingRole')` when the capability does not hold
+ */
+export declare function assertOrgRole(user: BaseUser | undefined, orgId: string | undefined, roles: readonly string[]): OrgScope;
+/**
+ * Every role `user` holds on AT LEAST ONE organization they reach.
+ *
+ * For a gate that runs before the organization of the operation is known - the `@auth`
+ * directive of a service whose operations name their organization in the arguments. It is the
+ * union of the effective roles over the reachable organizations, so it answers "could this user
+ * be allowed somewhere?"; the operation itself must then decide on its own organization with
+ * `hasOrgRole`/`assertOrgRole`.
+ *
+ * @param user the authenticated user (`NxContext.user`)
+ * @returns the user's roles plus the roles of their grants
+ */
+export declare function reachableRoles(user?: BaseUser): string[];
 /**
  * Every organization the user reaches, for the LIST case.
  *

package/build/utils/scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../src/utils/scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;+FAa+F;AAE/F,OAAO,EAAY,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAM1D,OAAO,EAAE,QAAQ,EAAE,MAAgB,oBAAoB,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,eAAe,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAqBhF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,QAAQ,CAQxE;AAcD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAAC,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,EAAE,GAAG,SAAS,CAcrE"}
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../src/utils/scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;+FAa+F;AAE/F,OAAO,EAAY,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAM1D,OAAO,EAAE,QAAQ,EAAE,MAAgB,oBAAoB,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,eAAe,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAqBhF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,QAAQ,CAQxE;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,cAAc,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAWxE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,QAAQ,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAGnH;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,QAAQ,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,QAAQ,CAQvH;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,EAAE,CAOxD;AAcD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAAC,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,EAAE,GAAG,SAAS,CAcrE"}

package/build/utils/scope.js

@@ -16,6 +16,10 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveOrgScope = resolveOrgScope;
 exports.assertOrgScope = assertOrgScope;
+exports.effectiveRoles = effectiveRoles;
+exports.hasOrgRole = hasOrgRole;
+exports.assertOrgRole = assertOrgRole;
+exports.reachableRoles = reachableRoles;
 exports.reachableOrgIds = reachableOrgIds;
 const nx_frame_be_1 = require("@nextage/nx-frame-be");
 const constants_1 = require("../constants");
@@ -77,6 +81,87 @@ function assertOrgScope(user, orgId) {
         throw new nx_frame_be_1.AppError('messages.authorization.missingRole');
     return scope;
 }
+/**
+ * The roles that apply to `user` while operating on the organization `orgId`.
+ *
+ * THE single definition of the EFFECTIVE ORGANIZATION ROLE. A user holds one organization-tier
+ * role in `roles[]`, and that role belongs to the organization they are a MEMBER of; a grant
+ * carries its own role, which belongs to the granted organization alone. Reading `roles[]` on a
+ * granted organization - what every check did - handed the membership role to an organization
+ * that never conferred it: a manager granted read-only access wrote and managed, and a member
+ * granted management could not.
+ *
+ * Built on `resolveOrgScope`, so the answer follows the same tiers:
+ *
+ *   PROVIDER (cross-tenant role) -> the user's roles, unchanged: the level reaches every tenant
+ *   MEMBER of `orgId`            -> the user's roles, unchanged: the membership role is theirs
+ *   GRANTED on `orgId`           -> the roles OUTSIDE the organization tier, plus the grant's role
+ *   unreachable `orgId`          -> the roles outside the organization tier, and no other
+ *
+ * System and application roles (`ADMIN`, `APP_CONFIG`, ...) are never narrowed: they are not a
+ * role on an organization, and they follow the user everywhere.
+ *
+ * @param user  the authenticated user (`NxContext.user`)
+ * @param orgId the organization being operated on
+ * @returns the roles that hold on that organization
+ */
+function effectiveRoles(user, orgId) {
+    const roles = user?.roles ?? [];
+    const scope = resolveOrgScope(user, orgId);
+    if (scope?.tier === enums_1.OrgScopeTier.PROVIDER || scope?.tier === enums_1.OrgScopeTier.MEMBER)
+        return [...roles];
+    const outsideOrgTier = roles.filter(r => !constants_2.ORG_MEMBER_ROLES.includes(r));
+    return scope?.role ? [...outsideOrgTier, scope.role] : outsideOrgTier;
+}
+/**
+ * Whether `user` reaches the organization `orgId` AND holds one of `roles` there.
+ *
+ * The question every per-organization capability asks - "may this user do THIS on THAT
+ * organization?" - answered with the effective role, never with `roles[]`.
+ *
+ * @param user  the authenticated user (`NxContext.user`)
+ * @param orgId the organization the operation targets
+ * @param roles the roles that grant the capability (any of them is enough)
+ * @returns `true` when the organization is reachable and one of the roles holds there
+ */
+function hasOrgRole(user, orgId, roles) {
+    return !!resolveOrgScope(user, orgId) && effectiveRoles(user, orgId).some(r => roles.includes(r));
+}
+/**
+ * Throwing variant of `hasOrgRole`, for the call sites that must simply deny.
+ *
+ * The error is the one of `assertOrgScope`, for the same reason: an organization out of reach,
+ * one that does not exist and one where the role does not hold are not told apart.
+ *
+ * @param user  the authenticated user (`NxContext.user`)
+ * @param orgId the organization the operation targets
+ * @param roles the roles that grant the capability
+ * @returns the scope through which the user reaches the organization
+ * @throws `AppError('messages.authorization.missingRole')` when the capability does not hold
+ */
+function assertOrgRole(user, orgId, roles) {
+    const scope = assertOrgScope(user, orgId);
+    if (!hasOrgRole(user, orgId, roles))
+        throw new nx_frame_be_1.AppError('messages.authorization.missingRole');
+    return scope;
+}
+/**
+ * Every role `user` holds on AT LEAST ONE organization they reach.
+ *
+ * For a gate that runs before the organization of the operation is known - the `@auth`
+ * directive of a service whose operations name their organization in the arguments. It is the
+ * union of the effective roles over the reachable organizations, so it answers "could this user
+ * be allowed somewhere?"; the operation itself must then decide on its own organization with
+ * `hasOrgRole`/`assertOrgRole`.
+ *
+ * @param user the authenticated user (`NxContext.user`)
+ * @returns the user's roles plus the roles of their grants
+ */
+function reachableRoles(user) {
+    const roles = new Set(user?.roles ?? []);
+    user?.grants?.forEach(g => g.id && g.role && roles.add(g.role));
+    return [...roles];
+}
 /**
  * The highest organization-tier role the user holds, if any.
  *

package/build/utils/scope.js.map

@@ -1 +1 @@
-{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/utils/scope.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;+FAa+F;;AAiC/F,0CAqBC;AAaD,wCAQC;AAmCD,0CAcC;AA1HD,sDAA0D;AAE1D,4CAAkD;AAClD,4CAAkD;AAElD,oCAA8C;AAG9C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAgB,eAAe,CAAC,IAAe,EAAE,KAAc;IAE7D,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;QACjB,OAAO,IAAI,CAAC;IAEd,4EAA4E;IAC5E,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,8BAAkB,CAAC;QACpC,OAAO,EAAE,IAAI,EAAE,oBAAY,CAAC,QAAQ,EAAE,CAAC;IAEzC,gFAAgF;IAChF,IAAI,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC;QAC/C,OAAO,EAAE,IAAI,EAAE,oBAAY,CAAC,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;IAEnE,6DAA6D;IAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;IAErD,IAAI,KAAK;QACP,OAAO,EAAE,IAAI,EAAE,oBAAY,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;IAE1D,mCAAmC;IACnC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,cAAc,CAAC,IAAe,EAAE,KAAc;IAE5D,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAE3C,IAAI,CAAC,KAAK;QACR,MAAM,IAAI,sBAAQ,CAAC,oCAAoC,CAAC,CAAC;IAE3D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,IAAc;IAEpC,OAAO,4BAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAgB,eAAe,CAAC,IAAe;IAE7C,IAAI,CAAC,IAAI;QACP,OAAO,EAAE,CAAC;IAEZ,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,8BAAkB,CAAC;QACpC,OAAO,SAAS,CAAC;IAEnB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAE9B,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAEzD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC"}
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/utils/scope.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;+FAa+F;;AAiC/F,0CAqBC;AAaD,wCAQC;AA0BD,wCAWC;AAaD,gCAGC;AAcD,sCAQC;AAcD,wCAOC;AAmCD,0CAcC;AA1ND,sDAA0D;AAE1D,4CAAkD;AAClD,4CAAkD;AAElD,oCAA8C;AAG9C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAgB,eAAe,CAAC,IAAe,EAAE,KAAc;IAE7D,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;QACjB,OAAO,IAAI,CAAC;IAEd,4EAA4E;IAC5E,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,8BAAkB,CAAC;QACpC,OAAO,EAAE,IAAI,EAAE,oBAAY,CAAC,QAAQ,EAAE,CAAC;IAEzC,gFAAgF;IAChF,IAAI,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC;QAC/C,OAAO,EAAE,IAAI,EAAE,oBAAY,CAAC,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;IAEnE,6DAA6D;IAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;IAErD,IAAI,KAAK;QACP,OAAO,EAAE,IAAI,EAAE,oBAAY,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;IAE1D,mCAAmC;IACnC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,cAAc,CAAC,IAAe,EAAE,KAAc;IAE5D,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAE3C,IAAI,CAAC,KAAK;QACR,MAAM,IAAI,sBAAQ,CAAC,oCAAoC,CAAC,CAAC;IAE3D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAgB,cAAc,CAAC,IAAe,EAAE,KAAc;IAE5D,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAE3C,IAAI,KAAK,EAAE,IAAI,KAAK,oBAAY,CAAC,QAAQ,IAAI,KAAK,EAAE,IAAI,KAAK,oBAAY,CAAC,MAAM;QAC9E,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IAEpB,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAE,4BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAEtF,OAAO,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;AACxE,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,UAAU,CAAC,IAA0B,EAAE,KAAyB,EAAE,KAAwB;IAExG,OAAO,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACpG,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,aAAa,CAAC,IAA0B,EAAE,KAAyB,EAAE,KAAwB;IAE3G,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAE1C,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC;QACjC,MAAM,IAAI,sBAAQ,CAAC,oCAAoC,CAAC,CAAC;IAE3D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,cAAc,CAAC,IAAe;IAE5C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IAEjD,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAEhE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,IAAc;IAEpC,OAAO,4BAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAgB,eAAe,CAAC,IAAe;IAE7C,IAAI,CAAC,IAAI;QACP,OAAO,EAAE,CAAC;IAEZ,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,8BAAkB,CAAC;QACpC,OAAO,SAAS,CAAC;IAEnB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAE9B,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAEzD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC"}

package/build/utils/tenancy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenancy.d.ts","sourceRoot":"","sources":["../../src/utils/tenancy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;+FAyB+F;AAI/F,OAAO,EAAe,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAOpE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAE7C;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,EAAE,eAgFxB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,IAAI,CAGlC"}
+{"version":3,"file":"tenancy.d.ts","sourceRoot":"","sources":["../../src/utils/tenancy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;+FAyB+F;AAI/F,OAAO,EAAe,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAOpE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAE7C;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,EAAE,eAiFxB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,WAAW,IAAI,IAAI,CAGlC"}

package/build/utils/tenancy.js

@@ -98,8 +98,9 @@ exports.eraTenancy = {
                 return exports.SHARED_TENANT_ID;
             }
             // Writing a tenant's own addition is CONFIGURING the organization, not entering data
-            // into it: `ORG_EDITOR` and `ORG_MEMBER` use the catalogue, they do not shape it.
-            if (!context.user?.hasRole?.(constants_2.TENANT_CONFIG_WRITE_ROLES))
+            // into it: `ORG_EDITOR` and `ORG_MEMBER` use the catalogue, they do not shape it. The
+            // role is the one of the REQUEST's organization, so a grant decides on what it grants.
+            if (!(0, tenant_1.hasTenantRole)(context, constants_2.TENANT_CONFIG_WRITE_ROLES))
                 throw new nx_frame_be_3.AppError('messages.authorization.accessDenied');
         }
         return (0, tenant_1.resolveTenant)(context.user, context.orgId);
@@ -113,7 +114,7 @@ exports.eraTenancy = {
     canWrite(mode, current, context) {
         if (current === exports.SHARED_TENANT_ID)
             return !!context.user?.hasRole?.(constants_1.SYSTEM_ROLES);
-        if (mode === nx_frame_be_2.TenancyMode.shared && !context.user?.hasRole?.(constants_2.TENANT_CONFIG_WRITE_ROLES))
+        if (mode === nx_frame_be_2.TenancyMode.shared && !(0, tenant_1.hasTenantRole)(context, constants_2.TENANT_CONFIG_WRITE_ROLES))
             return false;
         return current === (0, tenant_1.resolveTenant)(context.user, context.orgId);
     }

package/build/utils/tenancy.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenancy.js","sourceRoot":"","sources":["../../src/utils/tenancy.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;+FAyB+F;;;AAwH/F,kCAGC;AAzHD,sDAAoE;AAEpE,sDAAoE;AAEpE,sDAAoE;AACpE,4CAA4D;AAC5D,4CAA4D;AAC5D,qCAAwD;AAExD;;;;;;;;;;GAUG;AACU,QAAA,gBAAgB,GAAG,YAAY,CAAC;AAE7C;;;;;;GAMG;AACU,QAAA,UAAU,GAAoB;IAEzC,KAAK,EAAE,UAAU;IAEjB;;;;;OAKG;IACH,IAAI,CAAC,IAAiB,EAAE,OAAkB;QAExC,MAAM,MAAM,GAAG,IAAA,sBAAa,EAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAE1D,OAAO,CAAC,IAAI,KAAK,yBAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,wBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACtF,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,CAAC,IAAiB,EAAE,SAAkB,EAAE,OAAkB;QAE7D,IAAI,IAAI,KAAK,yBAAW,CAAC,MAAM,EAAE,CAAC;YAEhC,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,wBAAY,CAAC,CAAC;YAEzD,IAAI,SAAS,KAAK,wBAAgB,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAEnE,IAAI,CAAC,QAAQ;oBACX,MAAM,IAAI,sBAAQ,CAAC,qCAAqC,CAAC,CAAC;gBAE5D,OAAO,wBAAgB,CAAC;YAC1B,CAAC;YAED,qFAAqF;YACrF,kFAAkF;YAClF,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,qCAAyB,CAAC;gBACrD,MAAM,IAAI,sBAAQ,CAAC,qCAAqC,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,IAAA,sBAAa,EAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,IAAiB,EAAE,OAAgB,EAAE,OAAkB;QAE9D,IAAI,OAAO,KAAK,wBAAgB;YAC9B,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,wBAAY,CAAC,CAAC;QAEjD,IAAI,IAAI,KAAK,yBAAW,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,qCAAyB,CAAC;YACpF,OAAO,KAAK,CAAC;QAEf,OAAO,OAAO,KAAK,IAAA,sBAAa,EAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC;CACF,CAAC;AAEF;;;;;;GAMG;AACH,SAAgB,WAAW;IAEzB,iBAAG,CAAC,OAAO,GAAG,kBAAU,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"tenancy.js","sourceRoot":"","sources":["../../src/utils/tenancy.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;+FAyB+F;;;AAyH/F,kCAGC;AA1HD,sDAAoE;AAEpE,sDAAoE;AAEpE,sDAAoE;AACpE,4CAA4D;AAC5D,4CAA4D;AAC5D,qCAAwD;AAExD;;;;;;;;;;GAUG;AACU,QAAA,gBAAgB,GAAG,YAAY,CAAC;AAE7C;;;;;;GAMG;AACU,QAAA,UAAU,GAAoB;IAEzC,KAAK,EAAE,UAAU;IAEjB;;;;;OAKG;IACH,IAAI,CAAC,IAAiB,EAAE,OAAkB;QAExC,MAAM,MAAM,GAAG,IAAA,sBAAa,EAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAE1D,OAAO,CAAC,IAAI,KAAK,yBAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,wBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACtF,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,CAAC,IAAiB,EAAE,SAAkB,EAAE,OAAkB;QAE7D,IAAI,IAAI,KAAK,yBAAW,CAAC,MAAM,EAAE,CAAC;YAEhC,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,wBAAY,CAAC,CAAC;YAEzD,IAAI,SAAS,KAAK,wBAAgB,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAEnE,IAAI,CAAC,QAAQ;oBACX,MAAM,IAAI,sBAAQ,CAAC,qCAAqC,CAAC,CAAC;gBAE5D,OAAO,wBAAgB,CAAC;YAC1B,CAAC;YAED,qFAAqF;YACrF,sFAAsF;YACtF,uFAAuF;YACvF,IAAI,CAAC,IAAA,sBAAa,EAAC,OAAO,EAAE,qCAAyB,CAAC;gBACpD,MAAM,IAAI,sBAAQ,CAAC,qCAAqC,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,IAAA,sBAAa,EAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,IAAiB,EAAE,OAAgB,EAAE,OAAkB;QAE9D,IAAI,OAAO,KAAK,wBAAgB;YAC9B,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,wBAAY,CAAC,CAAC;QAEjD,IAAI,IAAI,KAAK,yBAAW,CAAC,MAAM,IAAI,CAAC,IAAA,sBAAa,EAAC,OAAO,EAAE,qCAAyB,CAAC;YACnF,OAAO,KAAK,CAAC;QAEf,OAAO,OAAO,KAAK,IAAA,sBAAa,EAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC;CACF,CAAC;AAEF;;;;;;GAMG;AACH,SAAgB,WAAW;IAEzB,iBAAG,CAAC,OAAO,GAAG,kBAAU,CAAC;AAC3B,CAAC"}

package/build/utils/tenant.d.ts

@@ -45,6 +45,31 @@ import { ExistenceCheckModel, ScopedReadModel } from './tenant.interfaces';
  * @throws `AppError('messages.forbidden')` when the selection is out of reach
  */
 export declare function resolveTenant(user?: BaseUser, orgId?: string): string;
+/**
+ * The roles that apply to a request, on the organization it operates on.
+ *
+ * A request works inside ONE organization: the one it selected, or the user's own when it
+ * selected none - the rule of `resolveTenant`. Its roles are the effective roles there
+ * (`effectiveRoles`), so on an organization reached through a grant the grant's role decides,
+ * and nowhere does the membership role travel to an organization that did not confer it.
+ *
+ * It does NOT throw where `resolveTenant` does: an unreachable selection simply holds no
+ * organization role here, so a role check fails closed, and the scoping refuses the selection
+ * itself the moment a query runs. A user without any organization has nothing to narrow and
+ * keeps their roles.
+ *
+ * @param context the request context (authenticated user + selected organization)
+ * @returns the roles that hold on the organization of the request
+ */
+export declare function tenantRoles(context?: NxContext): string[];
+/**
+ * Whether one of `roles` holds for the request, on the organization it operates on.
+ *
+ * @param context the request context
+ * @param roles   the roles that grant the capability (any of them is enough)
+ * @returns `true` when one of them is among the roles of the request
+ */
+export declare function hasTenantRole(context: NxContext, roles: readonly string[]): boolean;
 /**
  * Forces `tenantId` on a payload or on a query filter, from the resolved organization.
  *

package/build/utils/tenant.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../../src/utils/tenant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;+FAS+F;AAE/F,OAAO,EAAY,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAI/E,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAS,qBAAqB,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,aAAa,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAkBrE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,GAAE,SAAc,GAAG,IAAI,CAGvE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAMjD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,GAAE,SAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAMpH;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,mBAAmB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CASpG;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,mBAAmB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIvG"}
+{"version":3,"file":"tenant.d.ts","sourceRoot":"","sources":["../../src/utils/tenant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;+FAS+F;AAE/F,OAAO,EAAY,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAI/E,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAS,qBAAqB,CAAC;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,aAAa,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAkBrE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,WAAW,CAAC,OAAO,GAAE,SAAc,GAAG,MAAM,EAAE,CAM7D;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAGnF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,GAAE,SAAc,GAAG,IAAI,CAGvE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAMjD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,GAAE,SAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAMpH;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,mBAAmB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CASpG;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,mBAAmB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIvG"}

package/build/utils/tenant.js

@@ -11,6 +11,8 @@
  *********************************************************************************************/
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveTenant = resolveTenant;
+exports.tenantRoles = tenantRoles;
+exports.hasTenantRole = hasTenantRole;
 exports.setTenant = setTenant;
 exports.getTenant = getTenant;
 exports.assertTenantScope = assertTenantScope;
@@ -67,6 +69,37 @@ function resolveTenant(user, orgId) {
         throw new nx_frame_be_1.AppError('messages.authorization.accessDenied');
     return orgId;
 }
+/**
+ * The roles that apply to a request, on the organization it operates on.
+ *
+ * A request works inside ONE organization: the one it selected, or the user's own when it
+ * selected none - the rule of `resolveTenant`. Its roles are the effective roles there
+ * (`effectiveRoles`), so on an organization reached through a grant the grant's role decides,
+ * and nowhere does the membership role travel to an organization that did not confer it.
+ *
+ * It does NOT throw where `resolveTenant` does: an unreachable selection simply holds no
+ * organization role here, so a role check fails closed, and the scoping refuses the selection
+ * itself the moment a query runs. A user without any organization has nothing to narrow and
+ * keeps their roles.
+ *
+ * @param context the request context (authenticated user + selected organization)
+ * @returns the roles that hold on the organization of the request
+ */
+function tenantRoles(context = {}) {
+    const user = context.user;
+    const orgId = context.orgId || (user?.organizations?.[0]?.id ? String(user.organizations[0].id) : undefined);
+    return orgId ? (0, scope_1.effectiveRoles)(user, orgId) : [...(user?.roles ?? [])];
+}
+/**
+ * Whether one of `roles` holds for the request, on the organization it operates on.
+ *
+ * @param context the request context
+ * @param roles   the roles that grant the capability (any of them is enough)
+ * @returns `true` when one of them is among the roles of the request
+ */
+function hasTenantRole(context, roles) {
+    return tenantRoles(context).some(r => roles.includes(r));
+}
 /**
  * Forces `tenantId` on a payload or on a query filter, from the resolved organization.
  *

package/build/utils/tenant.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.js","sourceRoot":"","sources":["../../src/utils/tenant.ts"],"names":[],"mappings":";AAAA;;;;;;;;;+FAS+F;;AA0C/F,sCAkBC;AAqBD,8BAGC;AAaD,8BAMC;AAqCD,8CAMC;AAqDD,8CASC;AAkBD,0DAIC;AApOD,sDAA+E;AAC/E,oFAA6G;AAE7G,mCAAkE;AAGlE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,SAAgB,aAAa,CAAC,IAAe,EAAE,KAAc;IAE3D,IAAI,CAAC,KAAK;QACR,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IAEzB,MAAM,SAAS,GAAG,IAAA,uBAAe,EAAC,IAAI,CAAC,CAAC;IAExC,sEAAsE;IACtE,IAAI,CAAC,SAAS;QACZ,OAAO,KAAK,CAAC;IAEf,2EAA2E;IAC3E,8EAA8E;IAC9E,uEAAuE;IACvE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC5B,MAAM,IAAI,sBAAQ,CAAC,qCAAqC,CAAC,CAAC;IAE5D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,SAAS,CAAC,IAAc,EAAE,UAAqB,EAAE;IAE/D,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,SAAS,CAAC,IAAe;IAEvC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM;QAC9B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAE1D,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACI,KAAK,UAAU,iBAAiB,CAAC,KAAsB,EAAE,EAAU,EAAE,UAAqB,EAAE;IAEjG,IAAI,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC;QAC/B,MAAM,IAAI,sBAAQ,CAAC,mBAAmB,CAAC,CAAC;IAE1C,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACI,KAAK,UAAU,iBAAiB,CAAC,KAA0B,EAAE,KAAc;IAEhF,IAAI,CAAC,KAAK;QACR,OAAO,IAAI,CAAC;IAEd,IAAI,CAAC,IAAA,6BAAe,EAAC,KAAK,CAAC;QACzB,OAAO,KAAK,CAAC;IAEf,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,IAAA,wBAAU,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACI,KAAK,UAAU,uBAAuB,CAAC,KAA0B,EAAE,KAAc;IAEtF,IAAI,CAAC,MAAM,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC;QACxC,MAAM,IAAI,sBAAQ,CAAC,qCAAqC,CAAC,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"tenant.js","sourceRoot":"","sources":["../../src/utils/tenant.ts"],"names":[],"mappings":";AAAA;;;;;;;;;+FAS+F;;AA0C/F,sCAkBC;AAkBD,kCAMC;AASD,sCAGC;AAqBD,8BAGC;AAaD,8BAMC;AAqCD,8CAMC;AAqDD,8CASC;AAkBD,0DAIC;AAxQD,sDAA+E;AAC/E,oFAA6G;AAE7G,mCAAkE;AAGlE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,SAAgB,aAAa,CAAC,IAAe,EAAE,KAAc;IAE3D,IAAI,CAAC,KAAK;QACR,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IAEzB,MAAM,SAAS,GAAG,IAAA,uBAAe,EAAC,IAAI,CAAC,CAAC;IAExC,sEAAsE;IACtE,IAAI,CAAC,SAAS;QACZ,OAAO,KAAK,CAAC;IAEf,2EAA2E;IAC3E,8EAA8E;IAC9E,uEAAuE;IACvE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC5B,MAAM,IAAI,sBAAQ,CAAC,qCAAqC,CAAC,CAAC;IAE5D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,WAAW,CAAC,UAAqB,EAAE;IAEjD,MAAM,IAAI,GAAI,OAAO,CAAC,IAAI,CAAC;IAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAE7G,OAAO,KAAK,CAAC,CAAC,CAAC,IAAA,sBAAc,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,OAAkB,EAAE,KAAwB;IAExE,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,SAAS,CAAC,IAAc,EAAE,UAAqB,EAAE;IAE/D,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,SAAS,CAAC,IAAe;IAEvC,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM;QAC9B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAE1D,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACI,KAAK,UAAU,iBAAiB,CAAC,KAAsB,EAAE,EAAU,EAAE,UAAqB,EAAE;IAEjG,IAAI,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC;QAC/B,MAAM,IAAI,sBAAQ,CAAC,mBAAmB,CAAC,CAAC;IAE1C,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACI,KAAK,UAAU,iBAAiB,CAAC,KAA0B,EAAE,KAAc;IAEhF,IAAI,CAAC,KAAK;QACR,OAAO,IAAI,CAAC;IAEd,IAAI,CAAC,IAAA,6BAAe,EAAC,KAAK,CAAC;QACzB,OAAO,KAAK,CAAC;IAEf,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,IAAA,wBAAU,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACI,KAAK,UAAU,uBAAuB,CAAC,KAA0B,EAAE,KAAc;IAEtF,IAAI,CAAC,MAAM,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC;QACxC,MAAM,IAAI,sBAAQ,CAAC,qCAAqC,CAAC,CAAC;AAC9D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextage/era-lib",
-  "version": "1.0.218",
+  "version": "1.0.219",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
   "files": [