@open-kingdom/shared-backend-util-rbac 0.0.2-18 → 0.0.2-19

package/README.md

@@ -19,6 +19,24 @@ providers: [
 ];
 ```
 
+### External identity (embedded hosts)
+
+The identity contract every OpenKingdom controller relies on is just
+`req.user: { id: number; email?: string }` (`AuthenticatedUser` / `AuthenticatedRequest`,
+exported here). Hosts with their own auth perimeter register NO OpenKingdom guards and stamp
+that shape from their own middleware:
+
+```typescript
+app.use((req, res, next) => {
+  req.user = { id: localUserId, email }; // verified by the host's own auth
+  next();
+});
+```
+
+`@RequirePermission` decorators are inert without `PermissionGuard`. A host that wants the
+guard's RBAC enforcement keeps it and binds `ROLE_RESOLVER` to its own `RoleResolver`
+implementation instead of `UserRolesService`.
+
 ## Usage
 
 ```typescript

package/dist/index.d.ts

@@ -3,4 +3,5 @@ export { Public, IS_PUBLIC_KEY } from './lib/decorators/public.decorator.js';
 export { PermissionGuard } from './lib/guards/permission.guard.js';
 export { ROLE_RESOLVER } from './lib/role-resolver.js';
 export type { RoleResolver } from './lib/role-resolver.js';
+export type { AuthenticatedUser, AuthenticatedRequest, } from './lib/authenticated-request.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,kDAAkD,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,YAAY,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,YAAY,EACV,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,gCAAgC,CAAC"}

package/dist/lib/authenticated-request.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The canonical identity contract between hosts and OpenKingdom backend
+ * packages.
+ *
+ * Every OpenKingdom controller that needs the caller reads `req.user.id`
+ * (record ownership) — nothing more. In the standard stack, `JwtAuthGuard`
+ * populates `req.user` and `PermissionGuard` decorates it with
+ * `role`/`permissions`. In EMBEDDED mode, the host registers neither guard and
+ * instead stamps this shape from its own auth middleware:
+ *
+ * ```ts
+ * app.use((req, res, next) => {
+ *   req.user = { id: localUserId, email };  // resolved by the host's perimeter
+ *   next();
+ * });
+ * ```
+ *
+ * Hosts that keep `PermissionGuard` supply their own `ROLE_RESOLVER` instead.
+ */
+export interface AuthenticatedUser {
+    id: number;
+    email?: string;
+    role?: string | null;
+    permissions?: string[];
+}
+export interface AuthenticatedRequest {
+    user?: AuthenticatedUser;
+}
+//# sourceMappingURL=authenticated-request.d.ts.map

package/dist/lib/authenticated-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticated-request.d.ts","sourceRoot":"","sources":["../../src/lib/authenticated-request.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,iBAAiB,CAAC;CAC1B"}

package/dist/lib/authenticated-request.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-kingdom/shared-backend-util-rbac",
-  "version": "0.0.2-18",
+  "version": "0.0.2-19",
   "publishConfig": {
     "access": "public"
   },