@open-rlb/nestjs-amqp 2.0.8 → 2.0.10

package/README.md

@@ -44,10 +44,10 @@ Con `--gateway=false` la factory passa a `BrokerModule` solo `{ options, topics,
 
 Monorepo NestJS (vedi `nest-cli.json`):
 
-| Progetto                 | Tipo        | Descrizione                                      |
-| ------------------------ | ----------- | ------------------------------------------------ |
-| `libs/rlb-nestjs-amqp`   | library     | La libreria vera e propria (il prodotto npm)     |
-| `apps/gateway`           | application | App di esempio/riferimento che usa la libreria   |
+| Progetto               | Tipo        | Descrizione                                    |
+| ---------------------- | ----------- | ---------------------------------------------- |
+| `libs/rlb-nestjs-amqp` | library     | La libreria vera e propria (il prodotto npm)   |
+| `apps/gateway`         | application | App di esempio/riferimento che usa la libreria |
 
 ```
 ┌─────────────────────────────────────────────────────────┐
@@ -56,7 +56,7 @@ Monorepo NestJS (vedi `nest-cli.json`):
                 │
         ┌───────▼────────┐   modules/proxy  ── Gateway
         │ HttpHandler    │   - registra route HTTP dinamiche
-        │ WebSocketSvc   │   - auth (jwt/jwks/basic/str-compare) + ACL/ruoli
+        │ WebSocketSvc   │   - auth (jwt/jwks/basic/str-compare) + ACL/azioni
         │ JwtService     │   - traduce HTTP/WS → messaggi broker
         └───────┬────────┘
                 │
@@ -80,7 +80,7 @@ Monorepo NestJS (vedi `nest-cli.json`):
 
 1. **`amqp-lib`** — driver a basso livello (`AmqpConnection`): connessione resiliente (`amqp-connection-manager`), canali gestiti, setup di exchange/queue/binding al boot, RPC con `correlationId` + *direct-reply-to*, consumer con gestione errori (`Nack` → ack/reject/requeue), graceful shutdown.
 2. **`modules/broker`** — astrazione di business: `BrokerService`, decoratori `@BrokerAction`/`@BrokerParam`, `MetadataScannerService` (auto-discovery dei metodi decorati e registrazione automatica dei consumer).
-3. **`modules/proxy`** — gateway HTTP/WebSocket: registrazione dinamica di route Express, auth pluggable, ACL/ruoli, WebSocket sicuro e scalabile, forwarding webhook.
+3. **`modules/proxy`** — gateway HTTP/WebSocket: registrazione dinamica di route Express, auth pluggable, ACL/azioni, WebSocket sicuro e scalabile, forwarding webhook.
 
 ### Flusso di una richiesta
 
@@ -126,7 +126,7 @@ import yamlConfig from './config/config.loader';
         gatewayOptions: config.get<GatewayConfig>('gateway'),
       }),
       providers: [
-        // { provide: RLB_GTW_ACL_ROLE_SERVICE, useClass: MyAclService }, // solo se usi `roles`
+        // { provide: RLB_GTW_ACL_ROLE_SERVICE, useExisting: AclService }, // solo se usi `actions`
       ],
     }),
   ],
@@ -222,12 +222,12 @@ broker:
 
 Un topic mappa un nome logico (azione/microservizio) su un percorso AMQP. Il `mode` decide la semantica.
 
-| `mode`      | Quando usarlo                          | Campi richiesti                                         | Semantica                            |
-| ----------- | -------------------------------------- | ------------------------------------------------------- | ------------------------------------ |
-| `rpc`       | request/response                       | `name`, `queue` (o `exchange`+`routingKey`)             | risposta immediata + timeout         |
-| `handle`    | worker su una coda                     | `name`, `queue`                                         | consumer di coda semplice            |
-| `broadcast` | un messaggio a molti consumer          | `name`, `exchange`, `routingKey`                        | fanout/topic; richiede `connection_name` |
-| `event`     | publish senza risposta                 | `name`, `queue` **oppure** `exchange`+`routingKey`      | fire-and-forget                      |
+| `mode`      | Quando usarlo                 | Campi richiesti                                    | Semantica                                |
+| ----------- | ----------------------------- | -------------------------------------------------- | ---------------------------------------- |
+| `rpc`       | request/response              | `name`, `queue` (o `exchange`+`routingKey`)        | risposta immediata + timeout             |
+| `handle`    | worker su una coda            | `name`, `queue`                                    | consumer di coda semplice                |
+| `broadcast` | un messaggio a molti consumer | `name`, `exchange`, `routingKey`                   | fanout/topic; richiede `connection_name` |
+| `event`     | publish senza risposta        | `name`, `queue` **oppure** `exchange`+`routingKey` | fire-and-forget                          |
 
 ```yaml
 topics:
@@ -348,14 +348,14 @@ Registra il servizio come provider in un modulo NestJS qualunque: il `MetadataSc
 
 #### Sorgenti `@BrokerParam(source, name?)`
 
-| Source      | Valore iniettato                                      |
-| ----------- | ----------------------------------------------------- |
-| `body`      | `payload[name ?? nomeParametro]`                      |
-| `body-full` | payload completo                                      |
-| `header`    | `headers[name ?? nomeParametro]`                      |
-| `tag`       | consumer tag AMQP                                     |
-| `action`    | action del messaggio                                  |
-| `topic`     | topic corrente                                        |
+| Source      | Valore iniettato                 |
+| ----------- | -------------------------------- |
+| `body`      | `payload[name ?? nomeParametro]` |
+| `body-full` | payload completo                 |
+| `header`    | `headers[name ?? nomeParametro]` |
+| `tag`       | consumer tag AMQP                |
+| `action`    | action del messaggio             |
+| `topic`     | topic corrente                   |
 
 > Se ometti `@BrokerParam` su un parametro, il default è `{ source: 'body' }` con chiave = nome del parametro.
 
@@ -363,9 +363,9 @@ Registra il servizio come provider in un modulo NestJS qualunque: il `MetadataSc
 
 Ogni `@BrokerAction` è eseguibile **sia in RPC sia in event**, senza modifiche al servizio. Cambia solo cosa attende il chiamante.
 
-| Modalità | Come si invoca                                    | Cosa si attende                                          |
-| -------- | ------------------------------------------------- | ------------------------------------------------------- |
-| `rpc`    | `broker.requestData(...)` / path `mode: rpc`      | la **risposta** del metodo (request/response)           |
+| Modalità | Come si invoca                                    | Cosa si attende                                             |
+| -------- | ------------------------------------------------- | ----------------------------------------------------------- |
+| `rpc`    | `broker.requestData(...)` / path `mode: rpc`      | la **risposta** del metodo (request/response)               |
 | `event`  | `broker.publishMessage(...)` / path `mode: event` | solo che il **broker prenda in carico** (publisher confirm) |
 
 `publishMessage` è `async` e si risolve solo al publisher confirm (rigetta su nack/errore). Sul gateway, una path `mode: event` risponde `202` **dopo** il confirm e `503` se il broker non accetta.
@@ -516,7 +516,7 @@ ws.send(JSON.stringify({ action: 'unsubscribe', topic: 'orders' }));
 ### Sicurezza e scalabilità
 
 - **Auth per evento**: `events[].auth` indica il provider che verifica il token e mappa i claim per quell'evento; `requireAuth: false` rende l'auth opzionale (anonimi ammessi, claim mappati se il token c'è). Subscribe negato (`onError: unauthorized`) se l'auth è richiesta e il token non è valido.
-- **Authz per evento**: `roles` (ACL via `IAclRoleService`) sull'identità ricavata da `auth`.
+- **auth per evento**: `roles` (ACL via `IAclRoleService`) sull'identità ricavata da `auth`.
 - **Scoping per-utente**: `scopeClaim` + `payloadKey` impediscono a un client di ricevere dati altrui tramite un `select` arbitrario (il filtro server-side è intersecato con quello del client, mai allargato). Se `scopeClaim` è impostato senza `payloadKey`, **nega tutto** (safe default).
 - **Sessione limitata dalla scadenza del token**: l'`exp` del JWT viene catturato alla prima verifica e la connessione viene chiusa (`1008 token expired`) appena scade — niente consegne dopo la scadenza.
 - **Origin allowlist**: `gateway.ws.allowedOrigins` rifiuta gli handshake cross-site (se omessa, tutte le origin sono accettate e lo si segnala a boot).
@@ -537,7 +537,7 @@ Due moduli **opzionali** per gestire ACL e configurazione gateway a database. **
 
 ### `AclModule` — ACL DB-backed con cache 2-livelli
 
-ACL (azioni → ruoli → grant per-utente) con `canUserDo` corretto e **cache RAM + L2 pluggable** (TTL diversi) e invalidazione che forza il DB.
+ACL (azioni → ruoli → grant per-utente) con un'unica primitiva `checkAction` (action-based, match **esatto** su `(companyId, resourceId)`, niente wildcard) e **cache RAM + L2 pluggable** (TTL diversi) e invalidazione che forza il DB.
 
 ```ts
 import { AclModule, AclService, AclActionRepository, AclRoleRepository, AclGrantRepository,
@@ -572,10 +572,9 @@ import { AclModule, AclService, AclActionRepository, AclRoleRepository, AclGrant
 export class AppModule {}
 ```
 
-- I handler sono esposti su `BrokerService` con topic **`rlb-acl`** (costante `ACL_TOPIC`): `acl-can-user-do` / `acl-can-user-do-gtw` (rpc), `acl-grant`/`acl-revoke`, `acl-action-*`, `acl-role-*`. Definisci nel tuo `broker.topics` un topic `rlb-acl`. (Il check ruoli del gateway è in-process via `IAclRoleService`, quindi gli auth-provider non richiedono più `aclTopic`/`aclAction`.)
-- **Due verifiche role-based** (servite dalla cache 2-tier, miss → DB → ripopola); input solo `userId` + `roles`, **niente topic/action**:
-  - `canUserDoGtw(roles, userId)` — **filtro primario del gateway** (role-based, OR): vero se l'utente ha almeno uno dei ruoli, resource-agnostico. È quello usato da `checkRoles` su `path.roles`. RPC `acl-can-user-do-gtw`.
-  - `canUserDo(roles, userId, resourceId)` — **lato microservizio**: vero se un grant **globale** (senza `resourceId`) **oppure** legato a quella risorsa dà all'utente il ruolo (`roles` accetta `string | string[]`). La risorsa è nota solo al ms, che chiama l'RPC `acl-can-user-do` con payload `{ userId, resource, roles }`.
+- I handler sono esposti su `BrokerService` con topic **`rlb-acl`** (costante `ACL_TOPIC`): `acl-check-action` (rpc), `acl-grant`/`acl-revoke`, `acl-list-resources-by-user`, `acl-action-*`, `acl-role-*`. Definisci nel tuo `broker.topics` un topic `rlb-acl`. (Il check del gateway è in-process via `IAclRoleService`, quindi gli auth-provider non richiedono più `aclTopic`/`aclAction`.)
+- **Verifica unica action-based** (servita dalla cache 2-tier, miss → DB → ripopola): `checkAction(userId, { companyId?, resourceId? }, action)` — vero se l'utente ha l'`action` (`string | string[]`, semantica OR) tramite un qualsiasi ruolo, su quella **esatta** coppia `(companyId, resourceId)`. Match: `grant.companyId === companyId && grant.resourceId === resourceId` (undefined/null/'' = assenti); unica deroga: entrambi assenti su richiesta **e** grant (grant globale). **Niente wildcard**; `companyId` è parte della decisione. Il gateway la usa in-process via `IAclRoleService.checkAction` su `path.actions`; è esposta anche come RPC `acl-check-action` (`{ userId, action, companyId?, resourceId? }`) per gli altri ms.
+- **grant/revoke sono gated**: il chiamante (header `X-GTW-AUTH-USERID`) deve avere l'azione `role-management` sulla risorsa target `(companyId, resourceId)`, altrimenti `403`. Il record grant è univoco per `(userId, companyId, resourceId)`; il primo `role-management` si fa **seed diretto a DB** (nessun bypass nella lib; azione del gate configurabile con `AclModuleOptions.roleManagementAction`).
 - **Invalidazione**: ogni mutazione (grant/role/action) svuota L1 e L2 → la prossima verifica pesca dal DB. Senza L2, la coerenza multi-istanza è limitata dal `ramTtlMs`.
 - **Cache L2 pluggable**: il consumer fornisce `{ provide: RLB_ACL_CACHE_STORE, useClass/useExisting }` che implementa `AclCacheStore` (`get/set/del/keys`). In `gateway-in-memory` è `InMemoryAclStore` (mock in RAM, nessuna dipendenza esterna); in produzione plugga uno store condiviso (es. Redis).
 
@@ -605,23 +604,23 @@ Handler su topic **`rlb-gateway-admin`** (`GATEWAY_ADMIN_TOPIC`):
 
 ## API `BrokerService`
 
-| Metodo                                                       | Uso                                              |
-| ------------------------------------------------------------ | ------------------------------------------------ |
-| `requestData(topic, action, payload?, headers?, timeout?)`   | RPC request/response (attende la risposta)       |
-| `publishMessage(topic, action, payload, headers?)` → `Promise<boolean>` | event fire-and-forget con publisher confirm |
-| `registerRpc(topic, handler)`                                | consumer RPC manuale                             |
-| `registerHandler(topic, handler)`                            | consumer `handle` / `broadcast` (ritorna void)   |
-| `getRpc(topic)` / `getHandler(topic)`                        | recupera l'handler registrato                    |
-| `events$` / `getEvents$<T>()`                                | Observable degli eventi dei topic `toObservable` |
+| Metodo                                                                  | Uso                                              |
+| ----------------------------------------------------------------------- | ------------------------------------------------ |
+| `requestData(topic, action, payload?, headers?, timeout?)`              | RPC request/response (attende la risposta)       |
+| `publishMessage(topic, action, payload, headers?)` → `Promise<boolean>` | event fire-and-forget con publisher confirm      |
+| `registerRpc(topic, handler)`                                           | consumer RPC manuale                             |
+| `registerHandler(topic, handler)`                                       | consumer `handle` / `broadcast` (ritorna void)   |
+| `getRpc(topic)` / `getHandler(topic)`                                   | recupera l'handler registrato                    |
+| `events$` / `getEvents$<T>()`                                           | Observable degli eventi dei topic `toObservable` |
 
 ### Decoratori
 
-| Decoratore                                                    | Uso                                  |
-| ------------------------------------------------------------- | ------------------------------------ |
-| `@BrokerAction(topic, action, type?)`                         | lega un metodo a topic/action        |
-| `@BrokerParam(source, name?)`                                 | mappa i parametri dai dati messaggio |
+| Decoratore                                                    | Uso                                    |
+| ------------------------------------------------------------- | -------------------------------------- |
+| `@BrokerAction(topic, action, type?)`                         | lega un metodo a topic/action          |
+| `@BrokerParam(source, name?)`                                 | mappa i parametri dai dati messaggio   |
 | `@BrokerAuth(authName, allowAnonymous?, roles?)`              | metadati di auth (usati dallo scanner) |
-| `@BrokerHTTP(method, path, dataSource?, timeout?, parseRaw?)` | metadati HTTP (usati dallo scanner)  |
+| `@BrokerHTTP(method, path, dataSource?, timeout?, parseRaw?)` | metadati HTTP (usati dallo scanner)    |
 
 ### Pipe utility
 
@@ -660,7 +659,7 @@ Questi sono i punti che causano più frequentemente bug silenziosi. **Leggili pr
 
 ### Auth / ACL
 
-14. **`roles` su una path richiede un `IAclRoleService`** registrato via `RLB_GTW_ACL_ROLE_SERVICE` in `ProxyModule.forRootAsync({ providers: [...] })`. Il check del gateway è **role-based**: `path.roles` elenca **nomi di ruolo** e l'utente passa se ne possiede **almeno uno** (`canUserDoGtw(path.roles, userId)`, filtro primario resource-agnostico). L'auth-provider deve definire `uidClaim` (per estrarre lo userId) + `headerPrefix`. La verifica fine sulla risorsa va fatta sul microservizio con `canUserDo(roles, userId, resourceId)` (RPC `acl-can-user-do`). Nota: `authOptions`/`gatewayOptions` si passano a `ProxyModule`, non a `BrokerModule`.
+14. **`actions` su una path richiede un `IAclRoleService`** registrato via `RLB_GTW_ACL_ROLE_SERVICE` in `ProxyModule.forRootAsync({ providers: [...] })`. Il check del gateway è **action-based**: `path.actions` elenca **nomi di azione** e l'utente passa se ne possiede **almeno una** sulla **esatta** coppia `(companyId, resourceId)` della richiesta (`checkAction(userId, ctx, path.actions)`). Il gateway estrae i campi canonici `companyId`/`resourceId` dalla richiesta (precedenza params→query→body) e li confronta in modo esatto. L'auth-provider deve definire `uidClaim` (per estrarre lo userId) + `headerPrefix`. Nota: `authOptions`/`gatewayOptions` si passano a `ProxyModule`, non a `BrokerModule`.
 15. **Gli header propagati sono uppercase e prefissati** (`${headerPrefix}${DEST}`): leggi `X-GTW-AUTH-USERID`, non `userId`.
 
 ### WebSocket
@@ -687,7 +686,7 @@ Questi sono i punti che causano più frequentemente bug silenziosi. **Leggili pr
 - `Queue <name> has no routing key`: l'exchange è di tipo `topic` ma il queue non ha `routingKey`.
 - `Client name is required ...`: manca `connection_name` (richiesto da broadcast e WebSocket).
 - `ACL Role Service not found`: stai usando `roles` senza aver registrato `RLB_GTW_ACL_ROLE_SERVICE`.
-- `401/403` dal gateway: controlla `auth`, `auth-providers[]`, e l'ACL service quando usi `roles`.
+- `401/403` dal gateway: controlla `auth`, `auth-providers[]`, e l'ACL service quando usi `actions`.
 - Timeout RPC: `replyQueues` errato, `action` non gestita da alcun servizio, o handler troppo lento (`timeout`).
 
 ---

package/modules/acl/auth-match.d.ts

@@ -0,0 +1,6 @@
+import { AclGrant } from './models';
+export interface AclResourceContext {
+    companyId?: string | null;
+    resourceId?: string | null;
+}
+export declare function grantMatchesResource(grant: AclGrant, ctx?: AclResourceContext): boolean;

package/modules/acl/auth-match.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.grantMatchesResource = grantMatchesResource;
+function norm(v) {
+    return v === undefined || v === null || v === '' ? null : String(v);
+}
+function grantMatchesResource(grant, ctx) {
+    return norm(grant?.companyId) === norm(ctx?.companyId) && norm(grant?.resourceId) === norm(ctx?.resourceId);
+}
+//# sourceMappingURL=auth-match.js.map

package/modules/acl/auth-match.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-match.js","sourceRoot":"","sources":["../../../libs/rlb-nestjs-amqp/src/modules/acl/auth-match.ts"],"names":[],"mappings":";;AAkBA,oDAEC;AAXD,SAAS,IAAI,CAAC,CAAU;IACtB,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC;AAOD,SAAgB,oBAAoB,CAAC,KAAe,EAAE,GAAwB;IAC5E,OAAO,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;AAC9G,CAAC"}

package/modules/acl/config/acl.config.d.ts

@@ -4,4 +4,5 @@ export interface AclCacheOptions {
 }
 export interface AclModuleOptions {
     cache?: AclCacheOptions;
+    roleManagementAction?: string;
 }

package/modules/acl/const.d.ts

@@ -1,19 +1,22 @@
 export declare const ACL_TOPIC = "rlb-acl";
 export declare const RLB_ACL_OPTIONS = "RLB_ACL_OPTIONS";
 export declare const RLB_ACL_CACHE_STORE = "RLB_ACL_CACHE_STORE";
+export declare const ACL_DEFAULT_ROLE_MANAGEMENT_ACTION = "role-management";
 export declare const ACL_ACTIONS: {
-    readonly canUserDo: "acl-can-user-do";
-    readonly canUserDoGtw: "acl-can-user-do-gtw";
+    readonly checkAction: "acl-check-action";
     readonly listResourcesByUser: "acl-list-resources-by-user";
     readonly grant: "acl-grant";
     readonly revoke: "acl-revoke";
+    readonly grantSearch: "acl-grant-search";
     readonly invalidate: "acl-invalidate";
     readonly actionUpdate: "acl-action-update";
     readonly actionDelete: "acl-action-delete";
     readonly actionList: "acl-action-list";
     readonly actionGet: "acl-action-get";
+    readonly actionSearch: "acl-action-search";
     readonly roleUpdate: "acl-role-update";
     readonly roleDelete: "acl-role-delete";
     readonly roleList: "acl-role-list";
     readonly roleGet: "acl-role-get";
+    readonly roleSearch: "acl-role-search";
 };

package/modules/acl/const.js

@@ -1,23 +1,26 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ACL_ACTIONS = exports.RLB_ACL_CACHE_STORE = exports.RLB_ACL_OPTIONS = exports.ACL_TOPIC = void 0;
+exports.ACL_ACTIONS = exports.ACL_DEFAULT_ROLE_MANAGEMENT_ACTION = exports.RLB_ACL_CACHE_STORE = exports.RLB_ACL_OPTIONS = exports.ACL_TOPIC = void 0;
 exports.ACL_TOPIC = 'rlb-acl';
 exports.RLB_ACL_OPTIONS = 'RLB_ACL_OPTIONS';
 exports.RLB_ACL_CACHE_STORE = 'RLB_ACL_CACHE_STORE';
+exports.ACL_DEFAULT_ROLE_MANAGEMENT_ACTION = 'role-management';
 exports.ACL_ACTIONS = {
-    canUserDo: 'acl-can-user-do',
-    canUserDoGtw: 'acl-can-user-do-gtw',
+    checkAction: 'acl-check-action',
     listResourcesByUser: 'acl-list-resources-by-user',
     grant: 'acl-grant',
     revoke: 'acl-revoke',
+    grantSearch: 'acl-grant-search',
     invalidate: 'acl-invalidate',
     actionUpdate: 'acl-action-update',
     actionDelete: 'acl-action-delete',
     actionList: 'acl-action-list',
     actionGet: 'acl-action-get',
+    actionSearch: 'acl-action-search',
     roleUpdate: 'acl-role-update',
     roleDelete: 'acl-role-delete',
     roleList: 'acl-role-list',
     roleGet: 'acl-role-get',
+    roleSearch: 'acl-role-search',
 };
 //# sourceMappingURL=const.js.map

package/modules/acl/const.js.map

@@ -1 +1 @@
-{"version":3,"file":"const.js","sourceRoot":"","sources":["../../../libs/rlb-nestjs-amqp/src/modules/acl/const.ts"],"names":[],"mappings":";;;AAGa,QAAA,SAAS,GAAG,SAAS,CAAC;AAEtB,QAAA,eAAe,GAAG,iBAAiB,CAAC;AAEpC,QAAA,mBAAmB,GAAG,qBAAqB,CAAC;AAG5C,QAAA,WAAW,GAAG;IAEzB,SAAS,EAAE,iBAAiB;IAE5B,YAAY,EAAE,qBAAqB;IAEnC,mBAAmB,EAAE,4BAA4B;IACjD,KAAK,EAAE,WAAW;IAClB,MAAM,EAAE,YAAY;IACpB,UAAU,EAAE,gBAAgB;IAE5B,YAAY,EAAE,mBAAmB;IACjC,YAAY,EAAE,mBAAmB;IACjC,UAAU,EAAE,iBAAiB;IAC7B,SAAS,EAAE,gBAAgB;IAC3B,UAAU,EAAE,iBAAiB;IAC7B,UAAU,EAAE,iBAAiB;IAC7B,QAAQ,EAAE,eAAe;IACzB,OAAO,EAAE,cAAc;CACf,CAAC"}
+{"version":3,"file":"const.js","sourceRoot":"","sources":["../../../libs/rlb-nestjs-amqp/src/modules/acl/const.ts"],"names":[],"mappings":";;;AAGa,QAAA,SAAS,GAAG,SAAS,CAAC;AAEtB,QAAA,eAAe,GAAG,iBAAiB,CAAC;AAEpC,QAAA,mBAAmB,GAAG,qBAAqB,CAAC;AAI5C,QAAA,kCAAkC,GAAG,iBAAiB,CAAC;AAGvD,QAAA,WAAW,GAAG;IAGzB,WAAW,EAAE,kBAAkB;IAE/B,mBAAmB,EAAE,4BAA4B;IACjD,KAAK,EAAE,WAAW;IAClB,MAAM,EAAE,YAAY;IACpB,WAAW,EAAE,kBAAkB;IAC/B,UAAU,EAAE,gBAAgB;IAE5B,YAAY,EAAE,mBAAmB;IACjC,YAAY,EAAE,mBAAmB;IACjC,UAAU,EAAE,iBAAiB;IAC7B,SAAS,EAAE,gBAAgB;IAC3B,YAAY,EAAE,mBAAmB;IACjC,UAAU,EAAE,iBAAiB;IAC7B,UAAU,EAAE,iBAAiB;IAC7B,QAAQ,EAAE,eAAe;IACzB,OAAO,EAAE,cAAc;IACvB,UAAU,EAAE,iBAAiB;CACrB,CAAC"}

package/modules/acl/index.d.ts

@@ -1,4 +1,5 @@
 export * from './acl.module';
+export * from './auth-match';
 export * from './cache/acl-cache.service';
 export * from './cache/cache-store';
 export * from './config/acl.config';

package/modules/acl/index.js

@@ -15,6 +15,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./acl.module"), exports);
+__exportStar(require("./auth-match"), exports);
 __exportStar(require("./cache/acl-cache.service"), exports);
 __exportStar(require("./cache/cache-store"), exports);
 __exportStar(require("./config/acl.config"), exports);

package/modules/acl/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../libs/rlb-nestjs-amqp/src/modules/acl/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,+CAA6B;AAC7B,4DAA0C;AAC1C,sDAAoC;AACpC,sDAAoC;AACpC,0CAAwB;AACxB,2CAAyB;AACzB,qEAAmD;AACnD,oEAAkD;AAClD,mEAAiD;AACjD,oEAAkD;AAClD,yDAAuC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../libs/rlb-nestjs-amqp/src/modules/acl/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,+CAA6B;AAC7B,+CAA6B;AAC7B,4DAA0C;AAC1C,sDAAoC;AACpC,sDAAoC;AACpC,0CAAwB;AACxB,2CAAyB;AACzB,qEAAmD;AACnD,oEAAkD;AAClD,mEAAiD;AACjD,oEAAkD;AAClD,yDAAuC"}

package/modules/acl/repository/acl-action.repository.d.ts

@@ -14,4 +14,5 @@ export declare abstract class AclActionRepository {
     abstract filterPaginated(filter: Record<string, any>, page?: number, limit?: number): Promise<PaginationModel<AclAction>>;
     abstract retrieveAll(): Promise<AclAction[]>;
     abstract retrieveAllPaginated(page: number, limit: number): Promise<PaginationModel<AclAction>>;
+    abstract search(q?: string, page?: number, limit?: number): Promise<PaginationModel<AclAction>>;
 }

package/modules/acl/repository/acl-action.repository.js.map

@@ -1 +1 @@
-{"version":3,"file":"acl-action.repository.js","sourceRoot":"","sources":["../../../../libs/rlb-nestjs-amqp/src/modules/acl/repository/acl-action.repository.ts"],"names":[],"mappings":";;;AAQA,MAAsB,mBAAmB;CAgBxC;AAhBD,kDAgBC"}
+{"version":3,"file":"acl-action.repository.js","sourceRoot":"","sources":["../../../../libs/rlb-nestjs-amqp/src/modules/acl/repository/acl-action.repository.ts"],"names":[],"mappings":";;;AAQA,MAAsB,mBAAmB;CAmBxC;AAnBD,kDAmBC"}

package/modules/acl/repository/acl-grant.repository.d.ts

@@ -11,4 +11,5 @@ export declare abstract class AclGrantRepository {
     abstract removeOne(filter: Record<string, any>): Promise<AclGrant>;
     abstract filter(filter: Record<string, any>): Promise<AclGrant[]>;
     abstract filterPaginated(filter: Record<string, any>, page?: number, limit?: number): Promise<PaginationModel<AclGrant>>;
+    abstract search(q?: string, page?: number, limit?: number): Promise<PaginationModel<AclGrant>>;
 }

package/modules/acl/repository/acl-grant.repository.js.map

@@ -1 +1 @@
-{"version":3,"file":"acl-grant.repository.js","sourceRoot":"","sources":["../../../../libs/rlb-nestjs-amqp/src/modules/acl/repository/acl-grant.repository.ts"],"names":[],"mappings":";;;AAOA,MAAsB,kBAAkB;CAYvC;AAZD,gDAYC"}
+{"version":3,"file":"acl-grant.repository.js","sourceRoot":"","sources":["../../../../libs/rlb-nestjs-amqp/src/modules/acl/repository/acl-grant.repository.ts"],"names":[],"mappings":";;;AAOA,MAAsB,kBAAkB;CAevC;AAfD,gDAeC"}

package/modules/acl/repository/acl-role.repository.d.ts

@@ -13,4 +13,5 @@ export declare abstract class AclRoleRepository {
     abstract list(): Promise<AclRole[]>;
     abstract listPaginated(page: number, limit: number): Promise<PaginationModel<AclRole>>;
     abstract getActionsByNames(names: string[]): Promise<string[]>;
+    abstract search(q?: string, page?: number, limit?: number): Promise<PaginationModel<AclRole>>;
 }

package/modules/acl/repository/acl-role.repository.js.map

@@ -1 +1 @@
-{"version":3,"file":"acl-role.repository.js","sourceRoot":"","sources":["../../../../libs/rlb-nestjs-amqp/src/modules/acl/repository/acl-role.repository.ts"],"names":[],"mappings":";;;AAQA,MAAsB,iBAAiB;CAetC;AAfD,8CAeC"}
+{"version":3,"file":"acl-role.repository.js","sourceRoot":"","sources":["../../../../libs/rlb-nestjs-amqp/src/modules/acl/repository/acl-role.repository.ts"],"names":[],"mappings":";;;AAQA,MAAsB,iBAAiB;CAkBtC;AAlBD,8CAkBC"}

package/modules/acl/services/acl-management.service.d.ts

@@ -1,18 +1,22 @@
 import { PaginationModel } from '../../../common';
 import { AclCacheService } from '../cache/acl-cache.service';
+import { AclModuleOptions } from '../config/acl.config';
 import { AclAction, AclGrant, AclRole } from '../models';
 import { AclActionRepository } from '../repository/acl-action.repository';
 import { AclGrantRepository } from '../repository/acl-grant.repository';
 import { AclRoleRepository } from '../repository/acl-role.repository';
+import { AclService } from './acl.service';
 export declare class AclManagementService {
     private readonly actions;
     private readonly roles;
     private readonly grants;
     private readonly cache;
+    private readonly acl;
     private readonly logger;
-    constructor(actions: AclActionRepository, roles: AclRoleRepository, grants: AclGrantRepository, cache: AclCacheService);
-    grant(userId: string, roles: string[], resourceId?: string, companyId?: string, friendlyName?: string): Promise<AclGrant>;
-    revoke(userId: string, roles: string[], resourceId?: string, companyId?: string): Promise<AclGrant | null>;
+    private readonly roleMgmtAction;
+    constructor(actions: AclActionRepository, roles: AclRoleRepository, grants: AclGrantRepository, cache: AclCacheService, acl: AclService, options: AclModuleOptions);
+    grant(userId: string, roles: string[], resourceId?: string, companyId?: string, friendlyName?: string, currentUser?: string): Promise<AclGrant>;
+    revoke(userId: string, roles: string[], resourceId?: string, companyId?: string, currentUser?: string): Promise<AclGrant | null>;
     private findGrant;
     upsertAction(name: string, description?: string): Promise<AclAction>;
     deleteAction(name: string): Promise<AclAction>;
@@ -22,6 +26,9 @@ export declare class AclManagementService {
     deleteRole(name: string): Promise<AclRole>;
     listRoles(page?: number, limit?: number): Promise<PaginationModel<AclRole>>;
     getRole(name: string): Promise<AclRole>;
+    searchActions(q?: string, page?: number, limit?: number): Promise<PaginationModel<AclAction>>;
+    searchRoles(q?: string, page?: number, limit?: number): Promise<PaginationModel<AclRole>>;
+    searchGrants(q?: string, page?: number, limit?: number): Promise<PaginationModel<AclGrant>>;
     getActionsByNames(names: string[]): Promise<string[]>;
     private assertActionsExist;
     private assertRolesExist;

package/modules/acl/services/acl-management.service.js

@@ -17,26 +17,33 @@ exports.AclManagementService = void 0;
 const common_1 = require("@nestjs/common");
 const common_2 = require("../../../common");
 const broker_1 = require("../../broker");
+const auth_match_1 = require("../auth-match");
 const acl_cache_service_1 = require("../cache/acl-cache.service");
 const const_1 = require("../const");
 const acl_action_repository_1 = require("../repository/acl-action.repository");
 const acl_grant_repository_1 = require("../repository/acl-grant.repository");
 const acl_role_repository_1 = require("../repository/acl-role.repository");
+const acl_service_1 = require("./acl.service");
 let AclManagementService = AclManagementService_1 = class AclManagementService {
-    constructor(actions, roles, grants, cache) {
+    constructor(actions, roles, grants, cache, acl, options) {
         this.actions = actions;
         this.roles = roles;
         this.grants = grants;
         this.cache = cache;
+        this.acl = acl;
         this.logger = new common_1.Logger(AclManagementService_1.name);
+        this.roleMgmtAction = options.roleManagementAction ?? const_1.ACL_DEFAULT_ROLE_MANAGEMENT_ACTION;
     }
-    async grant(userId, roles, resourceId, companyId, friendlyName) {
+    async grant(userId, roles, resourceId, companyId, friendlyName, currentUser) {
         if (!userId)
             throw new common_2.BadRequestError('userId is required');
         if (!roles?.length)
             throw new common_2.BadRequestError('roles are required');
+        if (!(await this.acl.checkAction(currentUser ?? '', { companyId, resourceId }, this.roleMgmtAction))) {
+            throw new common_2.ForbiddenError(`'${this.roleMgmtAction}' is required on the target resource to grant`);
+        }
         await this.assertRolesExist(roles);
-        const existing = await this.findGrant(userId, resourceId);
+        const existing = await this.findGrant(userId, companyId, resourceId);
         let result;
         if (existing) {
             const merged = Array.from(new Set([...(existing.roles || []), ...roles]));
@@ -52,12 +59,15 @@ let AclManagementService = AclManagementService_1 = class AclManagementService {
         await this.cache.invalidate(userId);
         return result;
     }
-    async revoke(userId, roles, resourceId, companyId) {
+    async revoke(userId, roles, resourceId, companyId, currentUser) {
         if (!userId)
             throw new common_2.BadRequestError('userId is required');
         if (!roles?.length)
             throw new common_2.BadRequestError('roles are required');
-        const existing = await this.findGrant(userId, resourceId);
+        if (!(await this.acl.checkAction(currentUser ?? '', { companyId, resourceId }, this.roleMgmtAction))) {
+            throw new common_2.ForbiddenError(`'${this.roleMgmtAction}' is required on the target resource to revoke`);
+        }
+        const existing = await this.findGrant(userId, companyId, resourceId);
         if (!existing)
             return null;
         const remaining = (existing.roles || []).filter((r) => !roles.includes(r));
@@ -67,9 +77,9 @@ let AclManagementService = AclManagementService_1 = class AclManagementService {
         await this.cache.invalidate(userId);
         return result;
     }
-    async findGrant(userId, resourceId) {
+    async findGrant(userId, companyId, resourceId) {
         const all = await this.grants.filter({ userId });
-        return (all || []).find((g) => (g.resourceId ?? null) === (resourceId ?? null));
+        return (all || []).find((g) => (0, auth_match_1.grantMatchesResource)(g, { companyId, resourceId }));
     }
     async upsertAction(name, description) {
         if (!name)
@@ -120,6 +130,15 @@ let AclManagementService = AclManagementService_1 = class AclManagementService {
             throw new common_2.BadRequestError('name is required');
         return this.roles.findByName(name);
     }
+    async searchActions(q, page, limit) {
+        return this.actions.search(q, Number(page) || 1, Number(limit) || 10);
+    }
+    async searchRoles(q, page, limit) {
+        return this.roles.search(q, Number(page) || 1, Number(limit) || 10);
+    }
+    async searchGrants(q, page, limit) {
+        return this.grants.search(q, Number(page) || 1, Number(limit) || 10);
+    }
     async getActionsByNames(names) {
         return this.roles.getActionsByNames(names);
     }
@@ -144,8 +163,9 @@ __decorate([
     __param(2, (0, broker_1.BrokerParam)('body', 'resourceId')),
     __param(3, (0, broker_1.BrokerParam)('body', 'companyId')),
     __param(4, (0, broker_1.BrokerParam)('body', 'friendlyName')),
+    __param(5, (0, broker_1.BrokerParam)('header', 'X-GTW-AUTH-USERID')),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, Array, String, String, String]),
+    __metadata("design:paramtypes", [String, Array, String, String, String, String]),
     __metadata("design:returntype", Promise)
 ], AclManagementService.prototype, "grant", null);
 __decorate([
@@ -154,8 +174,9 @@ __decorate([
     __param(1, (0, broker_1.BrokerParam)('body', 'roles')),
     __param(2, (0, broker_1.BrokerParam)('body', 'resourceId')),
     __param(3, (0, broker_1.BrokerParam)('body', 'companyId')),
+    __param(4, (0, broker_1.BrokerParam)('header', 'X-GTW-AUTH-USERID')),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [String, Array, String, String]),
+    __metadata("design:paramtypes", [String, Array, String, String, String]),
     __metadata("design:returntype", Promise)
 ], AclManagementService.prototype, "revoke", null);
 __decorate([
@@ -219,11 +240,40 @@ __decorate([
     __metadata("design:paramtypes", [String]),
     __metadata("design:returntype", Promise)
 ], AclManagementService.prototype, "getRole", null);
+__decorate([
+    (0, broker_1.BrokerAction)(const_1.ACL_TOPIC, const_1.ACL_ACTIONS.actionSearch, 'rpc'),
+    __param(0, (0, broker_1.BrokerParam)('body', 'q')),
+    __param(1, (0, broker_1.BrokerParam)('body', 'page')),
+    __param(2, (0, broker_1.BrokerParam)('body', 'limit')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Number, Number]),
+    __metadata("design:returntype", Promise)
+], AclManagementService.prototype, "searchActions", null);
+__decorate([
+    (0, broker_1.BrokerAction)(const_1.ACL_TOPIC, const_1.ACL_ACTIONS.roleSearch, 'rpc'),
+    __param(0, (0, broker_1.BrokerParam)('body', 'q')),
+    __param(1, (0, broker_1.BrokerParam)('body', 'page')),
+    __param(2, (0, broker_1.BrokerParam)('body', 'limit')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Number, Number]),
+    __metadata("design:returntype", Promise)
+], AclManagementService.prototype, "searchRoles", null);
+__decorate([
+    (0, broker_1.BrokerAction)(const_1.ACL_TOPIC, const_1.ACL_ACTIONS.grantSearch, 'rpc'),
+    __param(0, (0, broker_1.BrokerParam)('body', 'q')),
+    __param(1, (0, broker_1.BrokerParam)('body', 'page')),
+    __param(2, (0, broker_1.BrokerParam)('body', 'limit')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Number, Number]),
+    __metadata("design:returntype", Promise)
+], AclManagementService.prototype, "searchGrants", null);
 exports.AclManagementService = AclManagementService = AclManagementService_1 = __decorate([
     (0, common_1.Injectable)(),
+    __param(5, (0, common_1.Inject)(const_1.RLB_ACL_OPTIONS)),
     __metadata("design:paramtypes", [acl_action_repository_1.AclActionRepository,
         acl_role_repository_1.AclRoleRepository,
         acl_grant_repository_1.AclGrantRepository,
-        acl_cache_service_1.AclCacheService])
+        acl_cache_service_1.AclCacheService,
+        acl_service_1.AclService, Object])
 ], AclManagementService);
 //# sourceMappingURL=acl-management.service.js.map

package/modules/acl/services/acl-management.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"acl-management.service.js","sourceRoot":"","sources":["../../../../libs/rlb-nestjs-amqp/src/modules/acl/services/acl-management.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,4CAAmE;AACnE,yCAAyD;AACzD,kEAA6D;AAC7D,oCAAkD;AAElD,+EAA0E;AAC1E,6EAAwE;AACxE,2EAAsE;AAG/D,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAG/B,YACmB,OAA4B,EAC5B,KAAwB,EACxB,MAA0B,EAC1B,KAAsB;QAHtB,YAAO,GAAP,OAAO,CAAqB;QAC5B,UAAK,GAAL,KAAK,CAAmB;QACxB,WAAM,GAAN,MAAM,CAAoB;QAC1B,UAAK,GAAL,KAAK,CAAiB;QANxB,WAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;IAO5D,CAAC;IAOC,AAAN,KAAK,CAAC,KAAK,CACsB,MAAc,EACf,KAAe,EACV,UAAmB,EACpB,SAAkB,EACf,YAAqB;QAE1D,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,wBAAe,CAAC,oBAAoB,CAAC,CAAC;QAC7D,IAAI,CAAC,KAAK,EAAE,MAAM;YAAE,MAAM,IAAI,wBAAe,CAAC,oBAAoB,CAAC,CAAC;QACpE,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAGnC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC1D,IAAI,MAAgB,CAAC;QACrB,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1E,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAI,EAAE;gBACnD,KAAK,EAAE,MAAM;gBACb,SAAS,EAAE,SAAS,IAAI,QAAQ,CAAC,SAAS;gBAC1C,YAAY,EAAE,YAAY,IAAI,QAAQ,CAAC,YAAY;aACpD,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;QACxH,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,MAAM,CAAC;IAChB,CAAC;IAGK,AAAN,KAAK,CAAC,MAAM,CACqB,MAAc,EACf,KAAe,EACV,UAAmB,EACpB,SAAkB;QAEpD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,wBAAe,CAAC,oBAAoB,CAAC,CAAC;QAC7D,IAAI,CAAC,KAAK,EAAE,MAAM;YAAE,MAAM,IAAI,wBAAe,CAAC,oBAAoB,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAG3B,MAAM,SAAS,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM;YAC7B,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YACnE,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAI,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,MAAM,CAAC;IAChB,CAAC;IAGO,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,UAAmB;QACzD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC;IAClF,CAAC;IAKK,AAAN,KAAK,CAAC,YAAY,CACa,IAAY,EACL,WAAoB;QAExD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,wBAAe,CAAC,kBAAkB,CAAC,CAAC;QACzD,MAAM,KAAK,GAAuB,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAClG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC;IAChB,CAAC;IAGK,AAAN,KAAK,CAAC,YAAY,CAA8B,IAAY;QAC1D,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,wBAAe,CAAC,kBAAkB,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QAC9B,OAAO,OAAO,CAAC;IACjB,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CACc,IAAa,EACZ,KAAc;QAE5C,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAClF,CAAC;IAGK,AAAN,KAAK,CAAC,SAAS,CAA8B,IAAY;QACvD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,wBAAe,CAAC,kBAAkB,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAKK,AAAN,KAAK,CAAC,UAAU,CACe,IAAY,EACT,OAAiB,EACb,WAAoB;QAExD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,wBAAe,CAAC,kBAAkB,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO,EAAE,MAAM;YAAE,MAAM,IAAI,wBAAe,CAAC,sBAAsB,CAAC,CAAC;QACxE,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,KAAK,GAAqB,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACzG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QAC3D,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC;IAChB,CAAC;IAGK,AAAN,KAAK,CAAC,UAAU,CAA8B,IAAY;QAGxD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,wBAAe,CAAC,kBAAkB,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QAC9B,OAAO,OAAO,CAAC;IACjB,CAAC;IAGK,AAAN,KAAK,CAAC,SAAS,CACgB,IAAa,EACZ,KAAc;QAE5C,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAA8B,IAAY;QACrD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,wBAAe,CAAC,kBAAkB,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAe;QACrC,OAAO,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,KAAe;QAC9C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,wBAAe,CAAC,oBAAoB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,KAAe;QAC5C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,wBAAe,CAAC,kBAAkB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;CACF,CAAA;AAlKY,oDAAoB;AAezB;IADL,IAAA,qBAAY,EAAC,iBAAS,EAAE,mBAAW,CAAC,KAAK,EAAE,KAAK,CAAC;IAE/C,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC7B,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5B,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IACjC,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAChC,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,cAAc,CAAC,CAAA;;;;iDAqBrC;AAGK;IADL,IAAA,qBAAY,EAAC,iBAAS,EAAE,mBAAW,CAAC,MAAM,EAAE,KAAK,CAAC;IAEhD,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC7B,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5B,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IACjC,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,WAAW,CAAC,CAAA;;;;kDAclC;AAWK;IADL,IAAA,qBAAY,EAAC,iBAAS,EAAE,mBAAW,CAAC,YAAY,EAAE,KAAK,CAAC;IAEtD,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC3B,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,aAAa,CAAC,CAAA;;;;wDAOpC;AAGK;IADL,IAAA,qBAAY,EAAC,iBAAS,EAAE,mBAAW,CAAC,YAAY,EAAE,KAAK,CAAC;IACrC,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,MAAM,CAAC,CAAA;;;;wDAK9C;AAGK;IADL,IAAA,qBAAY,EAAC,iBAAS,EAAE,mBAAW,CAAC,UAAU,EAAE,KAAK,CAAC;IAEpD,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC3B,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,OAAO,CAAC,CAAA;;;;uDAG9B;AAGK;IADL,IAAA,qBAAY,EAAC,iBAAS,EAAE,mBAAW,CAAC,SAAS,EAAE,KAAK,CAAC;IACrC,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,MAAM,CAAC,CAAA;;;;qDAG3C;AAKK;IADL,IAAA,qBAAY,EAAC,iBAAS,EAAE,mBAAW,CAAC,UAAU,EAAE,KAAK,CAAC;IAEpD,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC3B,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC9B,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,aAAa,CAAC,CAAA;;;;sDASpC;AAGK;IADL,IAAA,qBAAY,EAAC,iBAAS,EAAE,mBAAW,CAAC,UAAU,EAAE,KAAK,CAAC;IACrC,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,MAAM,CAAC,CAAA;;;;sDAO5C;AAGK;IADL,IAAA,qBAAY,EAAC,iBAAS,EAAE,mBAAW,CAAC,QAAQ,EAAE,KAAK,CAAC;IAElD,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC3B,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,OAAO,CAAC,CAAA;;;;qDAG9B;AAGK;IADL,IAAA,qBAAY,EAAC,iBAAS,EAAE,mBAAW,CAAC,OAAO,EAAE,KAAK,CAAC;IACrC,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,MAAM,CAAC,CAAA;;;;mDAGzC;+BAjJU,oBAAoB;IADhC,IAAA,mBAAU,GAAE;qCAKiB,2CAAmB;QACrB,uCAAiB;QAChB,yCAAkB;QACnB,mCAAe;GAP9B,oBAAoB,CAkKhC"}
+{"version":3,"file":"acl-management.service.js","sourceRoot":"","sources":["../../../../libs/rlb-nestjs-amqp/src/modules/acl/services/acl-management.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAA4D;AAC5D,4CAAmF;AACnF,yCAAyD;AACzD,8CAAqD;AACrD,kEAA6D;AAE7D,oCAAuG;AAEvG,+EAA0E;AAC1E,6EAAwE;AACxE,2EAAsE;AACtE,+CAA2C;AAGpC,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAK/B,YACmB,OAA4B,EAC5B,KAAwB,EACxB,MAA0B,EAC1B,KAAsB,EACtB,GAAe,EACP,OAAyB;QALjC,YAAO,GAAP,OAAO,CAAqB;QAC5B,UAAK,GAAL,KAAK,CAAmB;QACxB,WAAM,GAAN,MAAM,CAAoB;QAC1B,UAAK,GAAL,KAAK,CAAiB;QACtB,QAAG,GAAH,GAAG,CAAY;QATjB,WAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;QAY9D,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,oBAAoB,IAAI,0CAAkC,CAAC;IAC3F,CAAC;IAOK,AAAN,KAAK,CAAC,KAAK,CACsB,MAAc,EACf,KAAe,EACV,UAAmB,EACpB,SAAkB,EACf,YAAqB,EACd,WAAoB;QAEhE,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,wBAAe,CAAC,oBAAoB,CAAC,CAAC;QAC7D,IAAI,CAAC,KAAK,EAAE,MAAM;YAAE,MAAM,IAAI,wBAAe,CAAC,oBAAoB,CAAC,CAAC;QACpE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;YACrG,MAAM,IAAI,uBAAc,CAAC,IAAI,IAAI,CAAC,cAAc,+CAA+C,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAGnC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QACrE,IAAI,MAAgB,CAAC;QACrB,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1E,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAI,EAAE;gBACnD,KAAK,EAAE,MAAM;gBACb,SAAS,EAAE,SAAS,IAAI,QAAQ,CAAC,SAAS;gBAC1C,YAAY,EAAE,YAAY,IAAI,QAAQ,CAAC,YAAY;aACpD,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;QACxH,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,MAAM,CAAC;IAChB,CAAC;IAGK,AAAN,KAAK,CAAC,MAAM,CACqB,MAAc,EACf,KAAe,EACV,UAAmB,EACpB,SAAkB,EACR,WAAoB;QAEhE,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,wBAAe,CAAC,oBAAoB,CAAC,CAAC;QAC7D,IAAI,CAAC,KAAK,EAAE,MAAM;YAAE,MAAM,IAAI,wBAAe,CAAC,oBAAoB,CAAC,CAAC;QACpE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;YACrG,MAAM,IAAI,uBAAc,CAAC,IAAI,IAAI,CAAC,cAAc,gDAAgD,CAAC,CAAC;QACpG,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAG3B,MAAM,SAAS,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM;YAC7B,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YACnE,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAI,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,MAAM,CAAC;IAChB,CAAC;IAGO,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,SAAkB,EAAE,UAAmB;QAC7E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,iCAAoB,EAAC,CAAC,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IACrF,CAAC;IAKK,AAAN,KAAK,CAAC,YAAY,CACa,IAAY,EACL,WAAoB;QAExD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,wBAAe,CAAC,kBAAkB,CAAC,CAAC;QACzD,MAAM,KAAK,GAAuB,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAClG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC;IAChB,CAAC;IAGK,AAAN,KAAK,CAAC,YAAY,CAA8B,IAAY;QAC1D,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,wBAAe,CAAC,kBAAkB,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QAC9B,OAAO,OAAO,CAAC;IACjB,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CACc,IAAa,EACZ,KAAc;QAE5C,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAClF,CAAC;IAGK,AAAN,KAAK,CAAC,SAAS,CAA8B,IAAY;QACvD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,wBAAe,CAAC,kBAAkB,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAKK,AAAN,KAAK,CAAC,UAAU,CACe,IAAY,EACT,OAAiB,EACb,WAAoB;QAExD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,wBAAe,CAAC,kBAAkB,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO,EAAE,MAAM;YAAE,MAAM,IAAI,wBAAe,CAAC,sBAAsB,CAAC,CAAC;QACxE,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,KAAK,GAAqB,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACzG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QAC3D,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC;IAChB,CAAC;IAGK,AAAN,KAAK,CAAC,UAAU,CAA8B,IAAY;QAGxD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,wBAAe,CAAC,kBAAkB,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QAC9B,OAAO,OAAO,CAAC;IACjB,CAAC;IAGK,AAAN,KAAK,CAAC,SAAS,CACgB,IAAa,EACZ,KAAc;QAE5C,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAA8B,IAAY;QACrD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,wBAAe,CAAC,kBAAkB,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAIK,AAAN,KAAK,CAAC,aAAa,CAA2B,CAAU,EAA+B,IAAa,EAAgC,KAAc;QAChJ,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;IAIK,AAAN,KAAK,CAAC,WAAW,CAA2B,CAAU,EAA+B,IAAa,EAAgC,KAAc;QAC9I,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IAIK,AAAN,KAAK,CAAC,YAAY,CAA2B,CAAU,EAA+B,IAAa,EAAgC,KAAc;QAC/I,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAe;QACrC,OAAO,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,KAAe;QAC9C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,wBAAe,CAAC,oBAAoB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,KAAe;QAC5C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,wBAAe,CAAC,kBAAkB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;CACF,CAAA;AAlMY,oDAAoB;AAqBzB;IADL,IAAA,qBAAY,EAAC,iBAAS,EAAE,mBAAW,CAAC,KAAK,EAAE,KAAK,CAAC;IAE/C,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC7B,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5B,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IACjC,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAChC,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,cAAc,CAAC,CAAA;IACnC,WAAA,IAAA,oBAAW,EAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAA;;;;iDAwB5C;AAGK;IADL,IAAA,qBAAY,EAAC,iBAAS,EAAE,mBAAW,CAAC,MAAM,EAAE,KAAK,CAAC;IAEhD,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC7B,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5B,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IACjC,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAChC,WAAA,IAAA,oBAAW,EAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAA;;;;kDAiB5C;AAWK;IADL,IAAA,qBAAY,EAAC,iBAAS,EAAE,mBAAW,CAAC,YAAY,EAAE,KAAK,CAAC;IAEtD,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC3B,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,aAAa,CAAC,CAAA;;;;wDAOpC;AAGK;IADL,IAAA,qBAAY,EAAC,iBAAS,EAAE,mBAAW,CAAC,YAAY,EAAE,KAAK,CAAC;IACrC,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,MAAM,CAAC,CAAA;;;;wDAK9C;AAGK;IADL,IAAA,qBAAY,EAAC,iBAAS,EAAE,mBAAW,CAAC,UAAU,EAAE,KAAK,CAAC;IAEpD,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC3B,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,OAAO,CAAC,CAAA;;;;uDAG9B;AAGK;IADL,IAAA,qBAAY,EAAC,iBAAS,EAAE,mBAAW,CAAC,SAAS,EAAE,KAAK,CAAC;IACrC,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,MAAM,CAAC,CAAA;;;;qDAG3C;AAKK;IADL,IAAA,qBAAY,EAAC,iBAAS,EAAE,mBAAW,CAAC,UAAU,EAAE,KAAK,CAAC;IAEpD,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC3B,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC9B,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,aAAa,CAAC,CAAA;;;;sDASpC;AAGK;IADL,IAAA,qBAAY,EAAC,iBAAS,EAAE,mBAAW,CAAC,UAAU,EAAE,KAAK,CAAC;IACrC,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,MAAM,CAAC,CAAA;;;;sDAO5C;AAGK;IADL,IAAA,qBAAY,EAAC,iBAAS,EAAE,mBAAW,CAAC,QAAQ,EAAE,KAAK,CAAC;IAElD,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC3B,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,OAAO,CAAC,CAAA;;;;qDAG9B;AAGK;IADL,IAAA,qBAAY,EAAC,iBAAS,EAAE,mBAAW,CAAC,OAAO,EAAE,KAAK,CAAC;IACrC,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,MAAM,CAAC,CAAA;;;;mDAGzC;AAIK;IADL,IAAA,qBAAY,EAAC,iBAAS,EAAE,mBAAW,CAAC,YAAY,EAAE,KAAK,CAAC;IACpC,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAAc,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAAiB,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,OAAO,CAAC,CAAA;;;;yDAElI;AAIK;IADL,IAAA,qBAAY,EAAC,iBAAS,EAAE,mBAAW,CAAC,UAAU,EAAE,KAAK,CAAC;IACpC,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAAc,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAAiB,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,OAAO,CAAC,CAAA;;;;uDAEhI;AAIK;IADL,IAAA,qBAAY,EAAC,iBAAS,EAAE,mBAAW,CAAC,WAAW,EAAE,KAAK,CAAC;IACpC,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAAc,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAAiB,WAAA,IAAA,oBAAW,EAAC,MAAM,EAAE,OAAO,CAAC,CAAA;;;;wDAEjI;+BAjLU,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAYR,WAAA,IAAA,eAAM,EAAC,uBAAe,CAAC,CAAA;qCALE,2CAAmB;QACrB,uCAAiB;QAChB,yCAAkB;QACnB,mCAAe;QACjB,wBAAU;GAVvB,oBAAoB,CAkMhC"}

package/modules/acl/services/acl.service.d.ts

@@ -1,4 +1,5 @@
 import { IAclRoleService } from '../../proxy/services/acl.service';
+import { AclResourceContext } from '../auth-match';
 import { AclCacheService } from '../cache/acl-cache.service';
 import { AclResourceGroup } from '../models';
 import { AclGrantRepository } from '../repository/acl-grant.repository';
@@ -10,9 +11,7 @@ export declare class AclService implements IAclRoleService {
     private readonly logger;
     constructor(grants: AclGrantRepository, roles: AclRoleRepository, cache: AclCacheService);
     private toList;
-    canUserDoGtw(roles: string | string[], userId: string): Promise<boolean>;
-    canUserDo(roles: string | string[], userId: string, resourceId?: string): Promise<boolean>;
-    handleCanUserDoGtw(userId: string, roles?: string | string[]): Promise<boolean>;
-    handleCanUserDo(userId: string, resource: string, roles?: string | string[]): Promise<boolean>;
+    checkAction(userId: string, ctx: AclResourceContext | undefined, action: string | string[]): Promise<boolean>;
+    handleCheckAction(userId: string, action: string | string[], companyId?: string, resourceId?: string): Promise<boolean>;
     listResourcesByUser(userId: string): Promise<AclResourceGroup[]>;
 }