@os.io/nest-kit 0.0.1-alpha.0

package/dist/auth/authorization/pbac/pbac.service.d.ts

@@ -0,0 +1,44 @@
+import type { ICacheService } from '../../interfaces';
+import type { PolicyContext, PolicyEffect, PolicyDocument } from './pbac.types';
+/**
+ * Policy-Based Access Control service.
+ *
+ * Evaluates user-assigned policies against the current request context.
+ * Supports wildcard matching and simple condition evaluation.
+ */
+export declare class PbacService {
+    private readonly cache;
+    private defaultEffect;
+    constructor(cache: ICacheService);
+    /**
+     * Configure the default effect when no policy matches.
+     */
+    setDefaultEffect(effect: PolicyEffect): void;
+    /**
+     * Evaluate a list of policy documents for a given action + resource.
+     *
+     * Returns `true` if access is granted, `false` otherwise.
+     *
+     * Evaluation logic (AWS IAM style):
+     *   1. An explicit `deny` overrides everything.
+     *   2. If any statement matches with `allow`, access is granted.
+     *   3. If no statement matches, the default effect applies.
+     */
+    evaluate(policies: PolicyDocument[], action: string, resource: string, context: PolicyContext): boolean;
+    /**
+     * Fetch policies for a user, using cache when possible.
+     */
+    getUserPolicies(userId: string): Promise<PolicyDocument[]>;
+    /**
+     * Invalidate cached policies for a user.
+     */
+    invalidateUser(userId: string): Promise<void>;
+    private matchAction;
+    private matchResource;
+    private wildcardMatch;
+    private evaluateCondition;
+    private resolveCondition;
+    private eq;
+    private resolveValue;
+}
+//# sourceMappingURL=pbac.service.d.ts.map

package/dist/auth/authorization/pbac/pbac.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pbac.service.d.ts","sourceRoot":"","sources":["../../../../packages/auth/authorization/pbac/pbac.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,KAAK,EAAmB,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEjG;;;;;GAKG;AACH,qBACa,WAAW;IAKpB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAJxB,OAAO,CAAC,aAAa,CAAwB;gBAI1B,KAAK,EAAE,aAAa;IAGvC;;OAEG;IACH,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IAI5C;;;;;;;;;OASG;IACH,QAAQ,CACN,QAAQ,EAAE,cAAc,EAAE,EAC1B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,aAAa,GACrB,OAAO;IAoBV;;OAEG;IACG,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAOhE;;OAEG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInD,OAAO,CAAC,WAAW;IAInB,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,aAAa;IAKrB,OAAO,CAAC,iBAAiB;IAUzB,OAAO,CAAC,gBAAgB;IAoBxB,OAAO,CAAC,EAAE;IAWV,OAAO,CAAC,YAAY;CAWrB"}

package/dist/auth/authorization/pbac/pbac.service.js

@@ -0,0 +1,146 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from '@nestjs/common';
+import { CACHE_SERVICE } from '../../auth.constants';
+/**
+ * Policy-Based Access Control service.
+ *
+ * Evaluates user-assigned policies against the current request context.
+ * Supports wildcard matching and simple condition evaluation.
+ */
+let PbacService = class PbacService {
+    cache;
+    defaultEffect = 'deny';
+    constructor(cache) {
+        this.cache = cache;
+    }
+    /**
+     * Configure the default effect when no policy matches.
+     */
+    setDefaultEffect(effect) {
+        this.defaultEffect = effect;
+    }
+    /**
+     * Evaluate a list of policy documents for a given action + resource.
+     *
+     * Returns `true` if access is granted, `false` otherwise.
+     *
+     * Evaluation logic (AWS IAM style):
+     *   1. An explicit `deny` overrides everything.
+     *   2. If any statement matches with `allow`, access is granted.
+     *   3. If no statement matches, the default effect applies.
+     */
+    evaluate(policies, action, resource, context) {
+        let allowCount = 0;
+        for (const doc of policies) {
+            for (const stmt of doc.statements) {
+                if (!this.matchAction(stmt, action))
+                    continue;
+                if (!this.matchResource(stmt, resource))
+                    continue;
+                if (stmt.condition && !this.evaluateCondition(stmt.condition, context)) {
+                    continue;
+                }
+                if (stmt.effect === 'deny')
+                    return false;
+                if (stmt.effect === 'allow')
+                    allowCount += 1;
+            }
+        }
+        if (allowCount > 0)
+            return true;
+        return this.defaultEffect === 'allow';
+    }
+    /**
+     * Fetch policies for a user, using cache when possible.
+     */
+    async getUserPolicies(userId) {
+        const cacheKey = `pbac:policies:${userId}`;
+        const cached = await this.cache.get(cacheKey);
+        if (cached)
+            return cached;
+        return [];
+    }
+    /**
+     * Invalidate cached policies for a user.
+     */
+    async invalidateUser(userId) {
+        await this.cache.del(`pbac:policies:${userId}`);
+    }
+    matchAction(stmt, action) {
+        return stmt.actions.some((a) => this.wildcardMatch(a, action));
+    }
+    matchResource(stmt, resource) {
+        return stmt.resources.some((r) => this.wildcardMatch(r, resource));
+    }
+    wildcardMatch(pattern, value) {
+        const regexStr = pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*');
+        return new RegExp(`^${regexStr}$`).test(value);
+    }
+    evaluateCondition(condition, context) {
+        // Simple condition evaluator — supports { "eq": { "user.department": "engineering" } }
+        // Extend this for production use with a proper expression engine.
+        try {
+            return this.resolveCondition(condition, context);
+        }
+        catch {
+            return false;
+        }
+    }
+    resolveCondition(node, context) {
+        if (typeof node !== 'object' || node === null)
+            return true;
+        const obj = node;
+        // Operator keys
+        if ('eq' in obj)
+            return this.eq(obj.eq, context);
+        if ('ne' in obj)
+            return !this.eq(obj.ne, context);
+        if ('and' in obj) {
+            const conditions = obj.and;
+            return conditions.every((c) => this.resolveCondition(c, context));
+        }
+        if ('or' in obj) {
+            const conditions = obj.or;
+            return conditions.some((c) => this.resolveCondition(c, context));
+        }
+        return true;
+    }
+    eq(mapping, context) {
+        if (typeof mapping !== 'object' || mapping === null)
+            return false;
+        const entries = Object.entries(mapping);
+        if (entries.length !== 1)
+            return false;
+        const [key, expected] = entries[0];
+        const actual = this.resolveValue(key, context);
+        return String(actual) === String(expected);
+    }
+    resolveValue(path, context) {
+        const parts = path.split('.');
+        let current = context;
+        for (const part of parts) {
+            if (typeof current !== 'object' || current === null)
+                return undefined;
+            current = current[part];
+        }
+        return current;
+    }
+};
+PbacService = __decorate([
+    Injectable(),
+    __param(0, Inject(CACHE_SERVICE)),
+    __metadata("design:paramtypes", [Object])
+], PbacService);
+export { PbacService };
+//# sourceMappingURL=pbac.service.js.map

package/dist/auth/authorization/pbac/pbac.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pbac.service.js","sourceRoot":"","sources":["../../../../packages/auth/authorization/pbac/pbac.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrD;;;;;GAKG;AAEI,IAAM,WAAW,GAAjB,MAAM,WAAW;IAKH;IAJX,aAAa,GAAiB,MAAM,CAAC;IAE7C,YAEmB,KAAoB;QAApB,UAAK,GAAL,KAAK,CAAe;IACpC,CAAC;IAEJ;;OAEG;IACH,gBAAgB,CAAC,MAAoB;QACnC,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;IAC9B,CAAC;IAED;;;;;;;;;OASG;IACH,QAAQ,CACN,QAA0B,EAC1B,MAAc,EACd,QAAgB,EAChB,OAAsB;QAEtB,IAAI,UAAU,GAAG,CAAC,CAAC;QAEnB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;gBAClC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC;oBAAE,SAAS;gBAC9C,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC;oBAAE,SAAS;gBAClD,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;oBACvE,SAAS;gBACX,CAAC;gBAED,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;oBAAE,OAAO,KAAK,CAAC;gBACzC,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO;oBAAE,UAAU,IAAI,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,IAAI,UAAU,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAChC,OAAO,IAAI,CAAC,aAAa,KAAK,OAAO,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,MAAM,QAAQ,GAAG,iBAAiB,MAAM,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,QAAQ,CAAC,CAAC;QAChE,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,MAAc;QACjC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,MAAM,EAAE,CAAC,CAAC;IAClD,CAAC;IAEO,WAAW,CAAC,IAAqB,EAAE,MAAc;QACvD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,CAAC;IAEO,aAAa,CAAC,IAAqB,EAAE,QAAgB;QAC3D,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrE,CAAC;IAEO,aAAa,CAAC,OAAe,EAAE,KAAa;QAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACnF,OAAO,IAAI,MAAM,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IAEO,iBAAiB,CAAC,SAAkC,EAAE,OAAsB;QAClF,uFAAuF;QACvF,kEAAkE;QAClE,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,IAAa,EAAE,OAAsB;QAC5D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAE3D,MAAM,GAAG,GAAG,IAA+B,CAAC;QAE5C,gBAAgB;QAChB,IAAI,IAAI,IAAI,GAAG;YAAE,OAAO,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACjD,IAAI,IAAI,IAAI,GAAG;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,KAAK,IAAI,GAAG,EAAE,CAAC;YACjB,MAAM,UAAU,GAAG,GAAG,CAAC,GAAgB,CAAC;YACxC,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC;YAChB,MAAM,UAAU,GAAG,GAAG,CAAC,EAAe,CAAC;YACvC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,EAAE,CAAC,OAAgB,EAAE,OAAsB;QACjD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAClE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAkC,CAAC,CAAC;QACnE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAEvC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAE/C,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAEO,YAAY,CAAC,IAAY,EAAE,OAAsB;QACvD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,OAAO,GAAY,OAAO,CAAC;QAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;gBAAE,OAAO,SAAS,CAAC;YACtE,OAAO,GAAI,OAAmC,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAA;AApIY,WAAW;IADvB,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,aAAa,CAAC,CAAA;;GAJb,WAAW,CAoIvB"}

package/dist/auth/authorization/pbac/pbac.types.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Policy effect — the outcome of evaluating a policy statement.
+ */
+export type PolicyEffect = 'allow' | 'deny';
+/**
+ * A single policy statement (akin to AWS IAM).
+ *
+ * @example
+ * ```typescript
+ * const policy: PolicyStatement = {
+ *   effect: 'deny',
+ *   actions: ['document:delete'],
+ *   resources: ['org:*'],
+ *   condition: { department: { ne: { ref: 'user.department' } } },
+ * };
+ * ```
+ */
+export interface PolicyStatement {
+    /** Whether this statement allows or denies access */
+    effect: PolicyEffect;
+    /** Actions this statement applies to (supports wildcard: 'document:*') */
+    actions: string[];
+    /** Resources this statement applies to (supports wildcard) */
+    resources: string[];
+    /** Optional conditions that must be satisfied */
+    condition?: Record<string, unknown>;
+}
+/**
+ * A complete policy document assigned to a user or role.
+ */
+export interface PolicyDocument {
+    /** Policy identifier */
+    id?: string;
+    /** Policy name */
+    name?: string;
+    /** List of statements */
+    statements: PolicyStatement[];
+}
+/**
+ * Evaluation context passed to condition functions.
+ */
+export interface PolicyContext {
+    user: Record<string, unknown>;
+    resource: Record<string, unknown>;
+    environment: Record<string, unknown>;
+}
+//# sourceMappingURL=pbac.types.d.ts.map

package/dist/auth/authorization/pbac/pbac.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pbac.types.d.ts","sourceRoot":"","sources":["../../../../packages/auth/authorization/pbac/pbac.types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,CAAC;AAE5C;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,eAAe;IAC9B,qDAAqD;IACrD,MAAM,EAAE,YAAY,CAAC;IACrB,0EAA0E;IAC1E,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,8DAA8D;IAC9D,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,wBAAwB;IACxB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,kBAAkB;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,UAAU,EAAE,eAAe,EAAE,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC"}

package/dist/auth/authorization/pbac/pbac.types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=pbac.types.js.map

package/dist/auth/authorization/pbac/pbac.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pbac.types.js","sourceRoot":"","sources":["../../../../packages/auth/authorization/pbac/pbac.types.ts"],"names":[],"mappings":""}

package/dist/auth/authorization/rbac/index.d.ts

@@ -0,0 +1,4 @@
+export { RbacService } from './rbac.service';
+export { RbacGuard } from './rbac.guard';
+export { Roles } from './rbac.decorator';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/authorization/rbac/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../packages/auth/authorization/rbac/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/auth/authorization/rbac/index.js

@@ -0,0 +1,4 @@
+export { RbacService } from './rbac.service';
+export { RbacGuard } from './rbac.guard';
+export { Roles } from './rbac.decorator';
+//# sourceMappingURL=index.js.map

package/dist/auth/authorization/rbac/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../packages/auth/authorization/rbac/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/auth/authorization/rbac/rbac.decorator.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Require specific roles to access a route.
+ * Works with the RbacGuard.
+ *
+ * By default, a user needs **at least one** of the listed roles.
+ * Pass `{ requireAll: true }` in options to require all roles.
+ *
+ * @example
+ * ```typescript
+ * @Roles('admin')
+ * @Roles('admin', 'moderator')
+ * @Roles('admin', 'super-admin', { requireAll: true })
+ * ```
+ */
+export declare const Roles: (...args: (string | {
+    requireAll: boolean;
+})[]) => import("@nestjs/common").CustomDecorator<string>;
+//# sourceMappingURL=rbac.decorator.d.ts.map

package/dist/auth/authorization/rbac/rbac.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.decorator.d.ts","sourceRoot":"","sources":["../../../../packages/auth/authorization/rbac/rbac.decorator.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,KAAK,GAAI,GAAG,MAAM,CAAC,MAAM,GAAG;IAAE,UAAU,EAAE,OAAO,CAAA;CAAE,CAAC,EAAE,qDAOlE,CAAC"}

package/dist/auth/authorization/rbac/rbac.decorator.js

@@ -0,0 +1,25 @@
+import { SetMetadata } from '@nestjs/common';
+import { METADATA_ROLES } from '../../auth.constants';
+/**
+ * Require specific roles to access a route.
+ * Works with the RbacGuard.
+ *
+ * By default, a user needs **at least one** of the listed roles.
+ * Pass `{ requireAll: true }` in options to require all roles.
+ *
+ * @example
+ * ```typescript
+ * @Roles('admin')
+ * @Roles('admin', 'moderator')
+ * @Roles('admin', 'super-admin', { requireAll: true })
+ * ```
+ */
+export const Roles = (...args) => {
+    const last = args[args.length - 1];
+    const opts = typeof last === 'object' ? args.pop() : undefined;
+    return SetMetadata(METADATA_ROLES, {
+        roles: args,
+        requireAll: opts?.requireAll ?? false,
+    });
+};
+//# sourceMappingURL=rbac.decorator.js.map

package/dist/auth/authorization/rbac/rbac.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.decorator.js","sourceRoot":"","sources":["../../../../packages/auth/authorization/rbac/rbac.decorator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,GAAG,IAA0C,EAAE,EAAE;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,GAAG,EAA8B,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,OAAO,WAAW,CAAC,cAAc,EAAE;QACjC,KAAK,EAAE,IAAgB;QACvB,UAAU,EAAE,IAAI,EAAE,UAAU,IAAI,KAAK;KACtC,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/auth/authorization/rbac/rbac.guard.d.ts

@@ -0,0 +1,19 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { RbacService } from './rbac.service';
+/**
+ * Guard that enforces Role-Based Access Control.
+ *
+ * Reads the required roles from the `@Roles()` decorator on the route
+ * handler (or controller) and checks them against the authenticated user.
+ *
+ * This guard is independent — you can use it with or without PBAC on
+ * different routes in the same application.
+ */
+export declare class RbacGuard implements CanActivate {
+    private readonly reflector;
+    private readonly rbacService;
+    constructor(reflector: Reflector, rbacService: RbacService);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}
+//# sourceMappingURL=rbac.guard.d.ts.map

package/dist/auth/authorization/rbac/rbac.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.guard.d.ts","sourceRoot":"","sources":["../../../../packages/auth/authorization/rbac/rbac.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,WAAW,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAG7C;;;;;;;;GAQG;AACH,qBACa,SAAU,YAAW,WAAW;IAEzC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW;gBADX,SAAS,EAAE,SAAS,EACpB,WAAW,EAAE,WAAW;IAGrC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CAmB/D"}

package/dist/auth/authorization/rbac/rbac.guard.js

@@ -0,0 +1,50 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Injectable } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { RbacService } from './rbac.service';
+import { METADATA_ROLES } from '../../auth.constants';
+/**
+ * Guard that enforces Role-Based Access Control.
+ *
+ * Reads the required roles from the `@Roles()` decorator on the route
+ * handler (or controller) and checks them against the authenticated user.
+ *
+ * This guard is independent — you can use it with or without PBAC on
+ * different routes in the same application.
+ */
+let RbacGuard = class RbacGuard {
+    reflector;
+    rbacService;
+    constructor(reflector, rbacService) {
+        this.reflector = reflector;
+        this.rbacService = rbacService;
+    }
+    async canActivate(context) {
+        const meta = this.reflector.getAllAndOverride(METADATA_ROLES, [context.getHandler(), context.getClass()]);
+        if (!meta || !meta.roles || meta.roles.length === 0) {
+            return true;
+        }
+        const request = context
+            .switchToHttp()
+            .getRequest();
+        const user = request.user;
+        if (!user)
+            return false;
+        return this.rbacService.hasRoles(user, meta.roles, meta.requireAll);
+    }
+};
+RbacGuard = __decorate([
+    Injectable(),
+    __metadata("design:paramtypes", [Reflector,
+        RbacService])
+], RbacGuard);
+export { RbacGuard };
+//# sourceMappingURL=rbac.guard.js.map

package/dist/auth/authorization/rbac/rbac.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.guard.js","sourceRoot":"","sources":["../../../../packages/auth/authorization/rbac/rbac.guard.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAiC,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;;;;;;;GAQG;AAEI,IAAM,SAAS,GAAf,MAAM,SAAS;IAED;IACA;IAFnB,YACmB,SAAoB,EACpB,WAAwB;QADxB,cAAS,GAAT,SAAS,CAAW;QACpB,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAG1C,cAAc,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAE/D,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,OAAO;aACpB,YAAY,EAAE;aACd,UAAU,EAAmD,CAAC;QACjE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAE1B,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAExB,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACtE,CAAC;CACF,CAAA;AAzBY,SAAS;IADrB,UAAU,EAAE;qCAGmB,SAAS;QACP,WAAW;GAHhC,SAAS,CAyBrB"}

package/dist/auth/authorization/rbac/rbac.service.d.ts

@@ -0,0 +1,43 @@
+import type { IAuthUser, ICacheService } from '../../interfaces';
+/**
+ * Service that resolves and caches role → permissions mappings.
+ *
+ * Cache key convention: `rbac:roles:<userId>` → string[]
+ *                       `rbac:perms:<role>`    → string[]
+ */
+export declare class RbacService {
+    private readonly cache;
+    constructor(cache: ICacheService);
+    /**
+     * Check if a user has at least one of the required roles.
+     *
+     * @param user       Authenticated user
+     * @param roles      List of role names required (at least one must match)
+     * @param requireAll If true, the user must have ALL specified roles
+     */
+    hasRoles(user: IAuthUser, roles: string[], requireAll?: boolean): Promise<boolean>;
+    /**
+     * Check if a user has a specific permission (derived from their roles).
+     *
+     * @param user       Authenticated user
+     * @param permission Permission identifier
+     */
+    hasPermission(user: IAuthUser, permission: string): Promise<boolean>;
+    /**
+     * Fetch roles for a user, using cache when possible.
+     */
+    getUserRoles(userId: string): Promise<string[]>;
+    /**
+     * Fetch permissions for a role, using cache when possible.
+     */
+    getRolePermissions(role: string): Promise<string[]>;
+    /**
+     * Invalidate the role cache for a user.
+     */
+    invalidateUser(userId: string): Promise<void>;
+    /**
+     * Invalidate the permission cache for a role.
+     */
+    invalidateRole(role: string): Promise<void>;
+}
+//# sourceMappingURL=rbac.service.d.ts.map

package/dist/auth/authorization/rbac/rbac.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.service.d.ts","sourceRoot":"","sources":["../../../../packages/auth/authorization/rbac/rbac.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGjE;;;;;GAKG;AACH,qBACa,WAAW;IAGpB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,aAAa;IAGvC;;;;;;OAMG;IACG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,UAAU,UAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAUtF;;;;;OAKG;IACG,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAW1E;;OAEG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAOrD;;OAEG;IACG,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAOzD;;OAEG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInD;;OAEG;IACG,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGlD"}

package/dist/auth/authorization/rbac/rbac.service.js

@@ -0,0 +1,95 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from '@nestjs/common';
+import { CACHE_SERVICE } from '../../auth.constants';
+/**
+ * Service that resolves and caches role → permissions mappings.
+ *
+ * Cache key convention: `rbac:roles:<userId>` → string[]
+ *                       `rbac:perms:<role>`    → string[]
+ */
+let RbacService = class RbacService {
+    cache;
+    constructor(cache) {
+        this.cache = cache;
+    }
+    /**
+     * Check if a user has at least one of the required roles.
+     *
+     * @param user       Authenticated user
+     * @param roles      List of role names required (at least one must match)
+     * @param requireAll If true, the user must have ALL specified roles
+     */
+    async hasRoles(user, roles, requireAll = false) {
+        if (!roles.length)
+            return true;
+        const userRoles = user.roles ?? (await this.getUserRoles(user.id));
+        return requireAll
+            ? roles.every((r) => userRoles.includes(r))
+            : roles.some((r) => userRoles.includes(r));
+    }
+    /**
+     * Check if a user has a specific permission (derived from their roles).
+     *
+     * @param user       Authenticated user
+     * @param permission Permission identifier
+     */
+    async hasPermission(user, permission) {
+        const userRoles = user.roles ?? (await this.getUserRoles(user.id));
+        for (const role of userRoles) {
+            const perms = await this.getRolePermissions(role);
+            if (perms.includes(permission))
+                return true;
+        }
+        return false;
+    }
+    /**
+     * Fetch roles for a user, using cache when possible.
+     */
+    async getUserRoles(userId) {
+        const cacheKey = `rbac:roles:${userId}`;
+        const cached = await this.cache.get(cacheKey);
+        if (cached)
+            return cached;
+        return [];
+    }
+    /**
+     * Fetch permissions for a role, using cache when possible.
+     */
+    async getRolePermissions(role) {
+        const cacheKey = `rbac:perms:${role}`;
+        const cached = await this.cache.get(cacheKey);
+        if (cached)
+            return cached;
+        return [];
+    }
+    /**
+     * Invalidate the role cache for a user.
+     */
+    async invalidateUser(userId) {
+        await this.cache.del(`rbac:roles:${userId}`);
+    }
+    /**
+     * Invalidate the permission cache for a role.
+     */
+    async invalidateRole(role) {
+        await this.cache.del(`rbac:perms:${role}`);
+    }
+};
+RbacService = __decorate([
+    Injectable(),
+    __param(0, Inject(CACHE_SERVICE)),
+    __metadata("design:paramtypes", [Object])
+], RbacService);
+export { RbacService };
+//# sourceMappingURL=rbac.service.js.map

package/dist/auth/authorization/rbac/rbac.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.service.js","sourceRoot":"","sources":["../../../../packages/auth/authorization/rbac/rbac.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD;;;;;GAKG;AAEI,IAAM,WAAW,GAAjB,MAAM,WAAW;IAGH;IAFnB,YAEmB,KAAoB;QAApB,UAAK,GAAL,KAAK,CAAe;IACpC,CAAC;IAEJ;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CAAC,IAAe,EAAE,KAAe,EAAE,UAAU,GAAG,KAAK;QACjE,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAE/B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAEnE,OAAO,UAAU;YACf,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAC3C,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,IAAe,EAAE,UAAkB;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAEnE,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC9C,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,MAAM,QAAQ,GAAG,cAAc,MAAM,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAW,QAAQ,CAAC,CAAC;QACxD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CAAC,IAAY;QACnC,MAAM,QAAQ,GAAG,cAAc,IAAI,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAW,QAAQ,CAAC,CAAC;QACxD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,MAAc;QACjC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,MAAM,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,IAAY;QAC/B,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;CACF,CAAA;AAzEY,WAAW;IADvB,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,aAAa,CAAC,CAAA;;GAFb,WAAW,CAyEvB"}

package/dist/auth/decorators/current-user.decorator.d.ts

@@ -0,0 +1,17 @@
+import type { IAuthUser } from '../interfaces';
+/**
+ * Parameter decorator that extracts the authenticated user from the request.
+ *
+ * @example
+ * ```typescript
+ * // Returns the full IAuthUser object
+ * @Get('me')
+ * getProfile(@CurrentUser() user: IAuthUser) { … }
+ *
+ * // Returns only the email
+ * @Get('email')
+ * getEmail(@CurrentUser('email') email: string) { … }
+ * ```
+ */
+export declare const CurrentUser: (...dataOrPipes: (keyof IAuthUser | import("@nestjs/common").PipeTransform<any, any> | import("@nestjs/common").Type<import("@nestjs/common").PipeTransform<any, any>> | undefined)[]) => ParameterDecorator;
+//# sourceMappingURL=current-user.decorator.d.ts.map

package/dist/auth/decorators/current-user.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"current-user.decorator.d.ts","sourceRoot":"","sources":["../../../packages/auth/decorators/current-user.decorator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,WAAW,8MAOvB,CAAC"}

package/dist/auth/decorators/current-user.decorator.js

@@ -0,0 +1,23 @@
+import { createParamDecorator } from '@nestjs/common';
+/**
+ * Parameter decorator that extracts the authenticated user from the request.
+ *
+ * @example
+ * ```typescript
+ * // Returns the full IAuthUser object
+ * @Get('me')
+ * getProfile(@CurrentUser() user: IAuthUser) { … }
+ *
+ * // Returns only the email
+ * @Get('email')
+ * getEmail(@CurrentUser('email') email: string) { … }
+ * ```
+ */
+export const CurrentUser = createParamDecorator((key, ctx) => {
+    const request = ctx.switchToHttp().getRequest();
+    const user = request.user;
+    if (!user)
+        return undefined;
+    return key ? user[key] : user;
+});
+//# sourceMappingURL=current-user.decorator.js.map

package/dist/auth/decorators/current-user.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"current-user.decorator.js","sourceRoot":"","sources":["../../../packages/auth/decorators/current-user.decorator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAyB,MAAM,gBAAgB,CAAC;AAG7E;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,oBAAoB,CAC7C,CAAC,GAAgC,EAAE,GAAqB,EAAW,EAAE;IACnE,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAwB,CAAC;IACtE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC,CACF,CAAC"}

package/dist/auth/decorators/index.d.ts

@@ -0,0 +1,3 @@
+export { CurrentUser } from './current-user.decorator';
+export { Public } from './public.decorator';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/decorators/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../packages/auth/decorators/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/auth/decorators/index.js

@@ -0,0 +1,3 @@
+export { CurrentUser } from './current-user.decorator';
+export { Public } from './public.decorator';
+//# sourceMappingURL=index.js.map

package/dist/auth/decorators/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../packages/auth/decorators/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/auth/decorators/public.decorator.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Mark a route handler or controller as publicly accessible
+ * (bypasses the global AuthGuard).
+ *
+ * @example
+ * ```typescript
+ * @Public()
+ * @Get('login')
+ * login() { … }
+ * ```
+ */
+export declare const Public: () => import("@nestjs/common").CustomDecorator<string>;
+//# sourceMappingURL=public.decorator.d.ts.map