@rhino-dev/rhino-nestjs 0.2.5 → 4.2.0

package/dist/errors/rhino-exception.d.ts

@@ -1,5 +1,5 @@
 import { HttpException } from '@nestjs/common';
-export type RhinoErrorCode = 'VALIDATION_FAILED' | 'FORBIDDEN_FIELDS' | 'CROSS_TENANT' | 'UNAUTHORIZED' | 'FORBIDDEN' | 'NOT_FOUND' | 'ACTION_DISABLED' | 'UNKNOWN_RESOURCE' | 'INVITATION_EXPIRED' | 'INVITATION_USED' | 'INVITATION_INVALID_ROLE' | 'NESTED_OPERATION_FAILED' | 'INCLUDE_NOT_AUTHORIZED';
+export type RhinoErrorCode = 'VALIDATION_FAILED' | 'FORBIDDEN_FIELDS' | 'CROSS_TENANT' | 'UNAUTHORIZED' | 'FORBIDDEN' | 'NOT_FOUND' | 'ACTION_DISABLED' | 'UNKNOWN_RESOURCE' | 'INVITATION_EXPIRED' | 'INVITATION_USED' | 'INVITATION_INVALID_ROLE' | 'NESTED_OPERATION_FAILED' | 'INCLUDE_NOT_AUTHORIZED' | 'AUTH_REJECTED' | 'MEMBERSHIP_DENIED';
 export interface RhinoErrorBody {
     code: RhinoErrorCode;
     message: string;
@@ -21,4 +21,15 @@ export declare class RhinoException extends HttpException {
     static actionDisabled(action: string): RhinoException;
     static unknownResource(slug: string): RhinoException;
     static includeNotAuthorized(slug: string): RhinoException;
+    static authRejected(message?: string, status?: number): RhinoException;
+    static membershipDenied(message?: string): RhinoException;
+}
+/**
+ * Thrown by a lifecycle hook to reject an otherwise-successful auth action.
+ * The controller catches it: for token-issuing actions (login/register) the
+ * just-issued token is revoked; the configured `status` (default 403) is then
+ * returned to the client. A hook may also throw any other error.
+ */
+export declare class RhinoAuthRejected extends RhinoException {
+    constructor(message?: string, status?: number);
 }

package/dist/errors/rhino-exception.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RhinoException = void 0;
+exports.RhinoAuthRejected = exports.RhinoException = void 0;
 const common_1 = require("@nestjs/common");
 /**
  * Single exception shape surfaced by the library. Frontends can rely on the
@@ -42,6 +42,24 @@ class RhinoException extends common_1.HttpException {
     static includeNotAuthorized(slug) {
         return new RhinoException('INCLUDE_NOT_AUTHORIZED', `Include not authorized: ${slug}`, 403, { slug });
     }
+    static authRejected(message = 'Authentication rejected', status = 403) {
+        return new RhinoException('AUTH_REJECTED', message, status);
+    }
+    static membershipDenied(message = 'You are not a member of this group.') {
+        return new RhinoException('MEMBERSHIP_DENIED', message, 403);
+    }
 }
 exports.RhinoException = RhinoException;
+/**
+ * Thrown by a lifecycle hook to reject an otherwise-successful auth action.
+ * The controller catches it: for token-issuing actions (login/register) the
+ * just-issued token is revoked; the configured `status` (default 403) is then
+ * returned to the client. A hook may also throw any other error.
+ */
+class RhinoAuthRejected extends RhinoException {
+    constructor(message = 'Authentication rejected', status = 403) {
+        super('AUTH_REJECTED', message, status);
+    }
+}
+exports.RhinoAuthRejected = RhinoAuthRejected;
 //# sourceMappingURL=rhino-exception.js.map

package/dist/errors/rhino-exception.js.map

@@ -1 +1 @@
-{"version":3,"file":"rhino-exception.js","sourceRoot":"","sources":["../../src/errors/rhino-exception.ts"],"names":[],"mappings":";;;AAAA,2CAA+C;AAuB/C;;;GAGG;AACH,MAAa,cAAe,SAAQ,sBAAa;IACtC,IAAI,CAAiB;IAE9B,YAAY,IAAoB,EAAE,OAAe,EAAE,MAAc,EAAE,OAA6B;QAC9F,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAChF,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,MAAM,CAAC,gBAAgB,CAAC,MAAgC;QACtD,OAAO,IAAI,cAAc,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,CAAC,eAAe,CAAC,MAAgB;QACrC,OAAO,IAAI,cAAc,CAAC,kBAAkB,EAAE,mDAAmD,EAAE,GAAG,EAAE;YACtG,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,MAAgC;QACjD,OAAO,IAAI,cAAc,CAAC,cAAc,EAAE,+CAA+C,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9G,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,OAAO,GAAG,cAAc;QAC1C,OAAO,IAAI,cAAc,CAAC,cAAc,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,CAAC,SAAS,CAAC,OAAO,GAAG,8BAA8B;QACvD,OAAO,IAAI,cAAc,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,OAAO,GAAG,WAAW;QACnC,OAAO,IAAI,cAAc,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,CAAC,cAAc,CAAC,MAAc;QAClC,OAAO,IAAI,cAAc,CAAC,iBAAiB,EAAE,sBAAsB,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,CAAC,eAAe,CAAC,IAAY;QACjC,OAAO,IAAI,cAAc,CAAC,kBAAkB,EAAE,qBAAqB,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,CAAC,oBAAoB,CAAC,IAAY;QACtC,OAAO,IAAI,cAAc,CAAC,wBAAwB,EAAE,2BAA2B,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACxG,CAAC;CACF;AA9CD,wCA8CC"}
+{"version":3,"file":"rhino-exception.js","sourceRoot":"","sources":["../../src/errors/rhino-exception.ts"],"names":[],"mappings":";;;AAAA,2CAA+C;AAyB/C;;;GAGG;AACH,MAAa,cAAe,SAAQ,sBAAa;IACtC,IAAI,CAAiB;IAE9B,YAAY,IAAoB,EAAE,OAAe,EAAE,MAAc,EAAE,OAA6B;QAC9F,MAAM,IAAI,GAAmB,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAChF,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,MAAM,CAAC,gBAAgB,CAAC,MAAgC;QACtD,OAAO,IAAI,cAAc,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,CAAC,eAAe,CAAC,MAAgB;QACrC,OAAO,IAAI,cAAc,CAAC,kBAAkB,EAAE,mDAAmD,EAAE,GAAG,EAAE;YACtG,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,MAAgC;QACjD,OAAO,IAAI,cAAc,CAAC,cAAc,EAAE,+CAA+C,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9G,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,OAAO,GAAG,cAAc;QAC1C,OAAO,IAAI,cAAc,CAAC,cAAc,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,CAAC,SAAS,CAAC,OAAO,GAAG,8BAA8B;QACvD,OAAO,IAAI,cAAc,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,CAAC,QAAQ,CAAC,OAAO,GAAG,WAAW;QACnC,OAAO,IAAI,cAAc,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,CAAC,cAAc,CAAC,MAAc;QAClC,OAAO,IAAI,cAAc,CAAC,iBAAiB,EAAE,sBAAsB,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,CAAC,eAAe,CAAC,IAAY;QACjC,OAAO,IAAI,cAAc,CAAC,kBAAkB,EAAE,qBAAqB,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,CAAC,oBAAoB,CAAC,IAAY;QACtC,OAAO,IAAI,cAAc,CAAC,wBAAwB,EAAE,2BAA2B,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACxG,CAAC;IAED,MAAM,CAAC,YAAY,CAAC,OAAO,GAAG,yBAAyB,EAAE,MAAM,GAAG,GAAG;QACnE,OAAO,IAAI,cAAc,CAAC,eAAe,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,CAAC,gBAAgB,CAAC,OAAO,GAAG,qCAAqC;QACrE,OAAO,IAAI,cAAc,CAAC,mBAAmB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;CACF;AAtDD,wCAsDC;AAED;;;;;GAKG;AACH,MAAa,iBAAkB,SAAQ,cAAc;IACnD,YAAY,OAAO,GAAG,yBAAyB,EAAE,MAAM,GAAG,GAAG;QAC3D,KAAK,CAAC,eAAe,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;CACF;AAJD,8CAIC"}

package/dist/guards/group-membership.guard.d.ts

@@ -0,0 +1,25 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { RhinoConfigService } from '../rhino.config';
+import { MembershipService } from '../services/membership.service';
+/**
+ * Coarse group-access gate (design §6), gated entirely by
+ * `auth.enforceGroupMembership`.
+ *
+ * When the flag is OFF this guard is a pure no-op: it returns `true`
+ * immediately and never inspects the request, so behavior is byte-for-byte
+ * unchanged. Install it AFTER `JwtAuthGuard` (needs `req.user`) and after
+ * `RouteGroupMiddleware` (needs `req.__routeGroup`).
+ *
+ * When ON:
+ *   - `public`/skip-auth requests bypass the check (no auth).
+ *   - the user must hold a membership row matching the resolved group (NULL row
+ *     = wildcard) and, for tenant groups, the resolved org. No match → 403.
+ *   - on success, the matched rows' permissions become the permission source
+ *     for the downstream ResourcePolicy (attached as `__membershipPermissions`).
+ */
+export declare class GroupMembershipGuard implements CanActivate {
+    private readonly config;
+    private readonly membership;
+    constructor(config: RhinoConfigService, membership: MembershipService);
+    canActivate(context: ExecutionContext): boolean;
+}

package/dist/guards/group-membership.guard.js

@@ -0,0 +1,70 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GroupMembershipGuard = void 0;
+const common_1 = require("@nestjs/common");
+const rhino_config_1 = require("../rhino.config");
+const membership_service_1 = require("../services/membership.service");
+const rhino_exception_1 = require("../errors/rhino-exception");
+/**
+ * Coarse group-access gate (design §6), gated entirely by
+ * `auth.enforceGroupMembership`.
+ *
+ * When the flag is OFF this guard is a pure no-op: it returns `true`
+ * immediately and never inspects the request, so behavior is byte-for-byte
+ * unchanged. Install it AFTER `JwtAuthGuard` (needs `req.user`) and after
+ * `RouteGroupMiddleware` (needs `req.__routeGroup`).
+ *
+ * When ON:
+ *   - `public`/skip-auth requests bypass the check (no auth).
+ *   - the user must hold a membership row matching the resolved group (NULL row
+ *     = wildcard) and, for tenant groups, the resolved org. No match → 403.
+ *   - on success, the matched rows' permissions become the permission source
+ *     for the downstream ResourcePolicy (attached as `__membershipPermissions`).
+ */
+let GroupMembershipGuard = class GroupMembershipGuard {
+    config;
+    membership;
+    constructor(config, membership) {
+        this.config = config;
+        this.membership = membership;
+    }
+    canActivate(context) {
+        if (!this.membership.enabled())
+            return true;
+        const req = context.switchToHttp().getRequest();
+        if (req.__skipAuth)
+            return true;
+        const user = req.user;
+        if (!user)
+            return true; // unauthenticated handling is JwtAuthGuard's job
+        const routeGroup = req.__routeGroup ?? null;
+        // The `public` group never enforces membership (no auth).
+        if (routeGroup === 'public')
+            return true;
+        const org = req.organization ?? null;
+        const isTenant = this.config.isTenantGroup(routeGroup);
+        const rows = this.membership.matchingRows(user, routeGroup, org, isTenant);
+        if (rows.length === 0) {
+            throw rhino_exception_1.RhinoException.membershipDenied();
+        }
+        // Switch the permission source to the matched membership row(s).
+        user.__membershipPermissions = this.membership.permissionsFromRows(rows);
+        return true;
+    }
+};
+exports.GroupMembershipGuard = GroupMembershipGuard;
+exports.GroupMembershipGuard = GroupMembershipGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [rhino_config_1.RhinoConfigService,
+        membership_service_1.MembershipService])
+], GroupMembershipGuard);
+//# sourceMappingURL=group-membership.guard.js.map

package/dist/guards/group-membership.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-membership.guard.js","sourceRoot":"","sources":["../../src/guards/group-membership.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAIwB;AACxB,kDAAqD;AACrD,uEAAmE;AACnE,+DAA2D;AAG3D;;;;;;;;;;;;;;;GAeG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAEZ;IACA;IAFnB,YACmB,MAA0B,EAC1B,UAA6B;QAD7B,WAAM,GAAN,MAAM,CAAoB;QAC1B,eAAU,GAAV,UAAU,CAAmB;IAC7C,CAAC;IAEJ,WAAW,CAAC,OAAyB;QACnC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE;YAAE,OAAO,IAAI,CAAC;QAE5C,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAgB,CAAC;QAC9D,IAAI,GAAG,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAChC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC,iDAAiD;QAEzE,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC;QAC5C,0DAA0D;QAC1D,IAAI,UAAU,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAEzC,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAEvD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC3E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,gCAAc,CAAC,gBAAgB,EAAE,CAAC;QAC1C,CAAC;QAED,iEAAiE;QAChE,IAAY,CAAC,uBAAuB,GAAG,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA9BY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;qCAGgB,iCAAkB;QACd,sCAAiB;GAHrC,oBAAoB,CA8BhC"}

package/dist/guards/jwt-auth.guard.js

@@ -39,12 +39,31 @@ let JwtAuthGuard = class JwtAuthGuard {
             throw rhino_exception_1.RhinoException.unauthorized('Missing bearer token');
         }
         const payload = this.auth.verifyToken(token);
+        if (await this.auth.isTokenRevoked(token)) {
+            throw rhino_exception_1.RhinoException.unauthorized('Token has been revoked');
+        }
         const userModel = this.config.authConfig().userModel;
         const delegate = this.prisma.model(userModel);
-        const user = await delegate.findUnique({
-            where: { id: payload.sub },
-            include: { userRoles: { include: { role: true } } },
-        });
+        // Only eager-load userRoles when multi-tenancy is configured. A
+        // single-tenant / org-less app's User model has no `userRoles` relation, so
+        // an unconditional include throws inside Prisma — which would make every
+        // authenticated request fail with a 401 even though the token is valid.
+        // Gate the include and fall back to a plain lookup if it fails. Multi-tenant
+        // behavior is byte-for-byte unchanged.
+        let user = null;
+        if (this.config.multiTenantEnabled()) {
+            user = await delegate
+                .findUnique({
+                where: { id: payload.sub },
+                include: { userRoles: { include: { role: true } } },
+            })
+                .catch(() => null);
+        }
+        if (!user) {
+            user = await delegate
+                .findUnique({ where: { id: payload.sub } })
+                .catch(() => null);
+        }
         if (!user)
             throw rhino_exception_1.RhinoException.unauthorized('User not found');
         req.user = user;

package/dist/guards/jwt-auth.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-auth.guard.js","sourceRoot":"","sources":["../../src/guards/jwt-auth.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAIwB;AACxB,2DAAuD;AACvD,6DAAyD;AACzD,kDAAqD;AACrD,+DAA2D;AAG3D;;;;GAIG;AAEI,IAAM,YAAY,GAAlB,MAAM,YAAY;IAEJ;IACA;IACA;IAHnB,YACmB,IAAiB,EACjB,MAAqB,EACrB,MAA0B;QAF1B,SAAI,GAAJ,IAAI,CAAa;QACjB,WAAM,GAAN,MAAM,CAAe;QACrB,WAAM,GAAN,MAAM,CAAoB;IAC1C,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAgB,CAAC;QAC9D,IAAI,GAAG,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,gCAAc,CAAC,YAAY,CAAC,sBAAsB,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC;YACrC,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE;YAC1B,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE;SACpD,CAAC,CAAC;QACH,IAAI,CAAC,IAAI;YAAE,MAAM,gCAAc,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;QAC/D,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA1BY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;qCAGc,0BAAW;QACT,8BAAa;QACb,iCAAkB;GAJlC,YAAY,CA0BxB"}
+{"version":3,"file":"jwt-auth.guard.js","sourceRoot":"","sources":["../../src/guards/jwt-auth.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAIwB;AACxB,2DAAuD;AACvD,6DAAyD;AACzD,kDAAqD;AACrD,+DAA2D;AAG3D;;;;GAIG;AAEI,IAAM,YAAY,GAAlB,MAAM,YAAY;IAEJ;IACA;IACA;IAHnB,YACmB,IAAiB,EACjB,MAAqB,EACrB,MAA0B;QAF1B,SAAI,GAAJ,IAAI,CAAa;QACjB,WAAM,GAAN,MAAM,CAAe;QACrB,WAAM,GAAN,MAAM,CAAoB;IAC1C,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAgB,CAAC;QAC9D,IAAI,GAAG,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,gCAAc,CAAC,YAAY,CAAC,sBAAsB,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,gCAAc,CAAC,YAAY,CAAC,wBAAwB,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9C,gEAAgE;QAChE,4EAA4E;QAC5E,yEAAyE;QACzE,wEAAwE;QACxE,6EAA6E;QAC7E,uCAAuC;QACvC,IAAI,IAAI,GAAQ,IAAI,CAAC;QACrB,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,EAAE,CAAC;YACrC,IAAI,GAAG,MAAM,QAAQ;iBAClB,UAAU,CAAC;gBACV,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE;gBAC1B,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE;aACpD,CAAC;iBACD,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,MAAM,QAAQ;iBAClB,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;iBAC1C,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,CAAC,IAAI;YAAE,MAAM,gCAAc,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC;QAC/D,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA7CY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;qCAGc,0BAAW;QACT,8BAAa;QACb,iCAAkB;GAJlC,YAAY,CA6CxB"}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { RhinoModule, type RhinoModuleOptions } from './rhino.module';
-export { RhinoException, type RhinoErrorCode, type RhinoErrorBody, } from './errors/rhino-exception';
+export { RhinoException, RhinoAuthRejected, type RhinoErrorCode, type RhinoErrorBody, } from './errors/rhino-exception';
 export type { RhinoRequest } from './interfaces/rhino-request.interface';
 export { RhinoConfigService, normalizeConfig, } from './rhino.config';
 export { RHINO_CONFIG, RHINO_PRISMA_CLIENT, RHINO_MODULE_OPTIONS, } from './constants/tokens';
@@ -7,11 +7,13 @@ export * from './interfaces/rhino-config.interface';
 export { ResourcePolicy } from './policies/resource-policy';
 export { JwtAuthGuard } from './guards/jwt-auth.guard';
 export { ResourcePolicyGuard } from './guards/resource-policy.guard';
+export { GroupMembershipGuard } from './guards/group-membership.guard';
 export { ResponseInterceptor, paginated } from './interceptors/response.interceptor';
 export { HiddenColumnsInterceptor } from './interceptors/hidden-columns.interceptor';
 export { ResolveOrganizationMiddleware } from './middleware/resolve-organization.middleware';
 export { RouteGroupMiddleware } from './middleware/route-group.middleware';
 export { createTenantRouteRewrite, type TenantRouteRewriteOptions, } from './middleware/tenant-route-rewrite';
+export { createDomainRouteResolver, type DomainRouteResolverOptions, } from './middleware/domain-route-resolver';
 export { GlobalController } from './controllers/global.controller';
 export { AuthController } from './controllers/auth.controller';
 export { InvitationController } from './controllers/invitation.controller';
@@ -24,6 +26,8 @@ export { ValidationService } from './services/validation.service';
 export { AuditService } from './services/audit.service';
 export { AuthService } from './services/auth.service';
 export { InvitationService } from './services/invitation.service';
+export { AuthHooksService, type AuthHookEvent } from './services/auth-hooks.service';
+export { MembershipService, type MembershipRow, } from './services/membership.service';
 export { NestedService } from './services/nested.service';
 export { OrganizationService } from './services/organization.service';
 export { ScopeService, type RhinoScope } from './services/scope.service';
@@ -33,6 +37,8 @@ export { withUuid } from './prisma/prisma-uuid.extension';
 export { RhinoModel, getRhinoModelMetadata, BelongsToOrganization, HasAuditTrail, HasUuid, HasSoftDeletes, ExceptActions, HidableColumns, PermittedAttrs, } from './decorators';
 export { coercePermissions, matchesPermission, resolveUserRoleSlug, resolveUserPermissions, userHasPermission, } from './utils/permission-matcher';
 export { formatPrice, type CurrencyCode } from './utils/format';
+export { compileDomain, matchDomain, type CompiledDomain, type DomainMatch, } from './utils/domain-pattern';
+export { validateRouteGroups, RouteGroupConflictError, } from './utils/route-group-validator';
 export { autoDiscoverScopes, type ScopeDiscoveryOptions } from './utils/scope-discovery';
 export { defineModel, type ModelDefinition } from './utils/model-builder';
 export { findOrganizationFkChain, type FkRelation, type FkChainStep, type WalkOptions, } from './utils/fk-chain-walker';

package/dist/index.js

@@ -14,14 +14,15 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.userHasPermission = exports.resolveUserPermissions = exports.resolveUserRoleSlug = exports.matchesPermission = exports.coercePermissions = exports.PermittedAttrs = exports.HidableColumns = exports.ExceptActions = exports.HasSoftDeletes = exports.HasUuid = exports.HasAuditTrail = exports.BelongsToOrganization = exports.getRhinoModelMetadata = exports.RhinoModel = exports.withUuid = exports.withSoftDelete = exports.describeRoutes = exports.applyRhinoRouting = exports.ScopeService = exports.OrganizationService = exports.NestedService = exports.InvitationService = exports.AuthService = exports.AuditService = exports.ValidationService = exports.BASE_HIDDEN_COLUMNS = exports.SerializerService = exports.QueryBuilderService = exports.ResourceService = exports.PrismaService = exports.NestedController = exports.InvitationController = exports.AuthController = exports.GlobalController = exports.createTenantRouteRewrite = exports.RouteGroupMiddleware = exports.ResolveOrganizationMiddleware = exports.HiddenColumnsInterceptor = exports.paginated = exports.ResponseInterceptor = exports.ResourcePolicyGuard = exports.JwtAuthGuard = exports.ResourcePolicy = exports.RHINO_MODULE_OPTIONS = exports.RHINO_PRISMA_CLIENT = exports.RHINO_CONFIG = exports.normalizeConfig = exports.RhinoConfigService = exports.RhinoException = exports.RhinoModule = void 0;
-exports.SeederGenerator = exports.TestGenerator = exports.PolicyGenerator = exports.ResourceDefinitionGenerator = exports.PrismaSchemaGenerator = exports.BlueprintRunner = exports.ManifestManager = exports.BlueprintValidator = exports.BlueprintParser = exports.appendIfMissing = exports.writeFileSafely = exports.fileExists = exports.createReadlineInterface = exports.selectFromList = exports.confirm = exports.ask = exports.runExportTypes = exports.runExportPostman = exports.runBlueprint = exports.runGenerate = exports.runInstall = exports.printHelp = exports.extractCommand = exports.parseFlags = exports.generateTypeScriptTypes = exports.generatePostmanCollection = exports.findOrganizationFkChain = exports.defineModel = exports.autoDiscoverScopes = exports.formatPrice = void 0;
+exports.PermittedAttrs = exports.HidableColumns = exports.ExceptActions = exports.HasSoftDeletes = exports.HasUuid = exports.HasAuditTrail = exports.BelongsToOrganization = exports.getRhinoModelMetadata = exports.RhinoModel = exports.withUuid = exports.withSoftDelete = exports.describeRoutes = exports.applyRhinoRouting = exports.ScopeService = exports.OrganizationService = exports.NestedService = exports.MembershipService = exports.AuthHooksService = exports.InvitationService = exports.AuthService = exports.AuditService = exports.ValidationService = exports.BASE_HIDDEN_COLUMNS = exports.SerializerService = exports.QueryBuilderService = exports.ResourceService = exports.PrismaService = exports.NestedController = exports.InvitationController = exports.AuthController = exports.GlobalController = exports.createDomainRouteResolver = exports.createTenantRouteRewrite = exports.RouteGroupMiddleware = exports.ResolveOrganizationMiddleware = exports.HiddenColumnsInterceptor = exports.paginated = exports.ResponseInterceptor = exports.GroupMembershipGuard = exports.ResourcePolicyGuard = exports.JwtAuthGuard = exports.ResourcePolicy = exports.RHINO_MODULE_OPTIONS = exports.RHINO_PRISMA_CLIENT = exports.RHINO_CONFIG = exports.normalizeConfig = exports.RhinoConfigService = exports.RhinoAuthRejected = exports.RhinoException = exports.RhinoModule = void 0;
+exports.SeederGenerator = exports.TestGenerator = exports.PolicyGenerator = exports.ResourceDefinitionGenerator = exports.PrismaSchemaGenerator = exports.BlueprintRunner = exports.ManifestManager = exports.BlueprintValidator = exports.BlueprintParser = exports.appendIfMissing = exports.writeFileSafely = exports.fileExists = exports.createReadlineInterface = exports.selectFromList = exports.confirm = exports.ask = exports.runExportTypes = exports.runExportPostman = exports.runBlueprint = exports.runGenerate = exports.runInstall = exports.printHelp = exports.extractCommand = exports.parseFlags = exports.generateTypeScriptTypes = exports.generatePostmanCollection = exports.findOrganizationFkChain = exports.defineModel = exports.autoDiscoverScopes = exports.RouteGroupConflictError = exports.validateRouteGroups = exports.matchDomain = exports.compileDomain = exports.formatPrice = exports.userHasPermission = exports.resolveUserPermissions = exports.resolveUserRoleSlug = exports.matchesPermission = exports.coercePermissions = void 0;
 // Module
 var rhino_module_1 = require("./rhino.module");
 Object.defineProperty(exports, "RhinoModule", { enumerable: true, get: function () { return rhino_module_1.RhinoModule; } });
 // Errors
 var rhino_exception_1 = require("./errors/rhino-exception");
 Object.defineProperty(exports, "RhinoException", { enumerable: true, get: function () { return rhino_exception_1.RhinoException; } });
+Object.defineProperty(exports, "RhinoAuthRejected", { enumerable: true, get: function () { return rhino_exception_1.RhinoAuthRejected; } });
 var rhino_config_1 = require("./rhino.config");
 Object.defineProperty(exports, "RhinoConfigService", { enumerable: true, get: function () { return rhino_config_1.RhinoConfigService; } });
 Object.defineProperty(exports, "normalizeConfig", { enumerable: true, get: function () { return rhino_config_1.normalizeConfig; } });
@@ -40,6 +41,8 @@ var jwt_auth_guard_1 = require("./guards/jwt-auth.guard");
 Object.defineProperty(exports, "JwtAuthGuard", { enumerable: true, get: function () { return jwt_auth_guard_1.JwtAuthGuard; } });
 var resource_policy_guard_1 = require("./guards/resource-policy.guard");
 Object.defineProperty(exports, "ResourcePolicyGuard", { enumerable: true, get: function () { return resource_policy_guard_1.ResourcePolicyGuard; } });
+var group_membership_guard_1 = require("./guards/group-membership.guard");
+Object.defineProperty(exports, "GroupMembershipGuard", { enumerable: true, get: function () { return group_membership_guard_1.GroupMembershipGuard; } });
 // Interceptors
 var response_interceptor_1 = require("./interceptors/response.interceptor");
 Object.defineProperty(exports, "ResponseInterceptor", { enumerable: true, get: function () { return response_interceptor_1.ResponseInterceptor; } });
@@ -53,6 +56,8 @@ var route_group_middleware_1 = require("./middleware/route-group.middleware");
 Object.defineProperty(exports, "RouteGroupMiddleware", { enumerable: true, get: function () { return route_group_middleware_1.RouteGroupMiddleware; } });
 var tenant_route_rewrite_1 = require("./middleware/tenant-route-rewrite");
 Object.defineProperty(exports, "createTenantRouteRewrite", { enumerable: true, get: function () { return tenant_route_rewrite_1.createTenantRouteRewrite; } });
+var domain_route_resolver_1 = require("./middleware/domain-route-resolver");
+Object.defineProperty(exports, "createDomainRouteResolver", { enumerable: true, get: function () { return domain_route_resolver_1.createDomainRouteResolver; } });
 // Controllers (consuming apps can re-export under their own routes)
 var global_controller_1 = require("./controllers/global.controller");
 Object.defineProperty(exports, "GlobalController", { enumerable: true, get: function () { return global_controller_1.GlobalController; } });
@@ -80,6 +85,10 @@ var auth_service_1 = require("./services/auth.service");
 Object.defineProperty(exports, "AuthService", { enumerable: true, get: function () { return auth_service_1.AuthService; } });
 var invitation_service_1 = require("./services/invitation.service");
 Object.defineProperty(exports, "InvitationService", { enumerable: true, get: function () { return invitation_service_1.InvitationService; } });
+var auth_hooks_service_1 = require("./services/auth-hooks.service");
+Object.defineProperty(exports, "AuthHooksService", { enumerable: true, get: function () { return auth_hooks_service_1.AuthHooksService; } });
+var membership_service_1 = require("./services/membership.service");
+Object.defineProperty(exports, "MembershipService", { enumerable: true, get: function () { return membership_service_1.MembershipService; } });
 var nested_service_1 = require("./services/nested.service");
 Object.defineProperty(exports, "NestedService", { enumerable: true, get: function () { return nested_service_1.NestedService; } });
 var organization_service_1 = require("./services/organization.service");
@@ -114,6 +123,12 @@ Object.defineProperty(exports, "resolveUserPermissions", { enumerable: true, get
 Object.defineProperty(exports, "userHasPermission", { enumerable: true, get: function () { return permission_matcher_1.userHasPermission; } });
 var format_1 = require("./utils/format");
 Object.defineProperty(exports, "formatPrice", { enumerable: true, get: function () { return format_1.formatPrice; } });
+var domain_pattern_1 = require("./utils/domain-pattern");
+Object.defineProperty(exports, "compileDomain", { enumerable: true, get: function () { return domain_pattern_1.compileDomain; } });
+Object.defineProperty(exports, "matchDomain", { enumerable: true, get: function () { return domain_pattern_1.matchDomain; } });
+var route_group_validator_1 = require("./utils/route-group-validator");
+Object.defineProperty(exports, "validateRouteGroups", { enumerable: true, get: function () { return route_group_validator_1.validateRouteGroups; } });
+Object.defineProperty(exports, "RouteGroupConflictError", { enumerable: true, get: function () { return route_group_validator_1.RouteGroupConflictError; } });
 var scope_discovery_1 = require("./utils/scope-discovery");
 Object.defineProperty(exports, "autoDiscoverScopes", { enumerable: true, get: function () { return scope_discovery_1.autoDiscoverScopes; } });
 var model_builder_1 = require("./utils/model-builder");

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAAA,SAAS;AACT,+CAAsE;AAA7D,2GAAA,WAAW,OAAA;AAEpB,SAAS;AACT,4DAIkC;AAHhC,iHAAA,cAAc,OAAA;AAOhB,+CAGwB;AAFtB,kHAAA,kBAAkB,OAAA;AAClB,+GAAA,eAAe,OAAA;AAGjB,YAAY;AACZ,6CAI4B;AAH1B,sGAAA,YAAY,OAAA;AACZ,6GAAA,mBAAmB,OAAA;AACnB,8GAAA,oBAAoB,OAAA;AAGtB,aAAa;AACb,sEAAoD;AAEpD,WAAW;AACX,8DAA4D;AAAnD,iHAAA,cAAc,OAAA;AAEvB,SAAS;AACT,0DAAuD;AAA9C,8GAAA,YAAY,OAAA;AACrB,wEAAqE;AAA5D,4HAAA,mBAAmB,OAAA;AAE5B,eAAe;AACf,4EAAqF;AAA5E,2HAAA,mBAAmB,OAAA;AAAE,iHAAA,SAAS,OAAA;AACvC,wFAAqF;AAA5E,sIAAA,wBAAwB,OAAA;AAEjC,aAAa;AACb,gGAA6F;AAApF,gJAAA,6BAA6B,OAAA;AACtC,8EAA2E;AAAlE,8HAAA,oBAAoB,OAAA;AAC7B,0EAG2C;AAFzC,gIAAA,wBAAwB,OAAA;AAI1B,oEAAoE;AACpE,qEAAmE;AAA1D,qHAAA,gBAAgB,OAAA;AACzB,iEAA+D;AAAtD,iHAAA,cAAc,OAAA;AACvB,6EAA2E;AAAlE,6HAAA,oBAAoB,OAAA;AAC7B,qEAAmE;AAA1D,qHAAA,gBAAgB,OAAA;AAEzB,WAAW;AACX,0DAA+E;AAAtE,+GAAA,aAAa,OAAA;AACtB,gEAA8D;AAArD,mHAAA,eAAe,OAAA;AACxB,0EAAuE;AAA9D,4HAAA,mBAAmB,OAAA;AAC5B,oEAAuF;AAA9E,uHAAA,iBAAiB,OAAA;AAAE,yHAAA,mBAAmB,OAAA;AAC/C,oEAAkE;AAAzD,uHAAA,iBAAiB,OAAA;AAC1B,0DAAwD;AAA/C,6GAAA,YAAY,OAAA;AACrB,wDAAsD;AAA7C,2GAAA,WAAW,OAAA;AACpB,oEAAkE;AAAzD,uHAAA,iBAAiB,OAAA;AAC1B,4DAA0D;AAAjD,+GAAA,aAAa,OAAA;AACtB,wEAAsE;AAA7D,2HAAA,mBAAmB,OAAA;AAC5B,0DAAyE;AAAhE,6GAAA,YAAY,OAAA;AACrB,oFAA0F;AAAjF,+HAAA,iBAAiB,OAAA;AAAE,4HAAA,cAAc,OAAA;AAE1C,oBAAoB;AACpB,sFAAuE;AAA9D,8HAAA,cAAc,OAAA;AACvB,wEAA0D;AAAjD,iHAAA,QAAQ,OAAA;AAEjB,aAAa;AACb,2CAUsB;AATpB,wGAAA,UAAU,OAAA;AACV,mHAAA,qBAAqB,OAAA;AACrB,mHAAA,qBAAqB,OAAA;AACrB,2GAAA,aAAa,OAAA;AACb,qGAAA,OAAO,OAAA;AACP,4GAAA,cAAc,OAAA;AACd,2GAAA,aAAa,OAAA;AACb,4GAAA,cAAc,OAAA;AACd,4GAAA,cAAc,OAAA;AAGhB,QAAQ;AACR,iEAMoC;AALlC,uHAAA,iBAAiB,OAAA;AACjB,uHAAA,iBAAiB,OAAA;AACjB,yHAAA,mBAAmB,OAAA;AACnB,4HAAA,sBAAsB,OAAA;AACtB,uHAAA,iBAAiB,OAAA;AAEnB,yCAAgE;AAAvD,qGAAA,WAAW,OAAA;AACpB,2DAAyF;AAAhF,qHAAA,kBAAkB,OAAA;AAC3B,uDAA0E;AAAjE,4GAAA,WAAW,OAAA;AACpB,2DAKiC;AAJ/B,0HAAA,uBAAuB,OAAA;AAMzB,YAAY;AACZ,iEAGsC;AAFpC,6HAAA,yBAAyB,OAAA;AAG3B,uEAGyC;AAFvC,8HAAA,uBAAuB,OAAA;AAIzB,mDAAmD;AACnD,qCAAoE;AAA3D,mGAAA,UAAU,OAAA;AAAE,uGAAA,cAAc,OAAA;AAAE,kGAAA,SAAS,OAAA;AAC9C,kEAA4D;AAAnD,6GAAA,UAAU,OAAA;AACnB,oEAA8D;AAArD,+GAAA,WAAW,OAAA;AACpB,sEAAgE;AAAvD,iHAAA,YAAY,OAAA;AACrB,gFAAyE;AAAhE,0HAAA,gBAAgB,OAAA;AACzB,4EAAqE;AAA5D,sHAAA,cAAc,OAAA;AACvB,6CAK4B;AAJ1B,6FAAA,GAAG,OAAA;AACH,iGAAA,OAAO,OAAA;AACP,wGAAA,cAAc,OAAA;AACd,iHAAA,eAAe,OAA2B;AAE5C,qCAIwB;AAHtB,gGAAA,UAAU,OAAA;AACV,qGAAA,eAAe,OAAA;AACf,qGAAA,eAAe,OAAA;AAGjB,mBAAmB;AACnB,iEAA+D;AAAtD,mHAAA,eAAe,OAAA;AAExB,uEAAqE;AAA5D,yHAAA,kBAAkB,OAAA;AAE3B,iEAA+D;AAAtD,mHAAA,eAAe,OAAA;AACxB,iEAA+D;AAAtD,mHAAA,eAAe,OAAA;AAExB,0FAAuF;AAA9E,gIAAA,qBAAqB,OAAA;AAC9B,sGAAmG;AAA1F,4IAAA,2BAA2B,OAAA;AACpC,4EAA0E;AAAjE,mHAAA,eAAe,OAAA;AACxB,wEAAsE;AAA7D,+GAAA,aAAa,OAAA;AACtB,4EAA0E;AAAjE,mHAAA,eAAe,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAAA,SAAS;AACT,+CAAsE;AAA7D,2GAAA,WAAW,OAAA;AAEpB,SAAS;AACT,4DAKkC;AAJhC,iHAAA,cAAc,OAAA;AACd,oHAAA,iBAAiB,OAAA;AAOnB,+CAGwB;AAFtB,kHAAA,kBAAkB,OAAA;AAClB,+GAAA,eAAe,OAAA;AAGjB,YAAY;AACZ,6CAI4B;AAH1B,sGAAA,YAAY,OAAA;AACZ,6GAAA,mBAAmB,OAAA;AACnB,8GAAA,oBAAoB,OAAA;AAGtB,aAAa;AACb,sEAAoD;AAEpD,WAAW;AACX,8DAA4D;AAAnD,iHAAA,cAAc,OAAA;AAEvB,SAAS;AACT,0DAAuD;AAA9C,8GAAA,YAAY,OAAA;AACrB,wEAAqE;AAA5D,4HAAA,mBAAmB,OAAA;AAC5B,0EAAuE;AAA9D,8HAAA,oBAAoB,OAAA;AAE7B,eAAe;AACf,4EAAqF;AAA5E,2HAAA,mBAAmB,OAAA;AAAE,iHAAA,SAAS,OAAA;AACvC,wFAAqF;AAA5E,sIAAA,wBAAwB,OAAA;AAEjC,aAAa;AACb,gGAA6F;AAApF,gJAAA,6BAA6B,OAAA;AACtC,8EAA2E;AAAlE,8HAAA,oBAAoB,OAAA;AAC7B,0EAG2C;AAFzC,gIAAA,wBAAwB,OAAA;AAG1B,4EAG4C;AAF1C,kIAAA,yBAAyB,OAAA;AAI3B,oEAAoE;AACpE,qEAAmE;AAA1D,qHAAA,gBAAgB,OAAA;AACzB,iEAA+D;AAAtD,iHAAA,cAAc,OAAA;AACvB,6EAA2E;AAAlE,6HAAA,oBAAoB,OAAA;AAC7B,qEAAmE;AAA1D,qHAAA,gBAAgB,OAAA;AAEzB,WAAW;AACX,0DAA+E;AAAtE,+GAAA,aAAa,OAAA;AACtB,gEAA8D;AAArD,mHAAA,eAAe,OAAA;AACxB,0EAAuE;AAA9D,4HAAA,mBAAmB,OAAA;AAC5B,oEAAuF;AAA9E,uHAAA,iBAAiB,OAAA;AAAE,yHAAA,mBAAmB,OAAA;AAC/C,oEAAkE;AAAzD,uHAAA,iBAAiB,OAAA;AAC1B,0DAAwD;AAA/C,6GAAA,YAAY,OAAA;AACrB,wDAAsD;AAA7C,2GAAA,WAAW,OAAA;AACpB,oEAAkE;AAAzD,uHAAA,iBAAiB,OAAA;AAC1B,oEAAqF;AAA5E,sHAAA,gBAAgB,OAAA;AACzB,oEAGuC;AAFrC,uHAAA,iBAAiB,OAAA;AAGnB,4DAA0D;AAAjD,+GAAA,aAAa,OAAA;AACtB,wEAAsE;AAA7D,2HAAA,mBAAmB,OAAA;AAC5B,0DAAyE;AAAhE,6GAAA,YAAY,OAAA;AACrB,oFAA0F;AAAjF,+HAAA,iBAAiB,OAAA;AAAE,4HAAA,cAAc,OAAA;AAE1C,oBAAoB;AACpB,sFAAuE;AAA9D,8HAAA,cAAc,OAAA;AACvB,wEAA0D;AAAjD,iHAAA,QAAQ,OAAA;AAEjB,aAAa;AACb,2CAUsB;AATpB,wGAAA,UAAU,OAAA;AACV,mHAAA,qBAAqB,OAAA;AACrB,mHAAA,qBAAqB,OAAA;AACrB,2GAAA,aAAa,OAAA;AACb,qGAAA,OAAO,OAAA;AACP,4GAAA,cAAc,OAAA;AACd,2GAAA,aAAa,OAAA;AACb,4GAAA,cAAc,OAAA;AACd,4GAAA,cAAc,OAAA;AAGhB,QAAQ;AACR,iEAMoC;AALlC,uHAAA,iBAAiB,OAAA;AACjB,uHAAA,iBAAiB,OAAA;AACjB,yHAAA,mBAAmB,OAAA;AACnB,4HAAA,sBAAsB,OAAA;AACtB,uHAAA,iBAAiB,OAAA;AAEnB,yCAAgE;AAAvD,qGAAA,WAAW,OAAA;AACpB,yDAKgC;AAJ9B,+GAAA,aAAa,OAAA;AACb,6GAAA,WAAW,OAAA;AAIb,uEAGuC;AAFrC,4HAAA,mBAAmB,OAAA;AACnB,gIAAA,uBAAuB,OAAA;AAEzB,2DAAyF;AAAhF,qHAAA,kBAAkB,OAAA;AAC3B,uDAA0E;AAAjE,4GAAA,WAAW,OAAA;AACpB,2DAKiC;AAJ/B,0HAAA,uBAAuB,OAAA;AAMzB,YAAY;AACZ,iEAGsC;AAFpC,6HAAA,yBAAyB,OAAA;AAG3B,uEAGyC;AAFvC,8HAAA,uBAAuB,OAAA;AAIzB,mDAAmD;AACnD,qCAAoE;AAA3D,mGAAA,UAAU,OAAA;AAAE,uGAAA,cAAc,OAAA;AAAE,kGAAA,SAAS,OAAA;AAC9C,kEAA4D;AAAnD,6GAAA,UAAU,OAAA;AACnB,oEAA8D;AAArD,+GAAA,WAAW,OAAA;AACpB,sEAAgE;AAAvD,iHAAA,YAAY,OAAA;AACrB,gFAAyE;AAAhE,0HAAA,gBAAgB,OAAA;AACzB,4EAAqE;AAA5D,sHAAA,cAAc,OAAA;AACvB,6CAK4B;AAJ1B,6FAAA,GAAG,OAAA;AACH,iGAAA,OAAO,OAAA;AACP,wGAAA,cAAc,OAAA;AACd,iHAAA,eAAe,OAA2B;AAE5C,qCAIwB;AAHtB,gGAAA,UAAU,OAAA;AACV,qGAAA,eAAe,OAAA;AACf,qGAAA,eAAe,OAAA;AAGjB,mBAAmB;AACnB,iEAA+D;AAAtD,mHAAA,eAAe,OAAA;AAExB,uEAAqE;AAA5D,yHAAA,kBAAkB,OAAA;AAE3B,iEAA+D;AAAtD,mHAAA,eAAe,OAAA;AACxB,iEAA+D;AAAtD,mHAAA,eAAe,OAAA;AAExB,0FAAuF;AAA9E,gIAAA,qBAAqB,OAAA;AAC9B,sGAAmG;AAA1F,4IAAA,2BAA2B,OAAA;AACpC,4EAA0E;AAAjE,mHAAA,eAAe,OAAA;AACxB,wEAAsE;AAA7D,+GAAA,aAAa,OAAA;AACtB,4EAA0E;AAAjE,mHAAA,eAAe,OAAA"}

package/dist/interfaces/rhino-config.interface.d.ts

@@ -36,13 +36,74 @@ export interface ModelRegistration {
         model: string;
     }>;
 }
+/**
+ * Context handed to every lifecycle hook. `routeGroup` is the resolved group
+ * name (or `null`/`undefined` for the legacy/global auth path), `organization`
+ * is present only for tenant groups, `token` is the just-issued JWT for
+ * token-issuing actions (login/register), and `request` is the raw request.
+ */
+export interface AuthHookContext {
+    user: any;
+    routeGroup?: string | null;
+    organization?: any;
+    token?: string;
+    request?: any;
+}
+/**
+ * Per-group lifecycle hooks. Each method runs AFTER the corresponding auth
+ * action succeeds. A method may reject by throwing `RhinoAuthRejected` (or any
+ * error) — for token-issuing actions the controller revokes the issued token
+ * and returns the rejection's status (default 403). All methods are optional;
+ * an absent method is a no-op. Implementations are registered per group via
+ * `RouteGroupConfig.hooks` and resolved from the Nest DI container.
+ */
+export interface AuthLifecycleHooks {
+    afterLogin?(ctx: AuthHookContext): void | Promise<void>;
+    afterLogout?(ctx: AuthHookContext): void | Promise<void>;
+    afterRegister?(ctx: AuthHookContext): void | Promise<void>;
+    afterPasswordRecover?(ctx: AuthHookContext): void | Promise<void>;
+    afterPasswordReset?(ctx: AuthHookContext): void | Promise<void>;
+}
 export interface RouteGroupConfig {
     prefix?: string;
+    /**
+     * Constrain this group to a specific host. Two groups can then share the
+     * same URL prefix and be selected by host.
+     *
+     *   - Omitted → the group matches any host (default; backward compatible).
+     *   - Literal host, e.g. `'admin.example.com'` → requests to that host
+     *     resolve to this group; requests from a non-matching host are rejected.
+     *   - Parameterized host, e.g. `'{organization}.example.com'` → the captured
+     *     `{organization}` subdomain feeds organization resolution, exactly like
+     *     a path-prefix tenant param. Matches Laravel's `Route::domain(...)`.
+     */
+    domain?: string;
     middleware?: Type<NestMiddleware>[];
     /** '*' = all registered models, array = subset by slug */
     models: '*' | string[];
     /** Skip the default JWT guard for this group (for public routes) */
     skipAuth?: boolean;
+    /**
+     * Register the full auth route set (login/logout/password/register) for this
+     * group, tagged with the group's name (Decision 9.A). The legacy unprefixed
+     * `/auth/*` set always remains for the default/global path. Opt-in; default
+     * `false`. The `public` group is never auth-enabled.
+     */
+    auth?: boolean;
+    /**
+     * Optional per-group lifecycle hooks. A class (resolved via Nest DI) or a
+     * plain object implementing {@link AuthLifecycleHooks}. Runs after each auth
+     * action for requests resolved to this group; may reject to revoke the token.
+     */
+    hooks?: Type<AuthLifecycleHooks> | AuthLifecycleHooks;
+    /**
+     * Whether this group is org-scoped (a tenant group). Tenant-group membership
+     * rows require an organization; non-tenant groups (e.g. `admin`, `driver`)
+     * store a NULL org. When omitted, a group is treated as a tenant group iff
+     * multi-tenancy is enabled. Set `tenant: false` for org-less groups even when
+     * multi-tenancy is on.
+     */
+    tenant?: boolean;
 }
 export interface MultiTenantConfig {
     enabled?: boolean;
@@ -66,6 +127,16 @@ export interface AuthConfig {
     userModel?: string;
     passwordField?: string;
     emailField?: string;
+    /**
+     * Master flag (default `false`) gating group-membership enforcement. When
+     * off, behavior is byte-for-byte unchanged: no membership check, permissions
+     * resolve from the org-presence heuristic. When on, an authenticated user
+     * must hold a `user_roles` membership row matching the request's
+     * `route_group` (a NULL row is a wildcard — Decision 9.B) and, for tenant
+     * groups, the resolved org; no match → 403 (Decision 9.C). Permissions then
+     * resolve from the matched row.
+     */
+    enforceGroupMembership?: boolean;
 }
 export interface PostmanConfig {
     roleModel?: string;

package/dist/middleware/domain-route-resolver.d.ts

@@ -0,0 +1,54 @@
+import type { Request, Response, NextFunction } from 'express';
+import type { RhinoConfig } from '../interfaces/rhino-config.interface';
+import type { PrismaClientLike } from '../prisma/prisma.service';
+export interface DomainRouteResolverOptions {
+    /**
+     * When `true` (default), a request whose host matches a parameterized
+     * domain group but whose captured subdomain resolves to no known
+     * organization → HTTP 404. When `false`, the request passes through
+     * unchanged (org simply isn't attached).
+     */
+    strict?: boolean;
+    /**
+     * When `true` (default), after resolving the org the resolver verifies the
+     * authenticated user (if any) is a member. Non-members → 404 (matches the
+     * tenant-route-rewrite contract: cross-tenant = "not found", no
+     * enumeration). When `req.user` is absent the check is skipped (auth runs
+     * later).
+     */
+    enforceMembership?: boolean;
+}
+/**
+ * Factory for an Express-level middleware that implements host-based route
+ * group resolution — the subdomain-multitenancy analogue of
+ * `createTenantRouteRewrite`.
+ *
+ * Context: NestJS serves every model through a single GlobalController, and a
+ * route group is resolved at request time. For a parameterized domain group
+ * (`{organization}.example.com`), the captured subdomain must be turned into a
+ * resolved `req.organization` BEFORE the controller runs — exactly like the
+ * path-based `/api/<slug>/...` rewrite does for the `:organization` prefix.
+ *
+ * Behavior:
+ *
+ *   1. For each route group with a `domain`, compile its pattern.
+ *   2. On each request, match `req.hostname` against those patterns.
+ *      - No domain group matches → next() (plain prefix routing applies).
+ *   3. When a parameterized domain group matches, take the captured
+ *      `{organization}` (or `{org}`) subdomain and:
+ *        - expose it on `req.params.organization`,
+ *        - resolve the org by `organizationIdentifierColumn` (cached),
+ *          strict-404 when unknown,
+ *        - enforce membership when `req.user` is present,
+ *        - attach `req.organization`.
+ *      A literal domain group matches but captures no params, so it only marks
+ *      the host as recognized (no org resolution).
+ *
+ * Intended for raw Express `app.use(createDomainRouteResolver(...))` BEFORE
+ * `applyRhinoRouting(...)`, alongside / instead of `createTenantRouteRewrite`.
+ */
+export declare function createDomainRouteResolver(args: {
+    prisma: PrismaClientLike;
+    config: RhinoConfig;
+    options?: DomainRouteResolverOptions;
+}): (req: Request, res: Response, next: NextFunction) => Promise<void>;

package/dist/middleware/domain-route-resolver.js

@@ -0,0 +1,145 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createDomainRouteResolver = createDomainRouteResolver;
+const domain_pattern_1 = require("../utils/domain-pattern");
+/**
+ * Factory for an Express-level middleware that implements host-based route
+ * group resolution — the subdomain-multitenancy analogue of
+ * `createTenantRouteRewrite`.
+ *
+ * Context: NestJS serves every model through a single GlobalController, and a
+ * route group is resolved at request time. For a parameterized domain group
+ * (`{organization}.example.com`), the captured subdomain must be turned into a
+ * resolved `req.organization` BEFORE the controller runs — exactly like the
+ * path-based `/api/<slug>/...` rewrite does for the `:organization` prefix.
+ *
+ * Behavior:
+ *
+ *   1. For each route group with a `domain`, compile its pattern.
+ *   2. On each request, match `req.hostname` against those patterns.
+ *      - No domain group matches → next() (plain prefix routing applies).
+ *   3. When a parameterized domain group matches, take the captured
+ *      `{organization}` (or `{org}`) subdomain and:
+ *        - expose it on `req.params.organization`,
+ *        - resolve the org by `organizationIdentifierColumn` (cached),
+ *          strict-404 when unknown,
+ *        - enforce membership when `req.user` is present,
+ *        - attach `req.organization`.
+ *      A literal domain group matches but captures no params, so it only marks
+ *      the host as recognized (no org resolution).
+ *
+ * Intended for raw Express `app.use(createDomainRouteResolver(...))` BEFORE
+ * `applyRhinoRouting(...)`, alongside / instead of `createTenantRouteRewrite`.
+ */
+function createDomainRouteResolver(args) {
+    const { strict = true, enforceMembership = true } = args.options ?? {};
+    // FIX 11.2: when group-membership enforcement is ON, an authenticated
+    // non-member must get a 403 from GroupMembershipGuard, which takes precedence
+    // over this resolver's cross-tenant 404. So we resolve & attach the org but
+    // skip the membership-404 here, deferring to the downstream guard. A
+    // genuinely unknown subdomain still 404s (strict). When enforcement is OFF
+    // (default), behavior is byte-for-byte unchanged.
+    const groupMembershipEnforced = args.config.auth?.enforceGroupMembership === true;
+    const orgModel = args.config.multiTenant?.organizationModel ?? 'organization';
+    const userOrgModel = args.config.multiTenant?.userOrganizationModel ?? 'userRole';
+    const idColumn = args.config.multiTenant?.organizationIdentifierColumn ?? 'slug';
+    const compiledGroups = [];
+    for (const [name, group] of Object.entries(args.config.routeGroups ?? {})) {
+        const compiled = (0, domain_pattern_1.compileDomain)(group.domain);
+        if (compiled)
+            compiledGroups.push({ name, group, compiled });
+    }
+    // Cache org lookups by captured subdomain value. `null` = probed, not found.
+    const cache = new Map();
+    const notFound = (res) => {
+        res.status(404).json({ code: 'NOT_FOUND', message: 'Organization not found' });
+    };
+    return async function domainRouteResolver(req, res, next) {
+        if (compiledGroups.length === 0)
+            return next();
+        try {
+            const host = resolveHost(req);
+            if (!host)
+                return next();
+            let matched = null;
+            for (const cg of compiledGroups) {
+                const result = (0, domain_pattern_1.matchDomain)(cg.compiled, host);
+                if (result) {
+                    matched = { group: cg, params: result.params };
+                    break;
+                }
+            }
+            if (!matched)
+                return next();
+            // Mark which group the host resolved to (parity with RouteGroupMiddleware).
+            req.__routeGroup = matched.group.name;
+            if (matched.group.group.skipAuth)
+                req.__skipAuth = true;
+            const rawSubdomain = matched.params.organization ?? matched.params.org;
+            if (rawSubdomain == null) {
+                // Literal domain group — no tenant to resolve.
+                return next();
+            }
+            // DNS hostnames are case-insensitive; orgs are slugged lowercase. Normalize
+            // the captured subdomain before the lookup, the cache key, and the param so
+            // `ACME.example.com` resolves the `acme` org consistently.
+            const subdomain = rawSubdomain.toLowerCase();
+            // Expose the captured subdomain like a path param.
+            req.params = req.params ?? {};
+            if (req.params.organization == null) {
+                req.params.organization = subdomain;
+            }
+            // Resolve the org from the subdomain (cached).
+            if (!cache.has(subdomain)) {
+                const delegate = args.prisma[camel(orgModel)] ?? args.prisma[orgModel];
+                if (!delegate?.findFirst) {
+                    // No org delegate — can't resolve. Pass through.
+                    return next();
+                }
+                const org = await delegate
+                    .findFirst({ where: { [idColumn]: subdomain } })
+                    .catch(() => null);
+                cache.set(subdomain, org ?? null);
+            }
+            const org = cache.get(subdomain);
+            if (!org) {
+                if (strict)
+                    return notFound(res);
+                return next();
+            }
+            // Membership check (cross-tenant → 404, not 403). Skipped when group
+            // membership enforcement is ON — the GroupMembershipGuard returns 403 for
+            // an authenticated non-member, which takes precedence (FIX 11.2).
+            if (enforceMembership && !groupMembershipEnforced && req.user) {
+                const userId = req.user.id;
+                const urDelegate = args.prisma[camel(userOrgModel)] ?? args.prisma[userOrgModel];
+                if (urDelegate?.findFirst) {
+                    const member = await urDelegate
+                        .findFirst({ where: { userId, organizationId: org.id } })
+                        .catch(() => null);
+                    if (!member)
+                        return notFound(res);
+                }
+            }
+            req.organization = org;
+            req.__orgSubdomain = subdomain;
+            return next();
+        }
+        catch (err) {
+            return next(err);
+        }
+    };
+}
+function resolveHost(req) {
+    const fromExpress = req.hostname;
+    if (fromExpress)
+        return String(fromExpress).split(':')[0];
+    const header = req.headers?.host ?? req.host;
+    return header ? String(header).split(':')[0] : undefined;
+}
+function camel(name) {
+    if (!name)
+        return name;
+    return name.charAt(0).toLowerCase() + name.slice(1);
+}
+//# sourceMappingURL=domain-route-resolver.js.map